Production and utilization facilities; domestic licensing: Fuel within dry storage casks or transportation packages in spent fuel pool; criticality control,

[Federal Register: November 16, 2006 (Volume 71, Number 221)]

[Rules and Regulations]

[Page 66648-66657]

From the Federal Register Online via GPO Access [wais.access.gpo.gov]

[DOCID:fr16no06-3]

NUCLEAR REGULATORY COMMISSION

10 CFR Part 50

RIN 3150-AH95

Criticality Control of Fuel Within Dry Storage Casks or Transportation Packages in a Spent Fuel Pool

AGENCY: Nuclear Regulatory Commission.

ACTION: Direct final rule.

SUMMARY: The Nuclear Regulatory Commission (NRC) is amending its regulations that govern domestic licensing of production and utilization facilities so that the requirements governing criticality control for spent fuel pool storage racks do not apply to the fuel within a spent fuel transportation package or storage cask when a package or cask is in a spent fuel pool. These packages and casks are subject to separate criticality control requirements. This action is necessary to avoid applying two different sets of criticality control requirements to fuel within a package or cask in a spent fuel pool.

DATES: Effective Date: The final rule will become effective January 30, 2007, unless significant adverse comments are received by December 18, 2006. A significant adverse comment is a comment where the commenter explains why the rule would be inappropriate, including challenges to the rule's underlying premise or approach, or would be ineffective or unacceptable without a change (refer to ``Procedural Background'' in the Supplementary Information section of this document for further details). If the rule is withdrawn, timely notice will be published in the Federal Register. Comments received after December 18, 2006 will be considered if it is practical to do so, but the NRC is able to ensure only that comments received on or before this date will be considered.

ADDRESSES: You may submit comments by any one of the following methods. Please include the following number RIN 3150-AH95 in the subject line of your comments. Comments on rulemakings submitted in writing or in electronic form will be made available for public inspection. Because your comments will not be edited to remove any identifying or contact information, the NRC cautions you against including personal information such as social security numbers and birth dates in your submission.

Mail comments to: Secretary, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, ATTN: Rulemakings and Adjudications Staff.

E-mail comments to: SECY@nrc.gov. If you do not receive a reply e- mail confirming that we have received your comments, contact us directly at (301) 415-1966. You may also submit comments via the NRC's rulemaking Web site at http://ruleforum.llnl.gov. Address questions

about our rulemaking website to Carol Gallagher at (301) 415-5905; e- mail cag@nrc.gov. Comments can also be submitted via the Federal eRulemaking Portal http://www.regulations.gov.

Hand deliver comments to: 11555 Rockville Pike, Rockville, Maryland 20852, between 7:30 a.m. and 4:15 p.m. Federal workdays [telephone (301) 415-1966].

Fax comments to: Secretary, U.S. Nuclear Regulatory Commission at (301) 415-1101.

Publicly available documents related to this rulemaking may be viewed electronically on the public computers located at the NRC's Public Document

[[Page 66649]]

Room (PDR), O-1F21, One White Flint North, 11555 Rockville Pike, Rockville, Maryland 20852. The PDR reproduction contractor will copy documents for a fee. Selected documents, including comments, can be viewed and downloaded electronically via the NRC rulemaking Web site at http://ruleforum.llnl.gov.

Publicly available documents created or received at the NRC after November 1, 1999, are available electronically at the NRC's Electronic Reading Room at http://www.nrc.gov/reading-rm/adams.html. From this

site, the public can gain entry into the NRC's Agencywide Document Access and Management System (ADAMS), which provides text and image files of NRC's public documents. If you do not have access to ADAMS or if there are problems in accessing the documents located in ADAMS, contact the PDR Reference staff at 1-800-397-4209, 301-415-4737, or by e-mail to pdr@nrc.gov.

FOR FURTHER INFORMATION CONTACT: George M. Tartal, Project Manager, Office of Nuclear Reactor Regulation, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, telephone (301) 415-0016, e-mail gmt1@nrc.gov.

SUPPLEMENTARY INFORMATION:

1. Background

   Storage of spent fuel can be done safely in a water filled spent fuel pool under 10 CFR Part 50, a transportation package under 10 CFR Part 71, or a dry storage cask under 10 CFR Part 72. The primary technical challenges involve removing the heat generated by the spent fuel (decay heat), storing the fuel in an arrangement that avoids an accidental criticality, and providing radiation shielding. Removing the decay heat keeps the spent fuel from becoming damaged due to excessive heatup. Transportation packages and dry storage casks are designed to be capable of removing the decay heat generated by the fuel when filled with water or when dry without the need for active heat removal systems. Avoiding an accidental criticality is important to preclude the possibility of overheating the spent fuel and damaging the fuel. When dry, transportation packages and dry storage casks are subcritical by the absence of water as a neutron moderator, as well as by geometric design, and through the use of neutron poison materials such as boral and poison plates. When the packages and casks are flooded with water, they may also rely on soluble boron to maintain the subcritical condition. Therefore, a boron dilution event is the scenario that could result in an accidental criticality with the possibility of excessive fuel temperature and subsequent fuel damage. Radiation shielding, provided by the water in a spent fuel pool or the container material in a transportation package or dry storage cask, is important to protect people that may be near the spent fuel from unacceptable exposure to radiation. The NRC has promulgated regulations governing the capability of both spent fuel pools (10 CFR Parts 50 and 70), dry storage casks (10 CFR Part 72) and transportation packages (10 CFR Part 71) to address these technical challenges for the protection of public health and safety.

   10 CFR 50.68 requires that spent fuel pools remain subcritical in an unborated, maximum moderation condition. Implementation of this regulation also allows credit for the operating history of the fuel (fuel burnup) when analyzing the storage configuration of the spent fuel. 10 CFR Parts 71 and 72 approve the use of spent fuel transportation packages and storage casks, respectively. 10 CFR Part 71 requires that transportation packages be designed assuming they can be flooded with fresh water (unborated), and thus are already analyzed in a manner that complies with the 10 CFR 50.68 assumption. However, 10 CFR Part 72 was, in part, predicated on the assumption that spent fuel (without any burnup) would remain subcritical when stored dry in a cask and remain subcritical when placed in a cask in a spent fuel pool at a commercial power reactor. Implementation of 10 CFR Part 72 relies on soluble boron, rather than on burnup, to assure subcriticality when the fuel is in a cask in a spent fuel pool.

   On March 23, 2005, the NRC issued Regulatory Issue Summary (RIS) 2005-05 addressing spent fuel criticality analyses for spent fuel pools under 10 CFR 50.68 and Independent Spent Fuel Storage Installations (ISFSI) under 10 CFR Part 72. The intent of the RIS was to advise reactor licensees that they must meet both the requirements of 10 CFR 50.68 and 10 CFR Part 72 with respect to subcriticality during storage cask loading in spent fuel pools. The need to meet both regulations and the differences in the assumptions described above create an additional burden on licensees to show that credit for soluble boron is not required to preclude an accidental criticality in a water-filled, high- density dry storage cask used for storing fuel. In order to satisfy both of these requirements, a site-specific analysis that demonstrates that the casks would remain subcritical for the specific irradiated fuel loading planned, without credit for soluble boron, as described in 10 CFR 50.68 is required. This analysis relies on the fuel burnup to determine the margin to criticality for the specific cask loading. The analysis is similar to that conducted for the spent fuel pool itself, but takes into account the unique design features of the cask when determining the minimum burnup required for spent fuel storage in the specific cask. This issue only applies to pressurized water reactors (PWR) because boiling water reactor (BWR) spent fuel pools do not contain soluble boron and the casks that are used to load BWR fuel do not rely on soluble boron to maintain subcriticality.

   The regulations, as currently written, create an unnecessary burden for both industry and the NRC, of performing two different analyses with two different sets of assumptions for the purpose of preventing a criticality accident, with no associated safety benefit. This burden is considered unnecessary because the conditions which could dilute the boron concentration within a transportation package or dry storage cask (hereinafter ``package or cask'') in a spent fuel pool, and cause fuel damage with the release of radioactive material, are highly unlikely. The NRC evaluated the two scenarios in which a boron dilution could occur: (1) A rapid drain down and subsequent reflood of the spent fuel pool, or (2) a slow boron dilution of the spent fuel pool. The result of the NRC evaluation is that the possibility of each scenario is highly unlikely (see Appendix A for additional details). Therefore, there is no safety benefit from requiring the licensee to conduct a site specific analysis to comply with 10 CFR 50.68(b) while fuel is within a package or cask in a spent fuel pool.

   As a result, a revision to the Commission's regulations is necessary to eliminate the requirement for separate criticality analyses using different methodologies and acceptance criteria for fuel within a package or cask in a spent fuel pool. This direct final rule will eliminate the need to comply with the criticality control requirements in Sec. 50.68 if fuel is within a package or cask in a spent fuel pool. Instead, the criticality requirements of 10 CFR Parts 71 and 72, as applicable, would apply to fuel within packages and casks in a spent fuel pool. For fuel in the spent fuel pool but outside the package or cask, the criticality requirements of 10 CFR 50.68 would apply.

   [[Page 66650]]

2. Section-by-Section Analysis of Substantive Changes

   Section 50.68 Criticality Accident Requirements

   Section 50.68 describes the requirements for maintaining subcriticality of fuel assemblies in the spent fuel pool. New paragraph (c) of this section states that the criticality accident requirements of 10 CFR 50.68(b) do not apply to fuel within a package or cask in a spent fuel pool. Rather, the criticality accident requirements of 10 CFR Part 71 or 72, as applicable, apply to fuel within a package or cask in a spent fuel pool. This new paragraph provides the regulatory boundary between Sec. 50.68(b) and 10 CFR Part 71 or 72 for performing criticality analyses. A licensee moving fuel between the spent fuel pool and a package or cask need only analyze fuel within the package or cask according to 10 CFR Part 71 or 72, as applicable, and is not required to analyze fuel within the package or cask using Sec. 50.68(b) requirements.

   For the purpose of this paragraph, any package or cask that is in contact with the water in a spent fuel pool is considered ``in'' the spent fuel pool. Also, once any portion of the fuel (fuel assembly, fuel bundle, fuel pin, or other device containing fuel) enters the physical boundary of the package or cask, that fuel is considered ``within'' that package or cask. When a package or cask is in a spent fuel pool, the criticality requirements of 10 CFR Part 71 or 72, as applicable, and the requirements of the Certificate of Compliance for that package or cask, apply to the fuel within that package or cask. Criticality analysis for the fuel in that package or cask in accordance with Sec. 50.68(b) is not required. For fuel in the spent fuel pool and not within a package or cask, the criticality requirements of Sec. 50.68(b) apply.

3. Procedural Background

   The NRC is using the ``direct final rule procedure'' to issue this amendment because it is not expected to be controversial. The amendment to the rule will become effective on January 30, 2007. However, if the NRC receives significant adverse comments by December 18, 2006, then the NRC will publish a document that withdraws this action. In that event, the comments received in response to this amendment would then be considered as comments on the companion proposed rule published elsewhere in this Federal Register, and the comments will be addressed in a later final rule based on that proposed rule. Unless the modifications to the proposed rule are significant enough to require that it be republished as a proposed rule, the NRC will not initiate a second comment period on this action.

   A significant adverse comment is a comment where the commenter explains why the rule would be inappropriate, including challenges to the rule's underlying premise or approach, or would be ineffective or unacceptable without a change. A comment is adverse and significant if:

   (1) The comment opposes the rule and provides a reason sufficient to require a substantive response in a notice-and-comment process. For example, a substantive response is required when:

   (a) The comment causes the NRC to reevaluate (or reconsider) its position or conduct additional analysis;

   (b) The comment raises an issue serious enough to warrant a substantive response to clarify or complete the record; or

   (c) The comment raises a relevant issue that was not previously addressed or considered by the NRC.

   (2) The comment proposes a change or an addition to the rule, and it is apparent that the rule would be ineffective or unacceptable without incorporation of the change or addition.

   (3) The comment causes the NRC to make a change (other than editorial) to the rule.

4. Voluntary Consensus Standards

   The National Technology Transfer and Advancement Act of 1995 (Pub. L. 104-113) requires that Federal agencies use technical standards that are developed or adopted by voluntary consensus standards bodies unless the use of such a standard is inconsistent with applicable law or otherwise impractical. This direct final rule eliminates duplication of criticality control requirements for fuel within a package or cask in the spent fuel pool. These packages and casks have separate requirements for criticality control during loading, storage and unloading operations. This rulemaking does not involve the establishment or use of technical standards, and hence this act does not apply to this direct final rule.

5. Agreement State Compatibility

   Under the ``Policy Statement on Adequacy and Compatibility of Agreement State Programs'' approved by the NRC on June 30, 1997, and published in the Federal Register on September 3, 1997 (62 FR 46517), this rule is classified as Compatibility Category ``NRC.'' Compatibility is not required for Category ``NRC'' regulations. The NRC program elements in this category are those that relate directly to areas of regulation reserved to the NRC by the Atomic Energy Act of 1954, as amended (AEA), or the provisions of Title 10 of the Code of Federal Regulations. Although an Agreement State may not adopt program elements reserved to NRC, it may wish to inform its licensees of certain requirements via a mechanism that is consistent with the particular State's administrative procedure laws but does not confer regulatory authority on the State.

6. Plain Language

   The Presidential Memorandum dated June 1, 1998, entitled ``Plain Language in Government Writing,'' directed that the Government's writing be in plain language. The NRC requests comments on this direct final rule specifically with respect to the clarity and effectiveness of the language used. Comments should be sent to the address listed under the heading ADDRESSES above.

7. Finding of No Significant Environmental Impact: Environmental Assessment

   The NRC has determined under the National Environmental Policy Act of 1969, as amended, and the NRC's regulations in Subpart A of 10 CFR Part 51, that this rule is not a major Federal action significantly affecting the quality of the human environment and, therefore, an environmental impact statement is not required. The basis for this determination is set forth below.

   This direct final rule eliminates duplication of criticality control requirements for fuel within a package or cask in the spent fuel pool. These packages and casks are required to meet the licensing requirements, defined in 10 CFR Part 71 or 72, as applicable, and the applicable Certificate of Compliance (CoC), which currently provide criticality control requirements for fuel loading, storage and unloading. This rulemaking will preclude the necessity for nuclear power plant licensees to meet the criticality control requirements for both regulations (for 10 CFR Part 50 and for 10 CFR Part 71 or 72) while fuel is within a package or cask in a spent fuel pool. The regulations in 10 CFR Parts 71 and 72, as applicable, coupled with the package or cask CoC, provide adequate assurance that there are no inadvertent criticality events while fuel is within a package or cask in a spent fuel pool. Experience over 20 years has demonstrated that the regulations in 10 CFR Parts 71 and 72 have been effective in preventing inadvertent criticality events, and the NRC concludes that as a matter of regulatory efficiency, there is

   [[Page 66651]]

   no purpose to requiring licensees to apply for and obtain exemptions from requirements of Sec. 50.68(b) if they adhere to the regulations in 10 CFR Part 71 or 72 as applicable. Since the regulations in 10 CFR Parts 71 and 72 and the CoC provide safe and effective methods for preventing inadvertent criticality events in nuclear power plants, the NRC concludes that this direct final rule will not have any significant impact on the quality of the human environment. Therefore, an environmental impact statement has not been prepared for this direct final rule.

   The foregoing constitutes the environmental assessment for this direct final rule.

8. Paperwork Reduction Act Statement

   This direct final rule does not contain a new or amended information collection requirement subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.). Existing requirements were approved by the Office of Management and Budget, Approval Number 3150- 0011, 3150-0008 and 3150-0132.

   Public Protection Notification

   The NRC may not conduct or sponsor, and a person is not required to respond to, a request for information or an information collection requirement unless the requesting document displays a currently valid OMB control number.

9. Regulatory Analysis

   Statement of the Problem and Objectives

   As described in the Background section of this document, the need to meet the criticality accident requirements of 10 CFR 50.68 and of 10 CFR Part 71 or 72, and the differences in their assumptions, create an additional burden on licensees to show that credit for soluble boron is not required to preclude an accidental criticality in a water-filled package for transporting fuel or a water-filled, high-density dry storage cask used for storing fuel. In order to satisfy both of these requirements, a site-specific analysis that demonstrates that the fuel in the package or cask would remain subcritical for the specific irradiated fuel loading planned, without credit for soluble boron, would be required. In the Sec. 50.68 analysis, the licensee would rely on the fuel burnup to determine the margin to criticality for the specific package or cask loading. The Sec. 50.68 analysis would be similar to that conducted for the spent fuel pool itself, but would take into account the unique design features of the package or cask when determining the minimum burnup required for spent fuel storage in the specific package or cask. This issue only applies to PWRs because BWR spent fuel pools do not contain soluble boron and the packages and casks that are used to load BWR fuel do not rely on soluble boron to maintain subcriticality. As currently written, these regulations create an unnecessary burden for both industry and the NRC with no associated safety benefit.

   The objective of this rulemaking activity is to revise 10 CFR 50.68 to eliminate the requirement for licensees to perform a separate criticality analysis based on the requirements of 10 CFR 50.68 for fuel within a package or cask in a spent fuel pool. As a result, any fuel that is in the spent fuel pool and not within the physical boundary of a package or cask remains subject to the criticality requirements of Sec. 50.68. Once the fuel enters the physical boundary of the package or cask, it is then subject to the criticality requirements of 10 CFR Part 71 or 72, as applicable, and no longer subject to the criticality requirements of Sec. 50.68.

   Alternative Approaches and Their Values and Impacts

   Another option to this amendment is for the NRC to make no changes and allow the licensees to continue requesting exemptions. If no changes are made, the licensees will continue to incur the costs of submitting exemptions (approximately $300k) and NRC will incur the costs of reviewing them (approximately $150k). Under this rule, an easing of the burden on licensees results from not having to request exemptions. Similarly, the NRC's burden will be reduced by avoiding the need to review and evaluate these exemption requests. Another downfall to this option is that licensees may not apply 10 CFR 50.59 to exemptions, instead necessitating a new exemption for future modifications to package or cask design. Furthermore, licensees would not be in compliance with existing regulations, and that the NRC would then be regulating by exemption rather than by rule.

   A final option is for the NRC to make no change and licensees to request a license amendment to add a Technical Specification which restricts the burnup of spent fuel assemblies loaded into the package or cask. This license amendment would only be required once, putting the licensee into compliance with NRC regulations, and would then permit licensees to make modifications using 10 CFR 50.59. However, the burden of producing and approving an amendment on both the licensee (approximately $300k) and the NRC (approximately $100k) is quite significant, with no safety benefit.

   Decision Rationale for the Selected Regulatory Action

   Based on the evaluation of values and impacts of the alternative approaches, the NRC has decided to revise 10 CFR 50.68 to eliminate the requirement for licensees to perform a separate criticality analysis based on the requirements of 10 CFR 50.68 for fuel within a package or cask in a spent fuel pool. This rule revision is an easing of burden action which results in increased regulatory efficiency. The rule does not impose any additional costs on existing licensees and has no negative impact on public health and safety. The rule will provide savings to licensees that transfer fuel from the spent fuel pool to a dry storage cask or transportation package. There will also be savings in resources to the NRC as well.

10. Regulatory Flexibility Certification

    Under the Regulatory Flexibility Act of 1980 (5 U.S.C. 605(b)), the NRC certifies that this rule does not have a significant economic impact on a substantial number of small entities. This direct final rule affects only the licensing and operation of nuclear power plants. The companies that own these plants do not fall within the scope of the definition of ``small entities'' set forth in the Regulatory Flexibility Act or the Small Business Size Standards set out in regulations issued by the Small Business Administration at 10 CFR 2.810.

11. Backfit Analysis

    The NRC has determined that the backfit rule does not apply to this direct final rule because this amendment does not involve any provisions that would impose backfits as defined in 10 CFR 50.109. Reactor licensees are currently required to meet both the requirements of 10 CFR 50.68 and 10 CFR Part 71 or 72, as applicable, with respect to subcriticality during package or cask loading or unloading in spent fuel pools. The need to meet both regulations creates an additional burden on licensees to show that credit for soluble boron is not required to preclude an accidental criticality in a package or cask when filled with water. In order to satisfy both of these requirements, a site specific analysis that demonstrates that the fuel in the package or cask would remain subcritical for the specific irradiated

    [[Page 66652]]

    fuel loading planned, without credit for boron, would be required. This action amends 10 CFR 50.68 so that the criticality accident requirements for spent fuel pool storage racks do not apply to the fuel within a package or cask in a spent fuel pool. This rule constitutes a voluntary relaxation of requirements, and as a result, a backfit analysis is not required.

    During the 535th meeting of the Advisory Committee for Reactor Safeguards on September 7, 2006, a concern was raised regarding any actions that would be required for licensees who have previously requested and been granted either: (1) a license amendment to modify the plant technical specifications to comply with the criticality accident requirements of 10 CFR 50.68 for fuel in a 10 CFR Part 72 licensed cask in their spent fuel pool, or (2) an exemption from the criticality accident requirements of 10 CFR 50.68 for fuel in a 10 CFR Part 72 licensed cask in their spent fuel pool. The NRC position is that this rulemaking activity does not constitute a backfit. The following discussion in the Backfit Analysis clarify this NRC position for the amendment or exemption cases described above.

    For licensees with an approved license amendment, no action is required by the licensee. The license amendment modified the licensee's 10 CFR Part 50 technical specifications by adding minimum fuel burnup limits to the fuel being loaded into a licensed dry storage cask. This direct final rule does not affect the licensee's ability to load spent fuel into the cask in accordance with the amended technical specifications, nor does it create any conflict with the amended technical specifications. Therefore, a licensee may choose to continue to comply with the requirements of their amended 10 CFR Part 50 license and with the requirements of 10 CFR Part 71 or Part 72, as applicable, while loading or unloading a package or cask in the spent fuel pool. However, for those licensees who have amended their 10 CFR Part 50 license to comply with 10 CFR 50.68 and have included minimum fuel burnup limits, and choose to take advantage of this voluntary relaxation of requirements, they must request removal of the previously amended portions of the 10 CFR Part 50 technical specifications as a conforming change consistent with the amended rule.

    For licensees with an approved exemption, no action is required by the licensee. The exemption permitted licensees to be exempt from the criticality accident requirements of 10 CFR 50.68 for fuel being loaded into a licensed dry storage cask. These licensees can continue operating under their approved exemption. However, a licensee may instead choose to comply with the amended rule. Operating under the exemption or the amended rule have effectively the same criticality accident requirements for fuel within a package or cask in a spent fuel pool, namely only those of 10 CFR Part 71 or Part 72, as applicable.

12. Congressional Review Act

    In accordance with the Congressional Review Act of 1996, the NRC has determined that this action is not a major rule and has verified this determination with the Office of Information and Regulatory Affairs, Office of Management and Budget.

    List of Subjects in 10 CFR Part 50

    Antitrust, Classified information, Criminal penalties, Fire protection, Intergovernmental relations, Nuclear power plants and reactors, Radiation protection, Reactor siting criteria, Reporting and recordkeeping requirements.

    0 For the reasons set forth in the preamble and under the authority of the Atomic Energy Act of 1954, as amended; the Energy Reorganization Act of 1974, as amended; and 5 U.S.C. 552 and 553, the NRC is adopting the following amendments to 10 CFR part 50.

    PART 50--DOMESTIC LICENSING OF PRODUCTION AND UTILIZATION FACILITIES

    0 1. The authority citation for part 50 continues to read as follows:

    Authority: Secs. 102, 103, 104, 161, 182, 183, 186, 189, 68 Stat. 936, 937, 938, 948, 953, 954, 955, 956, as amended, sec. 234, 83 Stat. 444, as amended (42 U.S.C. 2132, 2133, 2134, 2135, 2201, 2232, 2233, 2236, 2239, 2282); secs. 201, as amended, 202, 206, 88 Stat. 1242, as amended, 1244, 1246 (42 U.S.C. 5841, 5842, 5846); sec. 1704, 112 Stat. 2750 (44 U.S.C. 3504 note). Section 50.7 also issued under Pub. L. 95-601, sec. 10, 92 Stat. 2951 (42 U.S.C. 5841). Section 50.10 also issued under secs. 101, 185, 68 Stat. 955, as amended (42 U.S.C. 2131, 2235); sec. 102, Pub. L. 91-190, 83 Stat. 853 (42 U.S.C. 4332). Sections 50.13, 50.54(dd), and 50.103 also issued under sec. 108, 68 Stat. 939, as amended (42 U.S.C. 2138). Sections 50.23, 50.35, 50.55, and 50.56 also issued under sec. 185, 68 Stat. 955 (42 U.S.C. 2235). Sections 50.33a, 50.55a and Appendix Q also issued under sec. 102, Pub. L. 91-190, 83 Stat. 853 (42 U.S.C. 4332). Sections 50.34 and 50.54 also issued under sec. 204, 88 Stat. 1245 (42 U.S.C. 5844). Sections 50.58, 50.91, and 50.92 also issued under Pub. L. 97-415, 96 Stat. 2073 (42 U.S.C. 2239). Section 50.78 also issued under sec. 122, 68 Stat. 939 (42 U.S.C. 2152). Sections 50.80-50.81 also issued under sec. 184, 68 Stat. 954, as amended (42 U.S.C. 2234). Appendix F also issued under sec. 187, 68 Stat. 955 (42 U.S.C. 2237).

    0 2. Section 50.68 is amended by adding a new paragraph (c) to read as follows:

    Sec. 50.68 Criticality accident requirements.

    * * * * *

    (c) While a spent fuel transportation package approved under Part 71 of this chapter or spent fuel storage cask approved under Part 72 of this chapter is in the spent fuel pool:

    (1) The requirements in Sec. 50.68(b) do not apply to the fuel located within that package or cask; and

    (2) The requirements in Part 71 or 72 of this chapter, as applicable, and the requirements of the Certificate of Compliance for that package or cask, apply to the fuel within that package or cask.

    Dated at Rockville, Maryland, this 31st day of October, 2006.

    For the Nuclear Regulatory Commission. William F. Kane, Deputy Executive Director for Reactor and Preparedness Programs Office of the Executive Director for Operations.

    Note: This Appendix will not appear in the Code of Federal Regulations.

    Appendix A: Technical Basis Document for RIN 3150-AH95 (RN 678)

1. Background

   In the production of electricity from commercial power reactors, spent fuel that is generated needs to be stored and safely managed. As part of the design of all commercial power reactors, spent fuel storage pools (SFP) were included to provide for the safe storage of spent fuel for a number of years. For many years there was sufficient room in the original spent fuel pools to continually store spent fuel without space restrictions being an immediate concern. In the 1960's and 1970's, when the spent fuel pools currently in use were designed and built, it was anticipated that the spent fuel would be moved off the reactor site for further processing and/or permanent disposal. The planned long-term approach is for disposal of this spent fuel in a permanent geological repository.

   As delays were encountered with the development of the permanent geological disposal site, the spent fuel pools began to fill up and space restrictions became a concern. Since the 1970's licensees, with NRC approval, have increased the storage capacity of the spent fuel pools by changing the designs of the storage racks to allow the fuel to be safely stored closer together. This was recognized as a short term solution, with the assumption that permanent disposal would be made available within a reasonable period. As additional delays were encountered with the permanent geological disposal of the spent fuel, the nuclear power industry, in conjunction with the NRC,

   [[Page 66653]]

   developed alternative storage solutions, including storing the spent fuel in dry storage casks on their sites.

   Maintaining the capacity to store spent fuel in a spent fuel pool is important for safety. Being able to store the spent fuel in a water filled spent fuel pool allows the fuel that is removed from the reactor core at the start of a refueling outage to be safely cooled at the time it is generating the greatest decay heat. Also, the water provides shielding for the workers involved in conducting maintenance on the various systems and components necessary to safely operate the reactor. During a refueling outage, inspection and maintenance activities need to be performed on the systems and components that would normally protect the fuel from damage as a result of the operation of the reactor. These inspections and maintenance activities can be accomplished more effectively and efficiently by draining the water from the reactor coolant and other supporting systems. Placing the fuel assemblies in the spent fuel pool during this period allows the reactor coolant and other systems to be drained while keeping the spent fuel safe (covered with water). Therefore, it is important to maintain the capability to completely remove all of the fuel assemblies from the reactor vessel during a refueling outage (full core offload capability). From an operational perspective, additional capacity should be maintained to accommodate a full core offload as well as the storage of new fuel that replaces the spent fuel permanently removed from the reactor core.

   Storage of spent fuel can be done safely in a water filled spent fuel pool under 10 CFR Part 50, a transportation package under 10 CFR Part 71, or a dry storage cask under 10 CFR Part 72. The primary technical challenges involve removing the heat generated by the spent fuel (decay heat), storing the fuel in an arrangement that avoids an accidental criticality, and providing radiation shielding. Removing the decay heat keeps the spent fuel from becoming damaged due to excessive heatup. Dry storage casks are designed to be capable of removing the decay heat generated by the fuel when filled with water or when dry without the need for active heat removal systems. Avoiding an accidental criticality is important to preclude the possibility of overheating the spent fuel and damaging the fuel. When dry, casks are subcritical by the absence of water as a neutron moderator, as well as by geometric design, and for some cask designs through the use of neutron poison materials such as boral and poison plates. When the casks are flooded with water, they may also rely on soluble boron to maintain the subcritical condition. Therefore, a boron dilution event is the scenario that could result in an accidental criticality with the possibility of excessive fuel temperature and subsequent fuel damage. Radiation shielding, provided by the water in a spent fuel pool or the container material in a dry storage cask, is important to protect people that may be near the spent fuel from unacceptable exposure to radiation. The NRC has promulgated regulations governing the capability of both spent fuel pools (10 CFR Parts 50 and 70), dry storage casks (10 CFR Part 72) and transportation packages (10 CFR Part 71) to address these technical challenges for the protection of public health and safety.

   Since the original design of commercial reactors included spent fuel pools, the spent fuel is stored in these pools when it initially comes out of the reactor. Decay heat from this spent fuel is primarily produced by the radioactive decay of fission products generated during the period the fuel is in the reactor core. As the fission products decay, the amount of decay heat generated in the spent fuel also decreases. So, over time the spent fuel becomes cooler, requiring less heat removal capability. Since the decay heat is higher when the spent fuel is removed from the reactor, it is more efficient to cool the fuel in a spent fuel pool where the fuel is surrounded by water. This allows the heat to be transferred to the water in the pool. The spent fuel pool requires a dedicated cooling system to maintain the temperature of the water in the pool cool enough to prevent the water from boiling. The spent fuel is allowed to cool down in the spent fuel pool for several years before it is placed in a dry cask storage cask or transportation package. When placed in a dry storage cask or transportation package, the amount of heat generated by the spent fuel is low enough that the fuel can be cooled by the gas surrounding the fuel with the heat being transferred through the cask or package to the surrounding air. Once placed in the dry storage cask or transportation package, the fuel will remain cool enough to prevent fuel damage without the need for an auxiliary cooling system.

   Spent fuel pools, dry storage casks and transportation packages are designed to preclude an accidental criticality primarily by relying on the geometrical configuration of how the spent fuel is stored. Both wet and dry storage may rely on material that absorbs the neutrons necessary for the fission process to occur (fixed neutron poisons, such as boral, poison plates, etc.). This material is inserted when building the storage racks or when building the cask/package. This material is integral to the storage racks in the spent fuel pool and in the cask/package used to physically hold the spent fuel in place. This establishes the geometrical configuration of how the spent fuel is stored. Criticality is of a greater concern when the fuel is stored in a spent fuel pool because the water used to cool the fuel is also a very effective moderator that facilitates the nuclear fission process. In dry storage, the spent fuel is surrounded by a gas that does not act as a moderator, therefore, criticality is a significantly smaller concern and the spent fuel can be safely stored closer together than in a spent fuel pool.

   Transfer of the spent fuel from the spent fuel pool to the cask/ package is performed while the cask/package is submerged in the spent fuel pool. When the cask/package is in the spent fuel pool, the fuel stored in the cask/package is surrounded by water, making an accidental criticality a concern. To preclude an accidental criticality in this circumstance, other physical processes or systems are used, primarily by putting a neutron poison (boron) in the water. Before any spent fuel is placed in either a spent fuel pool or a cask/package, a detailed analysis is conducted that demonstrates that the geometrical configuration and other physical systems or processes provide reasonable assurance that an accidental criticality will be prevented.

   It is also possible that the spent fuel would need to be transferred out of a dry storage cask and back in to the spent fuel pool. This might arise in one of two situations. The first situation is that it might be necessary to inspect the spent fuel or the dry storage cask itself. This would necessitate transferring some or all of the spent fuel in the dry storage cask back into the spent fuel pool. The second and more probable situation that would require unloading the spent fuel from the dry storage cask back into the spent fuel pool, would be in preparation for shipment of the spent fuel. Before the spent fuel in a dry storage cask licensed pursuant to 10 CFR Part 72 only (not also licensed pursuant to 10 CFR Part 71) can be shipped, it must first be transferred to an approved transportation package licensed pursuant to 10 CFR Part 71. In order to place the spent fuel into the transportation package, it must first be unloaded from the dry storage cask back into the spent fuel pool. The dry storage cask is then removed from the spent fuel pool and is replaced by the transportation package. The spent fuel is then loaded into the transportation package.

   As described in more detail below, there are sufficient regulatory controls in place to provide reasonable assurance that spent fuel can be safely stored both in spent fuel pools and in dry storage casks or transportation packages. The purpose for the change to 10 CFR 50.68 is to reduce the regulatory burden imposed on licensees by removing a requirement for an unnecessary criticality analysis. This change clarifies that, when loading spent fuel into a dry storage cask or transportation package while in the spent fuel pool, the license requirements and controls (including the physical processes and systems) relied on by the NRC in its determination that a specific dry storage cask or transportation package is acceptable shall be followed and provide the basis for the NRC concluding that public health and safety are maintained.

2. Regulatory Evaluation

   The regulation at 10 CFR 50.68 requires that pressurized water reactor (PWR) SFPs remain subcritical in an unborated, maximum moderation condition. To demonstrate that the fuel in the SFP remains subcritical in this condition, 10 CFR 50.68 allows credit for the operating history of the fuel (fuel burnup) when analyzing the storage configuration of the spent fuel. Taking the burnup of the spent fuel into consideration reduces the reactivity of the fuel and reduces the need for soluble boron to demonstrate subcriticality. Meeting the unborated condition requirement provides reasonable assurance that potential boron dilution events that could occur during the storage period of spent fuel in the SFP would not result in an accidental criticality. Boron dilution events could occur due to leakage from the spent fuel pool requiring replenishment from an unborated water source. For example, a SFP liner rupture due

   [[Page 66654]]

   to an earthquake could result in a rapid drain down of the SFP as could a rupture of the SFP cooling system. Dilution could also result from the introduction of unborated water in the vicinity of the SFP, such as from a fire suppression system. For the rapid drain down scenario, the SFP might be replenished with unborated sources of water in an effort to quickly reestablish spent fuel cooling and to provide shielding. It is necessary to reestablish spent fuel cooling during a rapid drain down event to preclude the possibility of the elevated cladding temperature that could cause overheating of the fuel and a loss of fuel cladding integrity. Because of the very low likelihood of a rapid drain down event, it is not considered part of the licensing basis for commercial nuclear power reactors.

   Storage casks are approved for use by the NRC by the issuance of specific and general licenses pursuant to 10 CFR Part 72. Transportation packages for spent fuel are licensed pursuant to 10 CFR Part 71. 10 CFR Part 71 currently requires that the criticality safety system for transportation packages be designed with the assumption that a package can be flooded with fresh water (i.e., no soluble boron). Therefore, the transportation packages are already analyzed in a manner that complies with the 10 CFR 50.68 assumption. The following discussions will then focus only on storage casks. However, the transportation packages are included in the proposed change in order to allow loading/unloading operation of a transportation package into a 10 CFR Part 50 facility (i.e., spent fuel pool) without the need for a specific license or exemption considerations under 10 CFR Part 50.

   The certificates and licenses issued by the NRC for these storage casks and the requirements of 10 CFR Part 72 include controls for fuel loading, storage, and unloading that provide reasonable assurance that spent fuel cooling is maintained and an accidental criticality is avoided. These controls are not identical to the requirements contained in 10 CFR 50.68, but instead allow for an alternate means of assuring safety by providing additional requirements that are not present in 10 CFR 50.68. NRC approval of the storage cask designs was, in part, predicated on the assumption that unirradiated commercial nuclear fuel (fresh fuel) of no more than 5 weight percent enrichment would remain subcritical when stored in its dry configuration and that it would remain subcritical with a sufficient boron concentration (if any boron was required) when stored in a water filled configuration, such as when it is in a SFP at a commercial power reactor. Under 10 CFR Part 72, reliance is placed on soluble boron to assure subcriticality when the cask is full of water, rather than relying on fuel burnup. The fresh fuel assumption allowed the NRC to generically approve storage casks without regard to the operating history of the fuel from a criticality perspective by establishing a bounding case for the various fuel types that could be stored in the approved storage casks. If generic fuel burnup data were available, the NRC may have been able to approve storage cask designs without the need for boron to assure subcriticality, but would have put in place a minimum fuel burnup requirement instead. By having the 10 CFR Part 72 controls in place, loading, storage, and unloading of spent fuel can be accomplished in a manner that precludes an accidental criticality while maintaining sufficient fuel cooling capabilities.

3. Problem Statement

   On March 23, 2005, the NRC issued Regulatory Issue Summary (RIS) 2005-05 addressing spent fuel criticality analyses for SFPs under 10 CFR 50.68 and Independent Spent Fuel Storage Installations (ISFSI) under 10 CFR Part 72. The intent of the RIS was to inform reactor licensees that they must meet both the requirements of 10 CFR 50.68 and 10 CFR Part 72 with respect to subcriticality during storage cask loading in SFPs. Different assumptions are relied on under these regulations to achieve the same underlying purpose, namely to place spent fuel in a condition such that it remains cooled and to preclude an accidental criticality.

   The need to meet both regulations and the differences in the assumptions creates an additional burden on licensees to show that credit for boron is not required to preclude an accidental criticality in a storage cask when filled with water. This condition exists for NRC approved high density storage casks used for storing PWR fuel. As permitted under 10 CFR Part 72, boron can be relied on at PWR SFPs to maintain subcriticality during storage cask loading or unloading. However, 10 CFR 50.68 requires that spent fuel assemblies be subcritical with unborated water in SFPs. In order to satisfy both of these requirements, a site specific analysis that demonstrates that the storage casks would remain subcritical for the specific irradiated fuel loading planned, without credit for boron, would be required. In this analysis, the licensee would rely on the fuel burnup to determine the margin to criticality for the specific cask loading. The analysis would be similar to that conducted for the SFP itself, but would take into account the unique design features of the storage cask when determining the minimum burnup required for spent fuel storage in the specific cask.

   In a July 25, 2005, letter to the NRC, the Nuclear Energy Institute (NEI) indicated that the implementation of the RIS recommendations would ``create an unnecessary burden for both industry and the NRC with no associated safety benefit for public.'' In other words, preparing an amendment application by performing a redundant criticality analysis consistent with 10 CFR 50.68 would cause ``an unnecessary administrative burden for licensees with no commensurate safety benefits'' because the dry storage cask had already been approved based on the criticality analysis and assumptions required by 10 CFR Part 72, i.e., boron credit with no burnup credit. NEI reiterated its position at a meeting with the NRC staff on November 10, 2005.

   Subsequent to the November 10, 2005 meeting, the NRC decided to examine the likelihood of criticality in casks while submerged in SFPs during loading or unloading in the event of a boron dilution in SFPs due to natural phenomena and other scenarios. Based on the low likelihood of such an event, NRC has determined that a revision to 10 CFR 50.68 clarifying that the requirements of 10 CFR Part 71 or 72, as appropriate, apply to transportation packages and storage casks during loading and unloading operations while submerged in a PWR SFP. This issue does not apply to boiling water reactors (BWR) because BWR SFPs do not contain boron and dry storage casks that are used to load BWR fuel do not rely on boron to maintain subcriticality. As discussed below, there is no safety benefit from requiring the licensee to conduct a site specific analysis to comply with 10 CFR 50.68(b) in support of dry storage cask loading, fuel storage, or unloading activities.

4. Technical Evaluation

   In assessing the proposed change to 10 CFR 50.68, the staff considered what type of events could lead to damage of the fuel in a storage cask as a result of the proposed change. Since the central issue in the application of the regulations is whether boron is credited as a control for avoiding an accidental criticality, events that reduce the boron concentration in the storage cask were considered the only events that would be affected by the proposed change. There are two types of scenarios in which a boron dilution could occur. A rapid drain down and subsequent reflood of the SFP or in leakage from the SFP cooling system or from an unborated water source in the vicinity of the SFP (i.e., fire suppression system) that would go undetected by normal licensee activities (slow boron dilution event). Each of these scenarios are addressed below.

   1. Slow Boron Dilution Event

      The possibility of a slow boron dilution event resulting in an accidental criticality event in a storage cask in a SFP is highly unlikely based on the requirements contained in the technical specifications attached to the Certificate of Compliance issued under 10 CFR Part 71 or 72 for the specific cask design.

      The storage cask technical specifications require measurements of the concentration of dissolved boron in a SFP before and during cask loading and unloading operations. At a point a few hours prior to insertion of the first fuel assembly into a storage cask, independent measurements of the dissolved boron concentration in the SFP are performed. During the loading and unloading operation, the dissolved boron concentration in the water is confirmed at intervals that do not exceed 72 hours. The measurements of the dissolved boron in the SFP are performed independently by two different individuals gathering two different samples. This redundancy reduces the possibility of an error and increases the accuracy of the measurement that is used to confirm that the boron concentration is in compliance with the storage cask's technical specifications. These measurements are continued until the storage cask is removed from the SFP or the fuel is removed from the cask.

      In addition to the storage cask technical specification boron concentration sampling requirements, 10 CFR Part 72 also requires criticality monitoring. As stated in 10 CFR

      [[Page 66655]]

      72.124(c), a criticality monitoring system is required for dry storage cask loading, storage, or unloading operations:

      ``A criticality monitoring system shall be maintained in each area where special nuclear material is handled, used, or stored which will energize clearly audible alarm signals if accidental criticality occurs. Underwater monitoring is not required when special nuclear material is handled or stored beneath water shielding. Monitoring of dry storage areas where special nuclear material is packaged in its stored configuration under a license issued under this subpart is not required.''

      Although 10 CFR 72.124(c) states ``underwater [criticality] monitoring is not required,'' criticality monitoring is required when special nuclear material is handled, used, or stored at facilities where the requirements of 10 CFR Part 72 apply. The point being made in 10 CFR 72.124(c) is that the criticality monitors are not required to be located under the water, but rather that criticality monitors can be located above the water to satisfy this requirement. The facilities to which this requirement applies include 10 CFR Part 50 SFPs when loading, storing, or unloading fuel in storage casks licensed under 10 CFR Part 72. The underlying intent of 10 CFR 72.124(c) is that criticality monitors are required under circumstances where an accidental criticality could occur as the result of changes in the critical configuration of special nuclear material. As such, storage cask loading and unloading activities need to be monitored to provide reasonable assurance that these fuel handling activities (changes in the critical configuration) do not result in an accidental criticality.

      When storing fuel in a storage cask that requires boron to remain subcritical while submerged in the SFP, the critical configuration can be affected by changes to the moderation (temperature changes of the water) or boron concentration. The primary concern during storage under these circumstances is the dilution of the boron concentration. Therefore, to meet the underlying intent of 10 CFR 72.124(c) either criticality monitors are required to detect an accidental criticality or controls are necessary to preclude a boron dilution event that could lead to an accidental criticality. As previously discussed, periodic sampling (at intervals no greater than 72 hours) of the boron concentration is required when fuel is stored in storage casks in the SFP. The requirement to periodically sample the boron concentration provides reasonable assurance that should a slow boron dilution event occur, it would be identified such that actions could be taken to preclude an accidental criticality and thereby meet the underlying intent of 10 CFR 72.124(c).

      A slow boron dilution event would require that an unborated source of water be injected into the SFP and be undetected by normal plant operational activities for sufficient duration to allow the boron concentration to drop below the level required to maintain a storage cask subcritical. First, consider the nature of the boron dilution event that would be required to dilute the SFP boron concentration from the storage cask technical specification concentration level (typically about 2200 ppm) to the critical boron concentration value (typically around 1800 ppm). The in-leakage rate would have to be large enough to dilute the entire volume of the pool between the time of the initial boron concentration sample and the time of the subsequent boron concentration sample and yet be small enough to remain undetected. Cask loading and unloading are conducted by licensed operators or certified fuel handlers who are present during any fuel movement. It is reasonable to conclude that these operators or handlers would detect all but the smallest increases in SFP level that would be indicative of a slow boron dilution event. Second, consider the storage casks loading and unloading operation frequency and duration. The frequency and duration depend on the dry storage needs and the reactor facility design. Based on historical average data, only a few casks (on the order of about 5 casks) are loaded each year at an operating reactor that is in need of dry storage. Third, consider that the time a storage cask is actually loaded with fuel while in the SFP is typically between 24 and 72 hours. When all of these factors are considered, it is clear that the likelihood of an undetected slow boron dilution event occurring during the time that a storage cask is loaded with fuel in the SFP is very remote.

      Another scenario that could result in a slow boron dilution event is the intentional injection of unborated water into the storage cask while loaded with fuel. A person would need access to a source of unborated water and a means for injecting the water directly into the cask (e.g., using a fire hose). While it is possible that someone could intentionally inject unborated water into the cask, it is highly unlikely that this could be done without being promptly detected by other licensee personnel monitoring cask loading or unloading activities. This scenario would result in a localized dilution of boron concentration in the storage cask. As the soluble boron concentration decreased in the storage cask, the fuel in the cask could become critical. The inadvertent criticality would be detected by the criticality monitors required by 10 CFR 72.124 during cask loading and unloading operations. As such, the licensee would be notified of the inadvertent criticality and could take action to stop the intentional injection of unborated water into the cask, re-establish a subcritical boron concentration in the cask, and terminate the inadvertent criticality event. This scenario is essentially the same as any other slow boron dilution event in that it requires an undetected injection of unborated water into a cask that is loaded with fuel.

      With the controls of the storage cask technical specifications related to monitoring boron concentration, the requirements of 10 CFR 72.124(c) for criticality monitoring to detect and avoid an accidental criticality, and the very remote likelihood of an undetected slow boron dilution event occurring at the time a storage cask is being loaded, it is reasonable to conclude that considering a slow boron dilution event there is no safety benefit in requiring a licensee to conduct a site specific analysis to demonstrate that a dry storage cask will remain subcritical in an unborated condition as required by 10 CFR 50.68(b).

   2. Rapid Drain Down Event

      A rapid drain down event could be postulated if there were an event that caused a catastrophic failure of the SFP liner and supporting concrete structure. If there were a catastrophic failure of the SFP liner that resulted in a rapid drain down while a storage cask was in the SFP, the borated water in the storage cask would likely remain in the storage cask providing reasonable assurance that the fuel would be cooled and remain subcritical. However, if the storage cask were to become dry, the design of the storage cask would allow the fuel to remain cooled, and without water as a moderator the fuel in the storage cask would be significantly subcritical.

      To assess whether there is a safety benefit from requiring licensees to conduct an analysis of storage casks assuming no boron as the result of a rapid SFP drain down event three factors were considered in the NRC's assessment. The first factor is the probability that a storage cask will be in the SFP, loaded with fuel. The second factor is whether there are credible scenarios that could result in the rapid drain down of the SFP. The third factor is whether a boron dilution event would occur in the storage casks if the rapid SFP drain down event were to occur. As described below, when taken together, it is clear that it is not necessary to require licensees to conduct additional criticality analyses to demonstrate that the storage casks will remain subcritical assuming no boron as required by 10 CFR 50.68 in response to a SFP rapid drain down event due to its highly unlikely occurrence.

      For the first factor, historical data suggests that approximately five storage casks are loaded on a annual basis at those facilities that need dry storage. The casks are typically in the SFP with fuel installed for as long as 72 hours. Using 72 hours and the historical data as initial assumptions, the probability of a storage cask loaded with spent fuel being in a SFP is about 4E-2/yr. Licensees only have the capability of moving one storage cask at a time into or out of the SFP. The total time it typically takes to bring a storage cask into the SFP, load it with fuel, and remove it from the SFP area for transport to the ISFSI is between 3 and 5 days. If a licensee were to continuously load storage casks, assuming the shortest duration to complete the transfer cycle (24 hours to transfer the cask from outside the building into the spent fuel pool; loading two to three assemblies per hour, or 12 hours to load the cask to capacity; and 36 hours for removing the cask from the spent fuel pool, sealing the cask and removing it from the building), the licensee would be able to load approximately 120 storage casks per year. Under these assumptions, the probability of having a storage cask loaded with fuel in the SFP would increase to 1.6E-1/year. If one assumes that it is possible to load 1 storage cask a week (for a total of 52 casks a year) this would result in a probability of having a cask that is loaded with fuel physically in the pool of 4E-1/year.

      For the second factor, the NRC has assessed the possibility of rapid drain down

      [[Page 66656]]

      events at SFPs. From NUREG-1738, ``Technical Study of Spent Fuel Pool Accident Risk at Decommissioning Nuclear Power Plants,'' phenomena that could cause such a catastrophic failure include a storage cask drop (event frequency of about 2E-7/year), an aircraft impact (event frequency of about 2.9E-9/year), a tornado missile (event frequency of