Preliminary, Qualitative 

Human Reliability Analysis 

for Spent Fuel Handling

Office of Nuclear Regulatory Research

NUREG/CR-7017

SAND2010-8464P
DISCLAIMER: This report was prepared as an account of work sponsored by an agency of the U.S. Government. 

Neither the U.S. Government nor any agency thereof, nor any employee, makes any warranty, expressed or

implied, or assumes any legal liability or responsibility for any third party’s use, or the results of such use, of any

information, apparatus, product, or process disclosed in this publication, or represents that its use by such third

party would not infringe privately owned rights.

AVAILABILITY OF REFERENCE MATERIALS

IN NRC PUBLICATIONS

NRC Reference Material

As of November 1999, you may electronically access

NUREG-series publications and other NRC records at

NRC’s Public Electronic Reading Room at 

http://www.nrc.gov/reading-rm.html. Publicly released

records include, to name a few, NUREG-series

publications; Federal Register notices; applicant,

licensee, and vendor documents and correspondence;

NRC correspondence and internal memoranda;

bulletins and information notices; inspection and

investigative reports; licensee event reports; and

Commission papers and their attachments.

NRC publications in the NUREG series, NRC

regulations, and Title 10, Energy, in the Code of

Federal Regulations may also be purchased from one

of these two sources.

1. The Superintendent of Documents

 U.S. Government Printing Office

 Mail Stop SSOP

 Washington, DC 20402–0001

 Internet: bookstore.gpo.gov

 Telephone: 202-512-1800

 Fax: 202-512-2250

2. The National Technical Information Service

 Springfield, VA 22161–0002

 www.ntis.gov 

 1–800–553–6847 or, locally, 703–605–6000

A single copy of each NRC draft report for comment is

available free, to the extent of supply, upon written

request as follows:

Address: U.S. Nuclear Regulatory Commission

 Office of Administration 

 Publications Branch

 Washington, DC 20555-0001

E-mail: DISTRIBUTION.RESOURCE@NRC.GOV 

Facsimile: 301–415–2289 

Some publications in the NUREG series that are 

posted at NRC’s Web site address

http://www.nrc.gov/reading-rm/doc-collections/nuregs 

are updated periodically and may differ from the last

printed version. Although references to material found

on a Web site bear the date the material was accessed,

the material available on the date cited may

subsequently be removed from the site.

Non-NRC Reference Material

Documents available from public and special technical

libraries include all open literature items, such as

books, journal articles, and transactions, Federal

Register notices, Federal and State legislation, and

congressional reports. Such documents as theses,

dissertations, foreign reports and translations, and

non-NRC conference proceedings may be purchased

from their sponsoring organization.

Copies of industry codes and standards used in a

substantive manner in the NRC regulatory process are

maintained at—

The NRC Technical Library 

Two White Flint North

11545 Rockville Pike

Rockville, MD 20852–2738

These standards are available in the library for 

reference use by the public. Codes and standards are

usually copyrighted and may be purchased from the

originating organization or, if they are American

National Standards, from—

American National Standards Institute

11 West 42nd Street

New York, NY 10036–8002

www.ansi.org 

212–642–4900

Legally binding regulatory requirements are stated

only in laws; NRC regulations; licenses, including

technical specifications; or orders, not in 

NUREG-series publications. The views expressed

in contractor-prepared publications in this series are

not necessarily those of the NRC.

The NUREG series comprises (1) technical and

administrative reports and books prepared by the

staff (NUREG–XXXX) or agency contractors

(NUREG/CR–XXXX), (2) proceedings of

conferences (NUREG/CP–XXXX), (3) reports

resulting from international agreements

(NUREG/IA–XXXX), (4) brochures

(NUREG/BR–XXXX), and (5) compilations of legal

decisions and orders of the Commission and Atomic

and Safety Licensing Boards and of Directors’

decisions under Section 2.206 of NRC’s regulations

(NUREG–0750).
Preliminary, Qualitative 

Human Reliability Analysis 

for Spent Fuel Handling

Manuscript Completed: November 2011

Date Published: February 2012

Prepared by:

J. Brewer1 

P. Amico2

S. Cooper3

S. Hendrickson1

1 Sandia National Laboratories

 Albuquerque, NM 87185

 Operated by Sandia Corporation

 for the U.S. Department of Energy

 

2 SAIC

 Abingdon, MD 21009 

3 U.S. Nuclear Regulatory Commission

 Office of Nuclear Regulatory Research

 Washington, D.C. 20555-0001

S. Cooper, NRC Project Manager

S. Cooper, NRC Technical Lead

Office of Nuclear Regulatory Research

NUREG/CR-7017

SAND2010-8464P
ii

Sandia National Laboratories is a multi-program laboratory managed and operated by Sandia 

Corporation, a wholly owned subsidiary of Lockheed Martin Corporation, for the U.S. 

Department of Energy’s National Nuclear Security Administration under contract DE-AC04-

94AL85000.
iii

ABSTRACT

This report provides material that was originally generated as an interim letter report and that 

presented a preliminary, qualitative human reliability analysis (HRA) to examine, in a generic 

manner, how human performance of dry cask storage operations (DCSOs) could plausibly lead 

to radiological consequences that impact the public and the environment. This material is 

released in a NUREG/CR format to facilitate dissemination of human failure events that 

examine, in a preliminary fashion, the misloading of spent fuel into a cask. This report includes 

the investigation of cask drop scenarios as well as other DCSO human performance aspects. It

builds upon previous analyses and subject matter expert interviews to improve understanding of 

human performance issues that may arise in DCSOs. The scenarios and examinations 

represent a snap-shot in time and are preliminary to the qualitative HRA of cask drops provided 

in NUREG/CR-7016 [29]. This report demonstrates that process descriptions of varying levels of 

detail, when carefully reviewed in light of state-of-the-art understandings of human performance, 

can enable identification of key operational errors and vulnerabilities that may contribute to 

errors. It is anticipated that the preliminary, qualitative HRA of DCSOs in this report will enhance 

the ability to carry out a detailed, plant-specific qualitative HRA of DCSOs.

v

TABLE OF CONTENTS

ABSTRACT...............................................................................................................................iii

TABLE OF CONTENTS .............................................................................................................v

FIGURES..................................................................................................................................vii

TABLES ...................................................................................................................................vii

ACKNOWLEDGEMENTS..........................................................................................................ix

ABBREVIATIONS .....................................................................................................................xi

1. INTRODUCTION..........................................................................................................1-1

2. DRY CASK STORAGE OPERATIONS ACROSS THE U.S.........................................2-1

2.1. Distribution of Independent Spent Fuel Storage Installations in the U.S............2-3

2.2. Expected Distribution of Cask Systems in the U.S. by 2010..............................2-4

2.3. Typical DCSO Differences Between Boiling Water Reactors and Pressurized 

Water Reactors.................................................................................................2-6

3. POTENTIAL CONSEQUENCES OF INTEREST..........................................................3-1

3.1. NRC Pilot Probabilistic Risk Assessment of a Dry Cask Storage System .........3-1

3.2. EPRI Probabilistic Risk Assessment of Bolted Storage Casks ..........................3-4

4. RECENT CONCERNS IN SPENT FUEL HANDLING ..................................................4-1

4.1. Concerns Identified in NUREG-1774.................................................................4-1

4.2. Concerns Identified in Various Sources ............................................................4-2

5. GENERAL DESCRIPTION OF FUEL HANDLING AND CASK OPERATIONS...........5-1

6. HUMAN PERFORMANCE ANALYSIS APPROACH ...................................................6-1

7. OVERVIEW OF MISLOAD AND CASK DROP SCENARIOS......................................7-1

7.1. Misloading Fuel into a Cask ..............................................................................7-1

7.1.1. General Human Performance Vulnerabilities Impacting Fuel-Loading 

Activities............................................................................................... 7-2

7.1.2. Information Considered When Developing Misload Scenarios.............. 7-4

7.1.3. Additional Relevant Previous Events Related to Misloads .................... 7-6

7.1.4. Completeness of Misload Scenarios..................................................... 7-7

7.2. Dropping a Cask ...............................................................................................7-8

7.2.1. General Human Performance Vulnerabilities That Could Contribute to 

Cask Drops .......................................................................................... 7-8

7.2.2. Information Considered When Developing Cask Drop Scenarios ....... 7-10

7.2.3. Additional Relevant Previous Events Related to Cask Drops.............. 7-11

7.2.4. Completeness of Cask Drop Scenarios .............................................. 7-15

7.3. Tabular Listing of Human Failure Event Group Descriptions and Scenarios 

Described in this Report..................................................................................7-16

8. PRELIMINARY SCENARIOS ILLUSTRATING POTENTIAL HUMAN FAILURE 

EVENTS.......................................................................................................................8-1
vi

8.1. HFE Scenarios Before and During Fuel Loading...............................................8-2

8.1.1. Definition and Interpretation of Issue .................................................... 8-2

8.1.2. Base Case Scenario............................................................................. 8-2

8.1.3. General Human Performance Vulnerability Concerns........................... 8-3

8.1.4. Scenarios Before and During Final Loading ......................................... 8-3

8.2. HFE Scenarios During Transfer Cask Movement from Spent Fuel Pool to 

Preparation Area...............................................................................................8-8

8.2.1. Definition and Interpretation of Issue .................................................... 8-8

8.2.2. Base Case Scenario............................................................................. 8-9

8.2.3. General Human Performance Vulnerability Concerns........................... 8-9

8.2.4. Scenarios During Cask Movement from SFP to Preparation Area........ 8-9

8.3. HFE Scenarios During Multi-purpose Canister and Transfer Cask Sealing 

Operations ......................................................................................................8-13

8.3.1. Definition and Interpretation of Issue .................................................. 8-13

8.3.2. Base Case Scenario........................................................................... 8-13

8.3.3. General Human Performance Vulnerability Concerns......................... 8-14

8.3.4. Scenarios During MPC and Transfer Cask Sealing Operations .......... 8-16

8.4. HFE Scenarios During Transfer Cask Movement from Preparation Area to 

Transfer Pit .....................................................................................................8-21

8.4.1. Definition and Interpretation of Issue .................................................. 8-21

8.4.2. Base Case Scenario........................................................................... 8-21

8.4.3. General Human Performance Vulnerability Concerns......................... 8-22

8.4.4. Scenarios During Cask Movement from Preparation Area to Transfer Pit

........................................................................................................... 8-22

8.5. HFE Scenarios During MPC Movement from Transfer Cask Down to Storage 

Cask ...............................................................................................................8-25

8.5.1. Definition and Interpretation of Issue .................................................. 8-25

8.5.2. Base Case Scenario........................................................................... 8-25

8.5.3. General Human Performance Vulnerability Concerns......................... 8-26

8.5.4. Scenario During MPC Movement from Transfer Cask Down to Storage 

Cask................................................................................................... 8-30

8.6. HFE Scenarios During Storage Cask Movement from Transfer Pit to ISFSI 

Pad.................................................................................................................8-32

8.6.1. Definition and Interpretation of Issue .................................................. 8-32

8.6.2. Base Case Scenario........................................................................... 8-33

8.6.3. General Human Performance Vulnerability Concerns......................... 8-33

8.6.4. Scenarios During Cask Movement from Transfer Pit to ISFSI Pad ..... 8-34

8.7. HFE Scenarios During Monitoring and Storage at the ISFSI ...........................8-38

8.7.1. Definition and Interpretation of Issue .................................................. 8-38

8.7.2. Base Case Scenario........................................................................... 8-39

8.7.3. General Human Performance Vulnerability Concerns......................... 8-39

8.7.4. Scenarios During Cask Monitoring and Storage at the ISFSI.............. 8-40
vii

9. CONCLUSIONS...........................................................................................................9-1

10. REFERENCES...........................................................................................................10-1

APPENDIX A REVIEWS OF SELECTED REFERENCES................................................A-1

APPENDIX B DETAILED DESCRIPTION OF DRY CASK STORAGE OPERATIONS AND 

PROCESSES.............................................................................................B-1

APPENDIX C SUMMARIES OF INTERVIEWS WITH SUBJECT MATTER EXPERTS....C-1

FIGURES

Figure 2-1 Series of Transnuclear (TN)-40 casks at an independent spent fuel storage 

installation.........................................................................................................2-1

Figure 2-2 Holtec International HI-STORM 100 cask storage system with multipurpose 

canister (MPC) partially inserted and diagram of features. ................................2-2

Figure 2-3 (A) Components of the Holtec International HI-STORM 100 cask storage 

system,* and (B) components of the NUHOMS-type system in horizontal storage 

vault.†

................................................................................................................2-3

Figure 3-1 Percentage of risk per phase of operation for first-year and 20-year dry cask 

storage life cycle for NRC and EPRI analyses. ...............................................3-13

Figure 8-1 Intended versus actual placement of fuel in Scenario 2.....................................8-6

TABLES

Table 2-1 Current and expected distribution of cask systems across the U.S.*.................2-5

Table 3-1 Summary of HRA detailed quantification for grouped human actions from the 

EPRI report.......................................................................................................3-6

Table 3-2 Multiple human action dependence matrix from EPRI report.............................3-8

Table 3-3 Thermal loads versus fuel storage time from the EPRI report. ........................3-11

Table 3-4 Cask component thermal limit versus fuel storage time from the EPRI report. 3-11

Table 3-5 Summary of radiological risks comparing EPRI and NRC results.* .................3-12

Table 7-1 Summary of HFE group descriptions, scenario titles, and vulnerabilities.........7-17

Table 8-1 Scenarios before and during fuel loading. .........................................................8-3

Table 8-2 Scenarios during cask movement from SFP to preparation area.......................8-9

Table 8-3 Scenarios during MPC and transfer cask sealing operations. .........................8-16

Table 8-4 Scenarios during cask movement from preparation area to transfer pit...........8-22

Table 8-5 Subset of time-intensive operations that may or may not change if a much 

smaller fuel load and cask than the HI-STORM 100 systems were used per caskloading sequence.* .........................................................................................8-29

Table 8-6 Scenarios during MPC movement from transfer cask down to storage cask. ..8-30

Table 8-7 Scenarios during cask movement from transfer pit to ISFSI pad.....................8-34

Table 8-8 Scenarios during cask monitoring and storage at the ISFSI. ...........................8-40

ix

ACKNOWLEDGEMENTS

This report benefitted greatly from the insights and information sources provided by numerous 

subject matter experts at the U.S. Nuclear Regulatory Commission including James Pearson, 

Robert Temps, Dennis Damon, Vince Everett, Scott Atwater, Ray Kellar, John Thorp, Michael

Junge, Jimi Yerokun, Tina Gosh, Frank Jacobs, John Monninger, Sean Peters, Christopher

Ryder, Dennis Galvin, Erasmia Lois, Kendra Hill, and James Chang. The authors are 

particularly appreciative of the efforts of James Pearson for providing both tremendous expert 

insights and for carefully reviewing drafts of the report for accuracy. Additional subject matter 

expertise was provided by staff members at Sandia National Laboratories (SNL) including John 

Forester, Caren Wenner, Jeffrey LaChance, Ronald Knief, and staff members at SAIC including 

Steven Mirsky and Cindy Williams. The authors also thank SNL staff members Nancy Lies, 

Fotini Walton, and Elizabeth Galloway for providing extensive technical editing support during 

the report preparation process.

xi

ABBREVIATIONS

AFR away from reactor

AIT augmented inspection team

ANSI American National Standards Institute

AOS annulus overpressure system

ASME American Society of Mechanical Engineers

ATHEANA A Technique for Human Event Analysis

BWR boiling water reactor

CAD computer aided design

CFR code of federal regulations

CLC cask loading campaign

CNPP commercial nuclear power plant

CoC certificate of compliance

DCSO dry cask storage operations

DCSS dry cask storage systems

DID defense-in-depth

DOE U.S. Department of Energy

DSC dry shielded canisters

EFC error-forcing context

EOC error of commission

EOO error of omission

EPRI Electric Power Research Institute

ERT emergency response team

FH fuel handler

FHD forced helium dehydration system

FHP fuel handling personnel

FSAR final safety analysis report

GWd gigawatt days

HEP human error probability

HFE human failure event

HI-STORM Holtec International Storage and Transfer Operation Reinforced Module

HI-TRAC Holtec International Transfer Cask

HRA human reliability analysis

HSM horizontal storage module

HVAC heating, ventilation and air conditioning

IAEA International Atomic Energy Agency

IE initiating event

INL Idaho National Laboratory

IP inspection procedure

ISFSI independent spent fuel storage installation

MC inspection manual chapter

MEI maximally exposed individual

MLB multi-assembly leak-tight basket

MPC multi-purpose canister

MSB multi-assembly sealed basket

MTU metric ton of uranium

NDE non-destructive evaluation

NMSS USNRC Office of Nuclear Material Safety and Safeguards

NPP nuclear power plant
xii

NRC Nuclear Regulatory Commission

NRR Office of Nuclear Reactor Regulation at the NRC

NUHOMS Nutech Horizontal Modular System

PPE personal protective equipment

PRA probabilistic risk assessment

PSF performance shaping factor

psi pounds per square inch

psig pounds per square inch gauge

PT penetrant testing

PWR pressurized water reactor

QA quality assurance

RES USNRC Office of Nuclear Regulatory Research

RP reactor protection

RVOA removable valve operating assemblies

SAIC Science Applications International Corporation

SAR safety analysis report

SER safety evaluation report

SF spent fuel

SFA spent fuel assembly

SFH spent fuel handling

SFP spent fuel pool

SFPO Spent Fuel Project Office (within the NMSS office)

SGTS standby gas treatment system

SME subject matter expert

SNF spent nuclear fuel

SNL Sandia National Laboratories

S-R-K Skill-Rule-Knowledge taxonomy for describing skill acquisition

THERP Technique for Human Error Rate Prediction

TN transnuclear

TS technical specification

TVA Tennessee Valley Authority

UA unsafe action

USNRC United States Nuclear Regulatory Commission

UT ultrasonic testing

VDS vacuum drying system

VSC ventilated storage cask (VSC-24, VSC-33, etc.)
1-1

1. INTRODUCTION

The goal of the work documented in this report is twofold: (1) to perform a preliminary study on 

what a qualitative human reliability analysis (HRA) for spent fuel and cask handling operations

should include, and (2) to demonstrate that the “A Technique for Human Event Analysis”

(ATHEANA) HRA method can be usefully applied to these operations [2]. In support of this goal, 

this report builds upon previous analyses and takes several positive steps toward further 

evaluating human performance issues relevant to dry cask storage operations (DCSOs). This 

improved understanding of human performance issues may enhance the ability to carry out a 

detailed qualitative HRA for a specific nuclear power plant (NPP) in the future. An additional 

report was published which presents further information on steps that may be taken to reduce 

the likelihood of casks drops resulting from unsafe human actions [29].

The preliminary study involved typical qualitative HRA tasks such as collecting relevant 

information and preliminarily identifying unsafe actions and human failure events (HFEs), 

relevant influences (e.g., performance shaping factors, other contextual factors), and event 

scenarios. In particular, this study involved identifying and reviewing literature relevant to 

understanding human performance in spent fuel handling (SFH), interviews of SFH subject

matter experts, and use of all information obtained to perform a preliminary, qualitative HRA of 

SFH tasks that have a potential for misloads and drops.

This preliminary, qualitative HRA was conducted using elements of NUREG-1792, Good 

Practices for Implementing Human Reliability Analyses (HRA) [1], and NUREG-1624, Rev. 1, 

Technical Basis and Implementation Guidelines for A Technique for Human Event Analysis

(ATHEANA) [2], to form critical parts of the technical basis for the preliminary analysis. As a 

starting point for identifying scenarios involving important HFEs1 for SFH, in particular those 

involving DCSOs, scenarios identified in previous studies were reviewed. This NUREG/CR also 

identifies (preliminarily) additional HFEs that may occur during the pre-initiator and post-initiator 

phases of an initiating event (IE) that may strongly influence the ultimate consequences of a 

particular event.

Note that an HRA is typically performed in the context of a plant-specific probabilistic risk 

assessment (PRA) study. This study, however, was generated without the benefit of a larger 

PRA study; neither was it plant-specific. Therefore, it investigates only generic HRA issues 

relevant to SFH. In particular, the intent of this report is simply to identify scenarios and 

preliminary HFEs that may apply to a plant-specific application.

Specific tasks conducted in support of this effort included: 

• Identification and review of the literature (spanning from handling of individual rods to 

handling of spent fuel casks).

 1 A “human failure event” is an event that would be modeled as a basic event in the logic models of a PRA, and 

that is the result of one or more “unsafe actions.” These “unsafe actions” are actions inappropriately taken, or not 

taken when needed, by plant personnel that result in a degraded plant/facility safety condition.
1-2

• Interviews with subject matter experts (SMEs) to investigate types of SFH activities, 

human performance aspects of SFH, job aids,

2

• Performance of a preliminary, qualitative HRA of SFH activities to discover opportunities 

where misloads and drops may occur and, in the case of misloads, to identify points in 

the process where misloads might be recognized. 

potential variations from “typical” SFH 

activities, and significant accidents that have occurred during SFH.

SFH activities were separated into HFE scenario groupings, and then the potential use or 

usefulness of job aids, plausible variations in context, potential error mechanisms for fuelhandling-specific failures, and other performance shaping factors (PSFs) that may influence the 

likelihood and consequence of particular HFEs were examined and explored. 

Note that four primary sources of information provided the core for developing and investigating 

SFH HFE scenario groupings:

• SME interviews

• pilot dry cask PRA developed by the Nuclear Regulatory Commission (NRC) [4]

• bolted storage cask PRA conducted by the Electric Power Research Institute (EPRI) [5]

• Final Safety Evaluation Report for the Holtec International HI-STORM 100 cask 

system [6]

Other referenced sources played important but secondary roles in this preliminary analysis.

(See Appendix A for reviews of selected references.)

This analysis examines, generically, how human performance of dry cask storage operations 

can plausibly lead to radiological consequences that impact plant personnel and (to a lesser 

extent) possibly impact the public and the environment. Misloading spent fuel into a cask and 

dropping a loaded cask are the two HFE groupings of primary interest, although all human 

performance aspects of DCSOs are considered to some extent. This report builds on previous 

analyses in order to improve the understanding of human performance issues that may arise 

during DCSOs. 

Given that this human performance analysis is at a qualitative, preliminary level, process 

descriptions, unsafe action (UA) descriptions, human failure event (HFE) descriptions, and error

forcing context (EFC) descriptions are treated in a preliminary manner. However, the various 

scenarios and human performance considerations provide sufficient information to serve as a 

starting point for additional focused information gathering and HRA analysis activities (e.g., a 

comprehensive and plant-specific DCSO PRA performed using state-of-the-art HRA methods). 

 2 Job aids are repositories for information, processes, or perspectives; they are external to the individual; they 

support the work and activity to be done; they direct, guide, and enlighten performance (e.g., books, cards, software, 

alarms, control panels, various displays) [3]
2-1

2. DRY CASK STORAGE OPERATIONS ACROSS THE U.S.

Two important subtleties need to be recognized with regard to DCSOs. First, the specific

handling operations depend upon the design of the dry cask storage system (DCSS). Some 

DCSS designs use a directly loaded, bolted-closure storage cask to provide confinement, 

shielding, and thermal protection. This storage cask can be placed directly on the independent 

spent fuel storage installation (ISFSI) storage pad. Second, other DCSS designs use the 

canister as the containment boundary and use a separate structure to provide shielding and 

thermal protection. In these DCSS designs, the loaded canister must be transferred to the 

storage structure/container (e.g., a Holtec HI-STORM 100 storage cask) or may be fixed (e.g., a 

concrete vault structure such as the cylindrical, horizontal concrete crypts used in the Nutech 

Horizontal Modular System [NUHOMS] systems).

Figure 2-1 Series of Transnuclear (TN)-40 casks at an independent spent fuel storage 

installation.
2-2

Figure 2-2 Holtec International HI-STORM 100 cask storage system with multipurpose 

canister (MPC) partially inserted and diagram of features.

Figure 2-3 shows two types of DCSSs widely used in the U.S. Figure 2-3(A) shows the HISTORM 100 system, consisting of a multi-purpose canister (MPC), a transfer cask, and a HITRAC 100 storage cask. As discussed later in this report, DCSOs involving the HI-STORM 100 

DCSS at a Mark I BWR (boiling water reactor) plant provided the majority of the ”generic”

operation descriptions used for investigating human performance. Figure 2-3(B) provides an 

overview of the components in the NUHOMS-type storage vault approach. The NUHOMS 

system uses a dry shielded canister (DSC), which is essentially the same as an MPC, along 

with a transfer cask. This report does not analyze in detail the ISFSI emplacement operations 

involving horizontal storage units, although the operations prior to emplacement (including 

transport to the ISFSI) are represented in the “generic” operation descriptions.
2-3

Figure 2-3 (A) Components of the Holtec International HI-STORM 100 cask storage

system,

* and (B) components of the NUHOMS-type system in horizontal 

storage vault.

†

* Adapted from a figure available at the Holtec International Web site: http://www.holtecinternational.com. † Reference 7 (p. 1-11).

2.1. Distribution of Independent Spent Fuel Storage Installations in the U.S.

There are currently 51 ISFSIs in 33 states. Among these, 47 are co-located with commercial 

nuclear power plants (CNPPs), and the remaining four are away from reactor (AFR) sited 

ISFSIs. The four AFR ISFSI sites include the wet-storage General Electric Morris Operations 

(GE-MO) near Morris, Illinois; the Idaho National Laboratory (INL) dry storage ISFSI that stores 

fuel debris from Three Mile Island Unit 2; an ISFSI operated by Foster Wheeler, also located at 

INL; and a temporary facility to store spent fuel located in Utah. Furthermore, there are several 

sites where the CNPP has been decommissioned and an ISFSI remains at the site including: 

Big Rock Point, Fort St. Vrain, Haddam Neck (Connecticut Yankee), Maine Yankee, Rancho 

Seco, Trojan, and Yankee Rowe.
2-4

An ISFSI facility includes the following infrastructure items:

• Storage pad or engineered foundation (e.g., 0.91 meter (3 foot) thick concrete pad) 

where the dry-casks are placed

• Support services and auxiliary systems (including sewer and utility services)

• Transportation infrastructure

• Cask maintenance, repair, and decontamination buildings

• Administration building

• Security infrastructure

• Health physics support

2.2. Expected Distribution of Cask Systems in the U.S. by 2010

Nuclear power plants in the U.S. were not originally designed to store all of the spent fuel (SF) 

discharged during the life of the plant. The original concept was to transport spent fuel to 

reprocessing centers to extract and reconfigure useful fissile and fertile materials. Given that the 

reprocessing approach was not planned and a geologic repository is not available to store spent 

fuel, licensees have turned to DCSSs as a temporary storage option that enables them to 

decrease spent fuel inventory in spent fuel pools (SFPs). The NRC determined that all SFP 

storage capacity at existing CNPPs would be expended by 2015 in the absence of removing 

fuel and storing it in casks. Table 2-1 lists DCSSs in use or planned for the near future for U.S. 

plants as of 2010 [8]. The list is not complete, as additional utilities are deciding between 

storage systems, but it does reveal that most DCSSs fall into the two storage approaches (i.e., 

HI-STORM and NUHOMS) presented earlier in Figure 2-3. 
2-5

Table 2-1 Current and expected distribution of cask systems across the U.S.*

Reactor Dry storage technology Licensing method

† Date 

Issued

Surry

CASTOR V/21, TN-32, NAC-128, 

CASTOR X/33, MC-10 Site License 1986

NUHOMS-HD General License 2007

H.B. Robinson NUHOMS-07P Site License 1986

NUHOMS-24P General License 2005

Oconee NUHOMS-24P Site License 1990

NUHOMS-24P General License 1999

Fort St. Vrain Foster Wheeler MVDS Site License 1991

Calvert Cliffs NUHOMS-24P & 32P Site License 1992

Palisades VSC-24, NUHOMS-32PT General License 1993

Prairie Island TN-40 Site License 1993

Point Beach VSC-24, NUHOMS-32PT General License 1996

Davis-Besse NUHOMS-24P General License 1996

Arkansas Nuclear VSC-24, HI-STORM 100 General License 1996

North Anna TN-32 Site License 1998

NUHOMS-HD General License 2008

Trojan HI-STORM 100 Site License 1999

Idaho National Lab TMI-2 Fuel 

Debris NUHOMS-12T Site License 1999

Susquehanna NUHOMS-52B & 61BT General License 1999

Peach Bottom TN-68 General License 2000

Hatch HI-STAR 100, HI-STORM 100 General License 2000

Dresden HI-STAR 100, HI-STORM 100 General License 2000

Rancho Seco NUHOMS-24P Site License 2000

McGuire TN-32 General License 2001

Big Rock Point BNG Fuel Solutions W74 General License 2002

James A. Fitzpatrick HI-STORM 100 General License 2002

Maine Yankee NAC-UMS General License 2002

Columbia Generating Station HI-STORM 100 General License 2002

Oyster Creek NUHOMS-61BT General License 2002

Yankee Rowe NAC-MPC General License 2002

Duane Arnold NUHOMS-61BT General License 2003

Palo Verde NAC-UMS General License 2003

San Onofre NUHOMS-24PT General License 2003

Diablo Canyon HI-STORM 100 Site License 2004

Haddam Neck NAC-MPC General License 2004

Sequoyah HI-STORM 100 General License 2004

Idaho Spent Fuel Facility Concrete Vault Site License 2004

Humboldt Bay HI-STORM 100HB General License 2005

Private Fuel Storage Facility HI-STORM 100 General License 2006

Browns Ferry HI-STORM 100S General License 2005

Joseph M. Farley NUHOMS-32PT General License 2005

Millstone NUHOMS-32PT General License 2005

Quad Cities HI-STORM 100S General License 2005

River Bend HI-STORM 100S General License 2005

Fort Calhoun NUHOMS-32PT General License 2006

Hope Creek/Salem HI-STORM 100 General License 2006

Grand Gulf 1 HI-STORM 100S General License 2006

Catawba NAC-UMS General License 2007

Indian Point HI-STORM 100 General License 2008

St. Lucie NUHOMS-HD General License 2008

Vermont Yankee HI-STORM 100 General License 2008

Limerick NUHOMS-61BT General License 2008

Seabrook NUHOMS-HD-3PTM General License 2008

Monticello NUHOMS-61BT General License 2008

Kewaunee NUHOMS-39PT General License 2009
2-6

* From NRC, 2010

† Site-specific licenses are granted in accordance with 10 CFR 72; that is, the safety aspects of the ISFSI site are 

reviewed and, if approved, the NRC issues a specific license for the site. General licenses refer to the storage of 

spent fuel in certified casks in accordance with 10 CFR 72 Subpart K; that is, if the safety aspects are approved, the 

NPP licensee is authorized to store spent fuel in NRC-approved dry storage systems at a site licensed to operate a 

nuclear power reactor.

2.3. Typical DCSO Differences Between Boiling Water Reactors and Pressurized Water 

Reactors

Two primary differences in plant configurations affect the movement of casks within a nuclear 

power plant. These configurations are associated with the major differences between boiling 

water reactors (BWRs) and pressurized water reactors (PWRs). In BWRs, the SFP is typically 

inside the secondary containment portion of the reactor building immediately adjacent to the 

reactor vessel. The top surface of the SFP is above the level of the reactor vessel, which places 

it four or five floors above ground level. Therefore, cask system components that must be 

placed into the cask pit of the SFP must be vertically transferred (i.e., up to 30.5 meters (100 

feet)) above ground level in order to be lowered into the SFP. There are BWRs (e.g., the Mark 

III containment design) in which the SFP is located in the auxiliary building adjacent to the 

reactor building. In this case, the pool is generally located less than three floors above ground 

level.

In PWRs, the SFP is typically located in the fuel building outside the containment building that 

houses the reactor vessel and the primary coolant system. The SFP in a PWR is typically no 

more than one or two floors above ground level; therefore, the cask system components that 

must be placed into the cask pit will not have opportunities to drop vertically more than 

approximately 15.2 meters (50 feet). In addition, the two reactor types will generally have 

noticeably different horizontal travel paths for cask components going into and out of the pool. 

The PWR travel path for cask components is generally more direct, whereas the BWR travel 

paths can involve much greater horizontal movement.
3-1

3. POTENTIAL CONSEQUENCES OF INTEREST

Two previous dry cask PRA studies were of considerable assistance during the preparation of 

this report. They provided descriptions of SFH activities, initial insight into HFEs, and others’

perspectives on likelihoods and consequences related to that initial set of HFEs. The first study 

was a pilot dry cask PRA conducted by the NRC [4]. The second was a bolted storage cask 

PRA conducted by the Electric Power Research Institute [5].

3.1. NRC Pilot Probabilistic Risk Assessment of a Dry Cask Storage System

To further evaluate public risks from the handling, transfer, and storage of dry casks, the 

USNRC Office of Nuclear Regulatory Research (RES) responded to a request by the NRC’s 

Office of Nuclear Material Safety and Safeguards (NMSS) to develop and apply a method for 

performing a PRA of a DCSS. The motivation for the pilot PRA [4] involved several incidents at 

licensee facilities that had raised concerns about the possibility of a loaded spent fuel cask 

being dropped. That initial concern led to an interest in examining a broad range of potential 

initiating events during SFH activities that could lead to public health and environmental 

impacts. RES chose to perform a pilot PRA on a welded canister system (i.e., HOLTEC HISTORM 100) at a specific BWR site [4]. The HI-STORM 100 has three major components: a 

multi-purpose canister, a transfer cask, and a storage cask. The Mark I-type BWR was chosen 

for analysis. The Mark I-type represents the general configuration of 69% of the BWR fleet in 

the U.S., and BWRs comprise 33% of the overall U.S. fleet of CNPPs. The remainder of CNPPs 

are PWRs.

The pilot PRA report (NUREG-1864 [4]) contained a list of initiating events including dropping 

the cask inside the containment building during transfer operations and external events during 

on-site storage such as earthquakes, floods, high winds, lighting strikes, accidental aircraft 

crashes, and pipeline explosions. Potential cask failures from mechanical and thermal loads 

were modeled, and it was assumed that 5-year-old fuel would be in a cask at the time of any 

cask failure/breach. Risk to the public was measured in terms of the individual probabilities of a 

prompt fatality3 within 1.6 km (1 mi) and a latent cancer fatality4 within 16 km (10 mi) of the site. 

The pilot PRA study used the best available point estimates without any uncertainty analyses. In 

the absence of adequate information or data, conservative bounding assumptions or estimates 

were used. The pilot PRA authors clearly stated that the results might not necessarily apply to 

other cask systems or sites, but that the method might serve as a guide for similar PRAs. In 

partial vindication of this aim, this current analysis relied heavily upon the dry cask storage 

process description in the pilot PRA study to provide insights into DCSOs at BWRs. Given the 

intentional boundaries of the pilot PRA, it was recommended that no inferences or conclusions 

about regulatory implications be drawn. In addition to omitting uncertainty analyses, very few 

sensitivity analyses were performed to evaluate input variables; therefore, the degree of 

conservatism in the pilot PRA risk estimates cannot be determined. 

 3 A prompt fatality can be described as any death which occurs as a result of a large acute total body exposure 

sufficient to cause one or more of three major classes of fatal syndromes: cerebrovascular syndrome – death within 

30 to 50 hours from exposure of about 100 Gy (10,000 Rads), gastrointestinal syndrome – death within about 9 days 

from exposures of about 10 Gy (1,000 Rads) and hematopoietic (bone marrow death) – death in several weeks from 

exposures of 2.5 to 8 Gy (250 to 800 Rads). Zero probability of a prompt fatality was assumed at doses below a 

threshold of 150 Rem to the red bone marrow and 500 Rem to the lungs [4]

4 The linear, no-threshold model was used in the pilot study [4].
3-2

Aging effects were not considered in the pilot PRA, aside from cask and fuel corrosion analysis 

of a CASTOR-V/21 dry cask and its fuel contents that had been in storage for 14 years.

5 In 

analyzing this one cask, no evidence was found that the performance of the cask or integrity of 

the fuel would be affected. The risk was dominated by accident sequences involving the six 

stages of the handling phase. The primary concerns identified were dropping the transfer cask 

while it is being lifted out of the cask pit or being moved and lowered to the preparation area, all 

before the MPC lid is welded securely in place. The calculated risk from the beginning of fuel 

loading into one cask until the cask is lowered into position at the preparation area for drying, 

inerting, sealing, etc., is 3.5E-13 latent cancer fatalities.

It should be emphasized that the pilot PRA did not include an HRA. An HRA was not attempted

because it was beyond the scope of the study. Of particular note in the study were the following 

statements regarding the methods for estimating the frequency of dropping the transfer cask:

The frequency of dropping the transfer cask depends on the number of lifts and the 

probability of dropping the transfer cask given a lift. There are two approaches to 

estimating the drop probability. The first approach is to perform a reliability analysis of 

the crane used to lift the transfer cask and an HRA of workers’ actions to rig the cask 

and operate the crane. The second approach is to obtain an empirical estimate 

based on experience with lifting heavy loads. The study used the second approach.

Although the first approach provides more insight and is possibly more accurate, it is 

much more complex than the second approach. It must account for both the reliability 

of the lifting equipment (e.g., crane, yoke) and the reliability of workers to rig the 

transfer cask and operate the crane. A fault tree analysis of the crane equipment 

must be based on detailed design and operational information (e.g., lift heights, lift 

speeds, lift times, movements of the bridge, movements of the trolley). While the fault 

tree analysis can be performed with standard methods, the HRA requires further 

evaluation of human performance issues relevant to dry cask storage operations and, 

possibly, further development of HRA methods. For example, the kinds of actions 

that could result in dropping the transfer cask, such as the potential for human error 

in attaching the lift yoke to the trunnions at the subject plant, are not well understood, 

and not every erroneous action would necessarily cause the transfer cask to fall. [4]

[p. 3-9]

This current preliminary, qualitative HRA takes several positive steps toward further evaluating 

and understanding human performance issues relevant to DCSOs, which may enhance the 

ability to carry out a detailed qualitative HRA for a specific nuclear power plant in the future. 

Within the stated analysis boundaries (especially the best-estimate point values and lack of a 

detailed HRA), NUREG-1864 was instructive in developing and applying a methodology for both 

identifying risks to the public and identifying dominant contributors to risk associated with dry 

cask storage, based upon statistical and deterministic approaches. For example, while the pilot

PRA did not estimate the frequency of misloading fuel into a cask, its deterministic calculations 

investigated the effects of misloading on thermal loads, the failure probability of the MPC, and 

the possibility for a criticality incident. Such calculations provided significant value to the current 

analysis: they provided criteria that may be used to reduce the set of human actions or HFEs to 

 5 This cask was from the first set used to store fuel at the Surry Power Station, a dry, subatmospheric PWR near 

Surry, VA.
3-3

be examined that may challenge the Holtec International HI-STORM 100 cask system. In 

addition to investigating human performance problems that may arise in the use of DCSSs, the 

pilot PRA estimated the potential public consequences that may result from those problems.

The following high-level descriptions of the major operations involving loading spent fuel into 

casks and moving those casks into an ISFSI were used in the pilot PRA report. These 

operations were separated into three phases: handling, transfer, and storage.

Handling

The handling phase includes activities that take place both on the refueling floor and the ground 

floor, including (1) placing the cask into the cask pit; (2) loading the cask with fuel; (3) placing 

the MPC lid in position and securing it with a few bolts; (4) moving the transfer cask out of the 

pool and over to a preparation area; (5) draining, drying, inerting, and sealing the MPC; (6) 

lowering the transfer cask down to the storage cask; (7) lowering the MPC from the transfer 

cask to the storage cask; and (8) moving the MPC in the storage cask out of the secondary 

containment airlock. 

Transfer

The transfer phase includes activities that take place on the ground floor as the storage cask 

containing the MPC is moved past the secondary containment boundary, maneuvered up to a 

cask transporter (in this specific case a tracked vehicle), mounted to the cask transporter, 

moved to the ISFSI storage pad location, and lowered into position onto the storage pad.

Storage

The storage phase consists of routine monitoring and surveillance of the cask on the pad for 20 

years or more. 

The final point estimate conclusions from the pilot PRA are that there is only 3.9x10-13 latent 

cancer fatality probability during the first year of service, and 1.5x10-14 probability per year 

during subsequent years of storage. No prompt fatalities are expected among the public. No 

attempt was made to determine the frequency or manner in which fuel misloading might occur, 

although analyses were carried out to determine the thermal impacts for various gross misload 

scenarios. According to the assumptions specified in the report (i.e., all fuel assemblies are 

misloaded), failing the MPC would require loading of very “fresh” spent fuel (e.g., fuel cooled in 

the SFP for only 0.5 year). Interestingly, with respect to the fuel assemblies themselves, if the 

expected age of spent fuel (5 years cooling in SFP) were loaded, simply blocking the vents on 

the cask is expected to cause 20% of the assemblies to exceed their long-term failure 

temperature level of 742 o Fahrenheit (i.e., they would likely fail due to creep rupture). This 

situation, although not expected to challenge the MPC, may pose serious problems during 

future movement and handling of the casks.

In summary, NRC’s pilot dry cask PRA, briefly described in this section, provided us with 

several important items: (1) a starting point for building SFH process descriptions, (2) familiarity 

with the types of consequences conceivable during SFH activities, and (3) a base of information 

that could be used to drive initial questions presented to SMEs about SFH activities. It was not 

the intent of this preliminary HRA to delve into many details of consequences. Of prime 

importance was to identify the types of negative events that could happen and explore plausible 

ways in which they might occur. The NRC pilot PRA stated that cask drops were the biggest 
3-4

concern and that fuel misloading events were much less of a concern, but neither type of event 

posed a risk comparable to other risks typically encountered during nuclear power plant 

operation. Those conclusions helped us focus initial efforts, although additional evidence 

gathered later has cast doubts on the assertions of minuscule public and environmental risks 

from SFH activities. Given the vast number of human-performed SFH activities, increased 

doubts about the magnitude of risk greatly increase the importance of conducting more detailed 

HRAs.

3.2. EPRI Probabilistic Risk Assessment of Bolted Storage Casks

During the same time that the NRC was initiating its pilot PRA study on the HI-STORM 100 

system at a BWR site, the Electric Power Research Institute (EPRI) analyzed the bolted DCSS 

design at a generic PWR site and further applied generic site conditions based on the northeast 

U.S. [5]. The bolted cask and PWR were intentionally chosen to complement the NRC’s efforts. 

The EPRI study also focused on the radiological risks to the public over the life cycle of a spent 

fuel cask to obtain insights that could be used to optimize risk and resource allocations 

throughout DCSOs. The authors of the EPRI report also emphasized that they did not conduct a 

“best-estimate” or a “bounding analysis,” but something in between due to the nature of the 

conservative assumptions. Sensitivity analyses were performed on PRA assumptions, but the 

EPRI report was careful to note that an uncertainty analysis was not performed in a manner that 

would have necessitated a detailed customization of the PRA to a specific site. Because the 

report authors produced “generic results,” they felt that a rigorous uncertainty analysis would not 

be prudent. 

The types of results contained in the EPRI report included (1) the frequency of events that can 

result in cask confinement failure; and (2) the radiological risks (in terms of cancer fatalities per 

cask per year) to a receptor individual 100 to 300 meters from the cask following a cask-designbasis or beyond-design-basis event. The baseline cask used for the report was the 

Transnuclear, Inc. (TN) bolted cask that can hold 32 or 40 PWR or 68 BWR spent fuel 

assemblies (SFAs). The SFAs in the study were assumed to have achieved a burn-up of 45,000 

megawatt days per metric ton of uranium (MWd/MTU). The EPRI report concluded that the risks 

from dry storage in a bolted cask are orders of magnitude below other risks found in the nuclear 

industry, and it further asserted that the results reveal the ruggedness of the cask to withstand 

design-basis and beyond-design-basis events.

EPRI’s high-level description of the major operations included loading spent fuel onto casks and 

moving those casks into an ISFSI. The report categorized SFH activities into the following three 

major tasks or cask life cycle phases, which happen to be similar to the NRC’s pilot PRA 

operation headings: cask loading, cask transfer, and cask storage and monitoring.

Cask Loading

The cask loading phase involves activities beginning with placement of the first fuel assembly in 

the cask or canister and ending with the cask or cask and canister being properly drained, dried, 

inerted, and sealed. 

Cask Transfer

The cask transfer phase includes activities involving placement of the sealed cask system onto 

a transport vehicle, transport to the ISFSI, and placement in position at the ISFSI.
3-5

Cask Storage and Monitoring

The cask storage and monitoring phase includes activities required during storage at the ISFSI 

up until the fuel is moved off site (e.g., moved to a central spent fuel repository or fuel 

reprocessing facility). 

The EPRI report contained the following observation about the human performance elements of 

learning processes, developing special tools, and codifying knowledge into effective procedures 

to guide DCSOs:

As experience is developed, the procedures and special tools used to coordinate the 

activities of the plant operation, the transfer crew, the radiation protection team, and 

the site security team, are upgraded. After about 10 to 15 cask loadings, the 

procedures can reach a significant level of maturity, and a database of the measures 

from previous loadings, sealing, dry-outs, and testing can be used to verify that each 

new cask has been properly loaded. [5] [p. 2-2]

The EPRI report contained relatively detailed process descriptions for a “generic PWR” plant. 

EPRI also performed an HRA that provided a list of the types of human errors6

5

that might be 

expected during DCSOs involving bolted casks. An initial list of possible human errors was 

provided based upon previous studies; plant observations; review of procedures; and an 

overarching, deductive master logic diagram approach. An HRA screening was then carried out,

followed by the assignment of preliminary bounds on human error probabilities (HEPs) for 

human actions considered to be important contributors to risk. Table 3-1 provides a list of 

human actions grouped and assigned HEPs in the EPRI report [ ] [p. D-28-29].

 6 “Human error,” the term used extensively in the EPRI report [5], has been used by many to describe human 

failures in many contexts. In the PRA community, “human error” has often been used to refer to human-caused 

failures of a system or component. However, in the behavioral sciences, the same term is often used to describe the 

underlying psychological failures that may cause the human action that fails the equipment. Furthermore, “human 

error” often carries with it a negative connotation of incompetence, which is unfortunate as many “human errors” are 

not due to incompetence per se, but people are “set up” for failure through a combination of factors outside of their 

control and/or understanding of the system [2]. Therefore, in this preliminary analysis, the terms “human failure 

event” and associated “unsafe actions” are used instead of “human error.” 
3-6

Table 3-1 Summary of HRA detailed quantification for grouped human actions from the 

EPRI report.

Description Method1 Pcog2 Pexe3 HEP4 EF5

Failure to detect and repair 

observable problem

ASEP N/A 5.0E-03 5.0E-03 5

Non suppressed fire leads to 

longer than 1-hour fire

HCR/ORE/THERP 3.0E-03 1.0E-05 3.0E-03 5

Error in placing heavy load on 

pad

CBDTM/THERP 1.7E-06 1.0E-06 2.6E-06 10

Operator misses structural 

defect in rigging

CBDTM/THERP 8.0E-03 1.3E-03 9.3E-03 5

Undetected manufacturing 

defect in seal, flange, or 

connector

CBDTM/THERP 2.3E-03 1.3E-03 3.6E-03 5

Failure to detect mechanical 

problem during inspection

CBDTM/THERP 2.2E-02 1.0E-03 2.3E-02 5

Use of procedure to find crane 

problem D58.0.10 Rev. 1

CBDTM/THERP 2.2E-02 8.0E-03 2.9E-02 5

Spent fuel loading errors 

produce high heat load

CBDTM/THERP 1.4E-08 1.0E-08 2.4E-08 10

Safety culture THERP 0.0E+00 1.0E-01 1.0E-01 1

Error in providing neutron 

poison

CBDTM/THERP 1.2E-04 1.0E-04 2.2E-04 10

Operator failure to evacuate 

and pressurize with inert gas

CBDTM/THERP 3.6E-03 4.3E-04 4.0E-03 5

Error in reading the vacuum 

level

CBDTM/THERP 1.3E-03 4.3E-04 1.7E-03 5

Notes:

1

Methods included within this table are: ASEP (Accident Sequence Evaluation Program), 

HCR/ORE (Human Cognitive Reliability/Operator Reliability Experiments), THERP (Technique 

for Human Error Rate Prediction), and CBDTM (Cognitive-Based Decision Tree Method).

2

Pcog is the failure probability in correctly diagnosing the correct response 

3

Pexe is the failure probability in correctly executing the correct response

4

HEP = human error probability

5

EF = error factor
3-7

Table 3-1 (continued) Summary of HRA detailed quantification for grouped human 

actions from the EPRI report.

Description Method Pcog Pexe HEP EF

Operators damage or overpressure the inside of sealCBDTM/THERP 5.5E-03 4.3E-04 5.9E-03 5

Operators damage or overpressure the outside of the sealCBDTM/THERP 6.1E-03 4.3E-04 6.5E-03 5

Operators fail to detect high 

neutron radiation at surface of cask

CBDTM/THERP 1.5E-04 1.6E-04 3.1E-04 10

Failure to detect high radiation 

signals during testing

CBDTM/THERP 6.0E-04 4.3E-04 1.0E-03 5

Testing fails to detect high 

temperature during testing

CBDTM/THERP 2.0E-03 4.3E-04 2.5E-03 5

Operator fails to use emergency 

stop

HCR/ORE/THER

P

2.9E-04 1.0E-04 3.9E-04 10

Error in identifying burn-up amount 

required SFP storage time or 

location

Reference 

WSRC-TR-93-

581

5.0E-04 N/A 5.0E-04 5

Error in placing heavy load on pad CBDTM/THERP 1.7E-06 1.0E-06 2.6E-06 10

Fuel element jammed in cask 

damaging the SF cladding

Reference 

WSRC-TR-93-

581

N/A N/A 1.6E-04 5

SF pool crane operator selects 

wrong row of 13 or more SF 

elements

Binomial Model N/A N/A 2.4E-08 30

Undetected pin hole leaks in fuel 

pins

Estimated N/A N/A 1.0E-01 2

Failure in bolt torque leads to 

leakage through seal

Binomial Model N/A N/A 5.9E-08 30

Significant undetected cladding 

damage

Estimated N/A N/A 3.0E-02 2

Application of special heavy lifting 

procedures

Reference 

WSRC-TR-93-

581

N/A N/A 3.0E-04 5

Operator error in operating crane 

from statistical evaluation generic

Reference 

WSRC-TR-93-

581

N/A N/A 3.0E-05 5

In conducting their HRA, the authors of the EPRI report correctly pointed out an incorrect 

assumption that some analysts make in applying fault tree analysis to human errors (HEs). Fault 

trees treat basic events as statistically independent, which is not valid for HEs. Human actions 

contain dependencies when they involve the same operator, the same procedures, or compete

for the same resources at the same time. Therefore, analysts must evaluate possible 

combinations of HEs, prior to the quantification effort, to determine if such combinations may be 

assumed to be independent, and redefine the HEs and/or revise the logic model to correctly 

represent the dependencies. Dividing human actions into three time categories relative to the 

initiating event (i.e., pre-initiating, initiating, and post-initiating) helps identify actions that may be 

credibly assumed to be independent.
3-8

HRA quantification methods for arriving at human error probabilities (HEPs) were selected

based upon expert analysis judgment and the following methods: Technique for Human Error 

Rate Prediction (THERP), Accident Sequence Evaluation Program (ASEP) Human Reliability 

Analysis Procedure, Cause Based Decision Tree Method (CBDTM), and Human Cognitive 

Reliability/Operator Reliability Experiment (HCR/ORE). In addition, the Savannah River Site 

Human Error Database Development for Non Reactor Nuclear Facilities WSRC-TR-93-581 [9]

was cited for statistical information on fuel assembly handling and crane events. Note that the 

statistical data from NUREG-0612 [10], NUREG-1774 [11] and a Reliability /Safety Assessment 

for the Oyster Creek Reactor Building Crane [12] also were used to generate EPRI’s crane 

reliability model, but only the WSRC-TR-93-581 [9] was cited in the HEP estimates for fuel 

assembly handling and crane events.

The EPRI study then assessed dependency for groups of human actions according to a fivelevel scale, taken from THERP [13], ranging from complete dependence to zero dependence 

with high, moderate, and low dependence levels between those boundaries. Table 3-2 presents 

the dependence matrix used by the authors in assigning levels of dependence [5] [p. D-30].

Table 3-2 Multiple human action dependence matrix from EPRI report.

Single operator performs the 

actions

Multiple operators perform the 

actions

Time available to 

perform actions

Actions are 

functionally 

related

Actions are not 

functionally 

related

Actions are 

functionally 

related

Actions are not 

functionally 

related

> 30 minutes CD HD MD LD

> 60 minutes HD MD LD LD

> 2 hours HD MD LD LD

> 4 hours HD MD LD ZD

> 8 hours MD LD ZD ZD

> 12 hours LD ZD ZD ZD

> 24 hours ZD ZD ZD ZD

CD = Complete Dependence; HD = High Dependence; MD = Moderate Dependence; LD = Low Dependence;

ZD = Zero Dependence.

In addition to estimating HEPs, the EPRI report presented culture and management attention 

issues that may affect human performance during DCSOs. They grouped general observations 

in organizational categories, including commitment, awareness, preparedness, flexibility,

fairness, learning, and adherence. A list of the observations7 within those categories [5] [p. C-8 

& D-32,33] follows:

 7 The EPRI report [5] mentioned that site visits were performed at several specific plants. These observations 

appear to summarize general impressions of organizational culture/management across the sites visited.
3-9

Commitment

• Allocation of significant resources for spent fuel cask loading (crew size with diverse 

skills, specialized tools, and a low-pressure environment).

• Attention to safety and related issues such as human performance by holding a 

campaign briefing and stressing concern about complacency after successful cask 

loadings.

• High team coordination and cooperation.

Awareness

• Constant procedure updating to improve on coordination and timing of each step in the 

process (e.g., laser beam location, water lancing to speed up vacuum drying, and 

development of a pre-built scaffolding system).

Preparedness

• Procedures are based on Nuclear Energy Institute (NEI) guidelines [such that] the 

specific cask design, experience of others, dry runs and actual runs have identified and 

dealt with numerous potential threats to performance during spent fuel loading and 

transport by including contingency plans in the procedures.

• The team also maintained all fixtures, couplings, and rigging for a cask loading 

campaign in a portable shed that can be moved off the refueling floor to the other unit.

• The engineering interface provided alternate fuel elements in case of a problem with the 

original set.

• Each equipment element of the process was laid out carefully with an alignment set for 

easy pick-up and movement.

Flexibility

• The team demonstrated the ability to respond to three unplanned cases (repair to the 

transporter prior to the fifteenth cask loading, a potential breach of the secondary 

containment via a heating ventilation and air conditioning [HVAC] leak identified by the 

operational staff causing a delay of several hours, and small drops of oil below the crane 

were investigated and found to be due to some frothing in the open oil bath system). The 

team was able to restore the schedule after each case.

Fairness

• All team members were encouraged to identify problems and discuss them at daily 

briefings. Any operational errors were quickly corrected and cleaned up by the team and 

became opportunities for improvement.

• The temperature and time on the job was monitored to avoid heat stress for each 

individual. 
3-10

Learning

• The team was clearly looking for ways to improve their performance on this spent fuel 

cask design and continually updated the procedures.

• In practice, they completed the entire cycle during a 5-day period using a single shift 

(including cask inspection, loading, dry-out, and transport to the pad). The time spent 

was far lower than the cask manufacturer expected for this spent fuel loading and 

transport operation. 

• The crew learned the importance of decontamination while the cask was wet, which 

saved hours of decontamination time in the preparation area.

Adherence

• The organization was very cautious about exceeding any limitation even though there 

was a very large margin for each safety concern.

In addition to the HRA, the EPRI report included an insightful analysis of the thermal effects of 

various fuel misloading scenarios. The benefit of such a detailed analysis inspires additional 

reflection, in this report, on the ways in which misloads of various magnitudes might occur. For 

example, the only misloading scenario with near-term negative consequences for the public 

appears to be a very low-likelihood gross misloading of a very large number (or even an entire 

load) of very hot fuel assemblies (i.e., failure of the cask system boundary occurs); however, 

there may be other scenarios involving less severe misload events that could lead to a large 

release of fission products from the fuel pins to the general internal environment of the cask. 

These scenarios, while not causing immediate consequences to the public, become a 

dangerous latent condition for future occupational exposures and/or public exposures when 

either intentional or unintentional acts lead to an open or lightly shielded path from the inside of 

the cask to the surrounding environment. 

Table 3-3 shows the EPRI thermal hydraulic analyses of the decay heat load produced by a 

single 289 fuel pin (i.e., 17 x 17) fuel assembly over 27 years of storage [5] [p. C-22]. Note that 

the TN32 cask decay heat in the second row equals the single fuel assembly decay heat 

multiplied by the 32 fuel assemblies in the cask. Table 3-4 provides estimates of how various 

numbers of misloaded 1-year cooled assemblies may damage different components of the cask 

storage system [5] [p. C-22]. The last column of Table 3-4 also shows the expected 

consequences on cask components of having entire fuel loads comprised of 6-, 3-, and 2-yearold SNF. Inspection of Table 3-4 reveals that it would take a misload of 13 one-year-old or an 

entire load of two-year-old SNF assemblies to compromise the fuel cladding and the cask. 

These two events occurring due to human error are rightly inferred to be extremely unlikely.

However, as one starts to consider additional factors (e.g., fuel enriched above 3.5% U-235, 

higher burn-up fuel, cladding damage during handling, cladding corrosion during storage), 

scenarios involving fewer numbers of misloaded assemblies take on increased potential 

importance. Upon review of the EPRI analysis, this type of reasoning motivated us to include 

several permutations of fuel misload events in this report. 
3-11

Table 3-3 Thermal loads versus fuel storage time from the EPRI report. 

Westinghouse 17x17 spent fuel (3.5 w/o U-235 with 45,000 MWD/Mt decay heat)

Years cooled

1 2 3 4 5 7 10 17 27

Fuel assembly 

decay heat (kW)

5.49 3.07 2.05 1.65 1.25 0.986 0.809 0.66 0.53

TN32 cask decay 

heat (kW)

175.7 98.24 65.6 52.8 40 31.6 25.9 21.12 16.96

Table 3-4 Cask component thermal limit versus fuel storage time from the EPRI report.

Cask component Thermal 

limits

Number of 1 year stored assemblies Limit exceeded 

1 2 3 5 13 with full load of

Neutron shield (kW) 37.06 36.10 40.61 45.11 6-year SNF

Boral limit (long 

term) (kW)

58.2 54.12 3-year SNF

O-ring seal and fuel 

clad (kW)

89 90.15 2-year SNF

The top six sequences from the EPRI report, composing 89.4% of the estimated radiological 

risk, included:

(1) Transfer phase–high temperature fire (57.5%)

(2) Storage phase–heavy loads exceed structural limits (15.3%)

(3) Storage phase–high temperature and forces (14.8%)

(4) Transfer phase–on edge drop (1.0%)

(5) Loading phase–seismically induced refueling building failure (0.7%)

(6) Storage phase–cask impacted by a missile (0.1%)

The total radiological risk of DCSOs throughout their life cycle was calculated to be 5.6E-13 per 

cask per year for the first year and 1.7E-13 for each year thereafter. The transfer phase 

revealed the highest level of risk with a cancer risk of 3.38E-13 per cask. The majority of this 

risk is due to a single accident sequence in which a high-temperature fire occurs during cask 

transfer. This risk is calculated for a receptor individual at a point 300 meters downwind from the 

location of the cask accident. This transfer phase represented 59% of the total first-year risk.

The loading phase contains the lowest level of risk due to mitigating effects of the building 

ventilation system as well as the short duration of the event. The total cancer risk of the loading 

phase is 6.3E-14 per cask, which encompasses 11% of the total first-year risk. 

The radiological risk of the storage phase of the cask life cycle is 1.7E-13 per cask per year. 

This represents 30% of the total first-year risk. Therefore, the first-year cancer risk per cask is 

estimated to be 5.6E-13, and the cancer risk in subsequent years is estimated to be 1.7E-13. 

EPRI emphasized strongly that the level of fidelity of these calculations are to be understood as 

estimates that lie somewhere between a bounding estimate and a best estimate. 
3-12

The overall results of the EPRI report were similar to the NRC’s pilot PRA in that risks to the 

public did not include early fatalities, and the risk of latent cancer fatalities was very small. 

However, there were notable differences with respect to the phases of operation deemed to 

contain the largest radiological risks. 

Table 3-5 summarizes radiological risks for both the NRC and EPRI analyses in units of 

magnitude of risk per cask per year. (NRC and EPRI terminology for the three main phases of 

operations are provided in the first row.) 

Table 3-5 Summary of radiological risks comparing EPRI and NRC results.*

Phase

First-year risk+

(cancer risk per cask per year) 

Subsequent years risk+

(cancer risk per cask per year)

NRC; HISTORM-100; 

BWR

EPRI; TN32; 

PWR

NRC; HI-STORM100; BWREPRI; TN32; PWR

Cask Loading

(NRC: 

Handling)

(EPRI: 

Loading)

1.8E-12 6.3E-14 N/A N/A

Cask Transfer

(NRC: 

Transfer)

(EPRI: 

Transfer)

0.0 3.3E-13 N/A N/A

Cask Storage

(NRC: Storage)

(EPRI: Storage 

& Monitoring)

3.2E-14 1.7E-13 3.2E-14 1.7E-13

Total 1.8E-12 5.6E-13 3.2E-14 1.7E-13

*NRC and EPRI terms for the three main phases of operations are provided in the first column.

+ Estimated as risk to the public in terms of annual probability of a latent cancer fatality.

Figure 3-1 summarizes the percentage of overall risks by phases of operation during the first 

year and over a 20-year life cycle for both the NRC and EPRI analyses. Note the significant 

differences between the analyses driven primarily between plant types (i.e., Mark I BWR versus 

PWR) and cask systems (i.e., H-STORM 100 versus TN32), and driven secondarily by analysis 

approach (i.e., treatment of uncertainty, degree of best-estimate focus, inclusion of HRA, spent 

fuel load assumptions, etc.)
3-13

Figure 3-1 Percentage of risk per phase of operation for first-year and 20-year dry 

cask storage life cycle for NRC and EPRI analyses.

Thus, the differences between the results appear to be driven by the types of plants and cask 

systems chosen for study, as well as the analysis approach. Primary drivers for NRC’s results 

included the choice of a Mark I BWR, the HI-STORM 100 cask system, a point estimate 

approach without uncertainty analysis, and the lack of an HRA. Primary drivers for EPRI’s 

results included the choice of a PWR, the TN32 cask system, an approach aiming between 

best-estimate and bounding cases with some treatment of uncertainty, and the inclusion of an 

HRA. Given the different emphasis and approach of the NRC study versus the EPRI study, it is 

difficult to rank (in ordinal fashion) the many drivers that resulted in divergent analyses. 

We suspect that plant type, cask system type, and initiating event category selections will 

dominate most of the differences in potential consequences between plants engaging in 

DCSOs, although detailed plant-specific HRAs will be required, both to determine the full set of 

potential consequences and to generate defensible likelihood estimates for all identified 

potential consequences. That is, given the many human actions required throughout the life 

cycle of DCSOs, further comprehensive qualitative and quantitative HRAs are needed to 

determine (1) whether or not the risk levels indicated by the NRC and EPRI analyses actually 

are five orders of magnitude or more below other risks faced by licensees; and (2) whether or 

not any dominant human factors/human reliability concerns are present within DCSOs that 

ought to be identified and addressed to ensure that risk levels truly achieve or maintain order-ofmagnitude reductions with respect to other licensee risks. The EPRI analysis is a strong step 

toward using HRA in DCSOs. Of course, more advances are required in HRA of DCSOs, 

especially in light of serious recent concerns about the inspection, test, maintenance, uprating,

and operation of large cranes. These human-performance-related concerns not only impact the 

ability of engineered hardware to provide defense-in-depth (DID) measures against various 

hardware failures during cask movement, but they also degrade DID measures protecting 
3-14

against failure due to unsafe actions by operators (e.g., raising a cask too high such that twoblocking occurs).

This section has summarized the approaches and results of both the NRC [4] and EPRI [5] dry 

cask PRA studies, including the limitations of the HRAs in each analysis. The NRC analysts did 

not include an HRA, and instead used previous statistical data from various heavy load lift 

situations to estimate the likelihood of a load drop. The NRC analysis also did not include any 

likelihood estimates for misloading fuel into a cask, although deterministic analyses were 

presented to provide some indication of what type of misload would threaten the integrity of the 

cask system. The EPRI analysis did include an HRA; however, it did not explain in detail the 

contexts surrounding human errors. That is, a fuel misload or cask drop may occur with a given 

likelihood and consequence due to a person or crew not performing an activity properly, but 

insufficient information is given to describe how that error, or group of errors, occurred. In simple 

terms, both studies described “what” HFEs can happen (the EPRI study identifies many more 

than the NRC study), yet neither study explained “how” or “why” those events might happen.

The NRC study stated that the likelihood of a heavy load drop from a crane is simply equal to 

the retrospective number of heavy load drop-related events8 divided by the number of heavy lifts 

54,0009

13

(i.e., 5.6 x 10-5

). The NRC study made no attempt to infer how many of these drops 

would be due to a human error or HFE. In contrast, the EPRI study provided many more specific 

human errors that may contribute to a cask drop such as “general operator actions in operation”

and “failure to activate emergency stop button.” Human errors identified in the EPRI report were

then assigned a human error probability (HEP), which may be modified by a performance 

shaping factor (PSF) derived from a tabulated value in a first-generation HRA method such as 

THERP [ ] or obtained from expert judgment. The EPRI analysis then gave levels of 

dependence (complete, high, medium, low, or zero) among some human errors. While the EPRI 

approach is certainly more helpful in analyzing human performance issues than a single 

statistical estimate for all cask drops, it did not document “how” these errors might occur. (Note 

that both the NRC and EPRI studies intended to emphasize quantification; therefore, it is not

unusual that they did not describe in detail “how” such errors might occur.)

It is possible that the SMEs and HRA experts conducting the EPRI analysis did consider details 

of how specific human errors may occur (including error-forcing contexts), and it is clear from 

Appendix D of the EPRI report that the analysts were cognizant of many factors that can impact 

human performance. However, the EPRI report did not enable the reader to understand how 

specific human errors might occur, nor did it give insight into how to mitigate the occurrence or 

impact of such errors.

This current report begins filling in the gaps of “how” such errors or HFEs may occur by 

describing specific, detailed scenarios in which human actions result in consequential failures. 

For example, the scenarios in this report identify and describe the intentions, actions, 

interactions, unsafe actions, and error mechanisms that may lead to a particular type of HFE. 

The scenarios in Section 8 enable greater understanding of how such human failures may occur 

and allow inference of techniques for identifying and mitigating specific human performance 

issues.

 8 These are events reported in NUREG-1774 [11] that were very technically load drops or very close to a drop, 

but none were of the type in which a ≥ 266,893 Newton (30 ton) load fell freely through a large distance to the 

floor/ground.

9 Statistics estimated from NUREG-1774 [11].
3-15

In summary, the NRC pilot PRA did not include an HRA for SFH and DCSOs in its analysis of 

activities at a Mark I BWR. Second, the EPRI did provide a PRA including an HRA with a 

quantitative estimate of risk (i.e., somewhere between a best estimate and a bounding estimate) 

at a PWR, but it did not provide extensive details regarding “how” human errors might occur. 

Finally, this current report provides preliminary scenarios (biased toward the Mark I BWR SFH 

and DCSOs) that do provide enough information to begin allowing inference of techniques to 

identify and mitigate human performance issues. 

4-1

4. RECENT CONCERNS IN SPENT FUEL HANDLING

This section contains a brief chronological list of problems directly related to DCSOs that had 

occurred through 2005. Although presenting a picture in time of issues arising from transporting 

heavy loads, these issues are still relevant today. The first section provides three key insights 

from NUREG-1774 A Survey of Crane Operating Experience at U.S. Nuclear Power Plants from 

1968 through 2002 [11]. The chronological list emphasizes heavy load cranes because the 

majority of serious concerns deal with structures supporting crane systems, crane components, 

crane operations, and analyses used to determine crane capacities. The most serious concerns 

surround the uprating of crane capacities with simultaneous discoveries of age-related failure 

modes and deficiencies in inspection procedures that do not capture signs of age-related failure 

processes. 

4.1. Concerns Identified in NUREG-1774

NUREG-1774 A Survey of Crane Operating Experience at U.S. Nuclear Power Plants from 

1968 through 2002 was written to respond to candidate generic issue 186, “Potential Risk and 

Consequences of Heavy Load Drops in Nuclear Power Plants,” to determine the likelihood and 

significance of heavy load drops. It used a review of crane operating experience from the 

following sources: actual crane operating experience at U.S. nuclear power plants, licensee 

event reports, NRC inspection reports, licensee correspondence, and crane vendor reports. 

Included with the report were crane operating experience reports issued by the New Mexico 

Environmental Evaluation Group, the Department of Energy, the Department of the Navy, and 

the California Division of Occupational Safety and Health [11]. Listed below are three key 

insights from NUREG-1774:

(1) It was estimated that the average rate of drops for very heavy loads (i.e., based on 

retrospective analysis of load drop statistics) was 5.6E-5/demand. This estimate could 

be higher or lower at a particular plant due to varying human error rates which appeared 

to dominate load drop events. Of particular concern, only 8 of 74 plants indicated that a 

consequence analysis for heavy load drops had been performed at their plants. During 

1993-2002, the number of operating plants increased only 9% over the period from 

1983-1992, yet the number of crane-related injuries during the 1993-2002 period was 

100% higher than those in 1983-1992. 

(2) Considerable confusion/inconsistency regarding requirements has resulted in variability 

in what constitutes a single-failure-proof crane. While the features of dual reeving, 

redundant limit switches, and redundant brakes have been universally recognized, 

alleged ambiguity in NUREG-0554 [14] has led to inconsistent interpretations of 

remaining criteria. Therefore, not all declared “single-failure-proof” cranes are equal. 

(3) The three very heavy load drops recorded in NUREG-1774 were all due to rigging 

failures, not crane failures. Thus, none of these drops could have been prevented by 

using a truly single-failure-proof crane, although use of single-failure-proof cranes and 

lifting devices could have prevented the other load or hook and block assembly drops 

that have occurred.
4-2

4.2. Concerns Identified in Various Sources

This section contains a timeline of events, analyses, and SME observations that track growing 

concerns surrounding the use of cranes to lift heavy casks filled with spent fuel. Major issues 

noted in the items below include improper engineering analyses, manufacturing defects, 

improper repair practices, and problems with crane inspection and test processes. These items 

do not solely attribute problems with cranes to a lack of due diligence on the part of licensees; 

ambiguity involving requirements and regulatory guidance are also identified as needing 

improvement. 

• March 1997 – Whiting Corporation sent out a report announcing to licensees of an overstressed auxiliary hoist condition on a common type of heavy lift crane known to be in

use by 11 utility companies. Whiting recommended that the cranes only be used at or 

below 40% of the rated capacity; special review and authorization could be made for use 

with loads as high as 60% of rated capacity (10 CFR, Part 21 Notification; accession #: 

9703130317) [15].

• Generic Issue 186: Potential risk and consequence of heavy load drops in nuclear power 

plants. The Office of Nuclear Reactor Regulation (NRR) identified this issue in 1999 as it 

was recognized that licensees may not have taken adequate measures to assess and 

mitigate the consequences of dropped heavy loads. Specifically, the concern was that 

licensees were not adequately ensuring that spent fuel, fuel in the core, and equipment

needed to achieve safe shutdown or permit continued decay heat removal were 

protected from the possibility of heavy load drops. BWRs (particularly Mark I 

configurations) were singled out as being especially vulnerable, given the basic plant 

layout.

• January 2003 – Whiting Corporation sent out a notice that a hoist unit sold to utility 

companies prior to 1980 might contain two internal support bolts that are significantly 

over-stressed. The problem was identified through engineering analyses; no failures had

been reported yet. Whiting advised that cranes be used at a 50% reduction in rated hoist 

capacity to avoid compromising design safety factors (10 CFR, Part 21 Notification; 

event #: 39545) [16].

• September 2003 – During the 505th meeting of the Advisory Committee on Reactor 

Safeguards, the following conclusions were reached regarding Generic Issues 186 [17]:

— Heavy load drops in Nuclear Power Plants do not pose a high nuclear plant safety 

risk,

10

— We concur with the following staff recommendations:

but they do raise significant concerns regarding worker safety.

 Evaluate the capability of rigging components and materials to withstand 

rigging errors.

 Endorse American Society of Mechanical Engineers (ASME) NOG-1, Rules 

for Construction of Overhead and Gantry Cranes, for Type 1 cranes. “This 

will clarify the requirements for the construction or upgrade of cranes to the 

 10 We generally agree with this statement, although considerable uncertainty remains as to the actual risk, especially 

in light of the combination of recently discovered crane component aging-related failures, human factors concerns 

regarding inadequacies in inspection activities, deficits in procedure development/adherence, and rigging failures.
4-3

single-failure-proof crane category, which is referred to in NUREG-0612.”

[10]

 Reemphasize the need to follow and enforce NUREG-0612, Control of 

Heavy Loads at Nuclear Power Plants Phase 1 guidelines and continue to 

assess implementation of heavy load controls in safety-significant 

applications through the Reactor Oversight Process.

 Evaluate the need to establish standardized calculation methodologies for 

heavy load drops. “Accurate load drop analysis is essential to determine 

transport height and load path restrictions. Therefore, the staff recommends 

evaluating the need to establish standardized load drop calculation 

methodologies.”

— In response to the NUREG-1774 analysis: “licensees could have reduced the 

frequency of crane operating events attributable to human error if they had focused 

appropriate attention on the crane operating practices described in NUREG-0612.”

• June 2004 – In Region II, Tennessee Valley Authority (TVA) halted cask loading 

operations at the Sequoyah PWR nuclear power plant after craftsmen discovered cracks 

in crane bridge girder end truck and support. The inspection report stated that “initial 

cask loading was completed successfully following an interruption due to problems 

associated with the Auxiliary Building crane” [18]. The report also mentioned non-cited 

violations including material storage deficiencies and inadequate corrective actions 

related to the auxiliary building crane used for cask lifting. Inspectors also identified one 

unresolved item for crane design. During the first spent fuel cask loading operation at 

Sequoyah on June 10, 2004, the auxiliary building crane encountered two trips or stops 

when it was carrying the fully loaded cask. A broken rail anchor bolt was discovered, as 

were cracks in welds between the bottom flanges of the crane truck adjacent to the 

seismic restraint. Additionally, base metal cracks were discovered, about 30.5 

centimeters (12 inches) long, on the web near the concrete wall in a truck corner. 

Further inspections were immediately performed, and all outside web plates of the four 

trucks near the concrete walls were found to have similar weld and base metal cracks. 

More than 20 cracks were identified, using both visual and magnetic particle 

examinations. The cracks appeared to have been present for a long time (no definitive 

determination was made regarding how long). 

Periodic inspections for the girder structure in the cracked areas were not performed as 

required by ASME (or American National Standards Institute [ANSI]) B30.2, Overhead 

and Gantry Crane, Step 2-2.1.3.(c).(1), which states in part that deformed, cracked, or 

corroded members shall be inspected during the periodic inspection. Inspections did not 

reveal these cracks in the past as they were deemed inaccessible by the licensee. The 

licensee had deemed the areas inaccessible, but NRC determined that the areas were 

difficult to access, but not inaccessible. “These are considered missed opportunities to 

identify and correct the cracks on the crane trucks prior to the crane use during 

movement of the spent fuel” [18] [p. 7].

The NRC inspectors reviewed records of previous visual inspections by the licensee,

including a work order in which specified welds on the auxiliary building 1,112,055 

Newton (125-ton) crane were made to verify single-failure-proof conformance with

NUREG-0554. 
4-4

The licensee performed the visual inspections on critical welds during the crane 

upgrade to single failure proof status, whose failure could result in the drop of a 

critical load. The welds inspected were identified as critical welds by the crane 

vendor and included horizontal welds between girder top and bottom plates and 

web plates, and trolley load girder. The welds in the crane trucks were not 

identified as critical welds by the crane vendor and were therefore not inspected. 

The inspectors determined that all the welds in the load path, including the welds 

in the crane trucks, that are used to carry, transfer, or retain the critical loads and 

prevent the load drop should have been identified as critical welds and 

consequently inspected. ...This is considered another missed opportunity to 

identify and correct the cracks on the crane. [18] [p. 7]

An unresolved item discovered during the inspection involved three apparent problems 

in the auxiliary building crane seismic qualification calculation. These apparent problems 

included: lack of justification for nearly doubling allowable structural component stresses, 

the assumption to use two rails to resist the bridge wheel lateral forces, and the 

assumption to release wheel loads from the bridge rail longitudinal direction. These three 

apparent problems (still undergoing review) raise questions about the accuracy of 

allowable stresses and the appropriateness of the assumptions used to uprate the 

auxiliary building crane and asserting single-failure-proof compliance to NUREG-0554. 

• January 2005 – During a re-rate analysis and study, Whiting Corporation identified an 

overstress condition on some hoist equalizer plates and welds. This condition was 

limited to the hoists of some redundant crane trolleys (i.e., single-failure-proof trolleys). 

The recommendation was to visually inspect for cracks in the plates or welds in the 

assembly, adjacent to the rope termination, at each end of the equalizer arm, which the 

nut on the rope fitting bears against. Suspicious visual indications of potential cracks 

may be further examined using magnetic particle testing. A lack of any visible cracks 

during visual examination will allow the unit to be placed in operation at the 50% reduced 

capacity (10 CFR, Part 21 Notification; event #: 41318).
5-1

5. GENERAL DESCRIPTION OF FUEL HANDLING AND CASK OPERATIONS

The following general description of fuel handling and cask operations is not specific to any one 

particular plant. It represents a preliminary perspective on such operations. The level of detail 

will be sufficient to build preliminary base case scenarios from which to derive contexts for 

preliminary, potential unsafe actions and human failure. Two slightly different high-level 

descriptions of the major operations involved in loading spent fuel into casks and moving those 

casks into an ISFSI were provided in the NRC’s pilot PRA of a DCSS [4] and EPRI’s PRA of

bolted storage casks [5] as discussed in Section 3.

This report modifies the previous high-level categories of the major operations in order to better 

categorize major phases in which human performance problems may arise and to slightly 

increase the detail of high-level comparisons of potential consequences11 and risks associated 

with different cask systems. The new DCSO categorization scheme is divided into seven 

phases. Three phases expand on operations that were condensed into two phases in both the 

NRC and EPRI categorization schemes. Two phases are identical to phases used in either or 

both of the NRC and EPRI reports. Two phases involving planning and preparation are 

completely new (i.e., they were not addressed in the major operation categories in the NRC or 

EPRI reports). These categories serve to group major SFH and DCSOs in the detailed list of 

operations in Appendix B. 

This more comprehensive categorization of operations (i.e., the seven phases) can be used to 

guide the analysis of human performance in any future site-specific DCSO PRA. The seven 

phases suggested in this report offer at least two major benefits. First, the planning and 

preparation phases encourage more comprehensive analysis of operations that can “set up”

personnel for an accident in later phases. Second, adding more phases for “direct”

12 cask 

activities may better reflect actual “hand-offs” that occur between teams of personnel.

(1) Fuel Load Planning (new phase not used in the NRC or EPRI reports)

Fuel load planning involves activities by the appropriate engineering department (e.g., nuclear 

fuels engineering) to generate a fuel move plan incorporating proper review and approval and 

subsequent transmission of the plan to the fuel handlers who will carry out the operation. This 

activity depends upon proper configuration management practices such that an accurate record 

of the history and specific location of every fuel assembly in the SFP exists. The fuel movement 

plan should include the origin information—serial numbers and alphanumeric locations of 

assemblies within the SFP, and the destination information—cask canister locations and serial 

numbers of assemblies. In addition, the fuel load plan should include the process to be followed 

by fuel-handling personnel (FHP) during actual loading operations (e.g., three-part 

communications, independent review of loaded canister before closure).

(2) Cask Operations Personnel and Equipment Preparation (new phase not used in the 

NRC or EPRI reports)

 11 Consequences are of particular interest at this stage of the preliminary effort, although likelihood determination 

and risks (i.e., the product of consequences and likelihoods) were estimated to some degree in the NRC [4] and EPRI 

[5] analyses, the focus here is how a set of undesirable human actions might occur.

12 In this instance “direct” refers to hands-on activities that involve moving fuel, sealing casks, moving casks, etc. 

in contrast to “indirect” activities involving planning, preparation, administration, etc. This “direct” labor versus 

“indirect” labor is common terminology in product manufacturing settings.
5-2

This phase involves training and appropriate staffing of personnel for DCSOs, as well as 

inspection, test, maintenance, recertification, upgrading, etc., of all structures, systems, and 

components required for executing DCSOs. An example includes assigning trained personnel or 

enabling proper training of personnel who then conduct detailed structural inspections of 

auxiliary or refueling building crane supports and interfacing building structures to ensure that 

no cracks, deformations, or other aberrations threaten crane operations. This activity would be 

immediately accompanied by thorough inspection, test, and maintenance of crane systems and 

components before any critical heavy lifts are attempted (e.g., lifting a fuel- loaded and waterfilled cask from the SFP).

(3) Cask Preparation and Positioning (partially new; borrows from NRC “handling” phase)

This phase represents the beginning of actual DCSOs as the cask is brought into the plant for 

loading preparation activities, which culminate with placement of the empty cask/canister 

system into the cask loading pit of the SFP in advance of fuel loading.

(4) Cask Loading (not new; borrows from NRC ”handling” phase and is identical to EPRI “cask 

loading” phase; used for consequence grouping)

This phase begins with placement of the first fuel assembly in the cask or canister and ends 

with the cask or cask and canister being properly drained, dried, inerted, and sealed. 

(5) Loaded Cask Transfer Within Structure (partially new; borrows from NRC ”handling” and 

“transfer” phases as well as from EPRI “cask transfer” phase; used for consequence grouping)

This phase begins with preparations to transfer the loaded, sealed cask from the reactor, 

auxiliary, or fuel building and ends with the cask coupled to the cask transporter. 

(6) Loaded Cask Transfer Outside Structure (partially new; borrows from NRC ”transfer”

phase and EPRI “cask transfer” phase; used for consequence grouping)

This phase begins with a loaded cask coupled to the cask transporter and ready for movement 

to the ISFSI and ends with cask emplacement at the ISFSI.

(7) Loaded Cask Storage and Monitoring (not new; identical to the NRC “storage” phase and 

the EPRI “cask storage and monitoring” phase; used for consequence grouping)

This phase begins with cask emplacement at the ISFSI and ends when the cask contents (i.e., 

the spent fuel) are transferred to an off-site storage and/or processing location.
6-1

6. HUMAN PERFORMANCE ANALYSIS APPROACH

The human performance analysis approach used in this current report is a qualitative,

preliminary analysis. It was conducted using elements of NUREG-1792, Good Practices for 

Implementing Human Reliability Analyses (HRA) [1], and NUREG-1624, Rev. 1, Technical Basis 

and Implementation Guidelines for A Technique for Human Event Analysis (ATHEANA) [2].

However, given the preliminary nature of this analysis, process descriptions, human failure 

events (HFEs),

13 unsafe actions (UAs),14 and error-forcing context (EFC) 15 descriptions are 

treated somewhat generically. In fact, while specific HFEs and UAs were generated, EFCs were 

not explicitly identified (using that terminology) during this preliminary, qualitative HRA so as not 

to impose an excessive, method-specific structure on the scenarios (i.e., to avoid undue bias 

toward a particular HRA method; however, details beneficial for an ATHEANA application were 

generated). The resulting scenarios and human performance considerations, while intentionally 

unconstrained to a specific HRA technique, should serve as a good starting point for a more 

focused or plant-specific, state-of-the-art HRA that includes information gathering and HRA 

quantification activities. 

This human performance analysis presents a number of scenarios in which similar groups of 

HFEs may occur. For each HFE scenario grouping there is a definition and interpretation of the 

issue analyzed, including a summary statement of the issue, the reason for the analysis, and 

the potential consequences should the issue materialize. Following the definition is a general 

reminder of the scope of the analysis (i.e., qualitative, preliminary, and somewhat generic) and 

the initial conditions for the base case scenario to be explored. Appendix B contains further 

details about the base case scenarios, and specific sections are referenced as appropriate in 

the statement of initial conditions subsection. Many readers of this report will be familiar with the 

details of DCSOs. For those not familiar, it may be helpful to read through the process steps in 

Appendix B before reading Sections 7 and 8 of this report.

After presentation of the issue, reiteration of the scope, and description of the base case 

scenario and initial conditions for the HFE scenario grouping, a list of general human 

performance vulnerability concerns is provided. The list summarizes the types of factors that 

may influence HFEs for the issue analyzed. Three sources of potential human performance 

vulnerabilities have been used in this analysis:

(1) Results of HRA or human factors assessments performed during the preliminary,

qualitative HRA

(2) Insights provided by SMEs during interviews

(3) Insights from reviews of historical events

For some HFE scenario groupings, a list of relevant SME comments and a list of relevant 

previous events are included at the end of the general vulnerability concerns section. Following 

 13 “Human failure events” are events that would be modeled as basic events in the logic models of a PRA and 

that represent the failure of a function, system, or component that is the result of one or more unsafe actions. 14 “Unsafe actions” are actions inappropriately taken, or not taken when needed by plant personnel, that result in 

a degraded plant safety condition.

15 “Error-forcing contexts” are situations that arise when particular combinations of performance shaping factors

and plant conditions create an environment in which unsafe actions are more likely to occur.
6-2

the summary of vulnerabilities are descriptions of specific scenarios, each with an 

accompanying list of human performance vulnerabilities. Section 7 provides a further 

introduction to the misload and cask drop scenarios, briefly lists the HFE scenario groups and 

specific scenario titles, and provides a high-level listing of the vulnerabilities. Section 8 provides 

all of the specific scenarios that were generated for this preliminary, qualitative HRA.
7-1

7. OVERVIEW OF MISLOAD AND CASK DROP SCENARIOS

While we were conducting SME interviews and literature reviews for this report, it became 

apparent that two main categories of HFEs dominate SFH and DCSOs: (1) misloads and (2) 

cask drops. Misloading events can potentially lead to a slow degradation of a cask system,

which then leads to fission product releases of various magnitudes. A cask drop, especially with 

a loaded cask prior to lid sealing, can lead to large fission product releases inside the reactor, 

fuel, or auxiliary building (depending upon plant type). Cask drops may also lead to a range of 

other fission product releases either to a building environment or open atmosphere, depending 

upon when the drop occurs. The importance of misload and cask drop events led to an 

accumulation of specific insights from SMEs and specific events listed in NUREG-1774 [11] and 

other sources. 

Recent events involving crane structures, systems, and components, along with the apparent 

high public consequences associated with cask drops, motivated us to focus on cask drop 

scenarios. Therefore, further investigation of misloads may be delayed as cask drops are

investigated thoroughly. In anticipation of this redirected focus, this section provides an 

overview of the human performance vulnerabilities, relevant previous events, and the level of 

completeness of the current analysis with respect to both misloads and cask drops. This

overview emphasizes what must still be accomplished to thoroughly analyze both misloads and 

cask drops. The overview also presents a tabular listing of all scenarios described in this 

report.16

7.1. Misloading Fuel into a Cask 

Two types of spent fuel misload scenarios appear to dominate. 

(1) A fuel movement plan is improperly prepared (i.e., insufficiently aged, high-burn-up, or 

damaged fuel is selected, and/or canister fuel locations are inappropriately assigned). Proper 

execution of the “incorrect” fuel movement plan by fuel-handling personnel is generally assumed 

unless gross indications (e.g., very high radiation levels) present themselves. 

(2) Fuel-handling personnel do not follow a “correct” fuel movement plan, which then leads to a 

misloaded cask, or the fuel is damaged during the loading process. 

In both scenarios, numerous unsafe actions are required to arrive at the HFE in which a misload 

is realized. Additionally, it appears from the NRC [4] and EPRI [5] reports that a large number of 

”hot” spent fuel assemblies must be misloaded in order to threaten the fission product boundary 

of the cask system. Furthermore, fuel that is “too hot” for loading into a cask apparently (based 

on SME interviews) presents many indications that make it difficult to conceive of scenarios in 

which a misload is left undetected. For example, “hot” fuel presents the following indications: a 

very high radiation signature; a distinct blue glow of Cherenkov radiation for up to 3 years after 

discharge from the reactor core; and a visible convective turbulence in the water (i.e., a heat 

mirage effect). Once inside the cask, “hot" fuel leads to elevated temperatures and pressures in 

the cask and may even cause water in the cask to flash to steam. These indications, along with 

reports from SMEs that the fuel movement process is the “cleanest” part of SFH operations, 

forced us to struggle diligently to discover ways in which human failures could lead to an 

 16 Additional scenarios describing potential cask drop HFEs may be found in NUREG/CR-7016 [29].
7-2

undetected misload that finds its way to the ISFSI pad. Although difficult, it certainly is not 

inconceivable that a misloaded cask could be put into storage on an ISFSI pad. Section 7.1.1

discusses factors that may influence human performance during fuel-loading activities.

7.1.1. General Human Performance Vulnerabilities Impacting Fuel-Loading Activities

The following summarizes some potential human performance vulnerabilities, derived from both 

process descriptions and SMEs who have hands-on experience with the processes that may 

impact fuel-loading operations.

Unchallenging Activities

The activities involved in SFH are, in general, quite simple. The movements are slow, so each 

action takes a long time to complete. Some individuals have a significant amount of downtime 

between actions. There is ample opportunity for diversion and distraction, and an air of 

informality and complacency can easily exist within and amongst the team members. From a 

psychological perspective, there is insufficient dynamic activity to generate an optimum 

stress/arousal level for performance. This lack of challenge, combined with high experience 

levels of personnel (i.e., they have performed these operations without incident many times) 

may lead to a progressive disregard for step-by-step procedures. Over time, this migration from 

strict adherence to step-by-step procedures, to occasional violations of procedures, to routine 

violations of procedures, results in “informal rules” that personnel accept as normal at some 

point in time.

Limited Indicators and Job Aids

Compared to the control panel, local indicators, and other job aids common in the power plant 

operations, those that exist in spent fuel operations are quite limited. In general, processes are 

controlled primarily by visual cues. 

Visual Challenges

As mentioned above, visual cues are primary in performing spent fuel operations. In many 

cases, it is difficult to properly observe these cues because of the position of personnel in 

relation to the activities they are observing. Operations within the SFP can be particularly 

challenging; the refraction in the water and reflection from the water’s surface can distort the 

view of operations that require precise positioning. Observing signs of damage to individual fuel 

pins within a cask or canister may be severely hampered by structural elements.

Finally, in many cases, by its very nature and location, the action must be viewed from a 

distance. In such cases, personnel can miss small deviations that could possibly lead to 

significant problems simply because they do not have sufficient visual resolution to detect the 

error.
7-3

Communication Difficulties

There are significant challenges in communication among the team members performing spent 

fuel operations. The environment contains a significant amount of background noise, 

predominantly machine noise. Although key participants use headsets to communicate, 

headsets do not eliminate the potential for misunderstanding. Garbled communication (due to 

system interference or background noise) is possible, and in some cases it may not even be 

possible to clearly determine who is speaking. A belief that a particular individual is speaking, 

even if the individual is not, can bias the listener into hearing what he/she expects to hear.

Time Pressure

Although time pressure during cask loading campaigns (CLCs) is generally less than during 

refueling outages (due to the nonproducing status of the plant during an outage), missing 

scheduled milestones can increase expenses and uncertainty about time schedules for 

upcoming outages. SMEs state that time pressure can quickly emerge, even during fuelassembly movement operations. This ability for time pressure to emerge may be exacerbated 

by the perception of low consequence for errors during this process. All personnel perceive that

dropping a very large cask from a crane creates high-consequence outcomes; therefore, those 

operations are much less susceptible to time pressure. Handling of individual fuel assemblies 

may not carry with it the same need for slow, step-by-step execution. The tone set by all levels 

of management regarding the relative benefit of ensuring safety versus meeting a 

predetermined schedule will greatly impact the perception of time pressure among operations 

personnel.

Other Ergonomic Issues

Issues such as working in inhospitable settings (e.g., cramped locations on the refueling crane 

bridge, extreme heat) may affect the performance of fuel-handling personnel (FHP). These 

settings can affect the pace of the work either due to the need to evacuate the area quickly for 

safety reasons or comfort. Other issues such as required protective clothing may also arise 

(e.g., the suits required when working above the SFP); body movement may be restricted or the 

pace of the work may increase due to discomfort. 

Configuration Control

Configuration control processes are not always designed to avoid specific human performance 

problems that may arise from design peculiarities at a specific site. Such processes are driven 

by the accumulated knowledge and experience of those who administer/manage the system; 

however, thorough documentation of such knowledge and experience (which influences 

assumptions and error-checking processes) may not be present. These omissions can lead to 

problems (e.g., improperly prepared fuel movement plans) when configuration control activities 

are handed off to new personnel.
7-4

Trust

Trust is an essential component of any team-based activity. Crew members must be able to 

depend upon the correct behaviors of others when performing operations. However, trust can 

have a negative component as well. For example, in the second scenario in this grouping, a 

supervisor “trusts” his experienced FHP and spotter, leading him to cursorily verify fuel 

assembly loading. Crew members must always be reminded of the proper orientation of the 

“trust” relationship. In this case, trust should imply that the FHP and spotter can “trust” the 

supervisor to carefully review the fuel load to protect them from missing errors that will be 

sealed inside the cask and may present hazards to others years later.

7.1.2. Information Considered When Developing Misload Scenarios

Listed below are items summarized from SME interviews and other documented sources (see 

Appendix C for more information). These observations may prove beneficial in understanding 

relevant contexts for human performance that may tend toward the occurrence of human errors.

Comments in bold are logical extensions of vulnerabilities proposed by the authors of this 

report. Further discussions with SMEs and plant-specific personnel would be required to 

substantiate these proposed extensions. Here are quotations from the discussions with the 

SMEs:

(1) It is possible to pull fuel out of the wrong spots and put fuel into the wrong spots; the 

spotter with binoculars can check serial numbers, but there may be omissions; 

sometimes more than one fuel bundle will be moved before any written confirmations are 

annotated on the “move sheet,” which may have been taped up somewhere on the 

refueling platform by the crew (see p. C-6).

(2) Refraction of light in the water is a big issue; personnel look over the side of the refueling 

machine into water 6.1–14.6 meters (20–48 feet) deep to ensure proper positioning of 

the lifting device (see p. C-2). Visual difficulties can contribute to fuel assembly 

identification problems.

(3) This is a skilled activity; procedures are not generally followed in a step-by-step manner 

as far as reading or calling out the procedure step first and then executing it; the 

operators execute the learned steps as a skill-based routine (see p. C-6). Mistakes 

during this operation will likely involve slips17 and lapses.

18

(4) Misloads may not manifest themselves for weeks, months, or even years after the 

misload event occurs. Misloads can occur during fuel movement from the reactor core to 

Disruptions and 

distractions can occur. For example, a radiation alarm or fire alarm can go off. A former 

senior reactor operator told of lifting a fuel bundle when apparently the bundle snagged a 

piece of a core instrument cable (discarded to the SFP after a previous refueling 

outage). The radiation monitors went off when the fuel assembly approached the pool 

surface. The bundle was immediately lowered until the problem could be diagnosed (see 

p. C-8). Disruptions and distractions can lead to a slip or lapse.

 17 A slip is an attentional failure in which a planned task is carried out incorrectly or in the wrong sequence. See 

reference 21 for additional discussion on how slips may occur. 18 A lapse is a memory failure in which a step in a planned sequence of events is missed. See reference 21 for 

additional explanation.
7-5

the SFP, one SFP location to another SFP location, and the SFP to the dry storage cask 

(see p. C-7).

(5) The pace and nature of operations during the movement of fuel assemblies is very slow 

and repetitive. It quickly becomes a monotonous task to move fuel assemblies (see p. C2). Unchallenging activities can contribute to errors.

(6) Misloads into a storage cask that arrives at a central repository (e.g., Yucca mountain): 

will likely involve a DSC or multi-purpose canister (MPC) in a transportation cask 

licensed for long-distance transportation (i.e., not just to a local ISFSI at or adjacent to 

the plant site where the fuel is removed). If a misload reaches the repository, would 

repackaging operations be hindered? What possible damage or injury might occur? 

Would significant delays occur? Many people are interested in these questions (see p. 

C-7). Misloads going into an ISFSI are the big drivers on problems at the proposed 

Yucca Mountain fuel-handling (pre-storage processing) facility (i.e., misloads may 

become a latent failure that drives high-consequence events many years in the future;

see, p. C-9).

(7) Embrittled fuel may cause problems many years down the road, but one SME did not

expect problems; he noted, however, that problems could arise at decommissioned 

plants where there could be some potential for fuel configuration changes if the casks 

were dropped (see p. C-11).

(8) There is a “difference” between how people act when NRC is watching versus when 

NRC is not watching; at a PWR (October 1994) I led the report for an augmented 

inspection team (AIT) and it turned out that the plant was doing a refueling “off the cuff”

in many ways; we got wind of a problem when we saw that two refueling bridge masts 

had been damaged within a short period of time (see p. C-12).

(9) I can’t say that plants don’t perform other activities that might interfere with cask 

operations, but from what I hear, when casks are loading spent fuel, it is likely that other 

activities would be minimal; important factors might be the availability of personnel, etc. 

(see p. C-14).

(10) Distractions can occur during cask operations; depending where they are at in their 

master schedule, they could be planning for an outage immediately after loading of dry 

casks—that may be a really big issue for more plants. The plants have detailed plans for 

refueling outages, for cask loading, I’m not quite as sure, but a crunch between 

personnel as overlap is occurring between the two operations could be a big problem 

(see p. C-14).

(11) There have been problems (rare) when bundles are put in the wrong spot, but overall the 

planning phase is the “cleanest” part of the cask loading operation (see p. C-15).

(12) There isn’t really a path move plan for moving the fuel assemblies, but there are certain 

structures in the pool (e.g., up-enders used to alter the orientation of fuel bundle going 

into or coming out of the fuel transfer tube) that dictate some movement constraints. 

Typically, the operators will move all of the fuel to be put into the cask out of their initial 

storage rack positions and then group them together in another part of the spent fuel 

pool (if there is room). In this new configuration, all of the bundles are verified to be the 

right ones before they are moved into the MPC (see p. C-17).
7-6

(13) Items that may lead to a misload event include poor communication; mistakes involving 

slips or lapses among experienced personnel; and mistakes made on move sheets; for 

example, mistakes have been made on move sheets when refueling operations were 

conducted at sister units at the same plant site and the move sheets were swapped, 

(e.g., mirror images of each other); see p. C-18.

(14) At a dry, ambient pressure PWR there was 4.8-year-old fuel loaded instead of 5-yearold fuel; what they did at the NPP was to calculate by planned loading date, but then the 

loading date changed (see p. C-22). 

(15) With respect to loading fuel, at a decommissioned PWR there was one person handling 

the fuel; two verifications were made (the fuel handler and another observer); a 

supervisor also performed a third verification. The supervisor noticed a problem with the 

load; the right assemblies had been loaded, but they were in the wrong locations within 

the canister (see p. C-22).

(16) The only time you would notice “young” fuel loaded in a cask is if the radiation 

monitoring sensors in the pool area picked it up; or if you have good underwater 

cameras and they showed more heat coming off than you would expect (i.e., thermally 

induced turbulence affecting the refraction of light—same as the mirage effect on a hot 

day); or if a radiation measurement off the canister was too high. If the fuel was very 

fresh out of the reactor (i.e., under 3 years or so) it would still be glowing blue due to 

Cherenkov radiation (see p. C-22-23).

(17) In response to a questionnaire distributed by the International Atomic Energy Agency 

(IAEA) in March 1976, 11 nuclear power plant organizations provided information on fuel 

dropping incidents. The information covered drop heights from a few centimeters up to 9 

meters into reactor cores and storage ponds; 11 irradiated and two fresh fuel assemblies 

were involved in the incidents which were reported. One incident of some importance 

here involved dropping and damaging a fuel assembly during loading into a cask. The 

radioactivity release due to damaging the fuel interrupted cask loading and 

decontamination activities for several weeks [19].

7.1.3. Additional Relevant Previous Events Related to Misloads

Events are from NUREG-1774 [11] unless otherwise noted:

(1) The SFP crane limit switches were out of adjustment, allowing the crane to travel in 

restricted areas.

(2) Fuel assemblies were put in the wrong location (two occurrences).

(3) Fuel movement was performed without an operable radiation monitor.

(4) From problem evaluation report (PER) no. 3476 listed in an inspection report for a PWR 

with an ice condenser containment completed in 2004 [14], “While reviewing the DRAFT 

of the Fuel Selection calculation file, the team noted an error in the cask ‘Region’

designations for the fuel assemblies. DRAFT procedure NFTP-100, Fuel Selection for 

Dry MPC Storage was in error. Additionally, the heat load from an assembly with a 

component residing in it exceeded the heat load limit.”
7-7

7.1.4. Completeness of Misload Scenarios

The scenarios developed for this preliminary analysis were obtained by combining a relatively 

limited set of SME information, process descriptions from the Holtec HI-STORM 100 Final 

Safety Analysis Report (FSAR), and a literature review of misload events with our knowledge of 

how HFEs may result from various failures in how people perceive, learn, remember, and 

communicate. We did not obtain extensive explanations regarding the fuel movement planning 

process or cask loading campaign preparations as they actually occur at a specific plant. 

Furthermore, we did not observe operations at a specific site (other than a short edited video of 

SFH and DCSOs at one BWR), and we do not have first-hand experience in carrying out 

activities related to misloading fuel.

All of the above-mentioned limitations in the information gathered for the current report translate 

directly into limitations of the scenarios themselves to accurately represent the process 

contexts, individuals, and teams responsible for SFH and DCSOs. Along with these omissions 

are unanswered questions; for example:

• How many opportunities for fuel load planning failures or unsafe planning actions are 

generally present during the planning process?

• How many FHP are actively seeking indications that “improper” fuel assemblies have 

been selected for dry storage when they are performing fuel loading?

• Is the fuel-loading process designed such that FHP are directed to verify 

“appropriateness” of fuel selected for loading?

• How robust are measures to verify the adequacy of cask loading and sealing operations 

in subsequent phases of DCSOs? That is, as a cask is loaded, sealed, and then moved, 

what specific measures are used to verify that previous phases were performed 

correctly? How do expectations held by personnel impact their ability to actually identify 

and believe that a previous operation has resulted in a misload requiring investigation 

and a tedious resolution (e.g., cutting open a cask and removing/reloading/resealing)?

To complete a thorough qualitative HRA and to develop a state-of-the-art19

 19 In this report, a state-of-the-art HRA implies compliance with both the NUREG-1792 Good Practices for 

Implementing Human Reliability Analyses (HRA) [1] and the ATHEANA [2] HRA method.

quantitative HRA (if 

desired), the questions above (and many others) would need to be answered by gathering and 

analyzing additional plant-specific data and information for both PWR and BWR plants. The 

data and information would ideally be gathered through a combination of expert interviews, 

observation of actual cask loading campaign activities, detailed review of procedures, detailed 

review of previous misloading incidents, and application of a prospective ATHEANA-type HRA. 

In conjunction with gathering and analyzing detailed plant-specific information from two or a few 

plants, additional data (questionnaires, inspections, etc.) should be acquired that indicate fuel 

load planning and fuel movement activity performance for the population of U.S. nuclear power 

plants relative to the plant-specific analyses. The analysis would generate plant-specific

analyses beneficial for NRC regulation specific to those licensees and provide generalizations of 

power plant fleet performance that could enable development of uncertainty distributions for 
7-8

HRAs, which might then be used to improve the NRC’s risk-informed regulation for SFH and 

DCSOs.

7.2. Dropping a Cask 

As mentioned earlier in this section, cask drops, especially of a loaded cask before the lid is 

sealed, potentially lead to large fission product releases within a plant structure, posing highconsequence exposures, primarily to plant personnel. Cask drops that cause reactor systems to 

fail may also lead to exposures to the public, but these are not treated in this report because no 

specific plant design was used. Other types of cask drop scenarios occurring outside of plant 

structures potentially lead to both large fission product exposures to plant personnel, members 

of the public, and the environment. Also, recent events before and during this analysis 

revealed20 problems with crane structures, systems, and components, suggesting higher 

likelihoods of occurrence of cask drops than documented in previous analyses. Not only are 

numerous human actions required to inspect, test, maintain, and operate cranes, but also there 

are numerous opportunities for human failure during rigging operations. The potentially high 

consequences of a cask drop encourage thorough investigation of cask movement activities. 

As with misloads, there are many opportunities for cask drop events that must be avoided to 

safely conduct a cask loading campaign. In fact, it appears that many more opportunities exist 

for a high-consequence cask drop than a high-consequence misload of fuel.

21

7.2.1

Therefore, we 

placed additional emphasis on reviewing past heavy load drop events and related unsafe 

actions and HFEs. Section provides information on some factors that may influence 

human performance during cask movement activities.

7.2.1. General Human Performance Vulnerabilities That Could Contribute to Cask Drops

The following summary of potential human performance vulnerabilities was derived from 

process descriptions and SMEs who have hands-on experience.

Limited Nature of Procedures

Spent fuel operations are not highly proceduralized, but they depend primarily on skills learned 

and additional training experiences. The vast majority of the activities do not use written 

procedures at all, and with few exceptions, even those that include procedures do not have any 

formal checklists or verbal confirmation requirements spelled out.

Communication Difficulties

There are significant challenges in communication among the team members performing spent 

fuel operations. The environment contains a significant amount of background noise, 

predominantly machine noise. Although key personnel use headsets to communicate during 

some parts of the operation, headsets do not eliminate the potential for misunderstanding. 

Garbled communication (due to system interference or background noise) is clearly possible, 

 20 i.e., revealed to us.

21 It should be noted that the worst case may be a cask drop that involves a cask filled with certain types of 

misloaded fuel that liberates its contents during the drop. Adding a fire to this scenario and failure (or absence) of a 

plant structural barrier might be one of the worst conceivable scenarios.
7-9

and in some cases it may not even be possible to clearly determine who is speaking. A belief 

that a particular individual is speaking, even if they are not, can bias the listener into hearing 

what is expected. 

Hand signals are the predominant method team members use to communicate, but there is no 

guarantee that the intended recipient will see these signals (or even be looking for them). There 

may be difficulty in promptly getting an individual’s attention. Signals may also be interpreted 

improperly, especially given that conventions for the meaning of all signals not appear to be a 

firmly established.

Limited Indicators and Job Aids

Compared to the control panel and local indicators and other job aids common in the power 

plant operations, those that exist in spent fuel operations are quite limited. In general, processes 

are controlled primarily by visual cues. 

Visual Challenges

As mentioned above, visual cues are primary in performing spent fuel operations. In many 

cases, properly observing these cues is made difficult by the positioning of personnel in relation 

to the activities being observed. Operations within the SFP can be particularly challenging, as 

the refraction in the water and reflection from the surface of the water can distort the view of 

operations that require precise positioning.

Crane operations present challenges whether they are in the water or not. The crane operator 

must lean out over the crane bridge, and the view of an operation is essentially only from 

directly above. Many of the potential errors that could occur cannot be determined from above.

In addition, even the view from above may be obstructed, either by the yoke or by the load 

being moved. Thus, the operator is often put in the position of “being the hands for someone 

else’s eyes,” which make the operations vulnerable to the communication vulnerabilities 

discussed previously. 

Finally, in many cases, by its very nature and location, the action must be viewed from a 

distance. In such cases, personnel can miss small deviations that could possibly lead to 

significant problems simply because they do not have sufficient visual resolution to detect the 

error.

Unchallenging Activities

The activities involved in SFH are, in general, quite simple. In addition, the speed of the 

movements is slow, so each action takes a long time to complete. Basically, this is mostly slow, 

monotonous work, and some individuals have a significant amount of downtime between 

actions. There is ample opportunity for diversion and distraction, and an air of informality and 

complacency can easily exist within and amongst the team members. From a psychological 

perspective, there is insufficient dynamic activity to generate an optimum stress/arousal level for 

performance.
7-10

7.2.2. Information Considered When Developing Cask Drop Scenarios

Listed below are items summarized from SME interviews and other documented sources (see 

Appendix C for further information) that may aid in understanding relevant contexts for human 

performance that may tend toward human errors during cask movement. Comments in bold are

proposed logical extensions of vulnerabilities. Further discussions with SMEs and plant-specific 

personnel would be required to substantiate these proposed extensions. 

(1) Crane operations are highly repetitive and monotonous (see p. C-5).

(2) Many maintenance checks are required before use; often there is significant time 

pressure to complete the checks quickly and get on with the “real work”; there may be 

significant variability on how thoroughly these checks are performed (see p. C-5). 

Time pressure during core refueling operations is intense, but time pressure during dry 

cask operations is generally much less intense, although scheduling delays may elevate 

time pressure, especially if they threaten to disrupt the start of a scheduled refueling 

outage (see p. C-5). Plants with a large inventory of fuel in the SFPs can be rushed to 

get casks loaded to ensure full core pull-out potential as they run up to a refueling 

outage. Delays such as NRC inspections, equipment failures, bad weather, etc., can 

compress the time schedule (see p. C-13). (NMSS personnel were at a dry, ambient 

pressure PWR and a Mark III BWR; both were under time pressure during cask 

operations. More plants may be forced into this time pressure mode, depending on 

management. Some plants spend money early to unload the pool; others wait and 

become vulnerable to a time crunch [see p. C-13].) Even with planning, time pressure is 

visible; even if planning has gone well, something can disrupt the process such as the 

availability of personnel. Distractions can occur during cask operations; depending on 

the master schedule, an outage could be planned immediately after loading of dry casks, 

which may be a big issue. The plants have detailed plans for refueling outages and cask 

loading, but a crunch between personnel as the two operations overlap could be a 

significant problem (see p. C-14). The fact that time pressure is intense during core 

refueling operations may impact the accuracy of placing off-loaded fuel in the 

correct alphanumeric grid locations within the SFP. Inaccurate placements would 

potentially corrupt the fuel-loading plans used during cask loading campaigns.

(3) Cranes used to move the casks are very large (1.112E+6 – 2.224E+6 Newton (125–250 

ton) capacity). Many cranes have had their capacities greatly increased even though no 

structural changes were made (i.e., decisions have been made to cut into the 

“engineering design factors” of the original design [see p. C-5]). Some personnel may 

implicitly assume that the cask-carrying cranes are more robust than they actually 

are, given that re-ratings may not be accompanied by any structural or operation 

changes. These assumptions might encourage a general belief that procedures 

and equipment are so conservative that bypassing them on occasion is 

acceptable.

(4) Crane issues (even though many are mechanical, electrical, etc.) involve human factors

regarding inspection, testing, and maintenance; personnel and management systems 

are critical to keeping the systems working properly (see p. C-10).

(5) Hooks could fail (two hooks would have to fail on a single-failure-proof crane) and yokes 

could fail. At a decommissioned PWR, cracks were found in a yoke during a quarterly or 
7-11

annual inspection. Many parts of the hook are difficult to inspect, so generally the 

defects would be found during periodic planned inspections (see p. C-21). 

7.2.3. Additional Relevant Previous Events Related to Cask Drops

The following events during crane operations at nuclear power plants were documented in 

NUREG-1774 [11] unless otherwise noted:

(1) Taping back the safety latch on a hook to facilitate removal of the hook from the sling.

(2) Operator bypassed the upper limit electrical interlock and drove the crane sheave into 

the mechanical stop, breaking the cable.

(3) A bolt used to help secure a rigging device failed because it was improperly threaded.

(4) Improper rigging fabrication led to a drop of a large bolt that punctured the steel liner of a 

SFP.

(5) Slings on a hook were set at too acute of an angle and they slipped off the crane hook.

(6) A leather glove used as a softener was insufficient to keep a sling from severing while a 

trailer was lifted.

(7) Improper assembly of a hoist after an overhaul caused the failure of the hoist during a 

lift.

(8) Improper attachment of a lifting device.

(9) Improper rigging (at least two occurrences reported).

(10) Inadequate rigging softener material (at least two occurrences).

(11) Sling failed and dropped a 333,617 Newton (37.5-ton) crane due to lack of protection at 

sharp corners.

(12) Crane was not adequately tested following a modification in which a new trolley was 

added.

(13) A crane hook fabricated at the plant failed.

(14) Surveillance tests were not performed prior to using the crane.

(15) Fuel movement occurred without establishing proper ventilation (i.e., isolating the 

building atmosphere and/or establishing proper filter paths) (19 occurrences).

(16) Lift height limit switches were not properly calibrated and were overridden by the crane 

operator when lifting a spent fuel shipping cask over the SFP cask drop protection 

system.

(17) Maintenance failed to calibrate the spent fuel bridge crane load cell prior to crane use.
7-12

(18) Polar crane operating procedures were not followed.

(19) Polar crane rail clips were welded; this was caused by a poor engineering modification.

(20) Wrong procedure and wrong crane were used for a task.

(21) Miscalculation of loads led to movement of 569,372 Newton (64-ton) loads when 

311,376 Newtons (35 tons) had been expected using a crane rated for a working load of 

418,132 Newtons (47 tons).

(22) Hoist chain was not made of the correct material (configuration control issue).

(23) Maintenance personnel failed to test an overload cell prior to crane use.

(24) A polar crane brake modification to override brake controls.

(25) Cask handling crane was not tested prior to use.

(26) Maximum load height was exceeded by more than 1.22 meters (4 feet), and the wrong 

procedure was used for the lift.

(27) A signal man was not present during crane operations.

(28) Fuel handling crane not tested prior to use.

(29) A heavy load was lifted over the SFP.

(30) Crane load path went over safety-related structures.

(31) During a lift, a fire lasting longer than 600 seconds (10 minutes) started in the resistor 

bank cabinet for the polar crane auxiliary hoist.

(32) Spent fuel gate was lifted over irradiated fuel (two occurrences).

(33) Large crane used without signal-man present (two occurrences).

(34) Crane floor director gave the signal to lower the upper internals prematurely.

(35) Polar crane trolley fasteners found to be inadequate (two occurrences).

(36) It was found that approximately 10% of crane inspections were not performed.

(37) 47 out of 140 polar crane rail anchor bolts failed because of standing water from inleakage.

(38) A crane was operated over the SFP while both diesel generators were inoperable.

(39) Inadequate testing for heavy load lifts was discovered.

(40) Slow speed control on polar crane failed; operator had to jog the high speed control to 

move loads.
7-13

(41) During polar crane operation, a maintenance person fell into the refueling cavity and got 

contaminated.

(42) Crane interlocks not tested prior to use.

(43) Two-blocking event; cables severed.

(44) Crane rated at 1,512,395 Newtons (170 tons) lifted a 2,135,146 Newton (240-ton) load.

(45) Spent fuel casks were moved without establishing containment integrity.

(46) An empty dry storage cask was placed in the SFP and was mispositioned on the cask pit 

stand. This resulted in the cask leaning to one side, which caused the lifting hook to 

partially slip off the cask trunnion during a lift attempt.

(47) During movement of a cask from the SFP, electrical cabling overheated in the control 

circuits for the overhead crane. When the basket and transfer cask were about 6.1 

meters (20 feet) from the bottom of the pool, the resistor bank was glowing, and smoke 

was coming from the cabling. Twenty feet from the bottom of the pool would be roughly 

half of the full lift height for the cask from the bottom of the pool to the surface.

(48) Heavy loads were moved in the vicinity of the SFP with an incorrect lifting attachment.

(49) Crane speed control switches for hoist and trolley were held in override mode using 

adjustable wrenches.

(50) Polar crane loads paths found to be inadequate.

(51) Crane operated without adequate ventilation being established (five occurrences).

(52) Crane load path went over irradiated fuel (multiple occurrences).

(53) Crane stopped while moving a cask.

(54) Actuation of a crane overload during a cask lift.

(55) Crane interlocks and mechanical stops were defeated.

(56) Gantry crane surveillance procedure found to be inadequate.

(57) Polar crane rail was misaligned and eventually failed.

(58) Sling failed as load was lifted.

(59) Load became unbalanced, impacting a structural wall and damaging concrete.

(60) Multiple heavy load movements were performed over restricted areas.

(61) Heavy load exclusion areas were not properly documented or established.

(62) Miscalibrated load cell.
7-14

(63) A cask was lifted over safety-related components without the cask valve covers installed 

(multiple occurrences).

(64) Large load (253,548 Newtons (28.5 tons)) dropped 4.6 meters (15 feet), failed nylon 

rigging straps, and then fell 18.3 meters (60 feet) to the ground. Unspecified operator 

error was identified as the most likely cause.

(65) A crane was operated that had a “Do Not Operate” tag on it.

(66) Positive pressure noticed in the spent fuel building during spent fuel handling (multiple 

occurrences).

(67) Spent fuel was moved without adequate procedures.

(68) Contrary to procedure, workers attempted to lift a cask pit cover and a recirculation 

pump at the same time.

(69) Heavy loads have been lifted over 480 V vital switchgear multiple times.

(70) Overload protection was not provided over 22.9 centimeters (9 inches) of travel.

(71) Loose electrical connections caused problems with the trolley speed and intermittent 

operation of bridge speeds. This feature was not included in any surveillance testing.

(72) During movement of an SFP bridge crane, it ran into a safety rail that had been moved 

by maintenance.

(73) During movement of an SFP bridge crane, its wheel guard cut a 480 V cable causing a 

short.

(74) Crane operators failed to verify temperature requirements prior to a load lift. It may have 

been too cold for the lift.

(75) Rigging came loose; load dropped.

(76) A worker was drawn into a hoist drum by his safety harness lanyard, resulting in serious 

injuries.

(77) Crane operators failed to follow procedures during crane movement.

(78) While using polar crane, the lifting device for the load was not attached properly and the 

load became cocked.

(79) A procedure for a load lift did not exist.

(80) An ISFSI load movement lift height exceeded the maximum value in the procedure.

(81) The SFP bridge crane, with a fuel assembly latched and moving horizontally, did not 

respond to its control system, resulting in a near collision. The main power breaker was 

opened to stop crane motion. A near-heroic action was required to stop the crane 

movement.
7-15

(82) The polar crane traveled over the jet impingement zone multiple times.

(83) A hydraulic line on a mobile crane failed, resulting in an oil spill of many gallons.

(84) Repeated trips of the hoist overload relay were caused by a poor procedure.

(85) The SFP fuel handling hoist lowered on its own, caused by malfunctions of the main 

hoist switch.

(86) The reactor building crane tripped while lifting a spent fuel cask out of the SFP. The 

emergency brake engaged, probably because of the hoist shifting from low speed to 

high speed.

(87) The spent fuel bridge crane hoist control pendant control went dead when attempting to 

move the crane. A programming malfunction occurred.

(88) The load interlock for the auxiliary building crane was not tested. The interlock prevents 

crane travel over the SFP. The interlock had not been tested since the new crane was 

installed.

(89) An auxiliary-building-crane pendant cable became entangled with the SFP bridge during 

preparations for cask loading. The SFP crane shook, and operators observed sparks on 

the auxiliary crane. Power was lost to the auxiliary crane.

(90) There was a report of overstressed bolts being found in the auxiliary hoist on Whiting 

cranes which resulted in a recommendation to discontinue the use of the hoist or to 

derate it to 40% of the original rated capacity (1997).

(91) From an inspection report: “During crane movement, the inspector observed that crane 

control was being directed by a signal person located away from the crane operator. 

(Note: movement of the crane is by a spring loaded cord (pig-tail) from the crane to the 

controller.) The crane operator was not close to the pool, or directly observing the heavy 

load (cask) being lifted. He was using visual observations (standard crane hand signals) 

from the signal person. It appeared that crane operation could be enhanced by use of a 

remote controlled radio operated crane control so the operator could look directly at the 

heavy load being moved. Furthermore, each person involved with this evolution could be 

further helped by using radio headsets so they could communicate better” [20]. This 

event highlights the importance of communication, both visually for the crane 

operator and multi-modally between the entire lifting team to ensure safe cask 

movement.

7.2.4. Completeness of Cask Drop Scenarios

The scenarios developed for this preliminary analysis were obtained by combining a relatively 

limited set of SME information, process descriptions from the Holtec HI-STORM FSAR, and a 

literature review of load drop events (and related events) with our knowledge of how HFEs may 

result from various failure mechanisms originating in how people perceive, learn, remember, 

and communicate. We did not obtain extensive explanations regarding cask movement 

processes. Furthermore, we did not observe operations at a specific site (other than a short
7-16

edited video of SFH and DCSOs at one BWR), and we do not have first-hand experience in 

carrying out activities related to cask movement.22

All of the above-mentioned limitations in the information gathered for the current report translate 

directly into limitations of the scenarios themselves to accurately represent the process 

contexts, individuals, and teams responsible for SFH and DCSOs. Along with these omissions 

are unanswered questions, for example:

• How many opportunities for cask movement planning and execution actions are 

generally present during the planning process?

• Are personnel involved with cask movement operations adequately checking the actions 

of team members when they would otherwise be waiting for the next operation (e.g., is a 

rigger watching another rigger or transfer lid operator and verifying proper execution)?

• How robust are measures to verify the adequacy of cask movement operations (e.g., 

captivation of trunnions by yoke, lifting distance of MPC with short slings while transfer 

lid door is being opened)?

To complete a thorough qualitative HRA and develop a state-of-the-art quantitative HRA (if 

desired), the questions above (any many others) would need to be answered by gathering and 

analyzing additional plant-specific data and information for both PWR and BWR plants. The 

data and information would ideally be gathered through interviewing experts, observing actual 

cask loading campaign activities, conducting detailed reviews of procedures and previous cask 

drop incidents/near misses, and applying a prospective ATHEANA-type HRA. In conjunction 

with gathering and analyzing detailed plant-specific information from two or a few plants, 

additional data (e.g., questionnaires, inspections) should be acquired on cask movement 

experiences for the population of U.S. nuclear power plants relative to the plant-specific 

analyses. The analysis would generate plant-specific analyses beneficial for NRC regulation 

specific to those licensees and would provide generalizations of power plant fleet performance. 

This would enable development of uncertainty distributions for HRAs, which might then be used 

to improve the NRC’s risk-informed regulation for SFH and DCSOs.

7.3. Tabular Listing of Human Failure Event Group Descriptions and Scenarios 

Described in this Report

Table 7-1 lists the HFE group descriptions, simple descriptions of the scenarios within each 

HFE group, and related human performance vulnerabilities for all scenarios described in Section 

8 of this report. The seven HFE groups correspond to the seven phases of operation defined in 

Section 5.

 22 The scenarios documented here do not include all scenarios generated and published in the original letter report upon which 

this report is based. Some scenarios were removed as they were not deemed plausible based upon preliminary analysis of the 

relevant physics of failure. The remaining scenarios should be considered preliminary and appear to be plausible. However, detailed 

structural analysis of the scenarios was not performed.
7-17

Table 7-1 Summary of HFE group descriptions, scenario titles, and vulnerabilities.

HFE 

Group

HFE Group 

Description

Scenario Vulnerabilities

1 Before & 

during fuel 

loading

1. Failure in fuel-movement 

planning results in misload of 

≤ 13 spent fuel assemblies 

with wrong fuel.

2. Failures of multiple personnel 

in fuel movement results in 

misload of ≤ 4 spent fuel 

assemblies.

3. Failures of one person during 

fuel movement results in 

misload of ≤ 4 spent fuel 

assemblies.

4. Omission of in-pool staging 

results in misload of ≤ 4 spent 

fuel assemblies.

5. Failures during fuel 

movement lead to misload 

with wrong fuel.

6. Fuel-handling failures 

damage fuel during 

placement.

• Unchallenging activities

• Limited indicators & job aids

• Visual challenges

• Communication difficulties

• Perceived time pressure

• Configuration control

• Trust

• Inexperience

• Confirmation bias

• Informal rule leads to 

procedure violation

• Other ergonomic issues

2 Transfer cask 

movement 

from SFP to 

preparation

area

1. Failure in cask or canister lid 

placement leaves lid ajar.

2. Failure to align yoke arm 

leads to yoke arm slipping off 

trunnion as crane operator 

lifts cask out of SFP.

3. Crane operator translates 

cask into fuel pool wall; cask 

drops.

4. Crane operator raises cask 

too high; cable breaks & cask 

drops.

• Limited nature of procedures

• Communication difficulties

• Limited indicators & job aids

• Visual challenges

• Unchallenging activities

• Task distribution among 

team members
7-18

Table 7-1 (continued) Summary of HFE group descriptions, scenario titles, and 

vulnerabilities.

HFE 

Group

HFE Group 

Description

Scenario Vulnerabilities

3 MPC & 

transfer cask 

sealing 

operations

1. Failure to identify a fuel

misload event.

2. Human-initiated fire event–

welded cask.

3. Failure leaves leak path 

existing at the end of sealing 

& preparation activities–

welded cask.

4. Failure leads to impending 

leak path due to undetected 

problem during sealing & 

preparation activities–welded 

cask.

5. Failure leads to impending 

leak path due to undetected 

problem during sealing & 

preparation activities–bolted 

cask.

• Biases based on perception 

of loss

• Limited nature of procedures

• Time of day & shift work

• Pace of operations

• Visual challenges

• Perceived time pressure

• Omission in hazard analysis

• Improper training

• Overconfidence

• Lapse

• Other ergonomic issues 

(welder’s helmet)

4 Transfer cask 

movement 

from 

preparation

area to 

transfer pit

1. Crane operator causes cask 

to strike railing around 

transfer pit opening; cask 

drops.

2. Crane operator causes cask 

to hang up on edge of 

transfer pit opening; cask 

drops.

3. Yoke arm slips off of trunnion 

as crane operator lowers 

cask into transfer pit; cask 

drops.

• Limited nature of procedures

• Communication difficulties

• Limited indicators & job aids

• Visual challenges

• Unchallenging activities

• Task distribution among 

team members

5 MPC 

movement 

from transfer 

cask down to 

storage cask

1. Rigging failure leads to one or 

more long sling(s) detaching 

from MPC, and it drops with 

impact on transfer lid door.

2. Rigging failure leads to one or 

more long sling(s) detaching 

from MPC, causing MPC to 

drop and impact the interior 

bottom of the storage cask.

• Limited nature of procedures

• Communication difficulties

• Limited indicators & job aids

• Quality assurance

• Visual challenges

• Unchallenging activities

• Team dynamics

• Pace of operations

• Large number of manual 

operations

• Training

• Other ergonomic issues 

(access to inspection area, 

heat stress)
7-19

Table 7-1 (continued) Summary of HFE group descriptions, scenario titles, and 

vulnerabilities.

HFE 

Group

HFE Group 

Description

Scenario Vulnerabilities

6 Storage cask 

movement 

from transfer 

pit to ISFSI 

pad

1. Failure to tighten lift brackets 

leads to storage cask drop 

from storage cask transporter.

2. Failure to tighten lifting arm 

sleeves leads to storage cask 

drop from storage cask 

transporter.

3. Failure of planning and 

execution of transport;

transporter encounters soft 

spot along travel path to 

ISFSI and tips.

4. Transporter operator runs 

transporter into nearby 

storage cask at pad.

5. Failure to disconnect lift 

brackets properly from 

storage cask leads to storage 

cask drop when transport 

operator raises lifting bar.

• Procedural omissions

• Communication difficulties

• Limited indicators & job aids

• Quality assurance

• Visual challenges

• Unchallenging activities

• Team dynamics

• Pace of operations

• Large number of manual 

operations

• Training

• Disbelief that certain 

accidents can occur

• Cursory analysis of travel 

path

• Other ergonomic issues 

(access to inspection area, 

heat stress)

7 Cask 

monitoring & 

storage at the 

ISFSI

1. Personnel fail to identify 

misloaded cask during initial 

monitoring.

2. Personnel fail to identify “hot 

cask” during long-term 

monitoring.

3. Personnel fail to identify sings 

of corrosion on cask during 

long-term monitoring.

4. Personnel fail to detect small 

fission product release from 

cask during long-term 

monitoring at the ISFSI pad.

• Pace of operations

• Visual challenges

• Other ergonomic issues 

(clothing, not & cold weather, 

accessibility)

• Communication

• Low hit rate–disbelief in 

undetected misload

• Quality assurance

• Low emphasis by 

management on ISFSI 

operations

8-1

8. PRELIMINARY SCENARIOS ILLUSTRATING POTENTIAL HUMAN FAILURE EVENTS

This section describes preliminary scenarios developed for SFH operations. These scenarios 

include HFEs that might be modeled in a plant-specific PRA. Because this analysis is generic, 

these PRA events are simply identified as “potential HFEs.”

These preliminary scenarios are based upon the information collected and summarized in 

previous sections of this report and its appendices. To date, the information collected is not the 

complete set that would be expected for a full HRA/PRA analysis. Future work on this project 

will fill in some of these gaps.

23 However, as this report is generic (i.e., not based on plantspecific information), the identified scenarios will remain “preliminary.”

Because previous PRA studies [4, 5] were partly the basis for this analysis, some scenarios 

contain HFEs that were addressed to some degree in those previous studies, although it is 

important to note that neither the NRC’s pilot dry cask PRA nor EPRI’s bolted storage cask PRA 

thoroughly investigated the contexts (i.e., an ATHEANA-like approach) in which failures may 

occur. Therefore, even for HFEs identified in previous studies, this analysis provides additional

insight and understanding into how those HFEs may actually occur. 

The scenarios are organized into the following categories of SFH and cask operations. Please 

refer to Section 7.3 for a comprehensive table summarizing HFE group descriptions, scenario 

titles, and vulnerabilities.

(1) Scenarios before and during fuel loading

(2) Scenarios during transfer cask movement from SFP to preparation area

(3) Scenarios during MPC and transfer cask sealing operations

(4) Scenarios during transfer cask movement from preparation area to transfer pit

(5) Scenarios during MPC movement from transfer cask down to storage cask

(6) Scenarios during storage cask movement from transfer pit to ISFSI pad

(7) Scenarios during monitoring and storage at the ISFSI

Recall that this analysis is intended to be a qualitative preliminary-level analysis; therefore,

process descriptions, human failure events (HFE), descriptions, unsafe action (UA) descriptions, 

and error forcing context (EFC) descriptions are treated somewhat generically. In fact, specific 

HFEs, UAs, and EFCs are not explicitly identified during this stage of the qualitative HRA so as

not to impose excessive structure on these preliminary scenarios. In addition, there was no 

attempt to exhaust the search for possible scenarios; it was deemed sufficient for preliminary

demonstration purposes to cover a broad spectrum of scenario examples.

 23 Additional information regarding cask drop scenarios, human performance vulnerabilities, and mitigative 

strategies for avoiding the consequences of human errors is presented in NUREG/CR-7016 [29].
8-2

8.1. HFE Scenarios Before and During Fuel Loading 

This phase spans a wide range of time. It begins with previous movement of fuel in the SFP 

(i.e., how the current fuel arrangement in the pool emerged), includes the fuel move planning 

process, and continues through the actual loading process until the MPC is loaded with fuel. 

This phase ends at the point when the last fuel assembly has been loaded into the MPC and 

verification activities for the fuel load are complete. Further details on process steps are 

included in Section B.1 and B.4.1 of Appendix B.

8.1.1. Definition and Interpretation of Issue 

HFE Scenarios Prior To and During Fuel Movement Planning and During the Fuel-loading

Process – This process includes previous movements of fuel in the SFP that may affect the 

accuracy of fuel location inventories, the fuel planning process prior to a cask loading campaign, 

and the actual movement of fuel from the SFP to the cask or canister.

Reason for Analysis – These scenarios are analyzed because the potential of loading a cask 

with fuel that has been insufficiently cooled in the SFP, that has a higher burn-up history than 

the cask is designed for and rated to hold, or that has been otherwise damaged (i.e., mistakenly 

identified as intact fuel), or movement of the correct fuel assemblies into an incorrect 

configuration may challenge the cask or canister integrity.

Potential Consequences – Loading a cask or canister with fuel that is significantly hotter than 

anticipated, of too high a burn-up for the cask, or otherwise damaged, may lead to or 

exacerbate a process in which fission products may migrate beyond the site exclusion region 

and pose a hazard to public health and the environment. In the absence of cask or canister 

damage during movement or through corrosion/aging processes, fission products would likely 

be released (if released at all) during handling of casks decades after initial emplacement.

8.1.2. Base Case Scenario

Initial conditions – The initial conditions for this process involve an SFP in which bundles 

representing multiple core offloads are present, including an amount of “hot fuel” (i.e., out of the 

core less than 3 years) representing two-thirds of a full core load. There is also one-third of a full 

core load that is 3- to 5-year-old “warm fuel,” and there is one-third of a core load that is “highburn-up” fuel (e.g., 60+ GWd/MTU). This may be reasonably assumed for nuclear power plants 

in operation for more than 3 years, given that typically one-third of the core is changed out 

during each refueling campaign, and refueling campaigns are held once every 12 to 24 months.

A typical situation is defined:

• The nuclear fuel engineering department at the plant is beginning to prepare the fuel 

load plan for a cask loading campaign (CLC) expected to begin in 2 weeks.

• Preparations for the CLC have been underway for a couple of months.

• This is not the first CLC carried out at the plant.

• The next refueling outage is scheduled to begin in 4 months.
8-3

8.1.3. General Human Performance Vulnerability Concerns

(Refer to Section 7.1.1 for the list of human performance vulnerabilities.)

8.1.4. Scenarios Before and During Final Loading

Table 8-1 Scenarios before and during fuel loading.

HFE 

Group

HFE Group 

Description

Scenario Vulnerabilities

1 Before & 

during fuel 

loading

1. Failure in fuel movement 

planning results in misload of 

≤ 13 spent fuel assemblies 

with wrong fuel

2. Failures of multiple 

personnel in fuel movement 

results in misload of ≤ 4 

spent fuel assemblies

3. Failures of one person 

during fuel movement results 

in misload of ≤ 4 spent fuel 

assemblies

4. Omission of in-pool staging 

results in misload of ≤ 4 

spent fuel assemblies

5. Failures during fuel 

movement lead to misload 

with wrong fuel

6. Fuel handling failures 

damage fuel during 

placement

• Unchallenging activities

• Limited indicators & job aids

• Visual challenges

• Communication difficulties

• Perceived time pressure

• Configuration control

• Trust

• Inexperience

• Confirmation bias

• Informal rule leads to 

procedure violation

• Other ergonomic issues
8-4

Scenario 1: Failure in Fuel Movement Planning Process Results in Misload of ≤ 1324

Spent Fuel Assemblies with Wrong Fuel25

Planning person mistakenly duplicates instead of “reflects” the placement pattern of a sister unit,

resulting in extensive misplacement of fuel bundles. In this scenario, the plant site has two 

reactor units sharing a single SFP. During the refueling outage for one unit, the planning person 

mistakenly assigns the fuel movement (i.e., irradiated fuel movement to the SFP from the 

reactor core) in a manner that replicates the movement patterns used for the sister units’ last 

outage. The correct fuel movement pattern, based on the two-unit configuration, would have 

been to use a mirror image or reflected pattern. This mistake results in many “warm”

26 fuel 

assemblies being placed in locations where it is expected that “old” or “cold” fuel assemblies will 

be located. Time pressure and inexperience in preparing for the refueling outage contribute to 

the fuel movement plan mistake and the subsequent perfunctory approval by the department 

manager overseeing the planning operation.

Fuel handling person/personnel (FHP) and spotter fail to notice signs of “warm” fuel. Given that 

many fuel assemblies in the pool have not yet surpassed the 3-year mark, it is expected that 

some will exhibit the characteristic blue glow caused by Cherenkov radiation. It may be possible 

to observe increased water convection around the fuel assemblies due to light refraction (i.e., 

the mirage effect), but these personnel are not expecting or specifically trained to notice such 

phenomena. Therefore, they do not see the phenomena, or they see it and do not recognize it 

as a problem because they expect some fuel assemblies to be hotter than others.

Correct fuel movement (i.e., according to the fuel move sheets) is carried out. The FHP, spotter, 

and supervisor all execute their duties faithfully and correctly according to the fuel move sheets 

prepared by the nuclear fuels engineering department. This results in a large number of warm 

fuel bundles being placed along the outside perimeter of the canister, in addition to the hottest 

planned fuel bundles at the center of the canister. 

Cask sealing personnel do not detect presence of “warm fuel.” Temperature, pressure, and 

radiation monitoring during cask sealing operations do not identify higher-than-expected levels 

as being dramatic enough to alert personnel of a misload, especially in the context of a very 

well-executed fuel movement plan.

Potential Human Performance Vulnerabilities for Scenario 1:

• There is time pressure during refueling outage preparations.

• A configuration control process for developing fuel placement patterns is not established 

to provide cues that specifically interfere with replication versus reflection of sister unit 

core off-loads.

• Inexperience with generating fuel placement patterns leads to a “copy the other unit”

approach, instead of thoroughly understanding the core-to-SFP fuel movement process.

 24 Thirteen spent fuel assemblies were chosen because this value was identified in EPRI’s PRA of Bolted Storage 

Casks report as the number of 1 year-old assemblies that would need to be loaded into a TN cask to cause fuel 

cladding failure and failure of bolted cask barriers to fission product release [5]. 25 “Wrong fuel” indicates that improper assemblies (i.e., improperly aged, high-burn-up, damaged, etc.) are selected 

for movement; this is contrasted with scenarios in which the “right fuel” is put into the wrong locations within an MPC 

or canister.

26 Note that high-burn-up or damaged fuel could have been substituted in this scenario.
8-5

• Observing or otherwise being aware of the strict adherence to procedures by FHP, 

spotter, and supervisor provides enough evidence to cask sealing personnel to “believe”

that the right fuel is loaded in the right locations. Therefore, they readily discount signs 

(e.g., temperature, pressure, and radiation levels) that conflict with that “belief.” For 

example, the worker monitoring radiation might believe a slight error in calibrating the 

radiation monitor had occurred, as opposed to suspecting that incorrect fuel bundles 

were loaded.

• There are ergonomic issues among FHP related to clothing (i.e., the suits required when 

working above the SFP) and the cramped working space on the refueling crane bridge 

Scenario 2: Failures of Multiple Personnel in Fuel Movement Results in Misload of ≤ 427

Spent Fuel Assemblies

FHP succumb to the monotony of the fuel-loading task. The FHP and spotter stop following the 

step-by-step process indicated on the fuel move sheets after the first few fuel assembly moves. 

They are experienced personnel who have performed this type of operation many times, and 

they find the step-by-step process too tedious and largely unnecessary. They employ a new 

strategy of moving a column of four assemblies from an SFP rack to the designated positions in 

the staging area and then indicate the changes on the fuel move sheet. The spotter willingly 

goes along with this change in plan. The example position for the first of the four assemblies is 

in grid location alpha-20. FHP 2 happens to be thinking of a number similar to the number 20; 

for example, maybe his oldest child just turned 21 years old, or maybe he has worked for the 

utility for 21 years, etc. This type of similarity in the two numbers leads to a memory intrusion28

of 21 into the grid location. He proceeds to alpha-21 to retrieve the first of four assemblies in the 

column of 21. In this particular scenario, he experiences a “lapse.”

29

Spotter incorrectly verifies the position of the first assembly. The spotter is also bored by the 

monotony of the step-by-step process, but he does attempt to verify the first assembly in the 

column. The spotter correctly views the serial number of the bundle in location alpha-20 after 

the FHP have positioned the bridge crane, but before they have lowered the hoist. The spotter 

incorrectly believes that the FHP are retrieving the correct fuel assembly and did not “hear” the 

alpha-21, because the FHP either stated alpha-20 prior to moving the crane, or alpha-21 was 

stated and the spotter “heard” alpha-20. In this particular scenario the spotter has experienced a 

“slip.”

30

FHP complete the move of the fuel assemblies to the staging area. The bundles are moved to 

the locations that the four bundles in column 20 were to be placed. The location was the 

outermost column of four assemblies in a 24-assembly canister configuration (see Figure 8-1). 

 27 The reason for choosing ≤ four spent fuel assemblies is that we had a difficult time envisioning scenarios in which 

these types of human performance issues would lead to misloading of more than four bundles. It is important to note 

that this “difficult time” is a subjective assessment that might change if we are able to observe and learn more about 

SFH operations at a specific plant.

28 Here an intrusion is the introduction of a frequently recalled number from long-term memory into the script of 

alphanumeric grid locations for fuel assemblies. The frequent, recent reflection on the number (in this case 21, but 

many other number pairs could be substituted) centered around significant life events (e.g., child turning 21, or 

service anniversary of 21 years, etc.). This is contrasted with other number-letter types of mistakes (e.g., number “1”

and letter “l”; number “0” and letter “o”; etc.). 29 A lapse is a memory failure in which a step in a planned sequence of events is missed. See reference 21 for 

additional explanation.

30 A slip is an attentional failure in which a planned task is carried out incorrectly or in the wrong sequence. See 

reference 21 for additional discussion on how slips may occur.
8-6

According to the fuel move sheet, the fuel bundles from column 21 in the spent fuel racks were 

to be placed in one of the center-most columns of the canister. 

Figure 8-1 Intended versus actual placement of fuel in Scenario 2.

Spotter incorrectly verifies the position of the first four assemblies in the staging area. Given the 

slight (i.e., one column) discrepancy of the alignment of the mispositioned assemblies with the 

position designated in the fuel move plan, the spotter again incorrectly verifies the column 

position of the assemblies.

Note: Additional slips or lapses would need to be committed in order to sustain the view that a 

“correct” fuel assembly configuration is being created. This may be conceivable, given a general 

attitude of complacency with the “monotony” or “lack of challenge” in the activity. Also, SMEs 

have indicated that visual difficulties induced by awkward viewing (i.e., looking over the side of 

the bridge crane at refracted light) of fuel assemblies through 6.1 meters (20 feet) of water may 

lead to mistakes. Furthermore, distractions or disruptions (e.g., radiation alarms, fire alarms, 

operation of heavy machinery, multiple conversations/messages over a single communications 

network) that break the focus of attention of the FHP or spotter can increase the occurrence of 

slips and lapses and decrease the number of recoveries from those unintended actions. 

FHP “correctly” replicate the placement of the fuel assemblies from the staging area to the cask.

Given that unintended actions were not identified during the staging process, it is unlikely that a 

serious review of the fuel positioning in the canister would be undertaken. This may be 

especially true given the aversion to the monotony of the process and a desire to move on to 

other scheduled activities.

Supervisor fails to thoroughly check the configuration of fuel in the canister. The supervisor 

performs a largely perfunctory verification and signs off on the fuel move sheet to be returned to 

the department responsible for fuel planning and management.
8-7

Potential Human Performance Vulnerabilities for Scenario 2:

• Fuel-loading operations are largely unchallenging activities for the FHP and spotter (i.e., 

the pace is very slow and the operations “simple”), which leads to insufficient 

stress/arousal levels to ensure optimal performance.

• Extensive experience with such a monotonous activity leads numerous crews to 

informally bypass the step-by-step procedures. Therefore, this procedural violation has 

become part of the “informal rule set” for many crews.

• Visual cues are hampered by parallax effects (due to refraction) through the SFP water,

increasing the likelihood of slips and lapses for experienced personnel.

• The experienced supervisor trusts the abilities of the experienced FHP and spotter and 

chooses not to conduct a thorough verification.

• There are ergonomic issues among FHP related to clothing (i.e., the suits required when 

working above the SFP) and the cramped working space on the refueling crane bridge.

Scenario 3: Failures of One Person During Fuel Movement Results in Misload of ≤ 4 

Spent Fuel Assemblies

Scenario 3 is identical to Scenario 2 with the exception that only one person (i.e., FHP 1) is 

actually looking at the fuel move sheets and directing the actions of FHP 2. This relieves the 

requirement of multiple individuals committing multiple slips and lapses as needed to realize 

Scenario 2. In this case, the supervisor also performs a cursory verification and does not identify 

the misload.

Scenario 4: Omission of In-pool Staging Results in Misload of ≤ 4 Spent Fuel Assemblies

Scenario 4 represents two scenarios that are identical to Scenarios 2 and 3, except that fuel is 

moved directly from the SFP racks to the cask or canister (i.e., no in-pool staging area is used 

because of space constraints or in an effort to save time). Eliminating the in-pool staging activity 

further increases the likelihood of a misload because it removes an opportunity for independent 

verification of the fuel load.

Scenario 5: Failures During Fuel Movement Lead to Misload with Wrong Fuel

Scenario 5 represents three scenarios that are identical to Scenarios 2 through 4 except that the 

fuel movement involves misloaded fuel. That is, instead of loading the correct fuel in the wrong 

positions, incorrect fuel assemblies (i.e., improperly aged fuel assemblies, high-burn-up 

assemblies, or damaged assemblies) are placed in the cask or canister. Note that these 

scenarios would require additional instances of improperly recognizing fuel assembly serial 

numbers than in the mispositioning scenarios.

Scenario 6: Fuel Handling Failures Damage Fuel During Placement

FHP and spotter correctly execute the step-by-step fuel move sheet procedure. The fuel 

handlers and spotter diligently follow the procedure and correctly position the fuel assemblies in 

the SFP staging area and in the cask or canister.
8-8

FHP damage fuel during insertion into the cask or canister. Difficulty is experienced during the 

insertion of several fuel assemblies into the canister. FHP 2 must lower, then partially raise, 

then lower these difficult fuel assemblies to seat them in the canister slots. Some degree of 

binding is noticed during the lower/lift/lower maneuvers. Careful radiation monitoring does not 

detect any cladding failure due to these undesirable movements, and extensive visual 

inspection of fuel pins is not possible without an arduous process of removing the assemblies. 

The decision is made to seal the cask.

During loading of the “difficult” assemblies, the cladding on numerous fuel pins is damaged such 

that a minimal degree of mishandling of the cask (causing buckling of the damaged pins) or of 

corrosion processes within the cask (causing corrosion breach of the pins) leads to a release of 

fission product gases to the interior of the canister. 

Potential Human Performance Vulnerabilities for Scenario 6:

• Time pressure during the CLC discourages the desire to remove fuel assemblies for 

detailed inspections.

• Frequent prior experience with “difficult” fuel assemblies in the SFP desensitizes

personnel to the effects of cladding damage on long-term fuel integrity.

• “Normal” radiation readings (which would not be exceeded until cladding penetrations 

are present) reassure personnel that no significant damage has occurred and support 

the “desired decision” (i.e., involving much less time and effort) to leave the fuel in the 

cask or canister. 

• Ergonomic issues among FHP related to clothing (i.e., the suits required when working 

above the SFP) and the cramped working space on the refueling crane bridge motivate

them to complete the tasks quickly. 

8.2. HFE Scenarios During Transfer Cask Movement from Spent Fuel Pool to 

Preparation Area

This phase begins with the loaded MPC resting in the transfer cask at the base of the cask pit in 

SFP. The lid is about to be placed on the cask. The phase continues through removal of the 

transfer cask from the SFP and placement in the preparation area. Further details regarding 

process steps are included in Section B.4.2–5 of Appendix B.

8.2.1. Definition and Interpretation of Issue 

HFE scenarios during cask movement from SFP to cask preparation area – In this process the 

fuel has already been loaded into the cask. This phase starts at the point when the lid is to be 

placed onto the cask. It continues through the removal of the cask to the preparation area,

where the lid is to be firmly affixed to the cask, but ends prior to the lid being affixed.

Reason for analysis – These scenarios are analyzed due to the potential for dropping a loaded 

cask before the cask or canister lid is properly sealed and releasing radioactive materials and/or 

greatly increasing radioactivity levels in the building.
8-9

Potential consequences – Dropping a loaded cask outside of the SFP may result in severe 

contamination of the building atmosphere; coupled with an atmospheric containment breach 

(e.g., failure to isolate the building, inadvertent opening of a leak path), a large amount of fission 

products (especially radioactive noble gases) may migrate beyond the site exclusion region and 

pose some hazard to public health and the environment.

8.2.2. Base Case Scenario

Initial conditions – The initial conditions for the start of this phase of operation will vary with the 

specific plant and cask system being used. A typical situation is defined:

• The cask is sitting properly in the loading area of the SFP.

• The fuel elements have been properly loaded into the cask.

• The yoke is still attached to the crane, but it has been disconnected from the cask 

trunnions.

• The cask lid is connected to the yoke by straps.

• The lid is sitting along the side of the cask pit with the crane stationed above it.

8.2.3. General Human Performance Vulnerability Concerns

(Refer to list in Section 7.2.1.)

8.2.4. Scenarios During Cask Movement from SFP to Preparation Area

Table 8-2 Scenarios during cask movement from SFP to preparation area.

HFE 

Group

HFE Group 

Description

Scenario Vulnerabilities

2 Transfer cask 

movement 

from SFP to 

prep. area

1. Failure in cask or canister lid

placement leaves lid ajar

2. Failure to align yoke arm 

leads to yoke arm slipping off 

trunnion as crane operator 

lifts cask out of SFP

3. Crane operator translates 

cask into fuel pool wall, cask 

drops

4. Crane operator raises cask 

too high, cable is broken & 

cask is dropped

• Limited nature of procedures

• Communication difficulties

• Limited indicators & job aids

• Visual challenges

• Unchallenging activities

• Task distribution among 

team members
8-10

Scenario 1: Failure in Cask or Canister Lid Placement Leaves Lid Ajar

Operator fails to align cask lid over cask, and lid fails to seat properly. There are potentially two 

ways that the failure to align could result in the lid not seating properly. If the drain line misses 

its location, but is still inside the cask, the lid will not center over the cask and will touch the lip. If 

the drain line is in the proper location but the yoke is slightly off to one side, the friction on the 

line will increase as the lid descends, and the line could bind.31

Maintenance workers fail to notice lid not in place. Being above the cask, the crane operator can 

somewhat see the side-to-side alignment of the lid to the cask, but this will not allow him to 

judge whether the top of the lid is flush with the top of the cask. Although potentially three 

workers could confirm the placement of the lid, only one of these workers is actually assigned

this task. Furthermore, this worker’s view is somewhat distorted due to viewing through water. 

Radiation levels are not being monitored, OR radiation monitors fail, OR warning of high 

radiation is not acknowledged. One of the workers is specifically tasked with holding a radiation 

monitor above the water surface in the vicinity of the cask as it rises. This worker will determine 

whether a high radiation condition exists. Procedures do not specify a specific action level that 

constitutes high radiation; it is the responsibility of the worker to make that determination and 

notify fellow workers.

The monitor itself is not a regularly used piece of equipment, and it is periodically calibrated. It 

needs to be put into service specifically for this activity.

The worker must indicate the existence of a high radiation condition to the crane operator by

communication headset or by hand signals. There is quite a bit of noise in the area, and verbal 

communication can be misunderstood, especially given that multiple individuals are on the 

communication net, and it may be difficult to determine who is speaking and what they are 

saying. Hand signals may be clearer, but the operator is focused on the crane control panel and 

the cask and may not see the worker giving the signals in a timely fashion. 

Potential Human Performance Vulnerabilities for Scenario 1:

• Neither the crane operator nor the communication worker has a view that provides a 

complete picture of the alignment.

• Visual cues are hampered by parallax effects (due to refraction) through the water 

surface.

• There are no control aids that support proper alignment.

• The crane operator is not in a position to be able to determine whether the lid has seated 

properly.

 31 Note that even if the alignment is incorrect in the manner suggested here, there is enough play in the drain 

line such that the lid may still seat properly on the cask.
8-11

Scenario 2: Failure to Align Yoke Arm Leads to Yoke Arm Slipping Off Trunnion as 

 Crane Operator Lifts Cask Out of SFP

Operator fails to properly align yoke arms to trunnion; one yoke arm only partially engages. 

While the operator can see that the yoke arms have closed over the trunnions, there is no clear 

view of the connection to ensure that the trunnions are in far enough to guarantee a safe lift.

The indication that there is weight on the crane only indicates that the trunnions are at least 

partially engaged, which may be only the edge of an arm on the edge of a trunnion.

Maintenance workers fail to notice error. Although potentially three workers could confirm this

connection, only one is actually assigned this task. Furthermore, the worker’s view is hampered 

by the distortion through water. If the worker judges that the yoke arms are in the proper 

position, and this assessment is confirmed by the cask rising slightly as the yoke is tensioned, 

then the worker will begin to prepare for the next task in the process. The other workers will also 

be preparing for their roles.

Yoke arm slips off trunnion during lift. With the yoke arm only partially engaged, the cask will still 

be lifted by the crane. It is also possible that, despite the movement of the cask relative to the 

yoke, the cask will remain suspended until it reaches its next resting place. However, the 

relative motion could cause it to slip off at any time, which would cause the cask to drop 

sideways and the lid (which is not held in place) to come off.

Potential Human Performance Vulnerabilities for Scenario 2:

• Visual cues are hampered by parallax effects (due to refraction) through the water 

surface.

• There are no control aids that support proper alignment.

• Control panel indications do not provide positive indication that the yoke arms have 

engaged the grooves in the trunnion.

Scenario 3: Crane Operator Impacts Cask into Fuel Pool Wall; Cask Drops

Operator does not lift cask sufficiently to clear pool wall. The crane operator must depend on the 

height indicator on the control panel to determine whether the cask has been raised to a height 

sufficient to clear the SFP wall when it is moved. The view from the crane cabin does not offer a 

suitable angle to judge height above the pool surface once the bottom of the cask clears the 

surface.

32

Maintenance workers fail to notice error. At this point in the process, the workers do not have a 

particular role with respect to the cask. They have completed spraying the cask surface and are 

preparing to dry the cask surface once it is moved away from the pool. Their focus is on putting 

away the equipment used for spraying and radiation monitoring, and getting the equipment 

needed for wipe down and drying. They are unlikely to be expecting any problems with the 

simple move of the crane. 

 32 One important assumption in this scenario is that a designated spotter for the crane operations either has not 

been assigned, or the assigned spotter is temporarily unavailable or distracted during the lift.
8-12

Operator is not paying attention; cask hits pool wall and tilts over as crane moves; angle of cask 

causes yoke arms to slip off trunnions. The crane operator is likewise not expecting any 

problems with this move. The operator is primarily focused on the position indication on the 

control panel or on the crane to move to the position necessary for the drying process.

Potential Human Performance Vulnerabilities for Scenario 3:

• Visual cues are relatively useless to the crane operator.

• The maintenance workers are not tasked to monitor the progress of the move.

• The simplicity of this task adds a level of complacency to the crew.

Scenario 4: Crane Operator Raises Cask Too High; Cable Breaks and Cask Drops

Operator is not paying attention during lift of cask and fails to stop lift in time. This action is 

extremely simple but time consuming. A single switch will lift the cask, and no action is required 

other than to stop the lift at the appropriate time. The crane operator has no active function 

during the lift process, and this inactivity and lack of challenge can result in an attentiveness 

problem.

Operator does not respond to warning from workers. Because the workers are spraying the 

cask during the lift, they almost assuredly notice that the cask is still rising. The worker 

responsible for communication must get the attention of the crane operator and indicate the 

situation by communication headset or by hand signals. There is quite a bit of noise in the area, 

and verbal communication can be misunderstood, especially given that multiple individuals are 

on the communication net, and it may be difficult to determine who is speaking and what they 

are saying. Hand signals may be clearer, but the operator is distracted in this case and does not 

see the worker giving the signals in a timely fashion. 

Crane tops-out and drops cask due to a two-block failure. The crane operator fails to stop the lift 

in time, two-blocking occurs, and the wire rope of the crane breaks, which leads to a free fall 

cask drop.33

Potential Human Performance Vulnerabilities for Scenario 4:

• Simple tasks can lead to complacency and distraction.

• Workers have problems communicating with the crane operator.

• Indicators and job aids, such as alarms, on the crane control panel are insufficient.

 33 Even if the crane tops-out against the blocks, it is not a given that the cask will be caused to break away and 

fall. An upper load limit/interlock, over-current, and/or overload protections on the crane could still result in the crane 

lift motor shutting down and relieving the forces.
8-13

8.3. HFE Scenarios During Multi-purpose Canister and Transfer Cask Sealing 

Operations

This phase begins with the loaded transfer cask resting in the proper position in the preparation 

area for closure operations with the scaffolding properly arrayed around the outside of the 

transfer cask. The phase continues through sealing, purging, drying, and inerting operations. It

ends when both the MPC and transfer cask are ready to be transported to where the MPC be 

inserted into the storage cask. Further details regarding process steps are included in Section 

B.4.6–13 of Appendix B.

8.3.1. Definition and Interpretation of Issue 

HFE scenarios during MPC and transfer cask sealing operations – In this process the canister 

(MPC) is loaded. The MPC lid is placed on top, and the MPC is resting inside the transfer cask 

at the preparation area. All of the closure and preparation activities are performed such that the 

MPC is ready for emplacement in the shielded storage cask.

Reason for analysis – These scenarios are analyzed due to the potential for identifying a fuel 

misload event, a human-initiated fire event, and most importantly, for the potential to leave a 

leak path, or a “soon-to-be-present” leak path condition from the inside to the outside of the 

MPC.

Potential consequences – Storing misloaded fuel may degrade fuel assemblies such that fission 

products migrate to the general environment within the MPC; a human-initiated fire during 

closure operations may create a condition that leads to fuel damage and a release of fission 

products to the reactor, auxiliary, or fuel building environment; and the establishment of a leak 

path could allow for fission products to migrate to the storage cask or module at the ISFSI, 

which may then migrate away from the ISFSI and threaten the public and the environment.

8.3.2. Base Case Scenario

Initial conditions – The initial conditions for the start of this phase of operation will vary with the 

specific plant and cask system being used. A typical situation is defined:

• The loaded MPC in the transfer cask is positioned properly in the preparation area with 

scaffolding properly positioned around the cask. 

• The MPC lid has been placed into position, but it is merely resting, unsecured on the 

MPC shell.

• Personnel are decontaminating the area around the top flange of the transfer cask and 

preparing to install the temporary shield ring or other form of gamma radiation shielding 

to prevent radiation streaming from the trunnion recess areas of the transfer cask water 

jacket.
8-14

8.3.3. General Human Performance Vulnerability Concerns

Below is a summary of some potential human performance vulnerabilities that may affect MPC 

and transfer cask sealing operations.

Decision-Making Biases Based on Perception of Loss – The manner in which a person frames 

the concept of “loss” in a given situation provides a strong biasing factor toward all actions that 

enable the person to steer away from incurring that “loss” [22]. People often tend toward 

discovering a simple, non-loss-threatening alternative explanation to a situation, instead of 

attending to a complex, loss-threatening explanation. For example, the situation in which a 

radiation protection (RP) person detects high radiation levels after a re-decontamination of the 

lid may choose the non-loss-threatening explanation of “I just swiped too close to a normally 

’hot’ area” as opposed to the loss-threatening explanation of “Oh, no, we’ve got misloaded fuel 

in here and need to spend considerable time and effort to get the cask back in the pool and 

thoroughly investigate. Not only that, but we better move quickly.” The losses referred to here 

are the loss of time, lost of respect for those who “messed up and got us into this situation,” and 

potential loss related to damaging fuel that then leads to a fission product release. Another 

example of this loss-avoidance behavior is that of personnel draining, purging, drying, and 

backfilling who choose the simple, non-loss-threatening explanation of a “welding delay” leading 

to excessive temperatures (the specifics of this example are elaborated on in Scenario 1 in this 

section).

Interestingly, at the point in the future when the fuel misload condition described in scenario 1 is 

eventually discovered, the incident investigators will probably be astounded that multiple 

personnel disregarded signs of a fuel misload because the potential consequences of fuel 

damage, fission product release, etc., are so great versus the “inconvenience” of getting the fuel 

back in the pool and carefully tending to a potential problem. Of course, for the personnel 

conducting the tasks “in the moment” (e.g., under some level of time pressure, not wanting to 

disrupt major operations and schedules, not wanting to tarnish the team’s reputation) the mental 

accounting of “loss” may allow them to filter out and explain away signals that point to a misload 

event. Personnel “in the moment” may be thinking that they do not want to be forced to deal with 

a misload event, and they also cannot really imagine that the many barriers against a misload 

event would somehow be circumvented.

34 To learn more about the important and complex topic 

of loss avoidance and how people may conceptualize or perceive real/potential losses, please 

review references 22-24.

Limited Nature of Procedures – The cask sealing operations may be relatively well 

proceduralized, but they still depend primarily on craft-type skills and additional training 

experiences. In these activities, procedures will specify basic tasks in the process, but a number 

of skill-based subtasks are performed at the discretion of particular individuals and teams. A few 

specific potential procedural oversights presented in this section include the following: First, 

cask loading campaign preparations do not account for potential rapid relocation of fire ignition 

sources to flammable material storage areas due to rapid air movement by the HVAC system. 

This leads to improper designation of “safe” areas for flammable items and stationing of fire-

 34 Note that we are not trying to imply that such a fuel misload event scenario is somehow highly likely; such 

scenarios are simply designed to plausibly argue how an occurrence deemed “highly unlikely” using certain analysis 

techniques, may actually happen when human beings play crucial roles in the process. It should also be noted that 

one of the authors of this report has devised a framework which may assist in detecting and devising mitigation for 

parts of an operation that are vulnerable to undesirable actions based on the mental accounting of real or potential 

“loss” in addition to many other associated perceptual/decision making biases (e.g., confirmation bias, etc.) [22]
8-15

fighting personnel during “ignition prone” operations (e.g., welding, grinding, or cutting torch 

operations). Second, there is a lack of explicit procedures specifying that both members of the 

cask closure team must inspect all bolt holes for water. Current procedures specify only that all 

bolt holes need to be visually inspected; therefore, an opportunity for quality assurance (QA) 

redundancy is missed. 

Time of Day and Shift Work –The scenarios reveal an all too common pattern that emerges in 

shift work situations. Slips, lapses, mistakes, and violations tend to occur more often when 

workers are fatigued, especially when that fatigue is encountered during late night or early 

morning hours.

35 Furthermore, personnel working occasional night shifts may be tempted to 

rush operations in order to end shifts early or at least change the focus to non-taxing activities 

(e.g., hurry up with the welding that demands significant mental and physical effort, and then 

leisurely finish the balance of the shift with less demanding tear-down and clean-up activities).

Pace of Operations – Some activities involved in cask sealing, drying, purging, and backfilling 

operations are, in general, quite simple. In addition, the speed of many of the movements is 

slow, so each action takes a long time to complete. Basically, this can be slow, monotonous

work, and some individuals have significant downtime between actions. There is ample 

opportunity for diversion and distraction, and an air of informality and complacency can easily 

exist within and amongst the team members. From a psychological perspective, there may be 

insufficient dynamic activity to generate an optimum stress/arousal level for performance.

Visual Challenges – As mentioned previously, visual cues are the primary means of performing 

cask closure operations such as cleaning, grinding, tack welding, and even liquid dye penetrant 

testing and hydrostatic testing. Maintaining visual vigilance for long periods is difficult work.

36

Ultrasonic testing is often not suited for the major lid and closure ring welds; therefore, visual 

and tactile cues are critical. Another specific visual challenge comes from the use of a non-auto 

darkening welding helmet that reduces the ability of the welder to rapidly detect ignition of 

flammable material following a hydrogen ignition37 during lid closure operations.

Other Ergonomic Issues – The working space on the scaffolding surrounding the transfer cask 

is relatively cramped, and ambient temperatures and protective clothing (i.e., contamination 

control suits and additional clothing for protection from welding slag) can cause heat stress.

A number of actual events involving incomplete or incorrect procedures during sealing 

operations and also actual hydrogen ignition events during lid sealing have occurred (see the 

NEI database on SFH events [8]). Summaries of those events were made available to us via a 

 35 It is possible that not all individuals are affected this way as a function of late night or early morning activities, 

but the general stereotype has proven to be very strong, and despite some directed efforts, there has not been a 

reliable way to identify/select people who are especially suited to night shifts or early morning shifts (i.e., within 

subject variability is not well-understood). Day-to-night physiological changes (i.e., circadian rhythms) are well 

documented in a many studies of human performance. See reference 25 for an introduction and overviews of the 

circadian rhythm and shift work literature.

36 Research at Sandia National Laboratories has recently discovered dramatic levels of omission during aircraft 

structural inspections among highly experienced, highly motivated maintenance personnel. When confronted with the 

results of these experiments, many of the maintenance personnel are shocked to discover their actual level of 

performance. For discussion on human signal detection and for entry points into the extensive literature on this topic, 

see references 25, 26, 27, and 28. 37 A hydrogen ignition event during lid closure is typically a deflagration; deflagration is a process of subsonic 

combustion that usually propagates through thermal conductivity (hot burning material heats the next layer of cold 

material and ignites it); deflagration is contrasted with detonation, which is supersonic and propagates through shock 

compression.
8-16

CD from the NRC. Specific events are not listed here as they were generally of minor 

consequence. The point is that slips, lapses, mistakes, and violations have occurred during 

these types of operations. One SME interviewed described an event in which a weld gas 

(argon) was mistakenly used to backfill a cask. The mistake was identified before the cask left 

the preparation area, but instead of opening ports on the cask and repeating the backfill, a quick 

calculation was made that demonstrated the acceptability of using argon gas as the backfill gas.

8.3.4. Scenarios During MPC and Transfer Cask Sealing Operations

Table 8-3 Scenarios during MPC and transfer cask sealing operations.

HFE 

Group

HFE Group 

Description

Scenario Vulnerabilities

3 MPC and 

transfer cask 

sealing 

operations.

1. Failure to identify a fuel 

misload event

2. Human initiated fire event–

welded cask

3. Failure leaves leak path 

existing at the end of sealing 

& preparation activities–

welded cask

4. Failure leads to impending 

leak path due to undetected 

problem during sealing & 

preparation activities–welded 

cask

5. Failure leads to impending 

leak path due to undetected 

problem during sealing & 

preparation activities–bolted 

cask

• Biases based on perception 

of loss

• Limited nature of procedures

• Time of day & shift work

• Pace of operations

• Visual challenges

• Perceived time pressure

• Omission in hazard analysis

• Improper training

• Overconfidence

• Lapse

• Other ergonomic issues 

(welder’s helmet)

Scenario 1: Failure to Identify a Fuel Misload Event

Preparation worker does not decontaminate lid properly. The preparation worker does not 

completely wipe down and decontaminate the MPC lid surface and top flange area. The specific 

area not wiped down completely is near where the shield ring is installed to absorb gamma 

radiation near the trunnion recess areas of the transfer cask. The omission occurs as the 

preparation worker is trying to work around other personnel preparing to move the shield ring 

into position.

Radiation protection worker detects high radiation levels. After the shield ring is installed, the 

radiation protection (RP) worker detects an unusually high level of radiation emitting from the 

area that was not properly decontaminated above the trunnion recess area. The preparation 

worker, who is standing next to the RP worker, recalls forgetting to wipe down that area and 

mentions it to the RP worker. The preparation worker then wipes down the area. The RP worker 

makes another pass with the radiation monitor and finds a lower, but still unusually high level of 

radiation. However, the RP worker readily dismisses the radiation level to moving the probe too 

close to the trunnion recess side of the shield ring.
8-17

Welding equipment causes delay. A problem with the automated welding equipment causes a 

delay that postpones closure operations for more than an hour.

Excessive temperatures during draining and purging are attributed to delay. Unusually high 

MPC internal temperatures noted during the draining and purging processes are attributed to 

the delays in getting the cask sealed. Even some indications of localized water boiling in the 

cask are not investigated thoroughly. That is, personnel are expecting the cask to heat up due 

to fuel-decay heat when the MPC is filled with non-circulating, non-cooled water. The personnel 

are encouraged to keep moving and get the vacuum process underway as that will remove a 

large amount of heat from the MPC.

Lack of evidence of excessive cooling in the vacuum lines is positively received by personnel. It 

is typical for a gradual step process to be used in lowering MPC pressure with the vacuum 

drying system; this is often necessary to prevent ice from forming in parts of the system. With 

the present “warm” cask, evidence of icing never occurs, and the preparation personnel 

continue with a rapid evacuation process and subsequent helium backfill. 

Early pressurization with helium is not noticed. The personnel backfilling the cask with helium do 

not carefully estimate how much gas should be required to pressurize the MPC (e.g., from past 

experience or from rough phenomenological calculations); therefore, they do not notice that it 

requires a significantly smaller volume of helium to reach required pressures in the cask. 

Welding of remaining cask penetrations proceed quickly after the backfill, and an increased 

MPC internal pressure is not discovered.

Initial vent temperature monitoring does not reveal excessive temperatures. Excessive 

temperatures noted at the outlet vent of the storage cask are dismissed due to unseasonably 

hot local weather at the ISFSI. Fuel damage inside the MPC gradually proceeds, undetected for 

an extended period of time.

Potential Human Performance Vulnerabilities for Scenario 1:

• It is easy to find a simple, non-loss-threatening alternate explanation to a situation, 

instead of attending to a complex, loss-threatening explanation. For example, the 

situation in which the RP person detected high radiation levels after the redecontamination of the lid led to the non-loss-threatening explanation of “I just swiped 

too close to a normally ’hot’ area,” as opposed to the loss-threatening explanation of 

“Oh, no, we’ve got misloaded fuel in here and need to spend considerable time and 

effort to get the cask back in the pool and thoroughly investigate. Not only that, but we 

better move quickly.” The losses referred to here are the loss of time, lost of respect for 

those who “messed up and got us into this situation,” and potential loss related to 

damaging fuel that then leads to a fission product release. Another example of this loss 

avoidance behavior is that of the draining, purging, drying, and backfilling personnel who 

choose the simple, non-loss-threatening explanation of a “welding delay” leading to 

excessive temperatures.

Interestingly, in the future when this fuel misload condition is eventually discovered, the 

incident investigators will probably be astounded that multiple personnel disregarded 

signs of a fuel misload because the potential consequences of fuel damage, fission 

product release, etc., are so great versus the “inconvenience” of getting the fuel back in 

the pool and carefully tending to a potential problem. Of course, for the personnel 

conducting the tasks “in the moment” (e.g., under some level of time pressure, not 
8-18

wanting to disrupt major operations or schedules or tarnish the team’s reputation) the 

mental accounting of “loss” may allow them to filter out and explain away signals that 

point to a misload event. Personnel “in the moment” may be thinking that they do not

want to be forced to deal with a misload event, and they also cannot really imagine that 

the many barriers against a misload event would somehow be circumvented.

38

22

(To learn 

more about the complex topic of loss avoidance and how people may conceptualize or 

perceive real/potential losses, please review references , 23, and 24.)

• There are no detailed procedures with appropriate thresholds for alarm.

• There are errors in equipment calibration.

• Personnel perceive time pressure.

Scenario 2: Human-Initiated Fire Event – Welded Cask

Welder fails to monitor for hydrogen properly. In this scenario the fuel has been properly loaded 

into the MPC, but during preparations for welding, the welder does not properly monitor for 

hydrogen (e.g., improper placement, improper operation, error of omission in turning the 

equipment on, welder has sealed several MPCs with no previous hydrogen gas problems). 

During tack-welding operations, a hydrogen ignition occurs, which ignites flammable items near 

the welding operation. The welder is startled by the hydrogen ignition, and one of his hands is

slightly injured by the MPC lid, which quickly raises a couple of inches due to expanding 

hydrogen gas. The welder raises his dark-tinted welding helmet to the upright position, allowing 

him to visually survey the area.

Flammable items are left in close proximity to welding operations. Paperwork related to welding 

procedures are left in the vicinity of welding operations and are ignited. Upon raising the face 

shield of his welding helmet, the welder notices the burning papers and reaches for a nearby fire 

extinguisher.

Burning material migrates to the location of a large amount of flammable material in the vicinity 

of the cask preparation area scaffolding. One drawback to the high volume of air movement in 

the building (i.e., as the ventilation system works to maintain a negative pressure inside the 

building) readily becomes apparent; the burning papers migrate quickly toward other flammable 

materials (e.g., more paper products, nylon slings or webbing, lubricating oil, cleaning 

chemicals, dirty cleaning rags, towels used to decontaminate the cask) near the scaffolding, and 

a large fire erupts. 

Potential Human Performance Vulnerabilities for Scenario 2:

• Use of a non-auto-darkening welding helmet reduces the welder’s ability to rapidly detect 

ignition of flammable material following a hydrogen deflagration.

• Cask loading campaign preparations do not account for the potential for fire-ignition 

sources to rapidly relocate to flammable material storage areas due to rapid air 

movement by the heating, ventilation, and air conditioning (HVAC) system. This lead to 

 38 Again, reference 22 provides a framework which may provide assistance in detecting and mitigating parts of 

an operation that are vulnerable to undesirable actions based on the mental accounting or real or potential “loss” in 

addition to many other associated perceptual/decision making biases (e.g., confirmation bias, etc.).
8-19

improper designation of “safe” areas for flammable items and stationing of fire fighting 

personnel during “ignition prone” operations (e.g., welding, grinding, or cutting torch 

operations).

• Training on the use of hydrogen-monitoring equipment is inadequate or ineffective.

• Previous successes during lid-welding operations have encouraged a less attentive 

focus on hydrogen monitoring.

Scenario 3: Failure Leaves Leak Path Existing at the End of Sealing and Preparation 

Activities – Welded Cask

Welder closes lid on eighth and final cask during the cask loading campaign. The welder has 

performed very well on the previous seven MPC lids and accompanying port and drain covers 

and closure rings. No errors have been identified with the previous cask closure operations. The 

welder’s movements are finely tuned to perform the operations quickly and precisely. 

Previous non-destructive evaluations (NDEs) were successful. The person responsible for the 

liquid dye penetrant testing (PT) and ultrasonic testing (UT) has also successfully carried out the 

required duties on five of the previous seven cask-loading operations and is ready to repeat that 

performance one more time. 

It is the last night shift of the cask loading campaign. Both the welder and the NDE worker want

to complete these closure activities as soon as possible; therefore, they perform their operations 

quickly. Unfortunately, they move a bit too quickly. The welds on the MPC lid and closure ring 

each contain a nearly co-located defect due to co-located surface aberrations at the MPC lid-toshell interface. The NDE tests on the lid and closure ring consist only of the penetrant testing,

as the geometry and orientation of these welds is not conducive to ultrasonic testing. The 

penetrant tests are performed once the metals surfaces are just cool enough not to boil off the 

dye. Therefore, tension forces and related stress concentrations that would occur in the metal 

once the metal has cooled do not have time to occur before the tests are completed. The 

correct manner of carrying out the penetrant tests would be to allow the metal surfaces to cool 

much more before initiating the NDEs.

Hydrostatic testing does not reveal impending leak. The hydrostatic test does not expose the 

impending leak path as the very warm water inside the cask, pressurized with the addition of a 

relatively slight amount of SFP water, is still very warm and does not cause the MPC lid to cool 

rapidly. At this time, a leak path has not emerged in the closure ring either.

Welding of port and drain covers and drying and inerting operations proceed successfully. 

These operations are performed smoothly. Although the temperature decreases due to the

vacuum process cause the defect in the MPC lid weld to open into a small penetration path, the 

cooling is not sufficient to completely open the leak path in the closure ring. Therefore, no 

indications of an inability to hold helium gas pressure are observed.

It is cold in the storage cask staging area at the base of the reactor building. Further cooling of 

the closure ring, aided by cold ambient temperature (~40 oF) at and near the ground floor of the 

reactor building, enable the leak path to grow as the MPC is transferred to the storage cask. 

The complete leak path emerges just as the transport crawler is beginning to move the storage 

cask toward the ISFSI pad. Sounds of escaping gas are concealed by engine and track noises. 

The cask is properly positioned at the ISFSI pad without detection of the small leak path. 
8-20

Potential Human Performance Vulnerabilities for Scenario 3:

• Successfully and efficiently performing numerous previous cask sealing operations in 

recent days leads to overconfidence in abilities, which encourages deviations from 

procedures to accelerate the closure process.

• Beginning closure operations in the middle of the night shift further motivates personnel 

to “get the cask finished and out to the pad.”

Scenario 4: Failure Leads to Impending Leak Path Due to Undetected Problem During

Sealing and Preparation Activities – Welded Cask

This scenario is identical to Scenario 3 except that the actual leak path does not fully materialize 

until the loaded storage cask has been at the ISFSI pad for more than approximately 10 days 

(i.e., it has already gone through the initial monitoring period somewhere between 5 to 7 days

and has entered the long-term monitoring and storage time period). See Section B.7 of 

Appendix B for a description of ISFSI activities. 

Scenario 5: Failure Leads to Impending Leak Path Due to Undetected Problem During 

 Sealing and Preparation Activities – Bolted Cask

Water partially fills bolt holes. The cask operations procedure contains steps to install plugs or 

place barriers (e.g., duct tape) over the tops of the bolt holes to prevent water ingress. However, 

water manages to partially fill two of the bolt holes due to poorly placed or improperly adhering 

strips of duct tape.

Cask closure personnel fail to detect water in bolt holes. One of the two cask closure team 

members gets distracted while inspecting bolt holes for the presence of water. Two bolt holes 

containing some water escape inspection. All of the bolts are inserted into the bolt holes and 

torqued down to the specified level. The two bolts that reach proper torque levels “early” due to 

the water blockage do not stand out to the cask closure team as not being seated exactly the 

same as the other bolts. 

Slow evaporation of water in bolt holes exposes leak path. The leak path does not fully emerge 

for over a year as the water in the bolt holes slowly evaporates. Once the leak path is 

established, inerting gas escapes and corrosion processes accelerate. 

Potential Human Performance Vulnerabilities for Scenario 5:

• A slight slip of attention leads to omission of critical inspection activity.

• There are no explicit procedures specifying that both members of the cask closure team 

must inspect all of the bolt holes for water. Current procedures only specify that all bolt 

holes need to be visually inspected; therefore, an opportunity for QA redundancy is

missed. 
8-21

8.4. HFE Scenarios During Transfer Cask Movement from Preparation Area to Transfer 

Pit 

This phase begins with the sealed MPC and transfer cask ready for movement to where the 

pool lid will be changed out for the transfer lid. A portion of the scaffolding is just about to be 

moved out of the intended path of the transfer cask. The phase continues up until the transfer 

cask is lowered down through the transfer pit opening39 into the transfer pit and is resting on top 

of the storage cask. The phase ends before the short slings are removed and the long slings are 

attached. Further process step details are included in Sections B.5.1–8 of Appendix B.

8.4.1. Definition and Interpretation of Issue

HFE scenarios during cask movement from cask preparation area to transfer pit – In this 

process the canister (MPC) has been completely prepared, the lid has been welded in place, 

and the top of the transfer cask has been bolted on. This phase starts at the point when the 

scaffolding is to be removed from around the cask. It continues through the change of the 

transfer lid and the movement of the cask to the transfer pit on top of the storage cask, but ends 

prior to the removal of the short slings and attachment of the long slings. 

Reason for analysis – These scenarios are analyzed due to the potential for dropping a loaded 

transfer cask from a large height and potentially damaging both the fuel and the transfer 

cask/MPC.

Potential consequences – Dropping a loaded cask may result in severe contamination of the 

building atmosphere and exit of radioactive noble gases beyond the site exclusion region.

Coupled with an atmospheric containment breach (e.g., failure to isolate the building, 

inadvertent opening of a leak path), a larger amount of fission products may migrate beyond the 

site exclusion region and pose a hazard to public health and the environment. In a lesser event, 

the cask may need to be sent back to have the MPC lid cut off and returned to the SFP to 

inspect for potential fuel damage.

8.4.2. Base Case Scenario

Initial conditions – The initial conditions for the start of this phase will vary with the specific plant 

and cask system being used. A typical situation is defined:

• The transfer cask is sitting properly in the preparation area of the refueling floor.

• The canister (MPC) lid is properly welded to the MPC.

• The MPC drying/inerting process is complete.

 39 At this point it should be reiterated that most of the detailed process information gathered for this preliminary 

study involved DCSOs at a Mark I BWR; therefore, many of the scenarios in this section are heavily biased toward 

the types of handling that would occur within a Mark I BWR plant. It is anticipated that a future report will provide 

more emphasis on PWR-plant aspects of DCSOs. In general, the largest significant difference between the BWR and 

PWR plant environments involves greater vertical and horizontal movement paths for casks within the primary 

containment structure. ISFSI operations are very similar between BWRs and PWRs with the differences arising 

mainly from the particular storage technology chosen for the site.
8-22

• The yoke is still attached to the crane.

• The short slings have not been attached to the yoke or the transfer cask.

• The welding scaffolding is properly configured around the transfer cask.

8.4.3. General Human Performance Vulnerability Concerns

The general human performance vulnerability concerns for this HFE scenario grouping are 

similar to those for the HFE scenario groupings described in Section 7.2. The basic 

vulnerabilities involve visual cues, communication, job aids, and control panel indications.

Many of the SME comments and previous events listed in Section 7.2 apply to this section,

given the similarity of crane operations.

8.4.4. Scenarios During Cask Movement from Preparation Area to Transfer Pit

Table 8-4 Scenarios during cask movement from preparation area to transfer pit.

HFE 

Group

HFE Group 

Description

Scenario Vulnerabilities

4 Transfer cask 

movement 

from prep. 

area to 

transfer pit

1. Crane operator causes cask 

to strike railing around 

transfer pit opening, cask 

drops

2. Crane operator causes cask 

to hang-up on edge of 

transfer pit opening, cask 

drops

3. Yoke arm slips off of trunnion 

as crane operator lowers 

cask into transfer pit, cask 

drops

• Limited nature of procedures

• Communication difficulties

• Limited indicators & job aids

• Visual challenges

• Unchallenging activities

• Task distribution among 

team members

Scenario 1: Crane Operator Causes Cask to Strike Railing Around Transfer Pit Opening;

Cask Drops

Operator does not lift cask sufficiently to clear railing around transfer pit opening. The crane 

operator must depend on the height indicator on the control panel to determine whether the 

cask has been raised to a height sufficient to clear the safety railing that surrounds the transfer 

pit opening when it moves over the opening. However, the view from the crane cabin does not 

offer a suitable angle to judge height above the floor in relation to the height of the railing.

Operator does not respond to warning from workers. Because the workers are positioned 

around the cask and walk with it as it is moved to the transfer pit opening, they notice it strike 

the railing. They need to get the attention of the crane operator. They do not have the 

convenience of communication headsets, so they yell or attract the operator with hand signals. 
8-23

There is quite a bit of noise in the area, so voices are not heard. Hand signals are unlikely to be 

noticed unless the workers can get in the operator’s line of sight. 

Cask tilts in relation to yoke; then swings when railing gives way, causing yoke arms to slip off 

trunnions. On initial contact with the railing, the cask begins to tilt. The railing is weak compared 

to the mass of the cask, so it gives way as the cask continues to be forced against it. Once it 

gives way, the cask begins to swing. The swinging motion causes the yoke arms to slip off, 

resulting in the cask dropping through the equipment hatch into the pit below. The slings 

connected to the MPC do not prevent the drop, because they are not designed to hold the full 

weight of the cask.

Potential Human Performance Vulnerabilities for Scenario 1:

• Visual cues are relatively useless to the crane operator.

• Workers have a problem in communicating with the crane operator.

Scenario 2: Crane Operator Causes Cask to Hang Up on Edge of Transfer Pit Opening;

 Cask Drops

Operator does not properly align cask over transfer pit opening. The crane operator has only 

visual cues to properly align the cask over the transfer pit opening. The operator’s view is 

partially obstructed by the yoke and the cask itself. Ultimately, the operator must depend on the 

workers on the floor to direct where to stop, and then position the cask at the location they 

specify.

Operator does not respond to warning from workers. Because the workers are positioned 

around the cask and observe it as it is lowered through the pit opening, they notice it hang up 

and stop descending. They need to get the attention of the crane operator. They do not have 

the convenience of communication headsets, so they yell or try to attract the operator with hand 

signals. There is quite a bit of noise in the area, so voices may not be heard. However, the 

operator should be looking directly at the workers because they are signaling where to position 

the cask and when to begin lowering the cask. However, if distracted or overly confident about 

the operation, the operator may only be looking at the control panel to focus on the height to 

stop the cask at in the transfer pit. 

Cask tilts in relation to yoke, and yoke tension begins to slacken, causing yoke arms to slip off 

trunnions. On initial contact with the edge of the transfer pit, the cask begins to tilt. As the cask 

hangs up, the tension on the yoke slackens off, and the yoke arms slip off the trunnions. The 

cask then slips off the edge of the pit and falls into the transfer pit. The slings connected to the 

MPC do not prevent the drop because they are not designed to hold the full weight of the cask.

Potential Human Performance Vulnerabilities for Scenario 2:

• Visual cues are relatively useless to the crane operator.

• Workers have problems communicating with the crane operator.

• There are no job aids to assist in proper positioning of the cask above the hatch.
8-24

Scenario 3: Yoke Arm Slips Off Trunnion as Crane Operator Lowers Cask into 

 Transfer Pit; Cask Drops

Operator fails to properly align yoke arms to trunnion; one yoke arm only partially engages. This 

error occurs early in the process, just after the scaffolding is moved. While the operator can see 

that the yoke arms have closed over the trunnions, he does not have a clear view of the 

connection to ensure that the trunnions are in far enough to guarantee a safe lift. The indication 

that there is weight on the crane only indicates that the trunnions are at least partially engaged, 

which may only be the edge of an arm on the edge of a trunnion.

Maintenance workers fail to notice error. Potentially, three workers could confirm this connection

because they are distributed around the cask and follow it as it is moved to the skid, the transfer 

lid, and the transfer pit opening. They likely only notice something amiss during the initial lift. 

Once they judge that the yoke arms are properly positioned, and their assessment is confirmed 

by the cask rising slightly as the yoke is tensioned, they are unlikely to look at the yoke and 

trunnions again.

Yoke arms become progressively less secure during the moving process. For a yoke arm to slip 

off while the cask is being lowered into the transfer pit, the initial engagement of the yoke must 

be sufficient that it will not slip off during the first few phases of the movement. At each point 

where the cask is set down, there is an opportunity for an insufficiently secure yoke arm to 

become even less secure, leading to increased potential for a drop. In this case, this occurs as 

the cask is being lifted after the transfer lid is bolted on.

Maintenance workers fail to notice error. Having already observed the cask being moved twice 

since the connection of the yoke, and with no specific procedure or checklist to check on the 

yoke arm engagement at this point in the process, the workers do not observe the change in 

yoke arm engagement.

Yoke arm slips off trunnion. With the yoke arm only partially engaged, the cask is lifted by the 

crane. It is also possible that, despite the movement of the cask relative to the yoke, the cask 

remains suspended until it reaches its next resting place. However, the relative motion could 

cause it to slip off at any time. If this happens while the cask is being lowered into the transfer 

pit, the cask will fall a substantial distance.

Potential Human Performance Vulnerabilities for Scenario 3:

• The crane operator does not have a clear view of yoke arm engagement.

• There are no control aids that support proper alignment.

• Control panel indications do not provide positive indication that the yoke arms have 

engaged the grooves in the trunnions.
8-25

8.5. HFE Scenarios During MPC Movement from Transfer Cask Down to Storage Cask 

This phase begins when the transfer cask, with transfer lid mounted to the bottom, is resting on 

the storage cask and the crane operator is reducing the slack on the short slings so they may be 

removed. This phase ends when the MPC is resting inside the storage cask and the long slings 

have been removed. Further details regarding process steps are included in Section B.5.9 of 

Appendix B.

8.5.1. Definition and Interpretation of Issue 

HFE scenarios during the lowering of the MPC from the transfer cask to the storage cask – In 

this process the canister (MPC) is resting against the transfer lid inside the transfer cask, and 

the transfer cask is resting on top of the storage cask at the base of the transfer pit. The storage 

cask is resting on the skid on which it will be moved outside of the reactor building. This phase 

starts at the point when the crane operator has just reduced tension on the crane hoist cables 

so that the short slings become slack and can be removed from the MPC. It continues through 

the attachment and raising of the MPC with the long slings and ends after the MPC has been 

lowered into the storage cask and the long slings have been removed.

Reason for analysis – These scenarios are analyzed due to the potential for dropping a loaded 

MPC cask into the storage cask and damaging the fuel. 

Potential consequences – Dropping an MPC into the storage cask could result in a drop of

approximately 5.8 meters (19 feet) [3]. This violent impact would damage fuel and may 

compromise the integrity of the MPC to retain fission products released from the fuel pins. At a 

minimum, the MPC will need to be returned to the SFP for unloading and inspection of the 

damaged fuel. This operation could potentially release fission products to the building 

environment as extensive fuel damage would be expected. It is also possible that a leak path 

may be created as a direct result of the drop, which would release fission products beyond the 

building environment and thus become a safety concern for the public. 

8.5.2. Base Case Scenario

Initial conditions – The initial conditions for the start of this phase will vary with the specific plant 

and cask system being used. A typical situation is defined:

• The transfer cask is resting on top of the alignment ring/device, which is in turn mounted 

to the top of the storage cask

• The crane operator has just shut off the crane to avoid any inadvertent operation during 

sling rigging activities

• The MPC inside the transfer cask is resting on the transfer lid, and personnel are moving 

in to remove the short slings from their attachment point on the crane hook
8-26

8.5.3. General Human Performance Vulnerability Concerns

Below is a brief summary of some potential human performance vulnerabilities that may impact 

cask-lowering operations: 

Limited Nature of Procedures – The cask-lowering operations may not be highly proceduralized, 

but depend primarily on skills learned and additional training experiences. The vast majority of 

the activities do not use written procedures at all, and with few exceptions, even those that 

include procedures do not have any formal checklists or verbal confirmation requirements 

spelled out. A specific area in which procedures and/or training or rehearsal of those procedures 

may be lacking is in cask drop and subsequent fission product retention (i.e., limiting 

contamination of the facility and exposures off site) and worker-protection actions (e.g., actions 

to mitigate injury potential due to snapping slings or cables).

Quality Assurance (QA) – Careful verification of all DCSS components to the appropriate 

conformance requirements is essential during all phases of DCSOs, including those involving 

rigging equipment for lifting MPCs. Many of those QA processes are carried out using visual 

and tactile tests of rigging gear as a redundant check to rigorous inspections during the 

equipment procurement40 process. The scenarios in this section focus on two QA problems to 

emphasize the importance of all aspects/redundancies of a healthy QA system (i.e., 

procurement personnel, engineering verification tests, end user inspections, etc.). 

Communication Difficulties – There are significant challenges in communication between the 

team members performing spent fuel operations. The environment contains a significant amount 

of background noise, predominantly machine noise. Although key participants use headsets for 

communication, the headsets do not eliminate the potential for misunderstanding. Garbled 

communication (due to system interference or background noise) is possible, and in some 

cases it may not even be possible to clearly determine who is speaking. A belief that a particular 

individual is speaking, even if they are not, can bias the listener into hearing what is expected. 

Team members also use hand signals to communicate, but there is no guarantee that the 

intended recipient will see these signals (or even be looking for them). It may be difficult to get

the recipient’s attention promptly. Signals may be interpreted improperly, especially given that a 

convention for the meaning of all signals does not appear to be firmly established.

It is crucially important that team members performing the rigging operations and guiding the 

transfer lid operations have effective and rapid means for communicating to one another during 

these operations. If unexpected or undesirable events occur, they must also be able to 

communicate rapidly with more distant personnel who are observing operations. One 

communication channel especially important during these operations involves the rigging 

personnel and the crane operator. Clear communication to the crane operator to shut down the 

crane prior to removing the short slings and installing the long slings is required. Clear 

communications are also required when the crane operator begins to lift and then tension-load 

the long slings under the watchful direction of rigging personnel. Signals for MPC lowering must 

also be coordinated precisely.

 40 The rigorous inspections in the procurement process include those QA activities executed throughout the 

fabrication/manufacturing processes for the equipment.
8-27

Limited Indicators and Job Aids – Compared to the control panel and local indicators and other 

job aids common in power plant operations, those that exist in spent fuel operations are quite 

limited. In general, processes are controlled primarily by visual cues. Both visual and tactile 

cues need to be properly interpreted by the rigging personnel as they carry out their tasks and 

check the work of their teammates.

Visual Challenges – As mentioned above, visual cues are primary in performing spent fuel 

operations. In many cases, properly observing these cues is made difficult by the positioning of 

people in relation to the activities being observed. The crane operator may need to lean out over 

the crane bridge to obtain a marginally acceptable view of the operation, as the view from the 

bridge is essentially only from directly above. Many of the potential errors that could occur are 

related to the vertical position and cannot be determined from above. In addition, even the view 

from above may be obstructed, either by the yoke or by the load being moved. Thus, the 

operator is often put in the position of being the “hands for someone else’s eyes,” which makes

the operations susceptible to the communication vulnerabilities discussed previously. 

Finally, in many cases, by its very nature and location, the action must be viewed from a 

distance. In such cases, personnel can miss small deviations that could possibly lead to 

significant problems simply because they do not have sufficient visual resolution to detect the 

error.

Team Dynamics – The specific rigging team make-up may exhibit considerable variability if 

procedures and training are not sufficiently detailed. Some teams may be more methodical in 

carefully inspecting all bolts, slings, and other rigging materials before, during, and after 

installation than other teams. Inexperienced teams may run a greater risk of mistakes, and 

experienced teams may be at higher risk for slips and lapses. Of course, all team members, 

regardless of experience levels, should beware of the range of slips, lapses, and mistakes that 

might occur. 

Pace of Operations – SFH activities are, in general, quite simple, In addition, the speed of many 

of the movements is slow, so each action takes a long time to complete. Basically, this can be 

slow, monotonous work, and some individuals have a significant amount of downtime between 

actions. There is ample opportunity for diversion and distraction, and an air of informality and 

complacency can easily exist within and among team members. From a psychological

perspective, there may be insufficient dynamic activity to generate an optimum stress/arousal 

level for performance. In contrast, during the rigging operations, this general trend of slowpaced operations may actually be reversed as personnel perform rigging operations as quickly 

as possible to reduce radiation exposure and to shorten the time that the MPC is perched atop 

the storage cask. Overall, there may be a mix of people experiencing a wide range of perceived 

time stress; some are executing exceedingly slow, monotonous operations, and others are

executing quick operations (i.e., perceived time stress increases with significant attention 

focused on radiation exposure).

Other Ergonomic Issues – Although specific data on temperature stresses (either hot or cold 

environments) to personnel during these rigging operations was not readily available to us, 

evidence of heavy perspiration (sweat-soaked shirts) was visible in a videotape of many 

operations (including rigging) at one plant. Rigging in hot environments may provide increased 

opportunity for mistakes and possible loss of footing on surfaces slippery from perspiration. The 

rigging operations are also performed in a relatively cramped space at the top of the transfer 

cask and underneath the crane hook by personnel who are themselves tethered by personal 
8-28

protective safety equipment.

41 Additionally, the handling or physical design of fasteners and 

other equipment/tools used during rigging operations may not be optimal. The difficulty of 

safety-critical inspections increases; for example, the scenarios in this section illustrate a 

weakness in rigging equipment inspection due to difficulties in viewing the potential problem 

area.

Large Number of Manual Operations – As documented in Section 7.2, many crane load drop 

events involve problems with rigging operations.

42 In fact, a primary motivation for developing 

yokes to move casks was to eliminate rigging activities because they add many manually 

intensive process steps and many smaller equipment items that must be maintained and used 

properly. Rigging operations involve manually removing and installing multiple slings, fasteners, 

clips, etc. In addition, personnel need to be highly vigilant in identifying any fasteners/other 

equipment needing to be replaced because these operations are repeated many times during a 

cask loading campaign. Cask system designers (e.g., Holtec International) have been forced to 

balance competing objectives in order to develop the cask systems. Some of these competing 

objectives include safely transferring large amounts of spent fuel (to reduce the number of 

loading activities), but doing so in a way that does not overstress lifting devices and general 

building structures. 

For example, currently used cranes would not be able to maneuver a fuel- and water-laden 

transfer/storage cask (i.e., on the scale of a loaded HI-STORM 100) in and around the SFP or in 

other parts of the plant. This inability results in additional MPC handling using manually 

assembled rigging arrangements (i.e., short slings and long slings) at various stages of the 

process. Another potential option would be to make more frequent unloading trips between the 

SFP and the ISFSI using much smaller spent fuel loads. Of course, this strategy would likely 

involve longer times for completing a cask loading campaign. Holtec International’s FSAR for 

the HI-STORM 100 Cask System, Revision 3 [6] appears to indicate that many of the timeintensive operations involved in DCSOs may not change dramatically with the use of much 

smaller casks. Table 8-5 shows a subset of time-intensive operations that may or may not 

change if a much smaller fuel load and cask were used compared to the HI-STORM 100 

system. 

 41 To mitigate fall-related injuries.

42 Many of the SME comments and relevant previous events listed in section 7.2 apply to this section as well,

given the similarity of crane operations. Of particular note in the relevant events listed in section 7.2 are the loadcarrying problems related to rigging operations.
8-29

Table 8-5 Subset of time-intensive operations that may or may not change if a much 

smaller fuel load and cask than the HI-STORM 100 systems were used per 

cask-loading sequence.*

Action

Duration 

(seconds 

[minutes])

Change with 

smaller cask? (Yes, 

No, Maybe)

Estimated duration for 

50% smaller cask 

accomplishing same 

offload (seconds 

[minutes])

Loading pre-selected fuel into 

MPC

61,200 

[1,020]

Yes 61,200 [1,020]

Post-loading visual 

verification of fuel load

4,080 [68] Maybe 4,800 [80 (i.e., 40x2)]

Install MPC lid & attach yoke 2,700 [45] No 5,400 [90 (i.e., 45x2)]

Raise HI-TRAC to surface of 

SFP

1,200 [20] No 2,400 [40 (i.e., 20x2)]

Decontaminate & survey 

HI-TRAC

6,180 [103] No 12,360 [206 (i.e., 

103x2)]

Perform NDE on lid weld 13,800 [230] Maybe 24,000 [400 (i.e., 

200x2)]

Repeat PT on MPC lid final 

pass

2,700 [45] Maybe 3,600 [60 (i.e., 30x2)]

Perform NDE on vent & drain 

cover plate weld

6,000 [100] No 12,000 [200 (i.e., 

100x2)]

Perform NDE of closure ring 

welds

11,100 [185] Maybe 22,200 [370 (i.e., 

185x2)]

Draining, purging, drying &

inerting activities 

21,600 

[360]**

Yes 36,000 [600 (i.e., 

300x2)]

MPC sling installation, 

transfer lid mounting, & other 

storage-cask mating &

loading operations

7,080 [118] Yes 0 

Total for this subset of 

operations

137,640 

[2,294]

– – – – – – – 183,960 [3,066]

* (Selected operation durations were taken from reference 6.)

 The totals listed only represent estimates for this subset of activities. A detailed task analysis would be 

needed to accurately assess the differences between large and small casks. 

† We approximated 6 hours; this time period was not specified in the HI-STORM 100 FSAR.
8-30

8.5.4. Scenario During MPC Movement from Transfer Cask Down to Storage Cask

Table 8-6 Scenarios during MPC movement from transfer cask down to storage cask.

HFE 

Group

HFE Group 

Description

Scenario Vulnerabilities

5 MPC 

movement 

from transfer 

cask down to 

storage cask

1. Rigging failure leads to one 

or more long sling(s) 

detaching from MPC and it 

drops with impact on transfer 

lid door

2. Rigging failure leads to one 

or more long sling(s) 

detaching from MPC causing 

MPC to drop and impact the 

interior bottom of the storage 

cask

• Limited nature of procedures

• Communication difficulties

• Limited indicators & job aids

• Quality assurance

• Visual challenges

• Unchallenging activities

• Team dynamics

• Pace of operations

• Large number of manual 

operations

• Training

• Other ergonomic issues 

(access to inspection area, 

heat stress)

Scenario 1: Rigging Failure Leads to One or More Long Sling(s) Detaching from MPC;

 MPC Drops with Impact on the Transfer Lid Door

Rigging personnel do not notice damage to an inner loop on one of the long slings. The cask 

loading campaign has been proceeding well for over a week with six successful cask loads 

completed. During the previous cask loadings, two repeated events occurred with one of the 

long slings. The event was caused by the sling being slightly shorter than the rest of the slings; 

every time the slings were loaded, this sling loaded first and stretched farther than the remaining 

slings. The second event was caused by a rough edge on the inside of the forged ring that 

coupled this particular sling to the bolt mounted to the MPC lid; the rough edge was a point of 

very high pressure (i.e., force per unit area) on the loop at the bottom edge of the sling. During 

the routine visual inspections of the rigging equipment, the riggers pay close attention to the 

length of the slings and the sling bolts—both the bolt threads and the connection between the 

bolt and the forged ring. But neither rigger looks closely at the inside of the loops at the end of 

the slings. 

Rigging personnel signal to the crane operator to start the crane. Rigging personnel carefully 

unfurl the long slings and attach them to the MPC bolt holes. Each rigger quickly inspects the 

operations of the other by looking at and feeling the connection points to the MPC. Upon 

finishing the rigging, a hand signal is made to a nearby team member indicating that it is time to 

turn the crane back on. The team member, in radio communication with the crane operator, 

signals the crane operator to start up the crane. 

Crane operator starts the crane and then raises the hook. The crane operator carefully focuses 

attention on the signals from the riggers as relayed by the team member on the communication 

net. The crane operator can vaguely see the riggers’ hand signals, but needs the redundancy of 

the radio communications, as his elevated perspective did not afford a clear view.
8-31

Rigging personnel do not recognize any cause for concern during this or the previous MPC lifts 

with respect to how the long slings were tensioned. Rigging personnel do not take note of slight 

differences in how the long slings are loaded during the lift.

Crane operator begins to apply tension to the MPC. The crane operator begins raising the long 

slings until significant tension is applied to the MPC, lifting it off of the transfer lid. Once the 

MPC has been lifted several inches above the transfer lid, the “slightly shorter” sling snaps, and 

the MPC impacts the transfer lid door. Fuel pins inside the MPC are damaged, but no leak path 

penetrates the MPC shell. 

Potential Human Performance Vulnerabilities for Scenario 1:

• Difficulties in inspecting interior portions of the sling loops lead to omissions in the 

inspection process.

• The hot environment and concerns among rigging personnel about radiation exposure 

encourage rapid actions with the potential for omissions.

• QA practices do not catch the aberrations in the lifting equipment (e.g., raised edge on 

the inside of the forged lifting ring, slight length discrepancy in the long sling).

• There are no clear procedures or training for personnel near the sling break point (e.g., 

seek cover to avoid “sling snapback” injuries or fatalities).

Scenario 2: Rigging Failure Leads to One or More Long Sling(s) Detaching from MPC,

 Causing MPC to Drop and Impact the Interior Bottom of the Storage 

 Cask

The first portion of this scenario is identical to Scenario 1, up to the point that the MPC is 

suspended above the closed transfer lid door. 

Rigging personnel open the transfer lid. Once the MPC is clearly suspended by the crane, the 

rigging personnel remove the transfer lid door pin and slide open the horizontal door to open a 

pathway from the transfer cask to the storage cask. The rigging personnel re-insert the pin when 

the door is open. 

Crane operator begins to lower the MPC. The crane operator shifts the hoist into the hooklowering mode, and there is a slight jolt of the lifting cables above the hook. Immediately there is

a tearing sound as fibers along the inside of the forged ring on the “slightly shorter” sling give

way. The rigging personnel watch in shock as the sling snaps and violently shoots upward 

toward the crane operator’s cab. Simultaneously, the MPC tips slightly, yet abruptly (it is still 

inside the body of the transfer cask), as the remaining slings absorb the additional load and 

stretch noticeably. The abrupt rotational impact of the MPC with the transfer cask interior 

damages some of the fuel pins inside the MPC. The crane operator instinctively hits the stop 

button when the sling breaks.

There is a pause before lowering continues. Fortunately, the snapped sling does not injure any 

personnel near the operations. However, the loading of the remaining highly stretched slings 

leaves the bottom of the MPC about 30.5 centimeters (1 foot) below the plane of the transfer lid 

door. There is no way to provide additional support under the MPC. This pause lasts about 20 

seconds and is broken by the operation supervisor who orders the crane operator to continue 
8-32

lowering the cask. The only viable option seems to be to get the cask to the base of the storage 

cask quickly. The personnel standing close to the storage cask on the ground floor of the 

reactor building run to the opposite side of the storage-cask transport vehicle. 

The cask drops. The crane operator restarts the lowering operation, and immediately a second 

sling snaps. Nearby personnel dive away from the noise just as the remaining slings snap in 

rapid succession. The cask falls 4.9 meters (16 feet) and violently impacts the base of the 

storage cask. Massive damage occurs to the fuel inside the MPC, yet the MPC shell does not 

fail. The rapid drop of the MPC into the confined space of the storage cask causes compression 

of air, which slightly slows the MPC. The boundaries of the storage cask also force the MPC to 

land flat against its bottom surface, which distributes the impact forces relatively evenly across 

the shell bottom. One of the nearby personnel is mortally wounded by parts of a snapped sling. 

Potential Human Performance Vulnerabilities for Scenario 3:

• Difficulties in inspecting interior portions of the sling loops lead to omissions in the 

inspection process.

• The hot environment and concerns among rigging personnel about radiation exposure 

encourage rapid actions with the potential for omissions.

• QA practices do not catch the defects in the lifting equipment (e.g., raised edge on the 

inside of the forged lifting ring, slight length discrepancy in the long sling).

• There are no clear procedures or training for the crane operator about such an event 

(e.g., continue the lowering maneuver, initiate a damped free fall by releasing hoist 

tension via a clutch of some sort).

• There are no clear procedures or training for personnel near the sling break point (e.g., 

seek cover to avoid “sling snapback” injuries or fatalities).

8.6. HFE Scenarios During Storage Cask Movement from Transfer Pit to ISFSI Pad 

This phase begins when the MPC has been placed in the storage cask, and the storage cask is 

ready for movement out of the building. It continues through sealing of the storage cask and 

ends with emplacement at the ISFSI pad. Further details regarding process steps are included 

in Sections B.6.1–9 of Appendix B.

8.6.1. Definition and Interpretation of Issue 

HFE scenarios during storage cask movement from transfer pit to ISFSI – In this process the 

MPC has been placed in the storage cask, the slings have been removed, the transfer cask has 

been removed, and the alignment ring is on the top of the storage cask. This phase starts at the 

point when the storage cask is to be moved out of the reactor building. It continues through 

placement of the permanent lid on the storage cask and movement of the storage cask to the 

ISFSI site. It ends when the storage cask is placed on the pad and disconnected from the 

transport vehicle.

Reason for analysis – These scenarios are analyzed due to the potential for dropping a loaded 

storage cask and potentially damaging the fuel.
8-33

Potential consequences – Dropping a loaded storage cask requires that the MPC be sent back 

to the SFP and be unloaded because of potential fuel damage. If fuel damage has occurred, it is 

also possible that fission products may be released when the storage cask or MPC is opened. 

Even if the fuel has not been damaged, the storage cask must be sent back to have the MPC lid 

cut off and returned to the SFP for inspection for potential fuel damage, which opens up other 

possibilities for release scenarios. 

8.6.2. Base Case Scenario

Initial conditions – The initial conditions for the start of this phase of operation will vary with the 

specific plant and cask system being used. A typical situation is defined:

• The storage cask is sitting properly on its skid in the transfer pit.

• The canister (MPC) is properly inserted in the storage cask.

• The long slings have been removed from the MPC.

• The transfer cask has been lifted off the storage cask.

• The alignment ring is sitting properly on the storage cask.

8.6.3. General Human Performance Vulnerability Concerns

Many of the general human performance vulnerabilities for this HFE scenario grouping are 

similar to those found in previous sections of this report. The basic categories of vulnerabilities 

include: visual challenges, procedural omissions, lack of control panel indication in the crane 

and transporter cabs, poor implementation of existing procedures, communication problems, 

omissions in training, and a disbelief that certain types of accidents could really occur. 

Very few relevant events specifically related to this HFE scenario grouping were discovered,

although an SME did inform us of an incident in which the wheel of a cask transport vehicle 

sank into a soft spot during transit to the ISFSI pad. This event delayed the transport operation. 

Of course, many of the events related to crane use and rigging operations mentioned in Section 

7.2 apply to these scenarios as well. 
8-34

8.6.4. Scenarios During Cask Movement from Transfer Pit to ISFSI Pad

Table 8-7 Scenarios during cask movement from transfer pit to ISFSI pad.

HFE 

Group

HFE Group 

Description

Scenario Vulnerabilities

6 Storage cask 

movement 

from transfer 

pit to ISFSI 

pad

1. Failure to tighten lift brackets 

leads to storage cask drop 

from storage cask 

transporter

2. Failure to tighten lifting arm 

sleeves leads to storage 

cask drop from storage cask 

transporter

3. Failure of planning and 

execution of transport, 

transporter encounters soft 

spot along travel path to 

ISFSI and tips

4. Transporter operator runs 

transporter into nearby 

storage cask at pad

5. Failure to disconnect lift 

brackets properly from 

storage cask leads to 

storage cask drop when 

transport operator raises 

lifting bar

• Procedural omissions

• Communication difficulties

• Limited indicators & job aids

• Quality assurance

• Visual challenges

• Unchallenging activities

• Team dynamics

• Pace of operations

• Large number of manual 

operations

• Training

• Disbelief that certain 

accidents can occur

• Cursory analysis of travel 

path

• Other ergonomic issues 

(access to inspection area, 

heat stress)

Scenario 1: Failure to Tighten Lift Brackets Leads to Storage Cask Drop from 

 Storage Cask Transporter

Maintenance workers fail to properly tighten the bolts holding the lift brackets to the storage 

cask. Two maintenance workers are responsible for placing and tightening the bolts that 

connect the lift brackets to the storage cask. They complete the initial step of putting the bolts in 

place and hand-tightening them. This hand-tightening leaves the bolts loose during the 

movement of the transporter. Before they are able to complete the final tightening of the bolts, 

the maintenance workers become distracted, believe that they have already tightened the bolts,

and move on to their next action in preparation for transport. Because there is no specific 

procedure or checklist, they are unlikely to catch their error once they have made it.

Mobile crane operator fails to notice error. The crane operator has a very limited view of the top 

of the storage cask and is a significant distance away. The operator is waiting for the workers to 

clear the lines in order to move on to the next task of either retrieving the second bracket (if this 

is the first one) or securing the crane. If anything, the operator observes the initial handtightening of the bolts, but is very likely not even looking in the area during the final tightening. 

No confirmation from the crane operator is specifically required.
8-35

Loose bolts slip off during transport, and storage cask drops to ground. The bolts are sufficiently 

secure to allow initial lifting of the cask; however, at some point during cask movement the cask 

drops. 

Potential Human Performance Vulnerabilities for Scenario 1:

• The maintenance workers do not follow a procedure that guards against slips or lapses.

• The maintenance workers are not tasked to confirm each other’s work.

• The mobile crane operator is not in a position to visually confirm bolt insertion and 

tightening.

Scenario 2: Failure to Tighten Lifting Arm Sleeves Leads to Storage Cask Drop 

 From Storage Cask Transporter

Maintenance workers fail to properly install the sleeves connecting the lifting arms to the lift 

brackets. This is very similar to Scenario 1. Two maintenance workers are responsible for 

sliding the sleeves into the holes in the arms and brackets and the bolt through the sleeve, 

attaching the endplate, and then adding and tightening the nut. Failing to insert the bolt in the 

sleeve, use the endplate, or put on and tighten the nut has the potential for allowing the sleeve

to slide out of place during the movement of the transporter. The workers may become 

distracted at any point in the process and believe that they have completed all of the steps 

properly and then move on to their next action in preparation for transport. Because there is no 

specific procedure or checklist, they are unlikely to catch their error once they have made it.

Transporter operator fails to notice error. The transporter operator has a very limited view of the 

top of the storage cask and is a significant distance away. The operator is waiting to begin 

moving the storage cask to the pad until the workers have left the top of the storage cask and 

have moved the cherry-picker away. If anything, the operator observes the various movements 

of the workers during assembly of the components, but very likely does not see the specific 

components being installed, and may not even be looking in that direction on a constant basis. 

No confirmation from the transporter operator is specifically required.

Loose sleeve slips off during transport, and storage cask drops to ground. The sleeves are 

loose, and the vibration present during movement of the transporter contributes to decoupling of 

the sleeve and drop of the cask.

Potential Human Performance Vulnerabilities for Scenario 2:

• Visual cues for the transporter operator are hampered by the operator’s position in 

relation to the location of the assembly.

• There is no procedure or checklist used for the assembly process.

• The maintenance workers are not tasked to confirm each other’s work.

• No control panel indicators are available to even imply that the sleeves have been 

properly installed.
8-36

Scenario 3: Failure of Planning and Execution of Transport; Transporter Encounters 

 Soft Spot Along Travel Path to ISFSI and Tips

Personnel do not thoroughly analyze travel path. Personnel perform a cursory walk along the 

travel path to the ISFSI at the start of the cask loading campaign, but a careful analysis of the 

structural integrity of the travel path (e.g., investigation of underground piping and analysis of 

roadbed materials) is not performed. This type of analysis is especially important, given the 

scant records available of the travel path region from the time when the plant site was 

constructed. 

A pre-movement briefing does not mention soft spots. Encountering a soft spot along the travel 

path to the ISFSI is not anticipated; therefore, no attention is paid to such an event during the 

pre-movement briefing with the transporter operator, other loading personnel, and supervisory 

personnel.

Transporter operator encounters slight soft spot and continues moving forward. The transport 

operator senses a slight dip of one of the transport crawler tracks after rounding a turn along the 

travel path to the ISFSI pad but does not slow down or stop the vehicle. The operator continues 

moving forward, assuming that stable ground is not far beyond the soft spot. However, just as 

the heaviest loading point under the transporter track hits the soft spot, the transporter lurches 

toward the soft spot and tips over. During the tip-over, the lifting cleats on top of the storage 

cask snap off, and the storage cask falls over with the transporter (although it impacts the 

roadway on the edge of the bottom surface), then rolls out of and behind the transporter. The 

transporter operator, who was not wearing a seatbelt or harness (as this restricted his ability to 

turn to view the tracks and monitor cask motion) is violently thrown off the transporter and 

critically injured. 

Personnel observe operations. The personnel who witnessed the incident immediately call in 

the emergency response team (ERT) and direct them to focus their efforts on the critically 

injured transporter operator. 

Emergency response team arrives. The ERT arrives a few minutes after the accident. Most of 

the team members rush to help the critically injured transporter driver. 

Potential Human Performance Vulnerabilities for Scenario 3:

• A cursory analysis of the travel path to the ISFSI misses a significant soft spot in the 

ground near a turn.

• Worker disbelief that a transporter tip-over could occur leads to a lack of readiness for 

such an event among the entire team, including the transporter operator who is not 

wearing a seatbelt or harness.

• The transporter operator is not trained on how to handle the vehicle in the event of 

encountering a soft spot.
8-37

• All personnel, including ERT members, are not trained to expect the possibility of a 

pressurized release of fission products from a cask.

43

Scenario 4: Transporter Operator Runs Transporter Into Nearby Storage Cask at Pad

Transporter operator is not watching behind while maneuvering the transporter to place the 

storage cask on the pad. During maneuvers at the pad to place the storage cask in its assigned 

location, it is necessary to work around other storage casks already in place and to move the 

transporter both forward and backward. When moving backward, the operator is supposed to 

look behind to assure that nothing is in the way. However, the operator may be so focused on 

properly aligning the storage cask and so confident that there is plenty of room to maneuver, 

that he does not check behind.

Maintenance workers also fail to watch behind the transporter. The primary function of the 

workers in observing the movement of the storage cask is to help the operator to align it 

properly on the pad. While they may be looking behind the transporter during reverse 

movement, there is really no requirement for them to do so. They are aware that their next task 

is to disconnect the lift brackets from the storage cask once it is placed on the pad. 

Transporter impacts nearby storage cask. Due to the particular ISFSI pad placement being 

attempted by the transporter operator, the omission of checking the travel path leads to the 

moving cask hitting a stationary cask.

Potential Human Performance Vulnerabilities for Scenario 4:

• The focal point of the task at hand is clearly to the front of the transporter, and looking 

backward is a distraction.

• The maintenance workers are not tasked to watch behind the transporter.

• No proximity warning devices are provided on the transporter control panel.

Scenario 5: Failure to Disconnect Lift Brackets Properly from Storage Cask Leads to 

 Storage Cask Drop When Transport Operator Raises Lifting Bar

Maintenance workers fail to fully disconnect lifting brackets from storage cask. Two 

maintenance workers are responsible for disconnecting the lifting brackets from the storage 

cask once it is in place at the ISFSI pad. They must remove the large bolts (a total of four; two 

per bracket) that hold the brackets in place. Each worker does one bracket (two bolts). If they do 

not get a bolt completely free of the threads, the bolt will hang up on the end of the threads and 

cause the storage cask to lift off the ground when the lifting bar is raised and then break loose 

and drop back to the ground. There are two workers, and while it is likely that they will each 

observe the entire scene when they are done, there is no specific procedural check that 

requires each to check that the other has performed his part correctly.

 43 After such an accident, personnel would likely report that they knew the casks were pressurized with helium, but 

many may have forgotten how highly pressurized the fuel pins are and not explicitly thought through how a nearsimultaneous fuel-pin-MPC-storage-cask penetration event would result in a vigorous, pressurized release of gases 

and other fission products.
8-38

Operator fails to notice error. The transporter operator has a very limited view of the top of the 

storage cask and is a significant distance away, making it difficult to determine whether or not 

the bolts have been fully disengaged. Furthermore, no confirmation from the operator is 

specifically required. The operator’s attention is focused on moving the transporter away from 

the cask, and he likely depends on assurances from the maintenance workers that the bolts 

have been properly disengaged.

Operator raises lifting bar without noticing that storage cask is still partially connected. The 

transport operator faces directly toward the storage cask and focuses on the brackets while 

raising the lifting bar to observe when the brackets are clear of the storage cask. Typically, the

operator can see the storage cask begin to rise unevenly when a bolt does not release. In this 

case, the operator is distracted by activities of nearby personnel and does not notice that the 

transporter is still coupled to the cask.

Storage cask breaks loose from bolt and drops. The transport operator does not notice the 

problem until the cask drops.

Potential Human Performance Vulnerabilities for Scenario 5:

• Visual cues for the crane operator are hampered by position relative to the lift brackets.

• There is no procedure or checklist used for removing the brackets.

• The maintenance workers are not tasked to confirm each other’s work.

8.7. HFE Scenarios During Monitoring and Storage at the ISFSI

This phase begins immediately after the cask has been placed on the ISFSI pad and continues 

until the spent fuel is moved off the ISFSI site (e.g., for transport to a geologic repository). 

Further details regarding process steps are included in Sections B.6.9–B.7 of Appendix B.

8.7.1. Definition and Interpretation of Issue 

HFE scenarios during monitoring and storage – During these scenarios, the loaded storage 

cask is correctly positioned at the ISFSI, and the long period of monitoring and storage has 

begun. This phase is broken into two portions: initial monitoring and long-term monitoring. The 

initial monitoring confirms that the cask system temperature has stabilized. For the HI-STORM 

100 system this should occur between 5 to 7 days after emplacement on the ISFSI pad. Longterm monitoring is the subsequent time period up until the fuel is removed from the ISFSI pad.

Reason for analysis – These scenarios are analyzed due to the potential for missing another 

opportunity to identify a fuel misload or failing to notice a condition that may lead to overheating 

of fuel (e.g., blocking of vent paths on the HI-STORM storage cask). These scenarios are also 

analyzed to ensure that a fission product release is rapidly detected. For example, if water were 

left in the bolt holes of a TN cask, subsequent evaporation combined with some fuel pin damage 

could result in a fission product release to the environment.

Potential consequences – Failing to identify a misload of fuel could lead to eventual damage to 

fuel pins and subsequent release of fission products to the general MPC or fuel cask 
8-39

environment, which may present a hazard for those who might open the cask at a future date

(e.g., at the plant during preparation for transport to a geological repository or fuel reprocessing 

facility, or upon arrival at a distant facility for processing or disposal). Another potential 

consequence of damage to fuel pins could be a slow but direct release to the outside 

environment due to a corrosion-caused leak path. 

8.7.2. Base Case Scenario

Initial conditions – The initial conditions for the start of this phase of operation will vary with the 

specific plant and cask system being used. A typical situation is defined:

• The loaded storage cask is placed (and possibly anchored) in the proper position on the 

ISFSI pad. 

• Temperature and other sensors (if used on this cask system) are in place.

• ISFSI security procedures are adhered to, and no malicious tampering with the cask 

system occurs.

8.7.3. General Human Performance Vulnerability Concerns

Below is a brief summary of some potential human performance vulnerabilities that may impact 

ISFSI monitoring and storage operations: 

Pace of Operations – In contrast to the scenarios analyzed above, it may be true that the cask 

monitoring and storage operations are highly proceduralized. That is, personnel assessing 

temperatures, pressures, etc., may be trained to follow a strict procedure and complete a 

checklist or log during periodic monitoring activities. However, as revealed in SME interviews on 

fuel handling in the SFP,

44 personnel may soon fall into a mode of operation in which they 

perform a cursory check on many casks at the ISFSI pad and complete the checklist later. This 

type of casual monitoring behavior may be encouraged by the monotony of checking, day-afterday, casks that appear to be stable, and by local weather conditions (e.g., a harsh winter in 

Minnesota or Nebraska may cause personnel to “expedite” procedures to avoid exposure to the 

elements). Additionally, there is ample opportunity for diversion and distraction during the 

routine operations at the ISFSI, and an air of informality and complacency can easily exist within 

and amongst the ISFSI team members. From a psychological perspective, there may be 

insufficient dynamic activity to generate an optimum stress/arousal level for performance.

45

 44 Specifically, the SMEs mentioned that individual fuel assembly moves were not always recorded on the move 

sheet; sometimes fuel-handling personnel would move many assemblies before any written record was made.

 

This lack of stress/arousal may increase the occurrence of slips, lapses, and other mistakes,

even among personnel who genuinely intend to follow the procedures completely. This human 

45 This lack of vigilance in adhering to procedures is a significant problem for any unchallenging, highly repetitive 

operation in which the likelihood of a failure occurring is very low, but the consequences, should a failure occur, may 

be very high. An analogous situation is one in which a highly trained security force is tasked with protecting a vital 

facility for many years, over which there has never been the slightest hint of an attack, except for the occasional 

sensor activation by bad weather or foraging animals. At the ISFSI, the situation being watched for may be the 

eventual negative outcome (i.e., fission product release) due to a gradual corrosion process occurring inside a cask. 

Administrative actions should be taken to counteract the forces that lead to organizational complacency (e.g., 

occasional drills, rotation of personnel, unannounced inspections of activities, etc.).
8-40

performance vulnerability ties in closely with many aspects of the life-cycle-based QA process. 

Specific QA items mentioned in the scenarios of this section include the priorities of 

management and the subsequent focus of ISFSI team members as influenced by those 

priorities.

Visual Challenges – Monitoring and storage operations at the ISFSI may involve visual 

challenges in two general ways. First, for DCSSs in which there are both inlet and outlet vents 

on the storage cask, it may be inconvenient (e.g., the inlet vent is near the ground) or nearly 

impossible (e.g., the outlet vent is near the top of the cask) to visually check for a blockage 

without using fixed or pole-mounted cameras, ladders, etc. Checking the top surface of the cask 

for foreign items is part of this general challenge. The second general visual challenge involves 

using cameras to monitor for vent blockages or other debris accumulation (e.g., masses of 

tumbleweeds behind some of the casks). Closed circuit camera monitoring, although desirable 

for 24-hour monitoring of the ISFSI, should not become a replacement for manual visual checks 

unless the camera systems are very comprehensive (i.e., able to see all potential areas of 

blockages) and of sufficient fidelity (i.e., the human operator who must detect and discriminate 

images on the video monitors can do so reliably).

Other Ergonomic Issues – As mentioned previously, temperature extremes and other weather 

conditions may, at times, severely hamper both the motivation and mobility of those who

monitor casks at the ISFSI. For example, heavy cold-weather gear and blowing snow make it 

difficult to use a checklist on a clip-board. It may be preferable to use radio communications 

between a person braving the elements to read temperature and other sensor readings and to 

visually inspect cask components as they relay the data and observations (via disciplined threepart communications) to another person comfortably stationed inside the ISFSI management 

building. Other ergonomic issues relate to difficulties in accessing areas that need to be 

inspected.

8.7.4. Scenarios During Cask Monitoring and Storage at the ISFSI

Table 8-8 Scenarios during cask monitoring and storage at the ISFSI.

HFE 

Group

HFE Group 

Description

Scenario Vulnerabilities

7 Cask 

monitoring & 

storage at the 

ISFSI

1. Personnel fail to identify 

misloaded cask during initial 

monitoring

2. Personnel fail to identify ‘hot 

cask’ during long-term 

monitoring

3. Personnel fail to identify 

signs of corrosion on cask 

during long-term monitoring

4. Personnel fail to detect small 

fission product release from 

cask during long-term 

monitoring at the ISFSI pad

• Pace of operations

• Visual challenges

• Other ergonomic issues 

(clothing, hot & cold weather, 

accessibility)

• Communication

• Low hit rate–disbelief in 

undetected misload

• Quality assurance

• Low emphasis by 

management on ISFSI 

operations
8-41

Scenario 1: Personnel Fail to Identify Misloaded Cask During Initial Monitoring

ISFSI worker heads over to the cask for initial monitoring. The ISFSI worker approaches a cask 

that has been on the pad for 6 days to perform initial monitoring. It is a bright, sunny afternoon 

and the outlet vent at the top of the cask is facing west. 

ISFSI worker measures average inlet and outlet temperatures. The ISFSI worker diligently 

records temperatures at the inlet vent and then positions the roll-around ladder so he can safely 

ascend to the outlet vent at the top of the cask. Average temperature measurements at the 

outlet vent are a bit high according to the specifications on the check sheet. The experienced 

worker is not alarmed; this has been a very hot summer, and he dismisses the several-degree 

aberration as due to radiant heat from the sun directly hitting the vent for the past hour and 

directly heating the general region around the vent for several hours. The worker accurately 

records the measured temperature, but he does not request a more thorough investigation of 

the anomaly. He ponders for one more moment whether or not this is the right thing to do, but 

as beads of sweat roll down his face he chuckles to himself that the sun has made his own 

surface temperature a bit high today. His powers of good common sense reasoning have never 

failed him, so he stops thinking about the issue and heads back to the ISFSI management 

building.

Elevated temperatures are noted several months later. Another member of the ISFSI team 

discovers significantly elevated temperatures at the outlet vent of this cask several months later

during weather which should have had a slight cooling effect on the entire cask. Further 

investigation hints at actual or impending fuel damage, so the very expensive process of 

bringing equipment and personnel back to the site to move the fuel back to the SFP is initiated. 

Two months later, inspection of the MPC contents positively reveals the misload, and a reinventory of assemblies in the SFP is conducted. Fortunately, none of the other 12 casks at the 

site shows signs of a misload.

Potential Human Performance Vulnerabilities for Scenario 1:

• A combination of particular circumstances (i.e., hot sunny day and elevated outlet vent 

temperatures) enables worker to quickly disregard “undesirable” high temperature 

signals.

• General physical discomfort due to the hot conditions further biases worker to dismiss 

elevated readings.

• Numerous previous and successful cask emplacements de-sensitize the worker to the 

potential of a misload and subsequent cask heating.

Scenario 2: Personnel Fail to Identify “Hot Cask” During Long-Term Monitoring

This scenario is nearly identical to Scenario 1 for the initial monitoring period. 

The temperature sensor is miscalibrated. The temperature sensor used at the ISFSI developed 

a defect that was not discovered during the last calibration period. An incorrect46

 46 The miscalibration is assumed to have occurred due to a distraction (i.e., a slip) during the calibration process of 

several instruments, leading to critical omissions in correctly carrying out the calibration. See reference 16 for 

additional discussion on how slips may occur.

calibration over 
8-42

a limited range of temperatures did not reveal that the temperature sensor had become less 

sensitive to temperature changes above a certain threshold value. This non-linearity in sensor 

performance happened to begin near the upper range of temperatures expected at the cask 

outlet vents. This defect in the monitoring equipment prevents the ISFSI workers from 

identifying the elevated temperatures at the cask for many years. 

The QA process breaks down. Administration of the tool calibration program, managed under 

the QA section of the plant engineering department, focuses more on tools and equipment used 

for power plant operations. Of particular interest to the department is load-testing of lifting 

devices; an NRC inspector has cited the plant for not keeping up with load tests on a few 

devices; therefore, lifting equipment as well as torque tools and radiation monitoring equipment 

are the primary focus of the calibration team. Calibration activities for tools and equipment used 

at the ISFSI languish for many years, and the malfunctioning temperature monitor evades

proper detection because procedurally established re-calibration activities are not performed. 

The temperature monitor finally becomes visibly unstable. After many years with the defect, the 

temperature monitor begins displaying unmistakable signs of fluctuation and instability. The 

ISFSI personnel are authorized to purchase a new temperature monitor. The “hot” cask is 

discovered during the first use of the new temperature monitor, which happens to coincide with 

plant decommissioning operations and movement of some casks to a geologic repository. 

Potential Human Performance Vulnerabilities for Scenario 2:

• QA practices focus on power plant operations and not on ISFSI operations.

• Plant management does not place much emphasis on ISFSI operations. Personnel are

not concerned about a temperature monitor that has been cursorily calibrated and not 

re-calibrated at the specified intervals; even if they do voice concerns, the engineering 

department may not properly re-calibrate the equipment due to disinterest.

Scenario 3: Personnel Fail to Identify Signs of Corrosion on Cask During Long-Term 

 Monitoring

ISFSI workers monitor vent temperatures but do not aggressively inspect all areas of casks. The 

ISFSI workers periodically monitor temperatures at the inlet and outlet vents on the casks and 

perform walk-throughs along the rows of casks on the pad. Unfortunately, ISFSI personnel tend 

not to look very closely along the bottom edges of all of the casks. 

Two casks on the perimeter of the ISFSI pad, farthest from the ISFSI site building, are 

corroding. The two casks farthest from the ISFSI site building and at the periphery of the ISFSI 

pad are aggressively corroding from the outside due in part to local weather conditions and a 

buildup of debris at the base of the casks. 

One of the casks sustained damage during emplacement. One of these casks at the far edge of 

the pad was dropped slightly when it was lowered to the pad many years ago. Careful surveys 

of the exterior of the cask and temperature and pressure monitoring did not show signs of fuel 

damage. Unfortunately, the buckling stresses from the drop and subsequent creep rupture led 

to eventual fuel damage and release of fission products to the inside environment of the MPC. 

Fortunately, the aggressive corrosion process did not compromise the MPC shell before it was 

moved to and processed at a geologic repository. 
8-43

Potential Human Performance Vulnerabilities for Scenario 3:

• Life-cycle QA management practices47

• The inconvenience of inspecting portions of the cask bottom near the pad’s edge 

encourages insufficient QA practices.

at the ISFSI are not properly instituted or carried 

out.

Scenario 4: Personnel Fail to Detect Small Fission Product Release from Cask During 

 Long-Term Monitoring at the ISFSI Pad

This scenario is the same as for Scenario 3, except that the corrosion process did penetrate the 

MPC shell, and it depressurized. This leads to an offsite release of fission products over a 

number of days. 

Potential Human Performance Vulnerabilities for Scenario 4:

• Life-cycle QA management practices at the ISFSI are not properly instituted or carried 

out.

• The inconvenience of inspecting portions of the cask bottom near the pad’s edge 

encourages insufficient QA practices.

 47 Life-cycle QA practices can be vulnerable when the level of due diligence in the QA program fluctuates with the 

immediate priorities of management personnel who are interested in 3- to 5-year time horizons, which tend to 

coincide with the frequency that managers change positions within a utility. As a general rule, it is important to have 

significant responsibility and authority for good practices institutionalized among staff members who tend to stay at 

specific plants for much longer periods to mitigate the human performance issue of widely fluctuating QA vigilance.

9-1

9. CONCLUSIONS

This report documents material originally generated as an interim letter report that provides a 

preliminary study on what should be included in a qualitative HRA for SFH and DCSOs. This 

material is released in a NUREG/CR format to facilitate dissemination of HFEs that examine, in 

preliminary fashion, the misloading of spent fuel into a cask as well as the potential for dropping 

a loaded cask. The report was built upon previous analyses and takes several positive steps to 

advance the understanding of human performance issues relevant to DCSOs. This report was 

prepared without the benefit of the context provided by a larger PRA study, and it was not plantspecific. Therefore, it investigates only generic HRA issues relevant to SFH. In particular, this 

study identifies preliminary HFEs and scenarios that may apply to a plant-specific application. It 

is anticipated that the improved understanding of human performance issues provided by this 

preliminary study should enhance the ability to conduct a detailed qualitative HRA for a specific 

nuclear power plant in the future.

This preliminary study was conducted using elements of NUREG-1792, Good Practices for 

Implementing Human Reliability Analyses (HRA) [1], and NUREG-1624, Rev. 1, Technical Basis 

and Implementation Guidelines for A Technique for Human Event Analysis (ATHEANA) [2], to 

form critical parts of the technical basis for the preliminary analysis. Typical qualitative HRA 

tasks performed included the collection of relevant information and preliminary identification of 

HFEs or unsafe actions, relevant influences (e.g., performance-shaping factors, other contextual 

factors), and event scenarios. This project involved identifying and reviewing literature relevant 

to understanding human performance in SFH, interviews of SFH subject matter experts, and 

use of all of the information obtained to perform a preliminary, qualitative HRA of SFH tasks that 

have a potential for cask misloads and drops. 

A new seven-category scheme was introduced for grouping the phases of DCSOs to aid in

identifying and analyzing (in a preliminary fashion) HFEs that may occur during the pre-initiator 

and post-initiator phases of an initiating event (IE) that may strongly influence the ultimate 

consequences of a particular IE. Spent fuel handling activities were separated into HFE 

scenario groupings that examine the potential use or usefulness of job aids, plausible variations 

in context, potential error mechanisms for specific failures, and other performance shaping 

factors that may influence the likelihood and consequence of particular HFEs. The four primary 

sources of information used in developing and investigating the scenarios included subject 

matter expert (SME) interviews, a pilot dry cask PRA developed by the NRC [4], a bolted 

storage cask PRA conducted by EPRI [5], and the Final Safety Evaluation Report, Rev. 3, for 

the Holtec International HI-STORM 100 cask system [6]. Other referenced sources played 

important but secondary roles in this preliminary, qualitative HRA.

The NRC’s pilot dry cask PRA benefitted this study by providing process descriptions and 

consequence analysis for various misload and cask drop scenarios. Given that the NRC PRA

did not include an HRA, it provided little insight into human performance issues (aside from 

mentioning a few potential HFEs); however, the NRC PRA was helpful for directing the present 

analysis toward events that have the potential for consequential outcomes. EPRI’s bolted 

storage cask PRA provided similar insights regarding consequences (e.g., the type and 

magnitude of fuel misloads that may breach fission product barriers in the cask system), but it 

also included an HRA that identified many human actions that could contribute to a fission 

product release from a cask system. 
9-2

The EPRI analysis, while it included an HRA, did not provide detailed explanations of the 

context surrounding human errors. That is, a fuel misload or a cask drop may occur with an 

estimated likelihood and consequence due to a person or crew not performing an activity 

properly; however, insufficient information was given to describe how that error or group of 

errors occurred. In simple terms, the previous NRC and EPRI studies describe “what” HFEs can 

happen (the EPRI study identifies many more than the NRC study), yet neither study explains 

“how” or “why” those events might happen. The current report has begun, in preliminary fashion,

to fill in the gaps of “how” such errors or HFEs may occur by describing specific scenarios in 

which human actions result in misload or cask drop events. For example, the scenarios in this 

report identify and describe intentions, actions, interactions, unsafe actions, and error 

mechanisms that may lead to a particular type of HFE. The details provided in the scenarios are 

not exhaustive, but they show how we can obtain a greater understanding of such human 

failure, and they allow us to infer techniques for identifying and mitigating specific human 

performance issues. More specific guidance for avoiding or mitigating the consequences of 

human errors is presented in NUREG/CR-7016 [29]. 

In summary, this was a preliminary study of what should be included in a qualitative HRA for 

SFH and DCSOs. To complete a thorough qualitative HRA and to enable development of a 

state-of-the-art quantitative HRA (if desired), additional plant-specific data and information from 

both pressurized water reactor (PWR) and boiling water reactor (BWR) plants would need to be 

gathered and analyzed. The data and information would ideally be gathered through a 

combination of expert interviews; observation of actual cask loading campaign activities;

detailed review of procedures; detailed review of previous misloading, cask drop, and near miss

incidents; and application of a prospective ATHEANA-type HRA. In conjunction with gathering 

and analyzing detailed plant-specific information from two or a few plants, additional data (e.g., 

from questionnaires and inspections) should be acquired that indicate fuel load planning, fuel 

movement, and cask movement experience for the population of U.S. nuclear power plants 

relative to the plant-specific analyses. The analysis would provide plant-specific analyses that 

would benefit NRC regulation specific to those licensees and would provide generalizations of 

power plant fleet performance that could enable uncertainty distributions to be developed for 

HRAs, which might then be used to improve the NRC’s risk-informed regulation for SFH and 

DCSOs.
10-1

10. REFERENCES

1. Nuclear Regulatory Commission (U.S.) (NRC). NUREG-1792. “Good Practices for 

Implementing Human Reliability Analysis (HRA).” Washington, DC: NRC. 2005.

2. Nuclear Regulatory Commission (U.S.) (NRC). NUREG-1624, Rev. 1. “Technical Basis 

and Implementation Guidelines for A Technique for Human Event Analysis (ATHEANA).”

Washington, DC: NRC. 2000.

3. Rossett, A. and J. Gautier-Downes. A Handbook of Job Aids. San Diego: Pfeiffer & 

Company. 1991.

4. Nuclear Regulatory Commission (U.S.) (NRC). NUREG-1864. “A Pilot Probabilistic Risk 

Assessment of a Dry Cask Storage System At a Nuclear Power Plant.” Washington, DC: 

NRC. 2007.

5. Electric Power Research Institute. Probabilistic Risk Assessment (PRA) of Bolted 

Storage Casks: Updated Quantification and Analysis Report No. 1009691. Palo Alto, 

CA: Electric Power Research Institute. 2004.

6. Holtec International. “Holtec International Final Safety Analysis Report for the HISTORM 100 Cask System, Revision 3, Report No. HI-2002444.” Marlton, NJ: Holtec 

International. 2005.

7. Nuclear Regulatory Commission (U.S.) (NRC). “Safety Evaluation Report of Vectra 

Technologies, Inc. a.k.a. Pacific Nuclear Fuel Services, Inc. Safety Analysis Report for 

the Standardized NUHOMS Horizontal Modular Storage System for Irradiated Nuclear 

Fuel.” Washington, DC: NRC. 1994.

8. Nuclear Energy Institute (NEI). “U.S. Generating Companies With On-site Dry Storage 

Commitments.” 2002. [table posted on NEI Web site: http://www.nei.org]. 

9. Benhardt, H.C., et al. “Savannah River Site Human Error Database Development for 

Non Reactor Nuclear Facilities (U), WSRC-TR-93-581.” Aiken, SC: Westinghouse 

Savannah River Company. 1994.

10. Nuclear Regulatory Commission (U.S.) (NRC). NUREG-0612. “Control of Heavy Loads 

at Nuclear Power Plants: Resolution of Generic Technical Activity A-36.” Washington, 

DC: NRC. 1980.

11. Nuclear Regulatory Commission (U.S.) (NRC). NUREG-1774. “A Survey of Crane 

Operating Experience at U.S. Nuclear Power Plants from 1968 through 2002.”

Washington, DC: NRC. 2003.

12. Elrada, H.A.. “Reliability / Safety Assessment for the Oyster Creek Reactor Building 

Crane, GPU Nuclear Calculation C1302-882-5430-007.” GPU Nuclear. 1994.

13. Nuclear Regulatory Commission (U.S.) (NRC). NUREG/CR-1278. “Handbook of Human 

Reliability Analysis with Emphasis on Nuclear Power Plant Applications.” Washington, 

DC: NRC. 1983.

14. Nuclear Regulatory Commission (U.S.) (NRC). NUREG-0554. “Single-Failure-Proof 

Cranes for Nuclear Power Plants.” Washington, DC: NRC. 1979.

15. Whiting Corporation. “Over-stress of auxiliary hoists on Whiting Cranes, 10 CFR 21 

Notification, (U. S. Nuclear Regulatory Commission accession # 9703130317).” Harvey, 

IL: Whiting Corporation. 1997.

16. Nuclear Regulatory Commission (U.S.) (NRC). 10 CFR 21 Notification, Event Report # 

39545. Washington, DC: NRC. 2003.

17. Advisory Committee on Reactor Safeguards (ACRS). ACRS-2050 (2003). “Proposed 

Recommendations for Resolving Generic Issue 186, "Potential Risk and Consequences 

of Heavy Load Drops in Nuclear Power Plants." Washington, DC: NRC. September 24, 

2003.

18. Landis, K.D. “NRC Inspection Report 07200034/2004001.” Atlanta, GA: NRC. 2004.
10-2

19. International Atomic Energy Agency (IAEA). “Storage, Handling and Movement of Fuel 

and Related Components at Nuclear Power Plants, Technical Reports Series, No. 189.”

Vienna: IAEA. 1979.

20. Jorgensen, B.L. “NRC Inspection Report 72-37/2000001(DNMS).” Atlanta: NRC.

21. Reason, J. Human Error. Cambridge: Cambridge University Press. 1990.

22. Brewer, J.D. SAND2005-5730. “Risk Perception & Strategic Decision Making: General 

Insights, a New Framework, and Specific Application to Electricity Generation Using 

Nuclear Energy.” Albuquerque, NM: Sandia National Laboratories. 2005.

23. Kahneman, D. and A. Tversky. “Prospect Theory: An Analysis of Decision Under Risk.”

p. 263-291.Econometrica. 1979. 

24. Kahneman, D. and A. Tversky. “Choices, Values, and Frames.” American Psychologist.. 

Vol. 39 No. 4, p. 341-350: 1984.

25. Salvendy, G., ed. Handbook of Human Factors and Ergonomics. 2 ed. New York: John 

Wiley & Sons. 1997.

26. Kantowitz, B. H. and R. D. Sorkin. Human Factors: Understanding People-System 

Relationships. New York: John Wiley & Sons. 1983.

27. Wickens, C. D. and J. Hollands. Engineering Psychology and Human Performance. 

Upper Saddle River: Prentice Hall. 2000.

28. Wenner, C. A., F. W. Spencer, et al. “The Impact of Instructions on Aircraft Visual 

Inspection Performance: a First Look at the Overall Results.” Denver, CO: Human 

Factors and Ergonomics Society Annual Meeting. 2003.

29. Nuclear Regulatory Commission (U.S.) (NRC). NUREG/CR-7016. “Human Reliability 

Analysis – Informed Insights on Cask Drops.” Washington, DC: NRC. 2012.
A-1

APPENDIX A REVIEWS OF SELECTED REFERENCES

A Pilot Probabilistic Risk Assessment for a Dry Cask Storage System: NUREG-1864 [1]

To further evaluate public risks from the handling, transfer, and storage of dry casks, the U.S. 

Nuclear Regulatory Commission (USNRC) Office of Nuclear Regulatory Research (RES) 

responded to a request by the NRC’s Office of Nuclear Material Safety and Safeguards (NMSS) 

to develop and apply a method for performing a probabilistic risk assessment (PRA) of a dry 

cask storage system (DCSS). The motivation for this study involved several incidents at 

licensee facilities that raised concerns regarding the possibility of a loaded spent fuel cask being 

dropped. That initial concern led to an interest in examining a broad range of potential IEs 

during SFH activities that could lead to public health and environmental impact consequences. 

RES chose to perform a pilot PRA on a welded cask system (i.e., HOLTEC HI-STORM 100) at 

a specific BWR site.

The pilot PRA study used the best available point estimates without any uncertainty analyses. In 

the absence of adequate information or data, conservative bounding assumptions or estimates 

were used. The study authors clearly in state that the results may not necessarily apply to other 

cask systems or sites, but the method might serve as a guide for similar PRAs. In vindication of 

this aim, this current report relied heavily upon the dry cask storage process description 

provided in the pilot study to provide insights into DCSOs at BWRs. Also, given the intentional 

boundaries of the pilot study, it was recommended that no inferences or conclusions about the 

regulatory implications of the study be drawn. Furthermore, in addition to omitting uncertainty 

analyses, very few sensitivity analyses were performed to evaluate input variables. Therefore, 

the degree of conservatism in the risk estimates cannot be determined. 

Probabilistic Risk Assessment (PRA) of Bolted Storage Casks: Updated Quantification 

and Analysis Report No. 1009691 [2]

During the same period in which the NRC was initiating its pilot PRA study on the HI-STORM 

100 system at a BWR site, the Electric Power Research Institute (EPRI) analyzed a bolted 

DCSS design at a generic PWR site and further applied generic site conditions based on the 

Northeast United States [4]. The bolted cask and PWR were intentionally chosen to complement 

the NRC’s efforts. EPRI’s study focused on the radiological risks to the public over the life cycle 

of a spent fuel cask to obtain insights that could be used to optimize risk and resource 

allocations throughout DCSOs. The authors of the EPRI report also emphasized that they did 

not conduct a “best-estimate” or a “bounding analysis,” but something in between due to the 

nature of the conservative assumptions. Sensitivity analyses were performed on PRA 

assumptions, but the report is careful to note that an uncertainty analysis was not performed in 

a manner that would have necessitated a detailed customization of the PRA to a specific site. 

Because the report authors produced “generic results,” they felt that a rigorous uncertainty 

analysis would not be prudent.
A-2

Control of Heavy Loads at Nuclear Power Plants: NUREG-0612 [12]

This report describes the technical studies and evaluations performed by NRC staff on the 

heavy load handling near spent nuclear fuel. It also includes the staff’s guidelines and guideline 

implementation plans based on the technical studies. Key items emphasized include safe load 

paths, use of load handling procedures, training of crane operators, guidelines on slings and 

special lifting devices, periodic inspection and maintenance for the crane, use of single failure 

proof handling systems, use of mechanical stops or electrical interlocks to keep heavy loads 

away from fuel or safe shutdown equipment, or analyzing the consequences of postulated 

heavy load drops to show these are within acceptable limits. The report also reviews crane drop 

events described across three different sources: (1) Occupational Safety and Health 

Administration reports for industrial crane drops, (2) U.S. Navy crane experience, and (3) NPP 

licensee event reports (LERs).

A Survey of Crane Operating Experience at U.S. Nuclear Power Plants from 1968 through 

2002: NUREG-1774 [3]

NUREG-1774 was written to respond to candidate generic issue 186, “Potential Risk and 

Consequences of Heavy Load Drops in Nuclear Power Plants,” to determine the likelihood and 

significance of heavy load drops. The approach used was a review of crane operating 

experience from actual crane operating experience at U.S. nuclear power plants, licensee event 

reports, NRC inspection reports, licensee correspondence, and crane vendor reports. Included 

with the report were crane operating experience reports issued by the New Mexico 

Environmental Evaluation Group, the Department of Energy, the Department of the Navy, and 

the California Division of Occupational Safety and Health.

Spent Fuel Receipt and Storage at the Morris Operation [4]

This report provides a thorough pictorial and written description of the operation and 

maintenance activities in the only away from reactor, wet-storage ISFSI located near Morris, IL. 

The numerous photographs and drawings of cask and fuel handling equipment, along with 

carefully crafted written descriptions enable a comprehensive understanding of the fuel receipt, 

fuel movement, and fuel storage using two different types of storage cask systems available in 

1978 (i.e., the IF-300 cask and the NAC-1/NFS-4 cask). 

Storage, Handling and Movement of Fuel and Related Components at Nuclear Power 

Plants [5]

This excellent guidebook, prepared by the IAEA, is concerned with the techniques, problems, 

and safety requirements related to handling nuclear fuel (fresh and irradiated) and other core 

components for nuclear power plants. Detailed discussions review best practices and actual 

experiences covering fuel activities starting with reception, inspection and storage of fresh fuel 

through refueling activities, on-site movements, and preparations for off-site transport. Both 

safety and physical protection aspects are addressed. 
A-3

Options, Experience and Trends in Spent Nuclear Fuel Management [6]

This is an excellent and concise report presenting the fuel management options, international 

experience with these options, and trends circa 1995 for fuel management. The purpose of the 

report is also to encourage and assist countries in achieving an integrated approach to 

managing spent fuel by clearly delineating the technical options. The contents include policy 

considerations and their effect on spent fuel management, the current regulatory framework 

regarding spent nuclear fuel, selection of fuel management options, reprocessing technology, 

disposal technology, and storage technology. 

Long Term Storage of Spent Nuclear Fuel–Survey and Recommendations: Final Report 

of a Coordinated Research Project 1994–1997 [7]

This report provides a relatively detailed, international perspective on experiences with storage 

of spent nuclear fuel. It includes a listing of current/planned AFR spent fuel management 

practices around the world and detailed information regarding long-term behavior of spent fuel, 

long-term behavior of dry storage systems, wet spent fuel storage facilities, and regulatory 

concerns related to long-term spent fuel storage.

Design of Spent Fuel Storage Facilities [8]

This report provides guidance on how to build and maintain spent fuel storage facilities to 

ensure subcriticality of fuel, adequate removal of residual heat, radiation protection, and 

containment of radioactive material for the lifetime of the facility. It essentially represents and 

international consensus on useful design principles for spent fuel storage facilities, including 

both safety and safeguards considerations from design and operation through decommissioning 

activities. 

Value/Impact Analysis of Accident Preventive and Mitigative Options for Spent Fuel 

Pools [9]

This report documents a series of value/impact studies performed for accident prevention and 

mitigation options intended to reduce the risks posed by the storage of SNF at nuclear power 

plants in spent fuel storage pools. The options included low-density re-racking of spent fuel, 

installation of water sprays above the SFP, and installation of redundant water cooling and/or 

makeup systems. The report concluded that the options were not cost-effective, given the low 

likelihood of an SFP accident causing a significant radiological release and the high cost of 

modifications to a facility. An important caveat regarding this assessment was highlighted in the 

abstract to the report: “These insights are largely contingent upon compliance with guidelines 

developed for licensees to assure the safe handling of heavy loads in the vicinity of SFPs thus 

reducing the likelihood of the structural failure of the pool and rapid loss of water inventory due 

to a cask drop event.”

General Description of a Boiling Water Reactor [10]

This overview of boiling water reactor systems designed by the General Electric Company 

includes descriptions of major systems and operations. A chapter on refueling equipment and 

procedures provides information regarding fuel bundles; fuel receipt, storage, and shipment; 

bundle grappling equipment; and material handling using the refueling bride crane.
A-4

BWR Power Plant Training: BWR Technology [11]

The document is similar to the general description of a BWR described above, but it is designed 

more as a training manual. It goes into detail regarding plant systems, components, and 

methods of operation. Sections on fuel handling systems, components, and procedures 

benefitted this current report.

Holtec International Final Safety Analysis Report for the HI-STORM 100 Cask System [13]

This document contains a wealth of detailed information on the HI-STORM 100 cask system 

ranging from design and engineering data to recommended life-cycle-based operating 

procedures for various specific configurations of cask system components. Chapters 8–11 were 

especially useful during the preparation of this report as they provide a description of operating 

procedures along with CAD drawings showing configurations of cask system components at 

various steps in the procedures. The procedures are prescriptive to the extent that they provide 

the basis and general guidance for plant personnel in preparing detailed, written, site-specific

loading, handling, storage, and unloading procedures. It is expected that licensees will add, 

modify the sequence of, perform in parallel, or delete steps as necessary, provided that they

meet the intent of the FSAR guidance and satisfy the requirements of the Certificate of 

Compliance (CoC). Operational items not addressed include plant-specific equipment operating 

details on vacuum drying systems, valve manipulations, cask transporter operations, etc. (For 

example, cask system compatibility with general types of transporters is mentioned, but 

operational details are not.) In addition, descriptions of unloading activities do not address

specific details regarding extreme abnormal conditions, except for the following admonition:

In the event of an extreme abnormal condition (e.g., cask drop or tip-over event) 

the user shall have appropriate procedural guidance to respond to the situation. 

As a minimum, the procedures shall address establishing emergency action 

levels, implementation of emergency action program, establishment of personnel 

exclusion zones, monitoring of radiological conditions, actions to mitigate or 

prevent the release of radioactive materials, and recovery planning and 

execution and reporting to the appropriate regulatory agencies, as required. 

Standard Review Plan for Dry Cask Storage Systems [14]

This standard review plan (SRP) provides guidance to NRC staff in the Spent Fuel Project 

Office for performing safety reviews of DCSS. The SRP is intended to ensure the quality and 

uniformity of the staff reviews, which includes providing a basis for the scope of a review and 

clarifying regulatory requirements. The SRP allowed for greater understanding what comprises 

a safely designed and operated DCSS including the following elements: structural, thermal, 

shielding, criticality, and confinement criteria; as well as operating procedures, testing and 

maintenance, radiation protection, accident analyses, quality assurance, and decommissioning. 
A-5

Appendix A References

1. Nuclear Regulatory Commission (U.S.) (NRC). NUREG-1864. “A Pilot Probabilistic Risk 

Assessment of a Dry Cask Storage System At a Nuclear Power Plant.” Washington, DC: 

NRC. 2007.

2. Electric Power Research Institute. Probabilistic Risk Assessment (PRA) of Bolted 

Storage Casks: Updated Quantification and Analysis Report No. 1009691. Palo Alto, 

CA: Electric Power Research Institute. 2004.

3. Nuclear Regulatory Commission (U.S.) (NRC). NUREG-1774. “A Survey of Crane 

Operating Experience at U.S. Nuclear Power Plants from 1968 through 2002.”

Washington, DC: NRC. 2003.

4. Astrom, K.A. and K.J. Eger. “Spent Fuel Receipt and Storage at the Morris Operation: 

NEDG-21889.” San Jose, CA: General Electric Company: Nuclear Energy Programs 

Division. 1978.

5. International Atomic Energy Agency (IAEA). “Storage, Handling and Movement of Fuel 

and Related Components at Nuclear Power Plants, Technical Reports Series, No. 189.”

Vienna: IAEA. 1979.

6. International Atomic Energy Agency (IAEA). “Options, Experience and Trends in Spent 

Nuclear Fuel Management, Technical Reports Series, No. 378.” Vienna: IAEA. 1995.

7. International Atomic Energy Agency (IAEA). “Long term storage of spent nuclear fuel -

survey and recommendations: Final report of a coordinated research project 1994-1997, 

IAEA-TECDOC-1293.” Vienna: IAEA. 2002.

8. International Atomic Energy Agency (IAEA). “Design of Spent Fuel Storage Facilities, 

Safety Series, No. 116.” Vienna: IAEA. 1994.

9. Nuclear Regulatory Commission (U.S.) (NRC). NUREG/CR-5281. “Value/Impact 

Analyses of Accident Preventive and Mitigative Options for Spent Fuel Pools.”

Washington, DC: NRC. 1989.

10. General Electric Company (GE). “General Description of a Boiling Water Reactor: 

NEDP-20120.” San Jose, CA: GE.1975.

11. General Electric Company (GE). “BWR Power Plant Training: BWR Technology: NEDO10260.” San Jose, CA: GE. 1971.

12. Nuclear Regulatory Commission (U.S.) (NRC). NUREG-0612. “Control of Heavy Loads 

at Nuclear Power Plants: Resolution of Generic Technical Activity A-36.” Washington, 

DC: NRC. 1980.

13. Holtec International. “Holtec International Final Safety Analysis Report for the HISTORM 100 Cask System, Revision 3, Report No. HI-2002444.” Marlton, NJ: Holtec 

International. 2005.

14. Nuclear Regulatory Commission (U.S.) (NRC). NUREG-1536. “Standard Review Plan 

for Dry Cask Storage Systems.” Washington, DC: NRC. 1997.

B-1

APPENDIX B DETAILED DESCRIPTION OF DRY CASK STORAGE OPERATIONS AND 

PROCESSES

This detailed description is a hybrid of both welded cask and bolted cask with a mixture of 

process steps borrowed from DCSOs at both BWR and PWR plants. The primary focus is on 

operations followed at a Mark I BWR using the HI-STORM 100 DCSS for two reasons: (1) Data 

gathered during the NRC’s pilot dry cask PRA was made available to us; and (2) as mentioned 

in Section 2.3 this report, DCSOs at Mark I BWRs involve cask movement paths that present 

more opportunities for high-consequence failures than those found at other BWRs and PWRs. 

Varying levels of detail found in different parts of the DCSO reflect varying levels of detail in the 

information made available to us. Therefore, the following description is not complete, nor 

exhaustive, although we have aimed for both, given resource limitations. The information is 

arranged such that section headings (e.g., B.1, B.2) represent the seven phases of DCSOs 

presented in Section 5. The subheadings (e.g., B.2.1, B.2.2) present steps completed within 

each phase.

B.1 Fuel Load Planning 

Prepare the fuel load plan–The configuration control responsibility for preparing fuel movement 

plans will generally reside in the appropriate engineering department (e.g., nuclear fuel 

engineering) at a plant site. Below are the basic steps involved in generating the movement 

plan:

(1) A reactor engineer generates a fuel move sheet.

(2) A second reactor engineer reviews it.

(3) The reactor engineering supervisor approves it.

(4) The approved move sheet is forwarded to the fuel handlers.

This process involves engineers reviewing the current distribution of fuel assemblies in the SFP 

(i.e., location, age, burn-up level, etc.) and project forward in time to the age of fuel at the time a 

cask loading campaign is scheduled. It is anticipated that the reactor engineer(s) responsible for 

generating the fuel move sheet will select the oldest fuel bundles in the pool for dry cask 

storage. Given that there will be a distribution of assemblies of different ages (all should be at 

least 5 years old), the “youngest” assemblies should be positioned near the center of the cask 

or canister and the “oldest” assemblies toward the outside.

1 Care is required to prevent 

inadvertent loading of insufficiently decayed fuel or combinations of materials which exceed 

criticality limits Therefore, the reactor engineer(s) will also be responsible for determining the 

appropriate, specific placement pattern for assemblies within the canister. The fuel move sheet 

will include step-by-step instructions for locating the proper assemblies (i.e., alphanumeric grid 

locations and fuel assembly serial numbers) and configuring them in a vacant portion of the SFP 

storage racks in a manner identical to the eventual placement in their intended canister. 

It is assumed that the second reactor engineer assigned to review the move sheet will 

thoroughly review the fuel-loading plan and be watchful for any errors (i.e., fuel bundles that do 

not meet the proper age, burn-up, or canister location criteria). The reactor engineering 

supervisor approval is assumed to be a largely perfunctory task in which the supervisor may 

spot check a few assembly assignments and seek some evidence verifying that the required 

 1 The arrangement of placing the “youngest” assemblies near the center of the canister is done to provide as 

much radiation shielding as possible.
B-2

steps of the fuel move sheet process were followed—at a minimum this will consist of a verbal 

confirmation with the engineers who prepared and reviewed the fuel move sheet.

B.2 Cask Operations Personnel and Equipment Preparation 

B.2.1 Development and Review of Cask Operations Procedures – These Items are 

Adapted from Various References Including NRC Inspection Procedures 60854 

and 608562

• Ensure that cranes and rigging equipment are properly designed, built, and maintained 

such that they will operate well within safety margins during DCSOs.

• Ensure that analyses have been performed and procedures/provisions are in place to 

mitigate the effects of a heavy load drop in the SFP, a drop during travel inside plant 

buildings, a drop during travel to and during emplacement at the ISFSI, and the process 

for retrieving spent fuel from a loaded DCSS in the ISFSI and returning it to the SFP.

• Ensure that all personnel involved in DCSOs have received proper training and 

certification commensurate with their planned and potential roles during normal, offnormal, and emergency events. 

• Ensure that the reactor facility emergency planning programs are revised to incorporate 

provisions for responding to an emergency condition at the ISFSI.

• Ensure that all procedures limit the placement of flammable and explosive liquids near 

the loaded cask during movement from the fuel building to the ISFSI pad.

• Ensure that proper material storage and handling practices are developed and followed 

throughout DSCOs per Standard Program and Process (SPP) procedure 4.3. This 

includes cask systems components and all supporting equipment both inside the plant, 

at the ISFSI, and along cask travel paths.

• Develop classification criteria for determining whether spent fuel is damaged or intact 

and incorporate into the relevant DCSO procedures.

• Evaluate reactor programs to verify compliance with the conditions of the cask design 

(e.g., HOLTEC, TN, NUHOMS, etc.), Certificate of Compliance, Final Safety Analysis 

Report, and requirements of 10 CFR Part 72.

• Evaluate site environmental conditions to determine that flooding and high/low 

temperature extremes will not present problems for storage of spent fuel at the site.

• Establish a safe load path for moving the loaded canister such that it will not be moved 

over the SFP or safety critical systems (especially important if reactor unit[s] will be at 

power during cask loading campaign).

 2 Nuclear Regulatory Commission (U.S.) (NRC). Inspection Procedure 60854, "Preoperational Testing of ISFSI." 

Washington, DC; NRC. 2008a.

Nuclear Regulatory Commission (U.S.) (NRC). Inspection Procedure 60856, "Review of 10 CFR 72.212(b) 

Evaluations." Washington, DC; NRC. 2008b.
B-3

• Establish a process for retrieving spent fuel from a loaded DCSS in the ISFSI and 

returning it to the SFP.

• Ensure that provisions are established to maintain adequate cask cooling in the event of 

an extended load hang-up. These provisions will include thermal and structural 

considerations due to venting and re-flooding as needed to maintain cooling.

• Incorporate into procedures the correct pressure requirements for helium backfill of the 

canister after drying.

• Incorporate into procedures the requirement for helium leak testing of the canister lid 

welds. Ensure that acceptable leak rates for passing the test are consistent with the 

requirements in the technical specifications. Ensure that personnel assigned to perform 

leak tests are qualified to the appropriate leak test certification requirements.

• Ensure that procedures have provisions for monitoring hydrogen during cask lid welding.

• Ensure that personnel performing welding operations on cask are qualified to Section IX 

of the ASME Code and are certified as either welders and/or welding operators for the 

welding process to be used (e.g., tungsten arc welding).

• Ensure that personnel performing weld examinations are appropriately certified for liquid 

penetrant exams for both normal temperature weld examinations and high temperature 

weld examinations.

• Procure and control weld filler material in accordance with QA program and records 

management program procedures.

• Ensure that weld procedures are written and qualified in accordance with the 

requirements in Section IX of the ASME Code.

• Incorporate proper vacuum drying time limits and acceptance criteria into procedures.

• Ensure that the pressure relief valve set point for the canister is set in accord with 

manufacturer specifications

• Conduct an extensive pre-operational test program to prepare for the loading of the first 

cask. 

• Ensure that a quality assurance program that satisfies or exceeds reactor facility Part 50 

requirements is used for ISFSI activities. The following elements need to be included in 

the QA program:

 Procurement controls

 Control of measuring and test equipment

 Operating status

 QA audits

 Tracking of problems

 Identifying corrective actions
B-4

• Ensure that radiological controls are established to support cask activities.

• Ensure that potential effluents from casks (should they materialize) will be properly 

handled with structures, systems, and components at the ISFSI and along the travel 

path to the ISFSI

• Ensure that the records management program incorporates the various requirements for 

creating and maintaining ISFSI records. In addition to maintaining detailed records on

the fuel loading of each cask, licensees are to maintain the records provided by the cask 

supplier for each cask design used, and make provisions for transferring these records if 

a cask is sold, leased, loaned, or otherwise transferred to another user. 

• Implement an ISFSI security program consistent with the reactor facility security program 

including response to events, offsite support, training and certification of security force 

personnel, lock and key controls, and search requirements. The appropriate safeguards 

program and security plan must protect against the design basis threat of radiological 

sabotage in accordance with the requirements of 10 CFR 73.

• Ensure that a training program is established and maintained for personnel assigned to 

the ISFSI that provides a strong basis for understanding the requirements and safe 

practices associated with DCSOs.

• Ensure that roadways over which cask will be transported to the ISFSI meet the required 

compressive strength limits specified by the cask system manufacturer. Also ensure that 

the effects of weathering, repeated use, and possible interferences from overhead lines 

or nearby strictures have been considered. 

• Assess the potential impact of a breakdown of the transport vehicle transporting the cask 

on reactor site traffic and security activities.

B.2.2 Calibration of Inspection and Test Equipment

Examples of equipment requiring calibration include:

• Torque tools

• Radiation monitors

• Radiation alarms

• Pressure gauges

• Nondestructive examination equipment

• Temperature gauges

• Flow meters

• Gas monitors (e.g., hydrogen)

• Load cells used to measure tension loading on crane cabling

B.2.3 Inspection of Crane Components and Operation

NUREG-0554, Section 2.4 requires cold-proof testing followed by nondestructive examination 

(NDE) of welds whose failure could result in the drop of a critical load. This method of verifying 

material properties requires nondestructive examination of critical areas to be performed at an 
B-5

interval of four years or less. Therefore, inspection of critical welds is to have been performed 

within four years from the time the crane is to be used for a cask loading campaign.

3

NDE should be completed for all Class 1 areas before and after load testing. Welding plans for 

seismic upgrading must be thoroughly reviewed to ensure adherence to appropriate engineering 

analysis. NDE time periods should be established to account for latency periods for cracking 

and lamellar tearing, and a rerating method for upgraded/uprated cranes needs to be 

established and followed closely. Also, aging of structures, systems, and components must be 

recognized and negative effects hedged against via an appropriate management/maintenance 

recommendation. 

B.2.4 Inspection of Crane Support Structures

Ensure that crane support structures are thoroughly inspected for cracks or other aberrations 

that might impair or compromise the ability of the structure to safely distribute compression 

(stress), tension (strain), and shear loads imparted by the crane systems.

B.2.5 Inspection of Transport Vehicles

• Ensure that transport vehicle systems are operational and enable safe locomotion (e.g., 

no flammable liquid leaks, functional systems operate correctly, etc.)

• Ensure that cask support components are operational and prepared for safe movement 

of cask (e.g., on crawlers–lift unit boom pins in working order; on flatbeds–truck bed is 

free from structural anomalies, tires are inflated properly; all rigging equipment used to 

couple cask to transporter is in proper working order; etc.)

B.2.6 Inspection of Yokes, Hooks, Other Crane Accessories and Rigging (e.g., Slings, 

Mobile Cranes, In-House Manufactured Rigging/Support Equipment)

• Ensure formal QA for all yokes, hooks, other crane accessories and rigging.

• Perform visual checks and NDE evaluations as required.

• Ensure proper training of all personnel responsible for rigging and for verifying 

performance of rigging duties by others.

B.2.7 Inspection/Test of HVAC System and Building Atmosphere Isolation Systems

• Ensure that the reactor, auxiliary, or fuel building atmospheric isolation systems will be 

operational and in use during DCSOs.

• Ensure that the reactor, auxiliary, or fuel building atmospheric filtering systems will be 

operational and in use during DCSOs.

 3 It is important to note that NUREG-0554 [14] guidance is not applied in all situations; that is, some cranes that 

predate NUREG-0554 have not been held to NUREG-0554 requirements. Ideally, engineering analyses are 

performed such that acceptable (i.e., NUREG-0554 equivalent) consideration occurs for these grand-fathered cranes; 

however, SME material presented in Section 5 of this report suggests that there may be outstanding issues regarding 

cranes and crane monitoring processes.
B-6

• Ensure that emergency/back-up systems, which are required to start/operate under 

specified conditions, have been tested and are operational during DCSOs.

B.2.8 Staging of Equipment

• Be sure that cask system components (e.g., MPC, transfer cask, storage cask, 

fasteners, plugs, and other equipment) are properly received, initially inspected and 

stored at the site in advance of the cask loading campaign.

• Cask yoke and other lifting accessories are attached to the high-capacity, gantry crane 

in either the reactor, auxiliary, or fuel building – depending upon the specific plant 

design.

• Prepare and position all additional lifting devices and rigging equipment.

• Position the transfer slide4

• Erect scaffolding to safely support welders, welding, and other lid sealing, NDE 

equipment, and other operational monitoring equipment.

(if needed).

• Pre-position all welding and other lid sealing, NDE, and other operational monitoring 

equipment.

• Ensure safe positioning and handling of all flammable and/or hazardous materials (e.g., 

weld gas cylinders).

• Position the storage cask (e.g., Holtec HI-STORM storage cask) in the proper location 

for receiving the filled and sealed canister and transfer cask system components.

• Install vent duct shield inserts5

• Install the alignment guide or mating device

(if needed) on the storage cask.

6

• All equipment not needed for the cask loading campaign or other simultaneous 

operations is moved away from staging area and travel paths required by DSCO 

equipment.

on top of the storage cask (if needed).

B.3 Cask Preparation and Positioning 

Prior to beginning DCSOs, ensure the following:

• Personnel have been trained and certified per the approved training program.

 4 The transfer slide is a major piece of equipment for the Holtec HI-STORM 100 system that consists of an 

adjustable-height rolling carriage and a pair of channel tracks. The transfer slide supports the transfer step which is 

used to position the two lids (i.e., the pool lid and transfer lid) at the same elevation and creates a tight seam between 

the two lids to eliminate radiation streaming.

5 The vent duct shields, used in the Holtec systems, are designed to prevent radiation streaming from the HISTORM storage cask as the MPC is lowered past the vent openings from the transfer cask into the storage cask.

6 The alignment guide and the mating device are two components that are used in two different configurations of 

the Holtec cask system to facilitate the over-under positioning of the transfer cask and the storage cask prior to 

lowering the MPC into the storage cask.
B-7

• A pre-job briefing has been performed for all affected staff (and shift change briefs are 

prepared as applicable).

• Oversight and command and control responsibilities have been clearly established, 

including notification requirements.

• Specific radiological hazards are identified and controls implemented.

• All necessary sensors are properly calibrated and positioned.

• Impact limiters are placed in the cask decontamination or wash-down pit or prepared for 

attachment to cask system components if required or recommended by regulations, 

standards, or other approved operating procedures.

B.3.1 Bringing the Cask into the Building

• Welded lid

 MPC and transfer cask are moved into the auxiliary, reactor or fuel building 

depending upon the specific site configuration via cask component transport 

device (e.g., flatbed vehicle, rail car, crawler, etc.).

 Transfer cask components are moved into the cask decontamination area or 

wash-down pit7

• Bolted lid

using a large overhead gantry crane.

 Cask is moved into the auxiliary, reactor or fuel building depending upon the 

specific site configuration via cask component transport device (e.g., flatbed 

vehicle, rail car, crawler, etc.).

 Transfer cask components are moved into the cask decontamination area or 

wash-down pit using a large overhead gantry crane.

 Cask head fasteners are loosened.

B.3.2 Preparation of the Cask System for Loading and Lid Attachment

• Visually inspect the MPC Upending Frame8

• At the start of cask loading campaign, an empty transfer cask is upended.

for gouges, cracks, deformation or other 

indications of damage. Repair or replace damaged components as necessary.

9

 Position the HI-TRAC under the lifting device.

 7 The decontamination area or cask wash-down pit is an area designed for the receipt of both storage casks and 

dry cask storage casks. Decontamination is of major importance when storage casks containing or having contained 

irradiated fuel are brought into the plant. Decontamination is of lesser importance (i.e., with respect to radionuclides) 

when previously unused dry cask storage system components are brought into the plant.

8 An upending frame must be used to upend the MPC from the horizontal to the vertical position as the lifting 

lugs on the MPC are not designed to support large side loads.

9 The assumption here is that the transfer cask was transported to the plant in a horizontal orientation. It is 

possible that the transfer and storage casks could have been transferred in a vertical orientation.
B-8

 If necessary, remove the missile shield from the HI-TRAC Transfer Frame.

 Engage the lift yoke to the lifting trunnions.

 Apply lifting tension to the lift yoke and verify proper engagement of the lift yoke.

 Slowly rotate the transfer cask to the vertical position keeping all rigging as close 

to vertical as practicable.

• Ensure that inspection for general condition of the cask system components and main 

body lift lugs is performed.

• Wash/clean all cask system components as necessary.

• Ensure to perform thorough quality inspection to verify that the cask system meets the 

criteria for materials, structural integrity, and monitoring systems as stated in the cask 

Final Safety Analysis Report (FSAR).

• If necessary, remove the HI-TRAC transfer cask Top Lid by removing the top lid bolts 

and using the lift sling.

• Store the Top Lid and bolts in a site-approved location.

• Inspect all cavity locations within the transfer cask for foreign objects.

• Perform a radiological survey of the inside of the transfer cask to verify that no residual 

contamination is present from previous use of the cask.

10

• If necessary, configure the HI-TRAC transfer cask with the pool lid as follows:

 Inspect the seal on the pool lid for cuts, crack, gaps and general condition. 

Replace the seal if necessary.

 Remove the bottom lid bolts and store them temporarily.

 Raise the empty HI-TRAC and position it on top of the pool lid.

 Inspect the pool lid bolts for general condition. Replace worn or damaged bolts 

with new bolts.

 Install the pool lid bolts. Be sure to comply with bolt torque requirements.

 If necessary, thread the drain connector pipe to the pool lid.

• Install the MPC onto the Upending Frame; ensure that banding straps are secure around 

the MPC shell.

• Inspect the Upending Frame slings in accordance with the site’s lifting equipment 

inspection procedures.

• Rig the slings around the bar in a choker configuration to the outside of the cleats

 10 It is important to remember that during a CLC a single transfer cask and related components will likely be 

reused many times as only the MPC and HI-STORM storage casks will be dedicated to each individual fuel load and 

stored at the ISFSI. Therefore, replacement of seals, bolts and other cask system components should be expected.
B-9

• Attach the MPC upper end slings of the Upending Frame to the main overhead lifting 

device.

• Attach the bottom-end slings to a secondary lifting device (or a chain fall attached to the 

primary lifting device).

• Raise the MPC in the Upending Frame.

11

 Slowly lift the upper end of the Upending Frame while lowering the bottom end of 

the Upending Frame.

 When the MPC approaches the vertical orientation, tension on the lower slings 

may be released.

 Place the MPC in the vertical orientation.

 Disconnect the MPC straps and disconnect the rigging.

• Install the MPC into the HI-TRAC transfer cask.

 Install the four point lift sling to the lift lugs inside the MPC.

 Raise and place the MPC inside the HI-TRAC.

 Rotate the MPC so that the alignment marks punched into the top edges of both 

the MPC and the transfer cask are properly aligned when the MPC is seated.

 Disconnect the MPC rigging or the MPC lift rig. 

• Install the upper fuel spacers in the MPC lid (if required12

 Position the MPC lid on supports to allow access to the underside.

) as follows:

 Thread the fuel spacers into the holes provided on the underside of the MPC.

 Install threaded plugs in the MPC lid where and when spacers will not be 

installed.

• Perform an MPC lid and closure ring fit test (at the user’s discretion) as follows:

 Visually inspect the MPC lid rigging.

 Raise the MPC lid such that the drain line13

 Install the drain line to the underside of the MPC lid.

can be installed.

 Align the MPC lid and lifting yoke so that the drain line will be positioned in the 

MPC drain location.

 Install the MPC lid.

 11 The Upending Frame corner at the bottom of the MPC should be kept close to the ground during the upending 

process.

12 Depending upon the specific fuel-type to be stored, fuel spacers may or may not be required.

13 The drain line is actually a rigid metal pipe, threaded at the end which engages the MPC lid.
B-10

 Verify that the MPC lid fit and weld prep are in accordance with design 

drawings.

14

 Install, align and fit-up the closure ring.

 Verify that closure ring fit and weld prep are in accordance with the fabrication 

drawings or the approved design drawings.

 The fit test is now complete: Remove the closure ring, vent and drain port cover 

plates and the MPC lid; disconnect the drain line; store these components in a 

site-approved storage location.

• Install lower fuel spacers in the MPC (if necessary) by manually setting the lower fuel 

spacers into the MPC cells.

• Ensure that any neutron poisons and other internals are loaded properly into the 

cask/canister.

• The annulus15

• An inflatable seal is installed in the upper end of the annulus between the MPC and the 

transfer cask to prevent SFP water from contaminating the exterior surface of the MPC. 

The following steps are used for installing the inflatable seal:

is then filled with plant demineralized water and the MPC is filled with 

either SFP water or plant demineralized water (borated as required).

16

 When filling the annulus with water, stop filling just below the inflatable seal 

seating surface.

 Manually insert the inflatable annulus seal around the MPC.

 Ensure that the seal is uniformly positioned in the annulus area.

 Inflate the seal.

 Visually inspect the seal to ensure that it is properly seated in the annulus. 

Deflate, adjust and inflate the seal as necessary. Replace seal if needed. 

• Install the transfer cask top lid bolt plugs and/or apply waterproof tape over any empty 

bolt holes.

17

• Fill the MPC with either demineralized water or SFP water to approximately 30.5 

centimeters (12 inches) below the top of the MPC shell.

18

 14 The MPC shell is relatively flexible compared to the MPC lid and may create areas of local contact that impede 

lid insertion into the shell. Grinding of the MPC lid below the minimum diameter on the drawing is permitted to 

alleviate interference with the MPC shell in areas of localized contact.

15 The annulus is defined to be the space between the outer wall of the MPC and the inner wall of the transfer 

cask.

16 Do not use sharp tools or instruments to install the inflatable seal & putting some air into the seal aids in the 

installation process.

17 Inserting bolt hole plugs or waterproof tape over empty bolt holes reduces the time required for 

decontamination.

18 Keeping the water level below the top of the MPC prevents splashing during handling.
B-11

• If necessary due to plant capacity limitations, drain the water from the neutron shield 

jacket.

• Ensure that any neutron poisons are loaded properly into the cask/canister.

B.3.3 Dry Runs of Cask Movement

Dry runs of cask movement operations will be performed according to the plant procedures to 

ensure that all equipment and personnel are ready for fuel handling to proceed. The rest of 

these procedures will continue on as if dry run activities were previously performed. 

B.3.4 Movement of Cask to the Cask Loading Pit in the Spent Fuel Pool

• Ensure that the secondary containment is closed.

• Establish slightly negative pressure within the containment.

• If used, fill the Annulus Overpressure System (AOS) lines and reservoir with 

demineralized water and close the reservoir valve. Attach the AOS to the transfer cask.

• Verify SFP for proper boron concentration.

• Engage the lift yoke to the transfer cask lifting trunnions and position the transfer cask 

over the cask loading area (a.k.a., the cask pit, which is an alcove of the SFP) with the 

MPC fuel basket aligned to the orientation of the spent fuel racks.

• Wet the surfaces of the transfer cask and lift yoke with plant demineralized water while 

slowly lowering the transfer cask into the SFP.

• When the top of the transfer cask reaches the elevation of the reservoir, open the AOS 

reservoir valve. Maintain the reservoir water level at approximately 3/4 full the entire time 

the cask is in the SFP.

• Place the transfer cask on the floor of the cask pit and disengage the lift yoke. Visually 

verify that the lift yoke is fully disengaged. Remove the lift yoke from the SFP while

spraying the crane cables and yoke with plant demineralized water. 

• Observe the annulus for signs of air leakage. If leakage is observed (by the steady flow 

of bubbles emanating from one or more discrete locations) then immediately remove the 

transfer cask from the SFP and repair or replace the seal. 

• Gates between the SFP and the cask pit, above the level of the fuel, are then removed 

to allow movement of spent fuel assemblies from the SFP into the MPC seated within 

the transfer cask

B.4 Cask Loading

B.4.1 Fuel Movement from Rack Storage in the Spent Fuel Pool to the Cask Canister 

Fuel movement within the SFP – Fuel handlers carry out the instructions on the fuel move sheet 

to stage the fuel in the SFP in the same configuration as they are to be loaded into the canister. 
B-12

The fuel handlers perform double verification for each of the moves. The fuel handling 

personnel may be reactor operators (ROs), senior reactor operators (SROs), or radiation 

workers with specific training on refueling machine or spent fuel bridge crane operation. The 

general process for the fuel staging activity is described below:

(1) The fuel-handling personnel (FHP), in this case 2 people – fuel handler 1 (FH 1) and fuel 

handler 2 (FH 2), will crawl out to the basket on the refueling bridge crane (many BWRs) 

or the spent fuel bridge crane (PWRs and some BWRs) carrying their notebook 

containing the step-by-step fuel move sheets for the cask loading operation.

(2) The spotter (i.e., observer/verifier) will take up a position at the pool side with binoculars, 

a copy of the fuel move sheet, and a clipboard for securing the fuel move sheet pages. 

His duty will be to verify that the correct fuel assemblies are moved to the correct 

positions in both the staging area in the SFP and then into the cask or canister. 

(3) The FHP will tape up the first few sheets of the fuel move plan above the bridge crane 

console.

(4) The FHP will test the primary controls on the bridge crane, which include the following:

a. Hoist switch (lift/lower switch), spring loaded

b. X-axis spring loaded lever (side-to-side movement of bridge/hoist)

c. Y-axis spring loaded lever (front-to-back movement of bridge/hoist)

d. Weight scale with digital read out (displays tension due to load on the hoist)

e. Knob for grapple (rotate to engage or disengage)

(5) The FHP will execute the fuel movement tasks by conducting the following sub-tasks: 

a. Verify the alphanumeric grid location to move to and the serial number of the fuel 

assembly to pick up with the spotter before executing the move using 3 part 

communications; an example of the three-part communication process is shown 

below:

i. FH 1: Headed to grid location alpha-32 to pick up #100359, over

ii. Observer/Spotter: I confirm grid location alpha-32 to pick up #100359, 

over

iii. FH 1: Roger, out

b. Move the bridge crane to the grid location specified on the fuel move sheet (note 

that FH 2 is responsible for the crane movement, and FH 1 is responsible for 

radio communications with the spotter).

c. Lower the hoist to the grapple position.

d. Verify that the correct grid location and serial number is identified via 3 part 

communications with the spotter. An example of this communication is shown 

below:
B-13

i. FH 1: Arrived at grid location alpha-32 to pick-up #100359, over

ii. Observer/Spotter: Roger, I have a visual on #100359 at grid location 

alpha-32 for pick-up, over

iii. FH 1: Roger, out

e. Grapple the assembly.

19

f. Lift the assembly; FH 2 monitors the digital weight scale at the early stage of the 

lift to ensure that the bundle is being raised20

g. Verify the destination for the suspended assembly via 3 part communications 

with the spotter.

; FH 2 will hold the hoist switch in 

the raise position as the fuel assembly slowly raises.

h. Translate the assembly over to the correct grid location for “staging.”

i. Lower the fuel assembly into the designated grid location.

j. Confirm the destination for the assembly via 3 part communications with the 

spotter.

k. Mark the move on the move sheet with a pen tethered to the fuel move sheet 

clipboard.

l. Repeat sub-tasks (a)–(k) for each of the fuel assemblies to form the designated 

pattern in the SFP. Steps (a)–(j) will take approximately 600–720 seconds (10–

12 minutes) if all goes smoothly.

m. Repeat sub-tasks (a)–(k) to move each of the fuel assemblies into the cask or 

canister.

n. Have supervisor, nuclear fuel engineer, or other plant personnel provide an 

independent, final verification of the fuel assemblies as loaded into the cask or 

canister prior to commencement of canister lid sealing operations.

B.4.2 Placement of Canister Lid Over Loaded Fuel Canister with Limited Fastening to 

Canister

Place Lid on Cask – The crane operator will move the crane in order to center the lid over the 

cask. Maintenance workers attach the drain line (a pipe) to the underside of the MPC lid. 

Operator aligns drain line with the drain location in the MPC and lowers the lid onto the cask.

A single operator is stationed on the crane. The crane will be operated in a manual mode, with 

visual cues being used to initially lift the lid and move it to a position where the maintenance 

workers can attach the drain line. Approximately three workers will be in the vicinity of the pool, 

and one of them will be in communication with the crane operator, either through hand signals 

 19 Rotating the grapple knob will result in a light illuminating on the crane control panel indicating that the 

command to grapple was given, not that the grapple successfully occurred.

20 SMEs interviewed during the course of this project mentioned that the FHP may need to grab and wiggle the 

hoist cables after grappling a fuel assembly in order to “break it free” from the grid location and enable lifting.
B-14

or a communications headset. Once the lid is in position, the other two workers will screw the 

drain line into the lid (the line is threaded at one end). The crane operator will move the lid over 

the pool so that the drain line is above the drain location in the cask where it is intended to slide. 

He will use a combination of the position indicators on the crane, his own visual observation, 

and direction from the communication worker. The other workers have no specific assignment 

during this phase of the operation other than to notify the crane operator if some type of 

misalignment is occurring. The crane operator will lower the lid towards the cask, making 

corrections in the location to get the alignment correct. Once the drain line enters the proper 

location, he will lower the lid the rest of the way down. Weight indication on the crane control 

panel will indicate when the lid has stopped moving. Proper seating of the lid will be confirmed 

through observation by the communication worker.

21

Placement of Lid on Bolted Cask:

• Lower the O-ring onto the cask.

• Lower the cask lid onto the cask.

B.4.3 Attachment of Yoke to Transfer Cask

Connect Yoke to Cask Trunnions – Crane operator positions yoke at trunnions and engages the 

trunnions by closing the yoke arms and slightly lifting the yoke.

Once the lid is positioned, the operator will spread the yoke arms. He will then continue to lower 

the yoke and observe, with the help of the communication worker, when the arms are properly 

aligned with the trunnions. Height indication on the control panel will help to confirm proper 

height. Once aligned, the operator will close the arms so that the holes in the arms go over the 

trunnions. The communication worker will confirm that this has occurred. The operator will then 

raise the yoke slightly so that the yoke arm engages the grooves in the trunnions, which will be 

confirmed by the communication worker.

B.4.4 Movement of Loaded Cask Out of Cask Loading Pit

Lift Cask from Pit – Crane operator raises crane to lift cask from pit. During the lifting process, 

maintenance workers are decontaminating22 the cask and crane components to remove 

contaminated water. Radiation monitoring is also performed.

The other maintenance workers will now position themselves around the cask pit. They will 

have wash-down sprays, and one will be holding a radiation monitor. The crane operator will 

raise the yoke to lift the cask from the pit. As the cask nears the water surface, the worker with 

the radiation monitor will check radiation levels, which is the final confirmation that the lid is 

properly seated. The operator will continue to raise the cask unless he is told to stop due to 

high radiation. As the cask breaks the surface, the workers will spray the surface to remove any 

contamination from the SFP. This will continue until the entire cask is out of the water. Using 

indicators on the crane, the operator will stop lifting the cask at the height specified by 

procedure.

 21 Once the MPC lid is installed, transfer cask/MPC removal from the SFP should proceed in an expeditious 

manner to minimize the rise in MPC water temperature.

22 Decontamination activities include both spraying components with water (typically de-ionized water) and 

wiping components.
B-15

B.4.5 Movement of Loaded Cask to Sealing and Testing Area

(1) Move Cask Away from Fuel Pool – Once the cask is at sufficient height (i.e., as low as 

possible with consideration taken for any obstacles in the travel path, e.g., railings, 

pipes, etc., and to prevent inadvertent contact with the floor), crane operator moves cask 

away from the fuel pool, hovering it above the refueling floor. Maintenance workers 

monitor and wipe down the cask. 

The operator will move the cask to a predefined location adjacent to the pool. The 

position indicators on the crane will establish when the crane is in the correct position. 

The exact location is not essential, so this indication may be sufficient. The cask will 

remain suspended over the floor while the maintenance workers use “mops” to wipe the 

excess water from cask surfaces.

Initial sealing of bolted casks–immediately after the cask is lifted out of and just away 

from the pool; operators will hand insert and hand tighten four bolts to “initially” secure 

the lid to the cask.

(2) Move Cask to Preparation Area – Crane operator moves the cask the rest of the way to 

the preparation area and lowers it to the ground, lowering the yoke sufficiently to take 

pressure off the trunnions.

The operator will now move the cask to the preparation area. The position indicators on 

the crane will help establish when the crane is in the correct position, which will be 

confirmed and corrected (if necessary) by visible observation of the crane operator and 

the workers using alignment aids marked on the floor. The operator will lower the cask 

to the ground, stopping when the weight indicator on the control panel indicates that the 

weight is reduced to only the weight of the yoke.

(3) Move Yoke Away from Cask – Crane operator disengages the yoke arms from the 

trunnions by opening the arms. Maintenance workers disconnect the yoke straps from 

the lid. Crane operator moves the yoke away from the cask.

The crane operator will open the yoke arms from the control panel, verifying visually that 

the arms are clear of the trunnions. Two maintenance workers will go to the top of the 

cask and release the four clasps that connect the yoke to the lid. They will be in a 

position that should allow them to see that the yoke arms have cleared the trunnions. 

Once they are clear of the cask, the crane operator will move the crane away from the 

cask. He will move it to a preselected location using the position indicators on the crane, 

and confirm visually that the yoke is out of the way for the next phase of work on the 

cask.

(4) If previously drained, fill the neutron shield jacket with plant demineralized water or an 

ethylene glycol solution (25% ethylene glycol solution, as required). 

(5) Measure the dose rates at the MPC lid and verify that the combined gamma and neutron 

dose is below expected values. This dose rate measurement at the MPC lid is very 

important as higher than expected dose rates will provide the first indication that fuel 

assemblies not meeting the CoC criteria may have been loaded, especially if the higher 

dose rate assemblies were loaded near the edges of the canister (i.e., furthest from the 

center of the canister and closest to the dose rate measurement equipment).
B-16

(6) Use crane23

B.4.6 Preparations for Welding or Bolting of Lid onto Cask

to complete the positioning of scaffolding around the transfer cask in the 

preparation area.

• Decontaminate the area around the transfer cask top flange and install the temporary 

shield ring.

24

• Clean the vent and drain ports to remove any dirt. Install the removable valve operating 

assemblies (RVOAs).

25

• Attach the water pump to the drain port and lower the water level to keep moisture away 

from the weld region.

26

• Disconnect the water pump.

.\

• Carefully decontaminate the MPC lid top surface and the shell area above the inflatable 

seal. 

• Deflate and remove the inflatable annulus seal.

• Survey the MPC lid top surfaces and the accessible areas of the top 7.62 centimeters (3

inches) of the MPC. 

• Install the annulus shield.

27

• For cask systems to be welded:

 Manual and semi-automated welding equipment is prepared for use.

 Hydrogen monitoring equipment is positioned near the lid weld location.

 Ensure that the lid is centered in the MPC shell; it may be necessary to use a 

hand-operated chain fall in order to closely control the lift and allow rotation and 

repositioning by hand. If the chain fall is hung from the crane hook, the crane 

should be tagged out of service to prevent inadvertent use during this operation. 

 If necessary, install MPC lid shims around the MPC lid to make the weld gap 

uniform

 23 It is possible that the auxiliary crane may be used to position scaffolding around the transfer cask while the 

main crane is still attached to the cask; in this situation there may be some potential for the auxiliary crane and 

scaffolding movement to result in a cask drag over. Further analysis of this possibility may lead to the development of 

an additional cask drop scenario in a subsequent report.

24 If the Temporary Shield Ring is not used, some form of gamma shielding (e.g., lead bricks or blankets) should 

be placed in the trunnion recess areas of the transfer cask water jacket to eliminate the localized hot spot.

25 The RVOAs allow the vent and drain ports to be operated like valves and prevent the need to hot tap into the 

penetrations during unloading operations. The RVOAs are purposely not installed until the cask is removed from the 

spent fuel pool to reduce the amount of decontamination. 26 Personnel should remain clear of the drain hose any time water is being pumped or purged from the MPC. 

Assembly crud, suspended in the water, may create a radiation hazard to workers. 27 The annulus shield is used to prevent objects from being dropped into the annulus and helps reduce dose 

rates directly above the annulus region. The annulus shield is hand installed and requires no tools.
B-17

 Conduct radiation monitoring at regular intervals (continuous monitoring is 

recommended) in order to detect evidence of a cask flaw or misloading event.

• For cask systems using bolt-on lids:

 Manual and pneumatic torque tools are prepared for use.

 Water is drained to allow for drying out bolt holes before fasteners are inserted; 

careful inspection is conducted to verify that bolt holes are dry.

 Conduct radiation monitoring at regular intervals in order to detect evidence of a 

cask flaw or misloading event.

B.4.7 Lid Fastening Operations

• Welded28

 Tack welds are manually performed to steady the lid on the MPC.

lid

 The tack welds are then visually inspected.

 The semi-automated welding equipment (or welding robot) is mounted to the 

MPC lid.

 The semi-automated welding equipment is activated and monitored by welding 

personnel.

 Conduct radiation monitoring at regular intervals in order to detect evidence of a 

cask flaw or misloading event.

• Bolted lid

 Gaskets are properly seated.

 Bolts are positioned by hand in bolt holes.

 Pneumatic torque wrenches are used to initially seat bolts in a specified insertion 

pattern.

 Manual torque wrenches are used to apply final torques to bolts following a 

specified torque sequence.

 Conduct radiation monitoring at regular intervals in order to detect evidence of a 

cask flaw or misloading event.

B.4.8 Non-Destructive Evaluation (Hydrostatic Testing, Dye Penetrants Tests, Ultrasonic 

Testing, etc.)

• Welded lid

 Liquid dye penetrant testing (PT) is performed to test the weld on both the root 

and final passes.

 28 If any of the MPC welds require grinding, there is a risk of contamination. All grinding activities should be 

performed under the direction of radiation protection personnel.
B-18

 Ultrasonic testing (UT) may be performed to test the weld (i.e., the geometry of 

the lid weld may not permit adequate conditions for ultrasonic testing); if multilayer UT is not feasible, a multi-layer PT should be performed during the welding 

operation including one intermediate examination after approximately every 

0.9525 centimeters (3/8 of an inch) of weld depth.

 The MPC is filled with water to hydrostatically test the weld.

 Attach the drain line to the vent port and route the drain line to the SFP or 

the plant liquid rad waste system.

 Fill the MPC with either SFP water or plant demineralized water until 

water is observed flowing out of the vent port drain hose. 

 Close the drain valve and pressurize the MPC to 861,845 +34,474/-0 

Pascals [125 +5/-0 pounds per square inch gauge (psig)]

 Close the inlet valve and monitor for a minimum of 600 seconds (10 

minutes). Any pressure drop is undesirable. 

 Following the 600 second (10 minute) hold period, visually examine the 

MPC lid-to-shell weld for leakage of water. The acceptance criterion is no 

observable water leakage.

 Release the MPC internal pressure, disconnect the water fill line and 

drain line from the vent and drain port RVOAs leaving the vent and drain 

port caps open.

 A second PT is performed on the MPC to verify structural integrity.

 Conduct pressure, temperature, and radiation monitoring at regular intervals 

once cask lid is affixed to enable early detection of undesirable transients.

• Bolted lid

 Pressure test the seal with helium.

 Conduct pressure, temperature, and radiation monitoring at regular intervals 

once cask lid is affixed to enable early detection of undesirable transients.

B.4.9 Draining, Purging, Drying, and Inerting Using Vacuum Drying or Forced Helium 

Dehydration System (FHD) 

• Using a vacuum drying system (VDS) – For MPCs without high burn-up fuel, the vacuum 

drying system may be connected to the MPC and used to remove all liquid water from 

the MPC in a stepped evacuation process. A stepped evacuation process is used to 

preclude the formation of ice in the MPC and vacuum drying system lines.

 The water is drained from the cask

 Attach the drain line to the vent port and route the drain line to the SFP or 

the plant liquid rad waste system.
B-19

 Attach the water fill line to the drain port and fill the MPC with either SFP 

water or plant demineralized water until water is observed flowing out of 

the drain line.

 Disconnect the water fill and drain lines from the MPC leaving the vent 

port valve open to allow for thermal expansion of the MPC water.

 Attach a regulated helium or nitrogen supply to the vent port.

 Attach a drain line to the drain port.

 Verify the correct pressure of the gas supply.

 Open the gas supply valve and record the time at the start of MPC 

draining.

 Start the warming pad29

 Drain the water out of the MPC until water ceases to flow out of the drain 

line.

if used.

 Shut the gas supply valve and disconnect the gas supply line from the 

MPC.

 Disconnect the drain line from the MPC.

 Attach the vacuum drying system (VDS) to the vent and drain port RVOAs. 

 Vacuum is drawn to a predetermined level to ensure thorough removal of water 

from cask–this is performed using a stepped evacuation process; the internal 

pressure should eventually be reduced below 400 Pascals (3 torr) and held for 

1,800 seconds (30 minutes) to ensure that all liquid water is removed.

30

 Perform the MPC drying pressure test in accordance with the technical 

specifications.

 Close the vent and drain port valves.

 Disconnect the VDS from the MPC.

 Stop the warming pad, if used.

 Close the drain port RVOA cap and remove the drain port RVOA.

 Set the helium31

 29 An optional warming pad may be placed under the Holtec HI-TRAC transfer cask to replace the heat lost 

during the evaporation process of MPC drying. This may be used at the user’s discretion for older and colder fuel 

assemblies to reduce vacuum drying times.

bottle regulator pressure to the appropriate pressure.

30 The MPC pressure may rise due to the presence of water in the MPC. The dryness test may need to be 

repeated several times until all the water has been removed. Leaks in the vacuum drying system, damage to the 

vacuum pump, and improper vacuum gauge calibration may cause repeated failure of the dryness verification test. 

These conditions should be checked as part of the corrective actions if repeated failure of the dryness verification test 

is occurring.

31 Technical Specifications require helium with a minimum purity of 99.995%.
B-20

 Purge the helium backfill system to remove oxygen from the lines.

 Attach the helium backfill system to the vent port on the MPC.

 Slowly open the helium supply valve while monitoring the pressure rise in the 

MPC.

 Carefully backfill the MPC in accordance with technical specifications (TSs).

 Disconnect the helium backfill system from the MPC.

 Close the vent port RVOA and disconnect the vent port RVOA.

 Gas sampling is used to verify that the proper type and quality of fill gas was put 

into the cask.

 Conduct pressure, temperature, and radiation monitoring at regular intervals to 

enable early detection of undesirable transients.

• Using a forced helium dehydration system (FHD) – This is for high burn-up fuel, or as an 

alternative for MPCs without high burn-up fuel.

 Helium gas is circulated through the MPC to evaporate and remove moisture. 

The residual moisture is condensed until no additional moisture remains in the 

MPC.

 The temperature of the gas exiting the system demoisturizer is maintained below 

-6.1° C (21° F) for a minimum of 1,800 seconds (30 minutes) to ensure that all 

liquid water is removed.

 Once devoid of moisture, the MPC is backfilled with a predetermined amount of 

helium gas.

 If high burn-up fuel has been placed in the MPC a supplemental cooling system 

(SCS) is connected to the transfer cask annulus prior to helium backfill and is 

used to circulate coolant to maintain fuel cladding temperatures below required 

limits.

 Gas sampling is used to verify that the proper type and quality of fill gas was put 

into the cask

 Conduct pressure, temperature, and radiation monitoring at regular intervals 

once cask lid is affixed to enable early detection of undesirable transients.

B.4.10 Welding of Remaining Cask Penetrations (Welded Lid Type Casks Only)

• A port cover and drain cover are welded to the lid.

 Wipe the inside area of the vent and drain port recesses to dry and clean the 

surfaces.
B-21

 Place the cover plate over the vent port recess.

 Weld the cover plate.

• The closure ring is welded to the lid and the shell for redundant sealing.

 Install and align the closure ring.

 Weld the closure ring to the MPC shell and the MPC lid.

B.4.11 Non-Destructive Evaluation of Final Welds

• Dye penetrant testing is used to test closure ring, port, and drain welds.

• Ultrasonic testing is used to test port and drain welds.

B.4.12 Draining of Annulus

• Remove the annulus shield (if used) and store in approved plant storage location.

• If use of the supplemental cooling system (SCS) is not required, attach a drain line to the 

transfer cask and drain the remaining water from the annulus to the SFP or the plant 

liquid rad waste system.

B.4.13 Installation of the Transfer Cask Lid and MPC Lifting Cleats

• Install the transfer cask top lid32

• Install and torque the top lid bolts.

. Inspect the bolts for general condition. Replace worn or 

damaged bolts with new bolts.

• Inspect the MPC lift cleat bolts for general condition. Replace worn or damaged bolts 

with new bolts.

• Install the MPC lift cleat.

• Drain and remove the temporary shield ring (if used).

B.5 Loaded Cask Transfer Within Structure

B.5.1 Remove Scaffolding from Around Transfer Cask

In succession, each scaffolding section is removed from around the cask. For each section, the 

crane33 operator will move the yoke/hook in order to be able to attach to the scaffolding. 

Maintenance workers attach each scaffolding section to the yoke/hook. The operator moves 

each scaffolding section out of the way. The workers unhook the scaffolding section from the 

yoke/hook. 

 32 When traversing the MPC with the transfer cask lid using non-sling-failure proof lifting equipment, the lid must 

be kept less than 61.0 centimeters (2 feet) above the top surface of the MPC. This is performed to protect the MPC 

lid from a potential lid drop.

33 The crane used may be the main crane (used for lifting the loaded cask), or it may be the auxiliary crane.
B-22

A single operator is stationed on the crane. The crane will be operated in a manual mode, with 

visual cues being used to position the crane at each scaffold section so that the maintenance 

workers can attach the section. Approximately two or three workers will be in the vicinity of the 

scaffolding, and one of them will be in communication with the crane operator through hand 

signals to provide guidance on positioning the crane. Once the crane is in position, the workers 

will attach the yoke/hook to the scaffolding. The crane operator will move the scaffolding to an 

out-of-the-way location on the refueling floor. He will use a combination of his own visual 

observation and direction from the communicating worker. The other workers have no specific 

assignment during this movement. Precise placement of the scaffolding sections away from the 

cask is not required. Once set down, the workers will release the crane from the scaffolding, 

and the process will repeat until all sections are moved.

B.5.2 Connect Short Slings to Yoke and to Canister (MPC) Lid 

Operator moves crane to cask and workers attach the short slings to the crane yoke and to the 

lifting loops on the MPC lid.

The operator positions the crane directly above the transfer cask, lowering it so that it is just 

above the cask. The crane will be operated in a manual mode, with visual cues being used to 

position the crane at each scaffold section so that the maintenance workers can easily reach the 

yoke from the top of the cask. One of the workers will be in communication with the crane 

operator through hand signals to provide guidance in positioning the crane. Height indication on 

the control panel will help to confirm proper height. Once the crane is in position, the workers 

will get on top of the cask with tools and the short slings. They will remove the support bolts 

and sleeves that will hold the short slings, hold the slings in position, slide the sleeves in so that 

they engage the slings, slide the bolts back through the hole in the yoke and through the center 

of the sleeves, put the end plate on the threaded end of the bolt, thread the nut on the bolt, and 

tighten the nut with a wrench. They will then attach the clasps on the end of the slings to the 

lifting loops on the MPC lid. 

B.5.3 Connect Yoke to Cask Trunnions 

Crane operator positions yoke at trunnions and engages the trunnions by closing the yoke arms 

and slightly lifting the yoke.

Once the slings are attached, the operator will spread the yoke arms. He will then continue to 

lower the crane and observe, with the help of the communication worker, when the arms are 

properly aligned with the trunnions. Height indication on the control panel will help to confirm 

proper height. Once aligned, the operator will close the arms so that the holes in the arms go 

over the trunnions. The communication worker will confirm that this has occurred. The operator 

will then raise the yoke slightly so that the yoke arm engages the grooves in the trunnions, 

which will be confirmed by the communication worker.

B.5.4 Move Transfer Cask to Transfer Slide 

Crane operator raises yoke to lift cask from floor. Operator moves cask above the transfer slide 

and lowers it on to the slide.

The maintenance workers will now position themselves around the transfer cask and observe it 

as the operator lifts the cask off the floor and moves the crane towards the transfer slide. The 

height indicator on the control panel will indicate that the cask has been raised enough to clear 
B-23

the edge of the slide. The operator will stop lifting the cask at the height specified by procedure. 

He will move the crane until the cask is positioned over and close to the slide. The overhead 

crane is shut down with the transfer cask suspended to prevent inadvertent operation. This will 

be done visually, with assistance from the workers. The transfer slide operator will then raise 

the transfer slide so that it snugly captivates the pool lid attached to the bottom of the transfer 

cask. The slide has an indented circle that the pool lid of the transfer cask will fit in to, which 

clearly indicates that the cask is properly positioned.

B.5.5 Unbolt Transfer Cask Pool Lid 

Once the cask is seated on the slide, the workers remove the bolts connecting the pool lid to the 

transfer cask. Radiation monitoring also occurs. 

The maintenance workers use wrenches to remove all of the bolts from the pool lid. The bolts 

are completely removed by one worker and placed in a large bag carried by another worker. 

Once the pool lid is unbolted, the workers pick up radiation monitors that have a detector at the 

end of an approximately 3.05 meter (10 foot) long pole. The receiver/display unit is near the 

handle, so the worker can see the reading. The transfer slide operator slowly lowers the 

transfer slide slightly providing a small space between the suspended cask and the transfer 

slide so that the workers can check the radiation levels coming from the MPC. Once the 

workers verify that the radiation levels are acceptable, the operation proceeds to the next step.

B.5.6 Use Transfer Slide to Position Transfer Lid 

Transfer slide operator moves the transfer lid underneath the cask.

The maintenance workers once again position themselves around the transfer cask and 

observe it as the transfer slide operator moves the transfer lid into position underneath the cask. 

The workers will help to center the cask on the transfer lid and rotate it so that the bolt holes in 

the cask are properly aligned with the bolt holes in the transfer lid, using hand signals to guide 

the transfer slide operator’s actions. The operator will stop maneuvering the transfer slide when 

the worker signals that the cask and transfer lid are properly aligned. 

B.5.7 Bolt Transfer Cask to Transfer Lid 

Workers replace the bolts in the lower end of the transfer cask. 

The maintenance workers place “washer rings” along the lower flange of the transfer cask, 

aligning the holes in the rings with the holes in the flange. They then proceed around the cask 

and place the bolts that were previously removed and placed in a bag back into the flange and 

though to the threaded holes in the transfer lid. They hand tighten the bolts as they go. Once 

all the bolts are in, they use a torque wrench to tighten the bolts to a torque level as specified in 

a procedure. 

B.5.8 Move Transfer Cask from Refueling Floor to Transfer Pit 

Crane operator lifts the transfer cask from the refueling floor (vertical lift only), moves it over to 

the transfer pit opening (horizontal movement only), and lowers it through the transfer pit 

opening until it is seated on the storage cask in the transfer pit (vertical lower only). 
B-24

The maintenance workers once again position themselves around the transfer cask and 

observe it as the operator lifts the cask off the floor (vertical lift) and then moves the crane 

towards the transfer pit opening (horizontal movement). The height indicator on the control 

panel is used to indicate that the cask has been raised sufficiently to clear the edge of the 

transfer skid (attached to the bottom of the transfer cask) and the railings around the transfer pit 

opening. The operator will lift the cask to the height specified by procedure to ensure sufficient 

clearance, but will not lift the cask higher than required. Following the vertical lift, he will then 

horizontally move the yoke until the cask is positioned over the equipment hatch. This 

horizontal movement will be coordinated by visual monitoring by the crane operator and by a 

designated spotter or other designated worker(s). He will then lower the cask through the 

transfer pit opening into the transfer pit, towards the storage cask. The storage cask is located 

just below an alignment device that has a series of blocks that delineate the corners of the 

transfer lid. The workers will help to center the cask between the blocks so that the corners 

properly aligned with the blocks, using hand signals to guide the crane operator’s actions. The 

operator will stop lowering the cask when the worker signals that the cask is properly seated 

and the slings are slack, which will be confirmed by the height indication on the control panel.

B.5.9 Removing the Short Slings and Installing the Long Slings

• Remove the short slings from the MPC lift cleats.

• Install the long slings to the MPC lift cleats.

B.5.10 Opening the Transfer Lid Door

• The MPC is raised slightly.

• The transfer lid door locking pins are removed.

• The doors are opened.

• At the user’s discretion, install trim plates to cover the gap above and below the 

door/drawer. The trim plates may be secured using hand clamps or any other method 

deemed suitable.

B.5.11 Lowering the MPC from the Transfer Cask to the Storage Cask

B.5.12 Disconnecting the Slings from the Crane and Lowering Down Onto the MPC Lid

B.5.13 Removing the Transfer Cask from the Top of the Storage Cask

• Remove trim plates (if used)

• Close doors on the transfer slide

• Remove the transfer cask using crane34

 34 Personnel should remain clear (to the maximum extent practicable) of the HI-STORM storage cask annulus 

when HI-TRAC transfer cask is removed due to radiation streaming.
B-25

B.5.14 Removing the MPC Lifting Slings and MPC Lifting Cleats and Insertion of Hole 

Plugs

B.5.15 Removing the Alignment or Mating Device

B.5.16 Removing the Vent Duct Shields

B.6 Loaded Cask Transfer Outside Structure

B.6.1 Remove Storage Cask from Reactor Building

A tug is attached to the skid and used to pull the skid and the storage cask out of the reactor 

building. The tug is disconnected from the skid once the storage cask is in the proper position 

for preparation.

The storage cask is sitting on a skid that rides on a pair of rails. A single operator is stationed in 

a motorized tug that also rides on the rails. The operator moves the tug towards the skid. A 

governor limits the speed of the tug to safe levels. Two or three workers stand near the skid 

and observe the tug. Arms on the tug’s hitch slide into position on the skid. No assistance is 

required to help the operator align the hitch (the rails maintain the proper alignment). The 

operator stops the tug once the hitch is engaged on the skid, which is confirmed by the workers 

by hand signal. The workers drop pins through the hitch arms (two on each side) to lock the 

hitch to the skid. The operator then backs the tug out of the reactor building until he gets to the 

preparation position for the storage cask. This is done visually, and precise placement is not 

required. 

B.6.2 Remove Alignment Ring

Operator moves the crane boom to the storage cask, lifts off the alignment ring, and removes 

the lid to the ground. Radiation monitoring also is performed.

This operation uses a mobile crane. Workers attach lifting straps to the hook on the crane 

cable. The operator in the crane cab positions the crane boom directly above the storage cask, 

lowering it so that the lifting straps rest on the top of the alignment ring with some slack. The 

crane operator uses visual cues to perform this action. At the same time, two workers are lifted 

in a man hoist to the top of the storage cask. They proceed to bolt the hooks at the four ends of 

the straps to the lifting loops on the alignment ring. They then back the man hoist away from 

the storage cask. The crane operator then lifts the alignment ring from the top of the storage 

cask and places it on the ground away from the storage cask. The workers in the cherry picker 

then use a long-boom radiation monitor to check the radiation levels above the MPC. Other 

workers on the ground unbolt the straps from the alignment ring. 

B.6.3 Place Permanent Shield Lid on Storage Cask

Operator moves crane boom to permanent shield lid, lifts permanent shield lid above storage 

cask, and lowers the lid into place. Radiation monitoring also is performed.

The operator moves the crane from the alignment ring to the adjacent permanent shield lid, and 

the workers bolt the straps to the permanent shield lid. The operator lifts the permanent shield 

lid and positions it above the storage cask. Using a combination of his own visual observations 

plus hand signals from the workers in the mobile crane, the operator centers the shield lid over 
B-26

the storage cask and lowers it into place. The lid will only sit flat if it is properly centered. The 

workers once again check the radiation levels above the storage cask and place the shield lid 

studs into the stud holes in the lid to assure it is aligned with the holes in the cask flange. They 

then unbolt the straps from the lid, and the operator moves the crane away from the storage 

cask. The workers tighten the studs. 

B.6.4 Install Vent Shield Cross-Plates and Vent Screens to Storage Cask

In cask designs with vents, operators mount cross-plates and vent screens to ensure that birds, 

insects, other animals or debris do not block air circulation paths through the storage cask. Vent 

shields also provide radiation protection for the air passageways.

B.6.5 Attach Lift Brackets to Storage Cask

The lift brackets are attached to the crane boom by the straps. The crane operator moves the 

brackets to the top of the storage cask, where they are anchored in place.

The maintenance workers on the ground attach the straps on the crane boom to the first of two 

lift brackets. The crane operator raises the lift bracket a few feet, and a worker puts anti-seize 

on the threads of the two large bolts that protrude from the bracket. The crane operator then 

positions the bracket above the storage cask. The two workers in the cherry picker stand on top 

of the storage cask to line the bolts up with holes on the top of the cask. They use hand signals 

to direct the crane operator to move and lower the bracket until the bolts slide into the holes. 

They use a ratchet to tighten the two bolts. They then remove the strap from the bracket and 

remove the support bolt, end plate, and sleeve from the top of the bracket and place the parts 

on top of the storage cask. The crane operator then moves the crane boom back to the ground 

where the second bracket is located, and this process is repeated for the second bracket. The 

crane boom is then moved away from the storage cask.

B.6.6 Attach Storage Cask to Transporter 

The storage cask transporter is moved to the location of the storage cask and the workers 

attach the lifting bar of the transporter to the lift brackets on the storage cask. 

The transport operator drives the transporter to a position lined up with and just short of the 

point where the lifting bar is aligned with the lift brackets. His visual orientation is such that he 

can clearly see the proper alignment points, so he does this visually, with no assistance from 

the workers. Once the transporter is in place, the workers on the cherry picker climb on top of 

the storage cask. The workers put anti-seize in the holes in the lift brackets and in the lifting 

arms on the transporter lifting bar. The workers then use hand signals to direct the transporter 

operator to ease the transporter forward to the proper position. The operator lowers the lifting 

bar until the lifting arms contact the main body of the brackets, which will align all the holes. On 

each bracket, the workers then slide the sleeve through the holes, the bolt through the center of 

the sleeve, add the endplate, and tighten the bolt using wrenches. The workers then return to 

the ground. 
B-27

B.6.7 Attach Kevlar Belt or Other Cask Stabilization Device

The cask is lifted slightly off of the ground by the cask transporter. Once suspended, operators 

attach a Kevlar belt or other stabilization device to steady the cask during movement.

35

B.6.8 Move36 Storage Cask to ISFSI Pad 

The transport operator drives the storage cask to the ISFSI pad. The workers detach the 

storage cask from the transport and the transport leaves the area.

The transport operator raises the lifting bar, lifting the storage cask a short distance off the skid. 

A gauge on the control panel indicates the proper height. Physical limits of the lifting bar 

hydraulic system prevent raising the storage cask too high. The operator drives the transporter 

along a marked path from the skid to a road that leads to the pad. He then follows the road to 

the pad. The operator is positioned at the controls in a location where he can see the path he 

needs to follow. The speed of the transporter is limited by the gearing and the maximum engine 

speed to a very slow pace. The operator maneuvers the transporter to line up with an empty 

space on the pad (including maneuvering around any storage casks that have already been 

placed on the pad). The operator positions the transporter on the pad at the proper location and 

lowers it to the ground. A cherry picker conveys workers to the top of the storage cask, who 

undo the bolts connecting the lift brackets to the storage cask. The transport operator raises the 

lift bar so that the brackets clear the storage cask, as indicated by the height gauge on the 

control panel, and drives the transporter away.

B.6.9 Emplacement for NUHOMS-type Systems

With the Nutech Horizontal Modular System (NUHOMS) cask system, the cask is transported 

from the reactor, auxiliary, or fuel building to the ISFSI on a large flatbed truck and the following 

basic actions are followed to position the cask inside a cylindrical, concrete crypt at the ISFSI:

• Carefully position the flatbed truck so that the back of the flatbed is very near the 

opening of the crypt with the flatbed in line with the central axis of the cylindrical storage 

location.

• Slide/lift the large metal door to the crypt location with a mobile crane.

• Commence final positioning of the flatbed with the crypt opening.

• Ensure proper alignment of the flatbed with the central axis of the cylindrical storage 

location using a laser beam sighting device.

• Push the MPC out of the transfer cask and into the crypt using a hydraulic ram.

• Move the flatbed away from the crypt opening.

 35 The cask is primarily suspended via large, bolted pins running through brackets attached to the lid of the 

storage cask. The additional stabilization device (e.g., a kevlar belt) helps to decrease large moment loads on the 

suspension pins resulting from the superimposed motions of the transporter movements along the roadway, other 

vibrations, etc.

36 It is recommended to perform a transport route walk-down to ensure that the cask transport conditions are met 

before moving the cask.
B-28

• Lower the large metal door to the crypt location using the mobile crane.

37

• The door to the crypt may or may not be tack welded in place as the large mass of the 

door tends to offer a significant deterrent to unauthorized entry.

For the Holtec HI-STORM cask system, once the storage cask is properly positioned on the 

ISFSI pad, perform shielding effectiveness testing and an air temperature rise test within 5–7 

days38 as follows:

• Measure the inlet air (or screen surface) temperature at the center of each of the four 

vent screens. Determine the average inlet air (or surface screen) temperature.

• Measure the outlet air (or screen surface) temperature at the center of each of the four 

vent screens. Determine the average outlet air (or surface screen) temperature.

• Determine the average air temperature rise by subtracting the results of the average 

inlet screen temperature from the average outlet screen temperature. 

B.7 Loaded Cask Storage and Monitoring

Adhere to all ISFSI operational procedures. These generally include the following:

• Ensure monitoring for corrosion of cask components.

• Ensure monitoring of pressure, temperature, and radiation levels.

 Initial temperature monitoring occurs at 5–7 days to allow temperature levels to 

reach a steady state following the loading and emplacement process.

 Long-term monitoring begins after the initial monitoring period (i.e., after the first 

week).

• Ensure monitoring of the structural integrity of the pad or horizontally-oriented, concrete 

storage vaults at the ISFSI.

• Ensure that no obstructions required for proper air circulation around the casks are 

present.

• Ensure proper calibration of all sensors used during monitoring activities.

• Ensure that a QA program that satisfies or exceeds reactor facility Part 50 requirements 

is maintained for ISFSI activities. The following elements need to be included in the QA 

program:

 Procurement controls

 Control of measuring and test equipment

 37 The large metal door remains suspended above the crypt opening as the MPC is pushed inside.

38 The air temperature rise test is to be performed between 5 and 7 days after installation of the HI-STORM 100 

lid to allow thermal conditions to stabilize. The purpose of this test is to confirm the initial performance of the HISTORM 100 ventilation system.
B-29

 Operating status

 QA audits

 Tracking of problems

 Identifying corrective actions

• Be sure to limit the placement of flammable and explosive liquids near the loaded cask 

during movement from the fuel building to the ISFSI pad.

• Ensure that potential effluents from casks (should they materialize) are properly handled 

with structures, systems, and components at the ISFSI and along the travel path to the 

ISFSI. Items that collect liquid effluent wastes (e.g., filters, scrubbers, sumps, and 

laboratory collection containers) and solid wastes (e.g., anti-contamination clothing and 

discarded swipe material) must be transferred from the operation systems into the waste 

stream for volume reduction or solidification, temporary storage, and shipment to a 

disposal site.

• Maintain detailed records regarding the fuel loading of each cask, records provided by 

the cask supplier for each cask design used, and be prepared to transfer these records if 

a cask is sold, leased, loaned, or otherwise transferred to another user. 

• Maintain an ISFSI security program consistent with the reactor facility security program 

including response to events, offsite support, training and certification of security force 

personnel, lock and key controls, and search requirements. The appropriate safeguards 

program and security plan must protect against the design basis threat of radiological 

sabotage in accordance with the requirements of 10 CFR 73.

• Maintain a training program for personnel assigned to the ISFSI that provides a strong 

basis for understanding the requirements and safe practices associated with DCSOs.

• Maintain a process for retrieving spent fuel from a loaded DCSS in the ISFSI and 

returning it to the SFP

C-1

APPENDIX C SUMMARIES OF INTERVIEWS WITH SUBJ ECT MATTER EXPERTS 

Notes from Meeting Held at NRC HQ in Rockville, MD on Wednesday, 8/24/05

Subject matter experts (SMEs) from the following organizations participated:

• SME1 – USNRC/RES

• SME2 – SNL

• SME3 – SAIC

• SME4 – USNRC/RES

• SME6 – USNRC/NMSS

• SME7 – USNRC/NMSS

• SME10 – USNRC/NRR

Notes:

• HRA in the realm of spent fuel handling is a largely unexplored area.

• An important goal of the project is to answer the question: What can happen during 

these operations? (i.e., consequences will be addressed subsequently).

• We watched a video prepared by INL showing some of the operations they perform at 

the lab with casks and fuel rods

• Things to keep in mind:

 Misloads (putting things in wrong place in pool, multi-purpose container [MPC], or 

directly into dry cask)

 Human error at the loading docks

 Yoke handling

 Crane operations

 Vacuum and backfill operations to dry, inert, and provide convective cooling for 

the casks

 Welding operations on cask or nearby

 QA/inspection activities

 Decontamination operations (primarily for cask upon entry & then before leaving 

plant buildings)

 Training

 Communication

 Procedures

 Experience

 Informal rules (i.e., the way it actually gets done)
C-2

• Discussion with SME4 and SME10 in which they describe their experiences at a dry, 

ambient pressure PWR:

 Refraction of light in the water is a big issue; you are looking over the side of the 

refueling machine into the water 6.1–14.6 meters (20–48 feet) deep in order to 

ensure proper positioning of the lifting device

 Proper tool handling is an important issue (i.e., precision motor skills)

 Winch operations

 Level indicators are important to make sure the tools/fuel assemblies are where 

you want them to be and where you think they should be

 SME10 had an interesting story about a time when the control element assembly 

(CEA) inside a fuel bundle was grasped by the refueling machine, but the CEA 

was not properly captivated and did not raise high enough; when translating 

away from the particular alpha-numeric grid location, SME10 alerted the senior 

reactor operator present that the housing was bending; operations were stopped 

immediately before major damage occurred to the bundle or refueling machine

 CEA – control element assembly – this sits on the spent fuel assemblies 

(sometimes); there’s a limited number of CEAs, some will be in the SFP and they 

will likely be removed from fuel bundles scheduled for loading into a cask

 The pace and nature of operations during the movement of fuel assemblies is 

very slow and repetitive. It quickly becomes a monotonous task to move fuel 

assemblies

 Old fuel gets moved into the dry casks weeks or months before a refueling 

outage; then fresh fuel which has been inspected gets moved into the pool; then 

during refueling - the fuel moved out of the reactor core gets put into the pool; 

and the fresh fuel is moved into the core; roughly 1/3rd of the core gets swapped 

out during the outage

 Sipping is performed in the core, where individual fuel pins may be replaced; bad 

pins are put into canisters that are the size of spent fuel assemblies (these are 

the trash cans–basically a fuel assembly in a box); at some plants, sipping may 

also occur among fuel bundles in the SFP if there is suspected or known damage 

to fuel pins

 There are different types of cask systems; some will have removable containers 

holding up to ~24 fuel assemblies; other systems will take the fuel assemblies 

directly; about 90 bundles will be moved during a dry cask loading sequence as 

this represents ~1/3 of a core load (this is similar to the amount of fuel offloaded 

and replaced during a refueling outage)

 It takes 4–5 days to fill one cask (roughly a month for all the casks in one transfer 

sequence); that is start to finish with the following general steps (the Nutech 

Horizontal Modular System (NUHOMS) is used at a dry, ambient pressure PWR):

 cask comes into the building

 cask put into wash pit

 cask head fasteners loosened 
C-3

 cask moved into dry cask pit (cask submerged at this point)

 cask head removed

 spent fuel assemblies are put into canister (e.g., Dry Shielded Canister 

[DSC]) then the canister is put into cask or spent fuel assemblies are put 

into the cask directly

 cask head is then replaced (not secured down with fasteners)

 cask is removed from water and put in wash down pit again (~2 days of 

wash down pit operations)

 cask head is secured down

 cask is then decontaminated with water wash

 water in cask is then displaced with gas (He), a vacuum is drawn to help 

dry contents, additional backfill occurs

 temperature and pressure is monitored continuously

 gas sampling is also required (calibration of equipment has been 

problematic in some cases; also, the wrong fill gas (Argon instead of 

Helium) has been used once)

 cask is loaded onto transport vehicle

 cask is transported to storage “pad” at the ISFSI

 cask is positioned onto “pad” ISFSI (the casks can be vertically positioned 

on a pad or they may be stored horizontally in concrete bunker/crypt 

arrangements)

 There are electronic stops on the refueling machine at a dry, ambient pressure 

PWR, but mechanical stops have also been installed due to malfunctions with the 

electronic stops

 All of the cranes used in the process are single failure proof cranes (i.e., the 

system is robust against most single failures per the guidance in NUREG-0554)

 Dry casks weigh ~ 756,198 Newtons (85 tons). For example with the NUHOMS 

system (weights do not include water weight before drain and vacuum operations 

are completed):

 24PHB DSC which holds 24 PWR fuel assemblies with maximum burn-up 

of 55 GWd/MTU (licensed for storage only, not transportation)

• 160,136 Newtons (18 tons) unloaded

• 324,720 Newtons (36.5 tons) loaded

 24PTH DSC which holds 24 PWR fuel assemblies with maximum burn-up 

of 60+ GWd/MTU, 3 years minimum decay time, and max U-235 

enrichment of 5%

• 217,963 Newtons (24.5 tons) unloaded

• 409,236 Newtons (46 tons) loaded
C-4

 24PT -1,2,4 DSC which holds 24 PWR fuel assemblies with maximum 

burn-up of 60 GWd/MTU, 5 years minimum decay time, and max U-235 

enrichment of 5%

• 160,136 Newtons (18 tons) unloaded

• 324,720 Newtons (36.5 tons) loaded

 32PT DSC which holds 32 PWR fuel assemblies with maximum burn-up 

of 45 GWd/MTU, 5 years minimum decay time, and max U-235 

enrichment of 5%

• 239,314 Newtons (26.9 tons) unloaded

• 453,719 Newtons (51 tons) loaded

 32PTH DSC which holds 32 PWR fuel assemblies with 60+ GWd/MTU, 5 

years minimum decay time, and max U-235 enrichment of 5%

• 262,445 Newtons (29.5 tons) unloaded

• 480,407 Newtons (54 tons) unloaded

 52B DSC which holds 52 BWR fuel assemblies with maximum burn-up of 

35 GWd/MTU, 5 years minimum decay time, and max U-235 enrichment 

of 4% (licensed for storage only, not transportation)

• 151,240 Newtons (17 tons) unloaded

• 311,376 Newtons (35 tons) unloaded

 61BT and 61BTH DSCs which hold 61 BWR assemblies with a current 

burn-up of 40 GWd/MTU and future burn-up of 60 GWd/MTU (licensing 

should be complete by 2006) with 5 years minimum decay time, and max 

U-235 enrichment of 5%.

• 201,949 Newtons (22.7 tons) unloaded

• 393,223 Newtons (44.2 tons) loaded

 Uncontrolled descent is the euphemism for “fall”

 One cask (or canister) can be loaded with fuel in one shift (i.e., picking up the 

fuel and placing it in position)

 Anyone on shift is capable of performing spent fuel operations; the same crew of 

2–4 people should be continuously present for the loading of one cask

 Again, the fuel goes from the SFP to the dry cask in the dry cask pit (or simply 

the cask pit), then the dry cask goes to the wash down pit (out of the pool–it’s a 

cleaning area), then the cask goes onto a flatbed truck or other out-of-building 

transport vehicle
C-5

 Once on the flatbed truck, the cask is moved to the ISFSI;

 Problems you can have with a crane:

 Raising it too high; this is how you can destroy a crane in a hurry

 Crane operations are highly repetitive and monotonous

 Lots of maintenance checks are required before use; often there is 

significant time pressure to get the checks done quickly and get on with 

the “real work”; therefore, there may be significant variability on how 

thorough these checks are performed

 Time pressure during core refueling operations is intense; time pressure during 

dry cask operations is generally much less intense, although scheduling delays 

will occasionally result in elevated time pressure, especially if delays are 

threatening to disrupt the start of a scheduled refueling outage.

 The cranes used to move the casks are very large 1.112E+6 – 2.224E+6 Newton 

(125–250 ton) capacity; note: many cranes have had their capacities greatly 

increased even though no structural changes were made (i.e., decisions have 

been made to cut into the “engineering design factors” of the original design)

 Auxiliary cranes used for moving something less than a dry cask are in the range 

of 311,376 – 444,822 Newtons (35–50 tons)

 Operator is given a list of fuel locations (alpha-numeric grid locations); it is a 

purely visual process of verifying that the right bundles are picked up with the 

refueling machine (2 operators are on the refueling machine); a 3rd person is at 

the pool side using binoculars to check the operations of the crew on the 

refueling machine (RM)

 There is manual control of the height adjustment of the lifting device (spring 

loaded lever)

 A switch is thrown to attach the refueling mast to a fuel bundle using grapple; a 

light turns on indicating that the switch has been thrown (it does not indicate 

whether a successful “grappling” has occurred)

 A scale (weight/force measure) is used to verify that you’re pulling something up

 The RM has cables doing the lifting and it is sometimes necessary to “wiggle”

them (as demonstrated by SME4 – basically grasping the cables and 

hanging/pushing until the movement breaks loose the bundle from the rack slot) 

to “help” a fuel bundle break free from its grid position

 Bottom of refueling machine is always submerged (i.e., even when the refueling 

winch is raised completely, the block/tackle/end effector remains under water)

 It is possible to pull fuel out of the wrong spots and put fuel into the wrong spots; 

the spotter with binoculars can check serial numbers, but there may be 

omissions; it is sometimes the case that more than one fuel bundle will be moved 
C-6

before any written confirmations are annotated on the “move sheet” which may 

have been taped up somewhere on the refueling platform by the operators

 This is a skilled activity; procedures are not generally followed in a step-by-step 

manner as far as reading or calling out the procedure step first and then 

executing it; the operators execute the learned steps as a skill-based routine

 Control panel layout on the refueling machine:

 Hoist switch

 X-axis spring loaded lever

 Y-axis spring loaded lever

 Weight scale

 Knob for grapple (rotate to engage or disengage)

 Here are the steps for operating the refueling machine (steps 4–10 below take 

600–720 seconds (10–12 minutes) if all goes smoothly) :

 Operators crawl out to the refueling basket

 Test the machine function

 Move sheet will likely be taped up somewhere in easy view

 Move to coordinates for fuel bundle pick-up

 Lower hoist

 Grapple

 Check that the hoist it is weighted by looking at the weight scale

 Hold hoist lever while the bundle slowly raises

 Translate machine with raised fuel bundle over to where the cask is 

located 

 Place bundle in cask; reverse process as picking up bundle (move sheet 

specifies where to put the bundle inside the cask or canister)

 A spotter is present to verify all operations, but as mentioned before, the 

operators may not “check off” items on the move sheet as each bundle is moved; 

they may wait until several bundles have been moved

 The spent fuel bundles in the SFP are organized/captivated in large stainless 

steel racks that have a honeycomb lattice structure and are lined with B4C (there 

is a limit of 2700 ppm of boron in the SFP)

Afternoon Meeting in One White Flint

• SME6 – cranes are a big issue; the NRC doesn’t have a focused approach to look at 

crane testing, maintenance, crane monitoring; NRR has limited expertise in looking at 

such things
C-7

• Casks are getting bigger (close to the crane limits)

• Issues with cracks in the crane supports

• Issues with welding failures or at least weakening due to welds on cranes

• Misloads may not manifest themselves for weeks, months, or even years after the 

misload event occurs. Misloads can occur during fuel movement from:

 The reactor core to the SFP

 One SFP location to another SFP location

 SFP to dry storage cask

• Misloads into a storage cask that arrives at a central repository (e.g., Yucca mountain); 

this will likely involve a DSC or MPC in a transportation cask licensed for long-distance 

transportation (i.e., not just to a local ISFSI at or adjacent to the plant site where the fuel 

is removed); if a misload reaches the repository, would repackaging operations be 

hindered? What possible damage or injury might occur? Would significant delays occur? 

These are questions that many people are interested in.

• An incident was mentioned in which a truck carrying a loaded dry cask to the ISFSI 

went off the designated path and buried a wheel into soft ground (i.e., softer than the 

heavy load capacity path the vehicles are supposed to follow); this may have occurred 

due to a problem with the hydraulic power steering unit

• Frequency of dry cask loading and transport may vary greatly from plant to plant; for 

example, some plants may have an extremely large cask loading campaign (CLC) after 

many years of accruing spent fuel in the SFP and then scale back to 1/3rd core CLCs 

before future refueling outages; other plants may continue to have large CLCs spaced 

several years apart.

• SME7 – it might be helpful to look at Part 21 event reports

• Need to get a copy of NEI’s Dry Storage Document (issues up through 2000)

• INL Licensee Event Report database

• Look at NRC inspection reports

• There was a mention of “problem plants”; we might want to approach some of those 

plants during data collection efforts at some point in the future

• Lots of differences between plants (e.g., some use voice communication; some use 

visual signals)

• Some casks leave by truck, some by trailer, some by tracked vehicle or “crawler”

• Remember disruptions and distractions; What if radiation alarms are going off? Fire 

alarms? Remember the example from SME4 where he was lifting a fuel bundle and 
C-8

apparently a piece of a core instrument cable (discarded to the SFP after a previous 

refueling outage) was snagged by the bundle and radiation monitors went off when the 

fuel assembly got closer to the pool surface. The bundle was immediately lowered down 

until the problem could be diagnosed.

• Yoke management will likely be very important; these are big pieces of equipment with 

multiple moving parts (e.g., the cables for raising the cask head in addition to the yoke 

arms that mount over the cask trunnions)

• We need to search for differences in the population of plants; big differences exist 

between BWRs & PWRs. It appears (initially) that there are more differences between 

those groups than within them - this may or may not be true.

Notes from Meeting Held at NRC HQ in Rockville, MD on Thursday, 8/25/05

Subject matter experts (SMEs) from the following organizations participated: 

• SME1 – USNRC/RES

• SME2 – SNL

• SME3 – SAIC

• SME8 – USNRC/NMSS

Notes:

• SME11 in Region 4 was recommended as someone we should speak with – he is an 

expert with regard to DCSOs

• We should ask SME8 about particular augmented inspection team (AIT) reports that our 

team should review

• Discussion with SME8:

 Wasn’t sure if there was a good process description document for SFH

 Focus on the ISFSIs at the reactor sites

 You pump water out of the cask; dry it; inert it

 Many of the sites have problems with the cranes available on site (e.g., cracks in 

trolleys and supports)

 Misloads going into an ISFSI are the big drivers on problems at the proposed 

Yucca Mountain fuel handling (pre-storage processing) facility (i.e., misloads may 

become a latent failure which drives high consequence events many years in the 

future)

 How are the cask loading lists created? How robust is the configuration control 

process? (i.e., likelihood of misloading events)

 How likely is it that “hot” fuel gets loaded into a cask?

 How quickly can such a mistake be identified?

 At what steps in the process would identification opportunities avail themselves?
C-9

 At some point, there may be a need for onsite movement of fuel out of dry casks 

and then into another container to go to Yucca Mountain or another storage site. 

That is, there might be a need for handling individual fuel assemblies.

 What are the important differences between older fuel and higher burn-up fuels 

now being used at many plants with regard to misloads?

 When can misload mistakes be made?

 When can a previous mistake be caught?

 Misloads and drops both appear to be very big issues; maybe two separate risk 

assessments/HRA analyses will eventually be necessary)

 Spent fuel management (organizing the move process from planning to 

execution needs to be understood)

• SME3 knows all the authors of the EPRI report; if anyone has questions for the authors–

SME3 can facilitate

Notes from Conference Call Held on Thursday, 9/29/05

Subject matter experts (SMEs) from the following organizations participated: 

• SME1 – USNRC/RES

• SME2 – SNL

• SME3 – SAIC

• SME6 – USNRC/NMSS

• SME8 – USNRC/NMSS

• SME9 – USNRC/NMSS

Notes:

• Start time 1:33 ET

• SME1 reviewed the data collection process for this “early-stage” project

• Two different perspectives right now of HRA data collection

• Bottoms-up (traditional HRA method, e.g., THERP)

• Top-down (ATHEANA)

• First question: Should we focus on cask operations?

• Maybe we should just focus on the cask operations for this call, today

• SME1: “I guess all of you are inspectors, what are your concerns?”

• SME6: We should probably have a conference call with team members from the various 

regions– not just people from the SFPO
C-10

• SME6: We do look at some of the cask activities, but the regional folks are responsible 

for reviewing the pre-operational and operational activities

• SME9: We don’t really watch the operations much, but we do participate in some of the 

safety analyses; we are aware of issues when they arise, but we don’t have eyes on 

target much of the time

• SME1: Perhaps after this call we should set up another conference call with some 

inspectors in the regions

• SME6: A number of information sources, primarily on Websites, provide reports on crane 

failures, cask drops, etc. to augment interviews

• SME9: I will provide a summary of the incident at Sequoia with crane issues and a crane 

drop.

• SME6: The crane issues, even though many seem mechanical/electrical, etc. – many 

involve human factors regarding inspection, test, and maintenance; the personnel and 

management systems are critical to keep the systems working properly

• SME6: I will also provide some information regarding the crane issues.

• SME1: Can you give us a preview of what we will find in these crane incidents?

• SME6: SME9 and I put together a list of concerns regarding the cranes. For example, 

(off Platt’s Website); cracks on a crane caused operations to halt for a period of time - I 

think this was a dry, ambient pressure PWR back in 1995, the cask was suspended for 

about 16 hours over the SFP – need to check the details

• Whiting Corporation (crane manufacturer) – a report was sent out by this manufacturer 

to customers with the product (an auxiliary hoist), alerting them of problems

• SME6: Event report Jan.10, 2005 – Overstressed condition on single-failure proof crane 

trolleys; many cranes need to be examined (16 or 17 plants) might need review as well 

(also related to Whiting hoists)

• SME1: What regulations do the inspection and maintenance programs fall under?

• They fall under 10 CFR Part 50, but very little prescriptive guidance is there

• Many of the existing plants have been grand fathered since the latest regulations were 

issued

• Dry Cask Storage PRA (Draft) – some discussion of cranes is considered

• SME1: We are looking for things that haven’t happened yet. Ex. Planning, inspection, 

etc.

• SME6: In addition to cranes, the prime movers for these casks include wheeled and 

tracked vehicles; they pick up the cask and move it to the ISFSI pad; ex. at a Mark-I 

BWR some cracks were identified in the transporter–even if you had a failure, there are 
C-11

height limits so a drop should not result in a big problem; at a dry, ambient pressure 

PWR they use a low-slung rail car then transfer to the tracked transporter; wheeled 

vehicles are traditionally used for the NUHOMS (horizontal system)

• SME1: In all cases the height for cask movement is limited by design?

• SME6 and SME9: Yes, we think so.

• SME6: There might be some problems with embrittled fuel many years down the road, 

but I don’t expect to see problems, except maybe with plants that have been 

decommissioned, there could be some potential for fuel configuration changes if the 

casks were dropped

• SME1: Issues far out in the future regarding future repository problems will likely be out 

of scope for this project.

• SME6: Handling of cask from the SFP to the reactor building floor (i.e., in Mark I BWRs) 

is the big issue with drops.

• SME1: One of the reasons for this project was a concern for how the HRA in the draft 

Dry Cask PRA was conducted – really not much description of the “why” and “how” of 

the process. Inspection and maintenance is important, but hasn’t been treated too well 

(or at all) in past analyses

• SME1: With regard to the planning of cask operations (video of operations at a Mark-I 

BWR) – there were lots of observers, but not many “verifiers” or “checkers” – so it 

seemed. 

• SME9: That might be a misimpression – there is a great deal of planning and procedures 

and a supervisor type of person verifies what is going on. Many observers are there, but 

they do have a role in actively monitoring the activity; e.g., the active voice 

communications between personnel; balancing needs to keep personnel exposures low, 

but ensure some verification activities; there are very detailed briefings before activities –

detailed hand-offs between shifts; the supervisor will have procedures, but many of the 

personnel doing the work will be conducting skill-based action without reference to 

written procedures

• SME9: 3 part communications are typically used – (1) Do this. (2) I understand that I 

need to do this. (3) Yes, that is what you need to do.

• SME6: Safety, communication, Stop – Think – Act – Review (STAR), are the things we 

are looking for

• SME6: It is rare that NRR is on the communication line, listening to voice communication 

of the activities as they are underway

• SME6: ROs will tell you that the process for identifying fuel bundles, and verifying 

bundles is checked and re-checked by multiple people

• SME9: There is a “difference” between how people act when NRC is watching versus 

when NRC is not watching; at an ice-condensed PWR (October 1994) I led the report for 
C-12

and augmented inspection team (AIT) and it turned out that the plant was doing a 

refueling “off the cuff” in many ways; we got wind of a problem when we saw that two 

refueling bridge masts had been damaged within a short period of time

• SME8: How much fuel handling is done by contractors?

• SME6: Contractors do a lot of activities; especially with decommissioning plants; and the 

welding teams and others are the same for many plants; this could have pros and cons –

people get good at the tasks as they do them over and over, but they might also 

encounter unexpected site-specific configuration and/or equipment changes that could

cause problems (i.e., interfere with skills attained in other plant environments)

• SME1: Are the same people who do the dry-runs the ones who do the actual 

operations?

• SME9: Yes, the same people; there is no requirement for dry runs – often the utilities will 

go through a few or more dry runs, then the NRC is invited in to see them conduct the 

actual operation

• SME6: There are pros and cons to having experienced crews who go to many plants

• SME9: The plant staff generally load the fuel into the casks

• SME1: After the fuel is in the cask, the contractors generally take over

• SME8: My background is in fuel cycle facilities – many times things get messed up 

because a “new” person, an untrained or poorly trained contractor; look for these types 

of disruptions

• SME1: Good point. Example for control room operators–the assumption is that these 

teams are always together–in reality people go on vacation, people get sick – a “normal”

crew is not always available

• SME9: There’s usually two sets of crews (day and night) with all the necessary training

• SME6: Lots of variation between plants and how much time it takes to load and store 

casks

• SME9: At a dry, ambient pressure PWR it took 5 days to dry out and seal up the first 

cask in a sequence; other sites have it down to one day; depends also on the 

type/integrity of fuel being loaded, practice for the crews, etc.

• SME1: Does the amount of fuel in the pool add time pressure?

• SME9: Plants that have a large inventory of fuel in the SFPs can get rushed at times to 

get casks loaded to ensure full core pull-out potential as they run-up to a refueling 

outage. Delays such as inspections by NRC, equipment failures, bad weather, etc., can 

compress the time schedule.

• SME6: I was at a dry, ambient pressure PWR a month ago and they were running into 

time pressure
C-13

• SME6: A Mark-III BWR is also experiencing time pressure; I’ll be out there next week.

• SME1: Will more plants be forced into this time pressure mode?

• SME6 and SME9: More plants may be forced into this time pressure mode, it depends 

on management at the plants–some plants are spending the money early to unload the 

pool, others are waiting and letting themselves become vulnerable to a time crunch

• SME1: Have you seen any “results” from time pressure?

• SME9: Even with planning ahead of time, there’s always time pressure visible among 

the teams.

• SME1: Time costs money, all the time

• SME6: Even if all has gone well with planning, something can “break” messing up the 

whole process

• SME1: Do the plants have the right people on site for major repairs?

• SME9: There have been several failures where they needed to get vendors involved to 

fix items; ex. leased equipment is often used, maintenance issues with the leased 

equipment have been identified as problems in the past

• SME9: There is a maintenance review procedure

• SME6: There is not always a plan to ensure equipment leaving a site is “serviceable”

and ready for the next plant

• SME6: At a Mark-I BWR – the TN trailer, an operator doing the offload was not 

experienced enough; he damaged some equipment and set the schedule back by a 

week

• SME6: We only see about a 5th or a 10th of the real activities that actually go on; I’ll send 

an email to the regional folks and provide SME1 as the contact to see if we can enrich 

our understandings of what “actually” goes on in the operations on site

• SME1: We’ve been told that plants don’t do other major tasks when cask operations are 

underway. Is that correct?

• SME6: I can’t say that plants don’t perform other activities that might interfere with cask 

operations, but from what I hear, when casks are loading spent fuel, it is likely that other 

activities would be minimal; important factors might be the availability of personnel, etc.

• SME1: In other settings, we’ve seen that distractions can play a big role in contributing to 

incidents/accidents

• SME6: Distractions can occur during cask operations; depending where they are at in 

there master schedule, they could be planning for an outage immediately after loading of 

dry casks–that may be a really big issue for more plants. The plants have detailed plans 
C-14

for refueling outages, for cask loading, I’m not quite as sure, but a crunch between 

personnel as overlap is occurring between the two operations could be a big problem

• SME6: I will send an email to the regional folks and try to help us get more information

• End time 2:25 ET

Notes from Meeting Held at NRC HQ in Rockville, MD on Thursday, 10/06/05

Subject matter experts (SMEs) from the following organizations participated: 

• SME1 – USNRC/RES

• SME2 – SNL

• SME3 – SAIC

• SME5 – USNRC/RES

• SME7 – USNRC/NMSS

• SME10 – USNRC/NRR

• SME14 – SAIC by phone

• SME15 – SAIC by phone

Notes:

• SME5 – different plants have a different approach to using interlocks on cranes (some 

have them, some do not)

• SME2 – it might be good to use an example where interlocks are not used or fail

• SME1 – it would be helpful if in the next phase of this project we could get SME3 and 

SME2 out to visit an actual plant; this may be difficult as discussed with SME6, but that 

would be a good next step.

• SME2 – What type of practice operations for cask loading are performed and then 

observed by NRC inspectors? Do they typically just observe the final, “real thing”?

• SME5 – that’s generally true, but the inspectors do look to see that a plan has been 

prepared for the activities, and they look at the plan in order to pick times when they 

want to observe operations

• SME1 – What does the fuel movement plan look like?

• SME5 – There have been problems (rare) when bundles are put in the wrong spot, but 

overall the planning phase is the “cleanest” part of the operations.

• SME5 – NRC inspectors do make sure plans are in place, but they don’t spend a great 

deal of time assessing the quality of the plans; the question is “do they have it?” not 

“how good is it?”

– SME5 had to leave –

– SME10 arrived –
C-15

• SME10 – the technicians tack weld the MPC lid in place manually and then set up the 

automated welder.

• A few process details at a dry, ambient pressure PWR:

 Put cask into wash-down pit

 Put canister (MPC) in cask

 Lower cask into “in pool” cask pit

 Yoke is permanently mounted to the high-capacity crane

 MPC has lifting padeyes on it

 Impact limiters are placed under the cask in the decontamination area, cask pit, 

etc.

 Dropping the crane hook into the SFP would seriously damage fuel

 Hook and block go into the water (as we saw in the video of operations at a 

Mark-I BWR)

 MPC lid is placed on top before the cask is removed from the pool

 An auxiliary crane is used to move the lid in position (i.e., the big crane is moved 

out of the way)

 Pump out enough water to allow MPC lid to be welded

 Weld lid in place

 Tack weld by hand

 Set up automated welder

 Conduct NDE (dye penetration tests)

 Drain

 Purge with water

 Purge with Nitrogen

 Draw a vacuum on the cask to dry remaining water out

 Test pressure (very low pressure achieved indicates vapor free cask)

 Fill cask with Helium to inert

 Weld penetrations in cask and MPC (purging and inerting access points)

 Secure cask lid in place

 Lift cask out of cask pit

• One of the dry, ambient pressure PWRs uses the NUHOMS System (horizontal 

canisters stored on site)

• Transport to the ISFSI is accomplished using a slow moving flatbed truck (2–3 mph)
C-16

• Slide/lift the door on the NUHOMS crypt with a mobile crane

• Push the MPC out of the transfer cask and into the crypt with a hydraulic ram

• Detailed laser siting is used to ensure proper alignment of the MPC with the crypt

• Tack weld/bolt door in place after it is lowered

• SME3 – What if the MPC gets jammed as it is being inserted?

• SME2 – SME10 made comment about the in-service inspection of the cranes; are there 

cases where visual inspection for cranes, crane girders, hooks, rigging, etc. are just 

made visually when another inspection means should be used

• SME2 – What is the division of labor during the cask operation?

• SME10 – the contractors are consultants; plant personnel perform all of the tasks, but 

contractors and “company experts” are brought in for specific tasks such as heavy lifting, 

welding, etc. These experts are in charge of and execute the operations for cask 

operations and will also be the ones who repair pumps, turbines, etc. – “the Turbine 

Gang” is a common nickname for these personnel. Reactor operators or even less 

experienced radiation workers can be qualified to perform the fuel-loading activities from 

SFP to the cask.

• Speed of lift and speed of movement using the large cranes is engineered to be slow.

• Getting the yoke mated to the cask and preparations for lift off of the flatbed can take a 

few hours

– (the discussion turned to spent fuel handling) –

• Before you move fuel into the cask:

 Get the cask ready

 Nuclear Fuels Engineering (NFE) department puts the fuel move plan together

 The printouts from NFE contain the moves in a step-by-step procedure including 

fuel storage rack locations and fuel bundle serial numbers

• SME2–Is there any specific path planning and subsequent execution? Or are move 

paths up to the discretion of the operators?

• SME10–There isn’t really a path move plan for moving the fuel assemblies, but there are 

certain structures in the pool (e.g., up-enders used to alter the orientation of fuel bundle 

going into or coming out of the fuel transfer tube) that dictate some movement 

constraints. Typically, the operators will move all of the fuel to be put into the cask out of 

their initial storage rack positions, and then group them together in another part of the 

SFP (if there is room). In this new configuration, all of the bundles are verified to be the 

right ones before they are moved into the MPC.
C-17

• SME10–Speed control for the SFP crane movements is up to the operator; they are also 

taught not to rely on the interlocks which limit crane movement; the interlocks are 

considered a back-up safety system

• SME10–There is a solid mechanical “click” when the grapple couples correctly with an 

assembly top plate. 

• SME10 mentioned again the incident where a Control Element Assembly (CEA) was 

being raised out of a fuel bundle; it was not lifted high enough before the spent fuel 

bridge crane was translated away from the location. During the translation, SME10

noticed the CEA bending and alerted the RO to stop the maneuver and back track.

• There is an alarm on the crane which indicates a slack cable or light load condition. 

• If the cable goes slack and you continued to lower a bundle (e.g., not into a rack fixture), 

the bundle would lay down horizontally in the pool.

• SME10–All communications are supposed to be 3–part and headsets are used:

 Transmitter of the message sends the message requesting action 

 Receiver of the message acknowledges by repeating the requested action

 Transmitter acknowledges that the receiver repeated the correct requested 

action

• SME10–Procedures for the process are hard copies located in a notebook or clipped 

together and physically located on the spent fuel bridge crane machine during the fuel 

movement evolution.

• There is a big focus on not introducing (i.e., dropping) foreign objects into the SFP. 

Remember SME10’s example of an operator who leaned over and suddenly realized 

that he had left some change in his shirt pocket. The change dropped into the water and 

led to a tedious “recovery operation”. That particular operator ended up leaving the plant 

not long after the incident. 

• SME2–Can “hot” bundles be detected quickly?

• SME10–Not sure.

• SME2 – How might plant personnel be led to a situation in which the wrong gas is used 

to inert the cask? (question based on incident described by SME4 in which weld gas 

(argon) was mistakenly put into cask instead of helium)

• SME10 – Potential problems that might result in such an event (i.e., backfill with wrong 

gas):

 Inexperienced person doing the job; not understanding the importance of using 

the right gas

 Experienced person exhibiting a slip or lapse
C-18

 Bad procedures

 Sleep deprivation (a good buddy watch system is needed, where pairs of 

operators look out for each other; supervisors are also trained to look for certain 

behaviors indicating fatigue or other “fitness for duty” problems)

• SME10–weight must be off the fuel crane cable in order for the grapple to release.

• Items that may lead to a misload event:

 Poor communication

 Mistakes involving slips or lapses

 Mistakes made on move sheets; for example, mistakes have been made on 

move sheets when refueling operations were conducted at sister units at the 

same plant site and the move sheets were swapped (mirror images of each 

other, etc.)

• SME3–I’ll talk to SME14 about the fuel movement plans and what opportunities exist for 

problems, and what problems have actually occurred. 

• SME10–general safety comment; it took the plant 4–5 events and one event involving a 

fatality for lessons regarding work in a condensate tank were actually “learned”

• SME3 called SME14 regarding Fuel Movement Planning (she has experience with this 

process from a dry, ambient pressure PWR); she will talk to a friend of hers at an electric 

power company who is involved in fuel movement planning all the time.

• SME3–NEI Database; helpful, but the incidents typically involved procedural omissions 

and the events themselves did not have significant consequences. 

• Welding the MPC lid involves multiple beads to be layered up one on top of another; 

very difficult to inspect these geometries using advanced NDE techniques, so dye 

penetration, visual inspection, and an extended period of leak test monitoring is used.

• SME3 called SME15–the maximum pressure for the casks is 150 psig (e.g., one of the 

dry, ambient pressure PWRs places the lid on the MPC before lifting the cask/canister 

system out of the pool).

• SME15 – the penetrations used for purging and inerting, which are the last items to be 

welded on the cask are inspected using advanced techniques such as ultrasonic testing. 

Various items described by SME15 as he read through procedures for a dry, ambient 

pressure PWR:

 Draw a vacuum on the cask

 Hold the vacuum for a long period of time

 Then inert with helium and test for leaks

 The yoke must be removed from the cask handling crane in order to put on 

slings used for putting the DSC into the cask
C-19

 The SFP level is lowered before the cask is put into the cask pit

 Hot fuel is put in the middle of the canister, cool fuel is put in the outer areas

 Lots of changing of rigging is required throughout the cask operations

 The crane hook and cables are sprayed with de-ionized water as the cask is 

lifted out of the pool

Notes from Conference Call Held on Thursday, 10/20/05

Subject matter experts (SMEs) from the following organizations participated: 

• SME1 – USNRC/RES

• SME2 – SNL

• SME3 – SAIC

• SME11 – USNRC/Region 4

• SME12 – USNRC/Region 4

• SME13 – USNRC/Region 4

Notes:

• SME1–introduction; the purpose of this conference call is for SME2 and SME3 to gain 

more insight into human performance concerns regarding spent fuel handling. Misloads 

and drops are key items of interest. We have talked with SME6, and others at NRC and 

were directed to you by a deputy director at the NRC. 

• SME11 – there is a cask loading operation coming up in a couple of months. Maybe your 

team could observe?

• The plants must perform a calculation to estimate whether a dropped cask could 

penetrate floor areas over which they are moved. If the plants determined that the cask 

pit could be penetrated due to fall then you must put some impact limiters under the 

cask. Licensees have in some cases been required to reinforce floors, etc. 

• When not using a single-failure proof crane they just barely lift casks off the floor surface 

to limit the consequences of a drop.

• When you have a single-failure proof crane, the cask will be carried higher (maybe 16 

inches) to allow for the redundant systems to stop the falling load. 

• Discussing cask weights: 934,127 Newtons (105 tons) is usually the maximum for a 

loaded transfer cask. The max at a one site is 1,112,055 Newtons (125 tons) due to a 

special piece of equipment involved. 

• When moving over the refueling floor there might be a situation where the cask has to be 

lifted a few more inches to clear certain items in the travel path.

• At a Mark-I BWR, if the cask was dropped over the transfer pit opening it would have 

fallen over 30.5 meters (100 feet) into the torus of the BWR. Since they were not using a 

single-failure proof crane, they had to stop power production operations in order to 

conduct the cask operations.
C-20

• SME1 – at a dry, ambient pressure PWR in 1995, a cask got stuck over the cask loading 

pit for 16 hours. SME11 remembered this case, and we have some information on the 

case in NUREG-1774.

• SME11 – If a cask tips fuel could slide out. 

• SME1 – What would cause a tip?

• SME11 – An intentional act. The crane operator could intentionally do it.

• SME1 – we don’t normally consider insider sabotage as a credible act.

• SME11 – there have been cases; for example, one in which 3 guys threw boric acid into 

the SFP to intentionally damage fuel several years ago.

• SME11 – there could be a failure of the hooks; you would have to fail two hooks on a 

single failure-proof crane; could have failures of yokes; there was a case at a 

decommissioned PWR where cracks in the yoke were found – a quarterly or annual 

inspection caught this event. Many parts of the hook are hard to inspect, so it is 

generally during these periodic planned inspections that you would find the defects. 

• SME11 – incident at a dry, ambient pressure PWR; a cask was put onto a trolley; the 

trolley sat very low to the ground and an inspector insisted on inspecting the bottom of 

the in-house built device; the plant staff complained, but the inspector was persistent 

and the inspection took place; a forklift was used to tip the trolley up, on the bottom there 

were many cracks in the welds; turns out that 1.9 centimeter (3/4 inch) welds were 

ordered by the trolley designer, but only 0.9525 centimeter (3/8 inch) welds were made 

by the welding team. 

• At a Mark-I BWR, modifications were made to update the crane to single failure proof 

status; analysis indicated that the structure could not hold up if there were a seismic 

event. Lots of controversy in Region III over this issue. 

• SME2 – Do any of the cask systems have bolts for the cask lid to help with the tipping 

issue? (i.e., when the loaded cask is transferred to the preparation area for head closure 

activities)

• SME11 – The Holtec company does have some fasteners on the shield lids now. Other 

manufacturers may be adding fasteners as well to help with the safety significance of a 

cask tipping event before the shield lid/plug is welded in place on the canister.

• SME12 – If a plant is moving a cask without a single-failure-proof crane, then there’s no 

translation of the cask until they have secondary protection (e.g., slings) in place. That 

is, the cask is raised vertically to the height needed for horizontal movement to another 

location (e.g., a transfer pit opening or sliding door in the floor), then slings are added, 

and then the cask is moved horizontally.

• SME12 – haven’t heard what people do with the single-proof cranes. Maybe they don’t 

restrict themselves as much with the movement paths as they should.
C-21

• SME11 – tipping would be a very big problem; but lots of things are done to avoid that. If 

you drop it down the transfer pit opening of a BWR then you would end up with quite a 

mess on your hands.

• SME12 – the utilities are not moving fuel between pools anymore; mainly moving into 

casks.

• SME11 – there are sister plants in one state that have moved fuel from one to the other. 

• SME12 – A Mark-I BWR and a dry, ambient pressure PWR used to send fuel to another 

wet storage location; another dry, ambient pressure PWR used to do that too. 

• SME11 – it can be a big problem getting water out of the casks. That can take some 

time, but using N2 can speed up the drying operation, as can different cask geometries. 

• Holtec uses a different design that keeps water out of interior parts of the structure, 

which has shortened drying times from 20 hours to 3–4 hours. That is, there is less free 

volume in which water may collect.

• Some plants had very long drying times. Several days. But new cask designs dry much 

quicker. Just a few hours if all goes well. 

• The backfill issues (i.e., accidentally using argon at a dry, ambient pressure PWR was 

an unusual event; they analyzed their way out of that problem by determining that the 

argon would still be a suitable backfill gas; therefore they did not have to reopen the 

cask).

• SME12 – some plants have a problem getting the right type of helium (i.e., “Balloon”

grade versus high purity which should be used in backfilling a cask).

• SME11 – there was a site that didn’t verify the purity of helium at 99.95%; they took it off 

the procedure, because the planners thought all they had on site was high purity; when I 

asked the personnel at the warehouse on site about it, turns out there were both low and 

high purity varieties on site – a very bad decision in changing the procedure had been 

identified and was subsequently corrected. 

• SME11 – with respect to loading fuel, at a decommissioned PWR there was one person 

handling the fuel; two verifications were made (the fuel handler and another observer); a 

supervisor also performed a 3rd verification. The supervisor noticed a problem with the 

load, the right assemblies had been loaded, but they were in the wrong locations within 

the canister.

• At a currently non-functioning PWR they misread a fuel bundle serial number and it got 

sent to INL. When that bundle number came up again and the bundle was missing from 

the pool, the mistake was realized and the bundle was then identified at INL.

• A currently non-functioning PWR; the neutron start-up source incident; SME11 and his 

team did a survey at the ISFSI for neutrons; DOE had to go back and do a time motion 

study of all the people involved in operations involving that cask in order to estimate the 

dose numbers. 
C-22

• In Region III at a dry, ambient pressure PWR there was 4.8 year old fuel loaded instead 

of 5 year old fuel. 

• SME11 – what they did at that dry, ambient pressure PWR was to calculate by planned 

loading date, but then the loading date changed. 

• The only time you would notice “young” fuel loaded in a cask is if the radiation 

monitoring sensors in the pool area picked it up; or if you have good underwater 

cameras and they showed more heat coming off than you would expect (i.e., thermally 

induced turbulence affecting the refraction of light–same as the mirage effect on a hot 

day); or if a radiation measurement off the canister was too high. If the fuel was very 

fresh out of the reactor (i.e., under 3 years or so) it would still be glowing blue due to 

Cherenkov radiation.

• SME11 – fuel that’s around 5kW would be at about 90 degrees Fahrenheit around 15kW 

– it would start burning hand; 33 MW/day (high-burn-up) you might see temps up around 

300 degrees C; to date we haven’t seen any really hot casks. 

• SME12 – related to misloading, temperature is not a good indicator for wrong fuel 

loading. 

• SME11 – the utilities are good about capturing unusual things in their corrective action 

system; the inspectors can look into all the incidents that have happened with a crane. 

We could take a look when we are onsite at a plant. The plants don’t like to let the 

Corrective Action Program documentation leave the plant site with NRC personnel, since 

it will then be accessible to others via the freedom of information act (FOIA). 

• SME11 – Visiting one of the dry, ambient pressure PWRs in February should not be a 

problem if you want to observe operations. The date could be a moving target, so you 

would need to have some flexibility.

• From the human factors aspect you are really talking about several days of operations 

and these plants operate on round the clock shifts (i.e., the activities you really want to 

see might occur at 2 a.m., etc.)

• The plants do not like to let procedures be taken outside the plant (see FOIA comments 

above). 

• SME2 – Can we look at the procedures before operations start? Yes. The NRC 

inspectors do that as well. 

• SME12–Reading the procedure while watching (e.g., a dry run) would be good since just 

reading the procedure before the events would be too cryptic; lots of plant specific 

equipment is mentioned that would be unfamiliar since each plant has so many different 

pieces of unique equipment (or at least unique names for equipment). 

• Observing a dry run activity might even be better in that the pace of operations is a bit 

different, plant staff are more relaxed and amenable to speaking with observers, etc.
C-23

Response to Emailed Question Regarding Neutron Startup Sources Tuesday, 11/29/05

The question involved the likelihood that a neutron start up source might be mistakenly loaded 

into a cask as part of a misloading event. Here is the response of personnel at a dry, ambient 

pressure PWR (therefore, this is that NPP’s process/experience): 

“...We had two in each reactor. They were the size of one CEA Finger (long tube ~ 2.5 

centimeters (1 inch) in diameter and ~ 3.7 meters (12 feet) long). They were placed on the core 

periphery in the two fuel assemblies that were closest to the two start-up NI channels 90 

degrees apart. They would fit in a guide tube. We would manually change them each refueling 

in the SFP. The assemblies from the old cycle would be moved in to the SFP directly beneath 

the sleeving station. The receiver assemblies would be placed next to the donors. Then using 

a long handle tool, the source which was resting on the guide tube lip of a corner guide tube 

was grappled and moved to the corner guide tube of the receiver assembly (the assembly 

replacing it in the new core).”

“After about ten years of operation we showed that the cores had enough startup neutrons from 

decay of reinserted fuel (even after an 18 month shutdown) that sources were not needed. 

Subsequently, we no longer use sources and have moved them to the SFP. They are stored in 

a guide tube of a fuel assembly and cannot be accessed without a source handling tool.” 

“With the arrangement at this NPP it would be impossible to mistake a source for a fuel 

assembly. Now what could happen is one could go to a wrong SFP location during a refueling 

and pick up one of the old discharged assemblies containing the sources and reinsert the 

assembly with a source into the core. This would require one to make a fuel-loading error.”




UNITED STATES 

NUCLEAR REGULATORY COMMISSION

WASHINGTON, DC 20555-0001

--------------------

OFFICIAL BUSINESS
NUREG/CR-7017 Preliminary, Qualitative Human Reliability Analysis for Spent Fuel Handling