Radiological Terrorism: Sabotage of Spent Fuel Pools

Radiological Terrorism: Sabotage of Spent Fuel Pool

Hui Zhang

The September 11 large-scale terrorist attacks on the World Trade Center and the Pentagon show the threat of nuclear and radiological terrorism is real. A successful attack or sabotage on a nuclear facility could cause the most potentially devastating radiological release into the atmosphere. While many people focus their concerns on the vulnerability of reactor containment buildings, an increasing number of nuclear experts areconcerned about the spent fuel pools (SFP) which would be more vulnerable than the reactor containment building, because most SFPs are housed in far less robust structures than the reactor containment vessels. Moreover, a SFP would contain much more radiation than a reactor core. ^[1] In particular, one major concern is the vulnerability of the pools' cooling systems. In absence of cooling water, the spent fuel would overheat, and the fuel-cladding could melt or catch fire in some cases. Thus it could release radioactive substances to the environment.

In fact, a number of countries are taking spent nuclear fuel vulnerabilities very seriously. For example, France has installed anti-aircraft missiles around its spent fuel ponds at its reprocessing facility. However, some scholars and experts argue that these nuclear facilities could not be vulnerable to terrorist attacks.

Risk of Spent Nuclear Fuel at Reactor Pools

In this paper, I will explain the potential consequences of the sabotage of spent fuel pools and the vulnerabilities of these pools to terrorist attacks. Finally, I will suggest some security measures to protect these spent fuel facilities.

Storage of Spent Nuclear Fuel

Each year, a typical 1 GWe light water reactor (LWR) discharges about 20 to 30 metric tonnes of heavy metal (tHM) in spent nuclear fuel (SNF). The SNF is very radioactive. Typically, each tonne SNF would emit above 200 million curies of activity at the time of reactor shutdown ^[2]. Thus, the SNF is very hot. For example, one day after shutdown, 30 t LWR spent fuel has a thermal output of about 6 MW. ^[3] To prevent the spent fuel from melting, once discharged from the reactor, it is placed on storage racks in rectangular pools, typically 10-20 m long, 7-15 m wide, and 12-13 m deep. ^[4] The pool is usually made of reinforced concrete walls four to five feet thick with stainless steel liners. Pools at pressurized water reactors (PWR, the most common reactors) are usually outside the reactor containment building and partially or fully embedded in the ground. Most of the spent fuel pools at boiling water reactors (BWR) are housed in reactor buildings and above ground. A pool can have a 15 to 30 year storage (i.e. about 400-800 t for a PWR) of SNFs discharged from a reactor. Spent fuel pools could hold about 10 times more long-lived radioactivity than a reactor core. After a period of cooling time, the spent fuel can be removed from the wet pool for a dry storage or reprocessing.

Today, about 10,000 tHM spent fuel is generated annually. Over 150,000 tHM spent fuels were in storage by 2000. More than 90% of the spent fuel in the world today is stored in pools at reactor sites or in away-from-reactor facilities. ^[5] The abandoning or delaying of reprocessing and the absence of established geologic repositories through the world have resulted in an increase of spent fuel stored at the power plants or in central repositories. Moreover, most reactors were built with an originally planned reprocessing program that made these reactors have much less pool storage capacity. Thus, in many cases, these pools are approaching or have exceeded their original design capacity. To compensate, in practice, many reactor operators in the world are "re-racking" the spent fuel in the pool so that the spent fuel is stored more densely. For example, at most operating reactors in the United States, the 're-rack' of spent fuel has been done. As discussed below, these densepacked pools would be more vulnerable to a pool fire and cause a large amount of radioactive release.

The Consequence of Cesium-137 Release

A 400 t PWR pool holds about 10 times more long-lived radioactivity than a reactor core. A radioactive release from such a pool would cause catastrophic consequences. One major concern is the fission product cesium-137 (Cs-137), which made a major contribution (about three quarters) to the long-term radiological impact of the 1986 Chernobyl accident. A spent fuel pool would contain tens of million curies of Cs-137. Cs-137 has a 30 year half-life; it is relatively volatile and a potent land contaminant. In comparison, the April 1986 Chernobyl accident released about 2 Mega Curies (MCi) Cs-137 into the atmosphere from the core of the 1,000 MWe unit 4. It is estimated that over 100,000 residents were permanently evacuated because of contamination by Cs-137.The total area of the radiation-control zone is about 10,000 km², in which the contamination level is greater than 15 Ci/km² of Cs-137. ^[6]

A typical 1 GWe PWR core contains about 80 t fuels. Each year about one third of the core fuel is discharged into the pool. A pool with 15 year storage capacity will hold about 400 t spent fuel. To estimate the Cs-137 inventory in the pool, for example, we assume the Cs137 inventory at shutdown is about 0.1 MCi/tU with a burn-up of 50,000 MWt-day/tU, thus the pool with 400 t of ten year old SNF would hold about 33 MCi Cs-137. ^[7] Assuming a 50-100% Cs137 release during a spent fuel fire, ^[8] the consequence of the Cs-137 exceed those of the Chernobyl accident 8-17 times (2MCi release from Chernobyl). Based on the wedge model, the contaminated land areas can be estimated. ^[9] For example, for a scenario of a 50% Cs-137 release from a 400 t SNF pool, about 95,000 km² (as far as 1,350 km) would be contaminated above 15 Ci/km² (as compared to 10,000 km² contaminated area above 15 Ci/km² at Chernobyl). Thus, it is necessary to take security measures to prevent such an event from happening.

Vulnerability of Spent Fuel Pools

Until today, no accident or sabotage happened to cause the release of radioactivity from a spent fuel pool. However, many scientists and nuclear security experts are very concerned about a significant release of radioactivity by a possible spent fuel fire, especially in the case of dense packing of pools - a method that has been used by many reactor operators worldwide including for most pools in the US.

The most serious risk is the loss of pool water, which could expose spent fuel to the air, thus leading to an exothermal reactions of the zirconium cladding, which would catch fire at about 900 °C. Thus, the Cs-137 in the rods could be dispersed into the surrounding atmosphere. Based on a Technical Study of Spent Fuel Pool Accident Risk at Decommissioning Nuclear Power Plant in 2000, the US Nuclear Regulatory Commission (NRC) conceded that "the possibility of a zirconium fire cannot be dismissed even many years after a final reactor shutdown." ^[10] Recently, a number of nuclear scientists outside the government agency arrived at the same conclusion. For example, the new technical study Reducing the hazards from stored spent power-reactor fuel in the United States by R. Alvarez et al. ^[11] points out that "In the absence of any cooling, a freshly discharged core generating decay heat at a rate of 100 kWt/tU would heat up adiabatically within an hour to about 600 °C, where the zircaloy cladding would be expected to rupture under the internal pressure from helium and fission product gases, and then to about 900 °C where the cladding would begin to burn in air." In addition, although the cooler fuel could not ignite on its own, many scientists are concerned that fire from freshly spent fuel could spread to adjacent cooler fuel by some mechanisms, including zircaloy oxidation propagation. ^[12] Finally, even for the case of non-dense-packed pools, there could still be some sabotage scenarios that cause a significant amount of radioactive release as discussed in the following section.

Thus, a loss of pool cooling could cause a pool fire. Then the question is how such a loss of pool water is brought about. A terrorist group could cause a loss of cooling water in a number of ways, such as,

• causing the loss of cooling, thus boiling the water off through the failure of pumps or valves, through the destruction of heat exchangers, or through a loss of power for the cooling system. It is estimated that, in the case of a loss of cooling, the time it would take for a spent fuel pool to boil down to near the top of the spent fuel would be as short as several hours, depending on the cooling time of the discharge fuel. ^[13] Moreover, in the case of terrorist attack, the operators of nuclear facilities might not have enough time to provide emergency cooling.
• causing the drainage of coolant inventory by piping failures or siphoning, and by gate and seal failures. Furthermore, a heavy load including a fuel transport cask could be dropped in the pools thus causing a collapse of the pool floor and a water leak. As reported, "The analysis exclusively considered drops severe enough to catastrophically damage the SFP so that pool inventory would be lost rapidly and it would be impossible to refill the pool using onsite or offsite resources. There is no possibility of mitigating the damage, only preventing it." "The staff assumes a catastrophic heavy load drop (creating a large leakage path in the pool) would lead directly to a zirconium fire." ^[14]
• puncturing the pool and causing a drainage by suicide airplanes, missiles, or other explosives. For the case that spent fuel pools are located above ground level, a suicide airplane could breach the pool bottom or sidewalls and cause a complete or partial drainage. A US NRC study estimated that a large aircraft (one weighing more than 5.4 tonnes) would have a 45% probability of penetrating the five-foot thick concrete wall of a spent fuel pool. The NRC staff has decided that it is prudent to assume that a turbine shaft of a large aircraft engine could penetrate and drain a spent fuel storage pool. ^[15]

However, there are some opposing arguments regarding the impact of an aircraft on a spent fuel pool. For example, a study conducted by the Electric Power Research Institute at the request of the Nuclear Energy Institute, which considers the impact of a Boeing 767 on spent fuel storage pools concluded that "the stainless steel pool liner ensures that, although the evaluations of the representative used fuel pools determined that there was localized crushing and cracking of the concrete wall, there was no loss of pool cooling water. Because the used fuel pools were not breached, the used fuel is protected and there would be no release of radionuclides to the environment." ^[16] However, many experts are concerned about the spent fuel pool damage from an aircraft crash.

A terrorist could also use anti-tank missiles to puncture a pool. Modern anti-tank weapons can be fired by shoulder or from a vehicle or boat, and launched as far as 2 km away. It is reported that some modern anti-tank missiles would be able to penetrate up to 3 m of reinforced concrete. Thus these weapons could be used to conduct an off-site attack on the pools. Moreover, a terrorist attack could include some kinds of on-site explosions to damage the pools, such as if a large truck bomb were detonated near the pool; or if a terrorist carried a certain type of explosive to the pool and blew a sizeable hole in the pool. In particular, the truck bomb would pose a big threat.

Risk of Spent Fuel Pools at Reprocessing Plants

Another risk is from the spent fuel pools at reprocessing plants. A reprocessing plant has even greater pool storage capacity than that of a reactor pool. Before reprocessing, the received spent fuels are stored in wet pools at the reprocessing plants. The buildings that house the pools could be even weaker than those pools at reactor sites. In particular, the roof of the building could be more vulnerable. Most of the sabotage scenarios conceivable for reactor pools could be applied to these pools at reprocessing plants. However, unlike those freshly discharged spent fuels at reactor pools with dense packing, the cooler spent fuel at reprocessing pools, which is at least two years old, could be difficult to ignite automatically in the absence of cooling.

Nevertheless, there might still be some ways to cause a significant radioactive release by a successful terrorist attack. For example, a two- or multiple-stage attack by truck bombs, aircraft impacts or other kinds of on-site explosion could at least breach the zircaloy cladding or even partly melt the fuel cladding. Even though this would not ignite a spent fuel fire, a significant fraction of Cs-137 in the rods could be released into the atmosphere. For example, a pool with 2,000 t ten-year-old SNF would hold about 170 MCi Cs-137. If 3% of this Cs-137 inventory were released, ^[17] about 5 MCi Cs-137 would be released, which is two times more than the 1986 Chernobyl accident. Furthermore, terrorists could pour fuel in the pool and start a fire that would cause ignition of the zircaloy cladding and lead to a greater release of the Cs-137 inventory. Recent results from France indicate that heating at 1,500 °C of high-burnup spent fuel for one hour caused the release of 26% of the Cs inventory. ^[18] Thus it would release about 44 MCi of Cs-137 into the environment, which would be twenty times more than the 1986 Chernobyl accident.

The major operating reprocessing plants are at French La Hague, British Sellafield, and Russian Mayak, and Japan is currently building a major reprocessing facility (with a capacity of 800 tHM/y) at Rokkasho, which is about 90% complete. UK's British Nuclear Fuels Plc. (BNFL) operates two reprocessing plants at Sellafield, the Magnox B205 and the Thermal Oxide Reprocessing Plant (THORP). The B205 plant has a capacity of 1,500 tHM/y and reprocesses SNF from 16 British Magnox reactors. THORP has a capacity of 1,200 tHM/y and reprocesses SNF from 14 British Advanced Gas-Cooled Reactors (AGR) as well as imported SNF. Like the Magnox reprocessing plant, THORP uses the standard Purex method. As reported, the French La Hague nuclear reprocessing facilities (with a normal capacity of 800 tHM/year in each of the two facilities) holds a stock of radioactive substances that greatly exceeds those of all the French nuclear reactors put together. According to a Cogema presentation on the situation of its storage pools on 30 June 2001, 7,484.2 t varied nuclear fuel (of which 7,077.7 t from France), is spread in five pools (which provide a total storage capacity of 13,990 t.) In addition, over 55 t separated plutonium, over 1,400 m³ highly radioactive glass, and 10,000 m³ of radioactive sludges are located there. ^[19]

Some experts are already concerned about the possible consequence of a terrorist attack on the La Hague nuclear reprocessing facilities. As a COGEMA-La Hague spokesman declared after September 11, as far as the design basis is concerned, the facilities are no more protected against an airliner crash than any other nuclear power station. ^[20] The World Information Service on Energy, Wise-Paris, estimated the potential impact of a major accident in La Hague's pools. ^[21] The calculation was made for the case of an explosion and/or fire in the spent fuel storage pool D (the smallest one), assuming that it is filled up to half of its normal capacity of 3,490 t, supposing a release of up to 100% of Cs-137. Based solely on the stock of Cs-137 in pool D, it is shown that a major accident in this pool could have an impact up to 67 times that of the Chernobyl accident. Moreover, the total Cs-137 inventory in the pools of La Hague reprocessing facilities is about 7,500 kg, 280 times as much as the Cs-137 amount released from the 1986 Chernobyl accident.

In fact, since 11 September 2001, attention has been drawn to the physical protection of nuclear power plants and reprocessing facilities. For example, France has installed anti-aircraft missiles around its spent fuel pond at the La Hague reprocessing facilities. Also in the UK, the House of Commons defense committee stressed that attention should be focused on the vulnerability of nuclear installations, including reprocessing plants. The Royal Air Force Tornado F3 fighters based at Coningsby, Lincolnshire, are responsible for intercepting hijacked commercial aircraft deemed a threat to UK nuclear sites. In July 2002, the British government published a White Paper entitled Managing the Nuclear Legacy: A Strategy for Action which proposed to transform the United Kingdom Atomic Energy Autority (UKAEA) Constabulary into a stand-alone force, the Civil Nuclear Constabulary (CNC). ^[22]

Reducing the Risks Posed by Spent Fuel Pools

Spent fuel facilities could become a tempting target for terrorists. Indeed, on September 11, the terrorists just used simple box-cutters to convert a fuel-laden jetliner into guided missiles and cause mass destruction. Similarly, terrorists could use conventional means to turn an adversary's nuclear spent fuel facilities into radiological weapons. Therefore it is an urgent priority to enhance the current nuclear security system worldwide. Here it is suggested that several security measures should be taken to improve the existing security systems for nuclear installations including spent fuel facilities.

• Every country with SNF facilities should review and upgrade its basis used for designing physical protection for these facilities to ensure that it reflects the threat as perceived after September 11. It should take some effective measures including a strong two-person rule protecting against well-trained insiders. It also needs to deny access to these nuclear facilities either by land or air to protect against sabotage. This would include, for example, re-examining the size of exclusion zones and adding effective physical barriers and delay mechanisms around nuclear facilities to prevent against truck bombs or boat attacks, and setting up a no-fly-zone around nuclear facilities to exclude attacks of suicide aircrafts. Moreover, all these facilities should be protected by well-trained, armed guard forces.
• Each country should enhance its security system to reduce the risk posed by spent fuel pools. To protect against terrorist sabotage on these pools, some specific measures should be taken, which would include hardening the pool floor and walls to prevent the breach by weapon attacks or heavy load drop, thus reducing the risk of the leak of coolant, and providing for emergency ventilation of spent fuel buildings or installing emergency water sprinkler systems to reduce the likelihood of fire in case of a loss of coolant. Furthermore, to reduce the likelihood of a pool fire, as much spent fuel as possible, especially SNF at pools with dense packing, should be moved into the less vulnerable dry storage type of cask as soon as possible. Unlike wet pools, dry casks are cooled by natural convection that is driven by the decay heat of the spent fuel itself, thus they are not vulnerable to loss of coolant. In the U.S., for example, only about 4% of the spent fuel inventory is in dry storage, because there is no financial incentive for the owner to move wastes to safer dry storage. It is estimated that the cost of onsite dry-cask storage for an additional 35,000 t of older spent fuel is about 0.03-0.06 cents per KWh generated from that fuel. ^[23]Nevertheless, such a cost is justified to reduce the potential catastrophic consequences of a pool fire.
• The International Atomic Energy Agency (IAEA) should re-examine and update its guidelines for the physical protection of nuclear facilities. Today there is no multilateral treaty that requires nuclear facilities, including reactors and spent fuel facilities, to be protected from sabotage. The only related treaty is the 1980 Convention on the Physical Protection of Nuclear Material. However, it only applies to the protection from theft of material in international transportation. In 1999, the IAEA made a substantial revision of its recommendations on physical protection (INFCIRC 225/Rev.4). After the September 11 attacks, the IAEA General Conference accepted twelve physical protection principles developed by an experts' group, which include commending the IAEA's programs of training, guidance, and technical assistance to assist states in establishing or improving systems of physical protection; requesting the IAEA to strengthen its work to prevent acts of terrorism; and urging IAEA members to support all of these programs. ^[24] However, all these recommendations are not mandatory. Given the threat of sabotage of nuclear facilities, the IAEA should review its guidelines for physical protections of nuclear facilities and create new requirements for regulations and standards of physical protection with their new understanding of the threat in the aftermath of September 11. At a minimum, each related country should immediately apply these standards of physical protections as recommended in INFCIRC 225/Rev.4 and by the experts' principles. Furthermore, the IAEA should soon conduct an amendment to the convention on physical protection with adoption of stronger physical protection standards against these threats and require each country to accept and apply those standards to its nuclear facilities. Also, the IAEA should be able to provide guidance, training, advisory services, and technical assistance to help countries improve their protection practices and to implement the new principles and recommendations. Finally, the international community should further enhance the international cooperative effort to improve current security systems of these nuclear facilities, including spent fuel facilities.