Journal Article - INESAP: International Network of Engineers and Scientists Against Proliferation

Radiological Terrorism: Sabotage of Spent Fuel Pools

| December 2003

Radiological Terrorism: Sabotage of Spent Fuel Pool

Hui Zhang

The September 11 large-scale terrorist attacks on the World Trade Center and the Pentagon show the threat of nuclear and radiological terrorism is real. A successful attack or sabotage on a nuclear facility could cause the most potentially devastating radiological release into the atmosphere. While many people focus their concerns on the vulnerability of reactor containment buildings, an increasing number of nuclear experts are concerned about the spent fuel pools (SFP) which would be more vulnerable than the reactor containment building, because most SFPs are housed in far less robust structures than the reactor containment vessels. Moreover, a SFP would contain much more radiation than a reactor core. [1] In particular, one major concern is the vulnerability of the pools' cooling systems. In absence of cooling water, the spent fuel would overheat, and the fuel-cladding could melt or catch fire in some cases. Thus it could release radioactive substances to the environment.

In fact, a number of countries are taking spent nuclear fuel vulnerabilities very seriously. For example, France has installed anti-aircraft missiles around its spent fuel ponds at its reprocessing facility. However, some scholars and experts argue that these nuclear facilities could not be vulnerable to terrorist attacks.

Risk of Spent Nuclear Fuel at Reactor Pools

In this paper, I will explain the potential consequences of the sabotage of spent fuel pools and the vulnerabilities of these pools to terrorist attacks. Finally, I will suggest some security measures to protect these spent fuel facilities.

Storage of Spent Nuclear Fuel

Each year, a typical 1 GWe light water reactor (LWR) discharges about 20 to 30 metric tonnes of heavy metal (tHM) in spent nuclear fuel (SNF). The SNF is very radioactive. Typically, each tonne SNF would emit above 200 million curies of activity at the time of reactor shutdown [2]. Thus, the SNF is very hot. For example, one day after shutdown, 30 t LWR spent fuel has a thermal output of about 6 MW. [3] To prevent the spent fuel from melting, once discharged from the reactor, it is placed on storage racks in rectangular pools, typically 10-20 m long, 7-15 m wide, and 12-13 m deep. [4] The pool is usually made of reinforced concrete walls four to five feet thick with stainless steel liners. Pools at pressurized water reactors (PWR, the most common reactors) are usually outside the reactor containment building and partially or fully embedded in the ground. Most of the spent fuel pools at boiling water reactors (BWR) are housed in reactor buildings and above ground. A pool can have a 15 to 30 year storage (i.e. about 400-800 t for a PWR) of SNFs discharged from a reactor. Spent fuel pools could hold about 10 times more long-lived radioactivity than a reactor core. After a period of cooling time, the spent fuel can be removed from the wet pool for a dry storage or reprocessing.

Today, about 10,000 tHM spent fuel is generated annually. Over 150,000 tHM spent fuels were in storage by 2000. More than 90% of the spent fuel in the world today is stored in pools at reactor sites or in away-from-reactor facilities. [5] The abandoning or delaying of reprocessing and the absence of established geologic repositories through the world have resulted in an increase of spent fuel stored at the power plants or in central repositories. Moreover, most reactors were built with an originally planned reprocessing program that made these reactors have much less pool storage capacity. Thus, in many cases, these pools are approaching or have exceeded their original design capacity. To compensate, in practice, many reactor operators in the world are "re-racking" the spent fuel in the pool so that the spent fuel is stored more densely. For example, at most operating reactors in the United States, the 're-rack' of spent fuel has been done. As discussed below, these densepacked pools would be more vulnerable to a pool fire and cause a large amount of radioactive release.

The Consequence of Cesium-137 Release

A 400 t PWR pool holds about 10 times more long-lived radioactivity than a reactor core. A radioactive release from such a pool would cause catastrophic consequences. One major concern is the fission product cesium-137 (Cs-137), which made a major contribution (about three quarters) to the long-term radiological impact of the 1986 Chernobyl accident. A spent fuel pool would contain tens of million curies of Cs-137. Cs-137 has a 30 year half-life; it is relatively volatile and a potent land contaminant. In comparison, the April 1986 Chernobyl accident released about 2 Mega Curies (MCi) Cs-137 into the atmosphere from the core of the 1,000 MWe unit 4. It is estimated that over 100,000 residents were permanently evacuated because of contamination by Cs-137.The total area of the radiation-control zone is about 10,000 km², in which the contamination level is greater than 15 Ci/km² of Cs-137. [6]

A typical 1 GWe PWR core contains about 80 t fuels. Each year about one third of the core fuel is discharged into the pool. A pool with 15 year storage capacity will hold about 400 t spent fuel. To estimate the Cs-137 inventory in the pool, for example, we assume the Cs137 inventory at shutdown is about 0.1 MCi/tU with a burn-up of 50,000 MWt-day/tU, thus the pool with 400 t of ten year old SNF would hold about 33 MCi Cs-137. [7] Assuming a 50-100% Cs137 release during a spent fuel fire, [8] the consequence of the Cs-137 exceed those of the Chernobyl accident 8-17 times (2MCi release from Chernobyl). Based on the wedge model, the contaminated land areas can be estimated. [9] For example, for a scenario of a 50% Cs-137 release from a 400 t SNF pool, about 95,000 km² (as far as 1,350 km) would be contaminated above 15 Ci/km² (as compared to 10,000 km² contaminated area above 15 Ci/km² at Chernobyl). Thus, it is necessary to take security measures to prevent such an event from happening.

Vulnerability of Spent Fuel Pools

Until today, no accident or sabotage happened to cause the release of radioactivity from a spent fuel pool. However, many scientists and nuclear security experts are very concerned about a significant release of radioactivity by a possible spent fuel fire, especially in the case of dense packing of pools - a method that has been used by many reactor operators worldwide including for most pools in the US.

The most serious risk is the loss of pool water, which could expose spent fuel to the air, thus leading to an exothermal reactions of the zirconium cladding, which would catch fire at about 900 °C. Thus, the Cs-137 in the rods could be dispersed into the surrounding atmosphere. Based on a Technical Study of Spent Fuel Pool Accident Risk at Decommissioning Nuclear Power Plant in 2000, the US Nuclear Regulatory Commission (NRC) conceded that "the possibility of a zirconium fire cannot be dismissed even many years after a final reactor shutdown." [10] Recently, a number of nuclear scientists outside the government agency arrived at the same conclusion. For example, the new technical study Reducing the hazards from stored spent power-reactor fuel in the United States by R. Alvarez et al. [11] points out that "In the absence of any cooling, a freshly discharged core generating decay heat at a rate of 100 kWt/tU would heat up adiabatically within an hour to about 600 °C, where the zircaloy cladding would be expected to rupture under the internal pressure from helium and fission product gases, and then to about 900 °C where the cladding would begin to burn in air." In addition, although the cooler fuel could not ignite on its own, many scientists are concerned that fire from freshly spent fuel could spread to adjacent cooler fuel by some mechanisms, including zircaloy oxidation propagation. [12] Finally, even for the case of non-dense-packed pools, there could still be some sabotage scenarios that cause a significant amount of radioactive release as discussed in the following section.

Thus, a loss of pool cooling could cause a pool fire. Then the question is how such a loss of pool water is brought about. A terrorist group could cause a loss of cooling water in a number of ways, such as,

  • causing the loss of cooling, thus boiling the water off through the failure of pumps or valves, through the destruction of heat exchangers, or through a loss of power for the cooling system. It is estimated that, in the case of a loss of cooling, the time it would take for a spent fuel pool to boil down to near the top of the spent fuel would be as short as several hours, depending on the cooling time of the discharge fuel. [13] Moreover, in the case of terrorist attack, the operators of nuclear facilities might not have enough time to provide emergency cooling.
  • causing the drainage of coolant inventory by piping failures or siphoning, and by gate and seal failures. Furthermore, a heavy load including a fuel transport cask could be dropped in the pools thus causing a collapse of the pool floor and a water leak. As reported, "The analysis exclusively considered drops severe enough to catastrophically damage the SFP so that pool inventory would be lost rapidly and it would be impossible to refill the pool using onsite or offsite resources. There is no possibility of mitigating the damage, only preventing it." "The staff assumes a catastrophic heavy load drop (creating a large leakage path in the pool) would lead directly to a zirconium fire." [14]
  • puncturing the pool and causing a drainage by suicide airplanes, missiles, or other explosives. For the case that spent fuel pools are located above ground level, a suicide airplane could breach the pool bottom or sidewalls and cause a complete or partial drainage. A US NRC study estimated that a large aircraft (one weighing more than 5.4 tonnes) would have a 45% probability of penetrating the five-foot thick concrete wall of a spent fuel pool. The NRC staff has decided that it is prudent to assume that a turbine shaft of a large aircraft engine could penetrate and drain a spent fuel storage pool. [15]

However, there are some opposing arguments regarding the impact of an aircraft on a spent fuel pool. For example, a study conducted by the Electric Power Research Institute at the request of the Nuclear Energy Institute, which considers the impact of a Boeing 767 on spent fuel storage pools concluded that "the stainless steel pool liner ensures that, although the evaluations of the representative used fuel pools determined that there was localized crushing and cracking of the concrete wall, there was no loss of pool cooling water. Because the used fuel pools were not breached, the used fuel is protected and there would be no release of radionuclides to the environment." [16] However, many experts are concerned about the spent fuel pool damage from an aircraft crash.

A terrorist could also use anti-tank missiles to puncture a pool. Modern anti-tank weapons can be fired by shoulder or from a vehicle or boat, and launched as far as 2 km away. It is reported that some modern anti-tank missiles would be able to penetrate up to 3 m of reinforced concrete. Thus these weapons could be used to conduct an off-site attack on the pools. Moreover, a terrorist attack could include some kinds of on-site explosions to damage the pools, such as if a large truck bomb were detonated near the pool; or if a terrorist carried a certain type of explosive to the pool and blew a sizeable hole in the pool. In particular, the truck bomb would pose a big threat.

Risk of Spent Fuel Pools at Reprocessing Plants

Another risk is from the spent fuel pools at reprocessing plants. A reprocessing plant has even greater pool storage capacity than that of a reactor pool. Before reprocessing, the received spent fuels are stored in wet pools at the reprocessing plants. The buildings that house the pools could be even weaker than those pools at reactor sites. In particular, the roof of the building could be more vulnerable. Most of the sabotage scenarios conceivable for reactor pools could be applied to these pools at reprocessing plants. However, unlike those freshly discharged spent fuels at reactor pools with dense packing, the cooler spent fuel at reprocessing pools, which is at least two years old, could be difficult to ignite automatically in the absence of cooling.

Nevertheless, there might still be some ways to cause a significant radioactive release by a successful terrorist attack. For example, a two- or multiple-stage attack by truck bombs, aircraft impacts or other kinds of on-site explosion could at least breach the zircaloy cladding or even partly melt the fuel cladding. Even though this would not ignite a spent fuel fire, a significant fraction of Cs-137 in the rods could be released into the atmosphere. For example, a pool with 2,000 t ten-year-old SNF would hold about 170 MCi Cs-137. If 3% of this Cs-137 inventory were released, [17] about 5 MCi Cs-137 would be released, which is two times more than the 1986 Chernobyl accident. Furthermore, terrorists could pour fuel in the pool and start a fire that would cause ignition of the zircaloy cladding and lead to a greater release of the Cs-137 inventory. Recent results from France indicate that heating at 1,500 °C of high-burnup spent fuel for one hour caused the release of 26% of the Cs inventory. [18] Thus it would release about 44 MCi of Cs-137 into the environment, which would be twenty times more than the 1986 Chernobyl accident.

The major operating reprocessing plants are at French La Hague, British Sellafield, and Russian Mayak, and Japan is currently building a major reprocessing facility (with a capacity of 800 tHM/y) at Rokkasho, which is about 90% complete. UK's British Nuclear Fuels Plc. (BNFL) operates two reprocessing plants at Sellafield, the Magnox B205 and the Thermal Oxide Reprocessing Plant (THORP). The B205 plant has a capacity of 1,500 tHM/y and reprocesses SNF from 16 British Magnox reactors. THORP has a capacity of 1,200 tHM/y and reprocesses SNF from 14 British Advanced Gas-Cooled Reactors (AGR) as well as imported SNF. Like the Magnox reprocessing plant, THORP uses the standard Purex method. As reported, the French La Hague nuclear reprocessing facilities (with a normal capacity of 800 tHM/year in each of the two facilities) holds a stock of radioactive substances that greatly exceeds those of all the French nuclear reactors put together. According to a Cogema presentation on the situation of its storage pools on 30 June 2001, 7,484.2 t varied nuclear fuel (of which 7,077.7 t from France), is spread in five pools (which provide a total storage capacity of 13,990 t.) In addition, over 55 t separated plutonium, over 1,400 m³ highly radioactive glass, and 10,000 m³ of radioactive sludges are located there. [19]

Some experts are already concerned about the possible consequence of a terrorist attack on the La Hague nuclear reprocessing facilities. As a COGEMA-La Hague spokesman declared after September 11, as far as the design basis is concerned, the facilities are no more protected against an airliner crash than any other nuclear power station. [20] The World Information Service on Energy, Wise-Paris, estimated the potential impact of a major accident in La Hague's pools. [21] The calculation was made for the case of an explosion and/or fire in the spent fuel storage pool D (the smallest one), assuming that it is filled up to half of its normal capacity of 3,490 t, supposing a release of up to 100% of Cs-137. Based solely on the stock of Cs-137 in pool D, it is shown that a major accident in this pool could have an impact up to 67 times that of the Chernobyl accident. Moreover, the total Cs-137 inventory in the pools of La Hague reprocessing facilities is about 7,500 kg, 280 times as much as the Cs-137 amount released from the 1986 Chernobyl accident.

In fact, since 11 September 2001, attention has been drawn to the physical protection of nuclear power plants and reprocessing facilities. For example, France has installed anti-aircraft missiles around its spent fuel pond at the La Hague reprocessing facilities. Also in the UK, the House of Commons defense committee stressed that attention should be focused on the vulnerability of nuclear installations, including reprocessing plants. The Royal Air Force Tornado F3 fighters based at Coningsby, Lincolnshire, are responsible for intercepting hijacked commercial aircraft deemed a threat to UK nuclear sites. In July 2002, the British government published a White Paper entitled Managing the Nuclear Legacy: A Strategy for Action which proposed to transform the United Kingdom Atomic Energy Autority (UKAEA) Constabulary into a stand-alone force, the Civil Nuclear Constabulary (CNC). [22]

Reducing the Risks Posed by Spent Fuel Pools

Spent fuel facilities could become a tempting target for terrorists. Indeed, on September 11, the terrorists just used simple box-cutters to convert a fuel-laden jetliner into guided missiles and cause mass destruction. Similarly, terrorists could use conventional means to turn an adversary's nuclear spent fuel facilities into radiological weapons. Therefore it is an urgent priority to enhance the current nuclear security system worldwide. Here it is suggested that several security measures should be taken to improve the existing security systems for nuclear installations including spent fuel facilities.

  • Every country with SNF facilities should review and upgrade its basis used for designing physical protection for these facilities to ensure that it reflects the threat as perceived after September 11. It should take some effective measures including a strong two-person rule protecting against well-trained insiders. It also needs to deny access to these nuclear facilities either by land or air to protect against sabotage. This would include, for example, re-examining the size of exclusion zones and adding effective physical barriers and delay mechanisms around nuclear facilities to prevent against truck bombs or boat attacks, and setting up a no-fly-zone around nuclear facilities to exclude attacks of suicide aircrafts. Moreover, all these facilities should be protected by well-trained, armed guard forces.
  • Each country should enhance its security system to reduce the risk posed by spent fuel pools. To protect against terrorist sabotage on these pools, some specific measures should be taken, which would include hardening the pool floor and walls to prevent the breach by weapon attacks or heavy load drop, thus reducing the risk of the leak of coolant, and providing for emergency ventilation of spent fuel buildings or installing emergency water sprinkler systems to reduce the likelihood of fire in case of a loss of coolant. Furthermore, to reduce the likelihood of a pool fire, as much spent fuel as possible, especially SNF at pools with dense packing, should be moved into the less vulnerable dry storage type of cask as soon as possible. Unlike wet pools, dry casks are cooled by natural convection that is driven by the decay heat of the spent fuel itself, thus they are not vulnerable to loss of coolant. In the U.S., for example, only about 4% of the spent fuel inventory is in dry storage, because there is no financial incentive for the owner to move wastes to safer dry storage. It is estimated that the cost of onsite dry-cask storage for an additional 35,000 t of older spent fuel is about 0.03-0.06 cents per KWh generated from that fuel. [23]Nevertheless, such a cost is justified to reduce the potential catastrophic consequences of a pool fire.
  • The International Atomic Energy Agency (IAEA) should re-examine and update its guidelines for the physical protection of nuclear facilities. Today there is no multilateral treaty that requires nuclear facilities, including reactors and spent fuel facilities, to be protected from sabotage. The only related treaty is the 1980 Convention on the Physical Protection of Nuclear Material. However, it only applies to the protection from theft of material in international transportation. In 1999, the IAEA made a substantial revision of its recommendations on physical protection (INFCIRC 225/Rev.4). After the September 11 attacks, the IAEA General Conference accepted twelve physical protection principles developed by an experts' group, which include commending the IAEA's programs of training, guidance, and technical assistance to assist states in establishing or improving systems of physical protection; requesting the IAEA to strengthen its work to prevent acts of terrorism; and urging IAEA members to support all of these programs. [24] However, all these recommendations are not mandatory. Given the threat of sabotage of nuclear facilities, the IAEA should review its guidelines for physical protections of nuclear facilities and create new requirements for regulations and standards of physical protection with their new understanding of the threat in the aftermath of September 11. At a minimum, each related country should immediately apply these standards of physical protections as recommended in INFCIRC 225/Rev.4 and by the experts' principles. Furthermore, the IAEA should soon conduct an amendment to the convention on physical protection with adoption of stronger physical protection standards against these threats and require each country to accept and apply those standards to its nuclear facilities. Also, the IAEA should be able to provide guidance, training, advisory services, and technical assistance to help countries improve their protection practices and to implement the new principles and recommendations. Finally, the international community should further enhance the international cooperative effort to improve current security systems of these nuclear facilities, including spent fuel facilities.


  1. Robert Alvarez, What about the spent fuel?, Bulletin of the Atomic Scientist, vol.58, no.1, January/February 2002, pp. 45-47.
  2. 1 Curie [Ci] corresponds to an activity of 3.7 10+10 decays per second. The total radioactivity of spent fuel is calculated with ORIGEN2.1. E.g. the radioactivity of 1 MT spent fuel (50 MWd/kgU burnup) discharged from a pressurized water reactor/PWR (4.5% initial enrichment) are approximately 214 MCi at discharge, 25 MCi after one week, 13 MCi after one month, and 3 MCi after one year, respectively.
  3. E.g., based on ORIGEN2.1 code, the thermal powers of 1 MT spent fuel (50 MWd/kgU burnup) discharged from a PWR (4.5% initial enrichment) are approximately 2 MW at discharge, 200 kW after one day, 100 kW after one week, and 13 kW after one year, respectively.
  4. Bennett Ramberg, Nuclear Power Plants as Weapons for the Enemy, Berkeley, CA, University of California Press, 1984.
  5. Matthew Bunn et al., Interim Storage of Spent Nuclear Fuel - A Safe, Flexible, and Cost-Effective Near-Term Approach to Spent Fuel Management, A Joint Report from the Harvard University Project on Managing the Atom and the University of Tokyo Project on Sociotechnics of Nuclear Energy, June 2001.
  6. Exposures and effects of the Chernobyl accident, Annex J in Sources and Effects of Ionizing Radiation, the UNSCEAR 2000 Report, vol. II (UN 2000);
  7. E.g. based on ORIGEN2.1 calculation, the radioactivity of Cs-137 in 1 MT spent fuel (50 MWd/kgU burnup) discharged from a PWR (4.5% initial enrichment) are approximately 1.04 X105 Ci at discharge and 8.25 X104 Ci after ten years discharge, respectively.
  8. Based on a spent fuel pool study by the Brookhaven National Laboratory, as much as 100% of the fuel's Cs-137 inventory would be released into the environment in a case of a pool fire. See details about the range estimate, e.g. R.J. Travis, R.E. Davis, E.J. Grove, and M.A. Azarm, A Safety and Regulatory Assessment of Generic BWR and PWR Permanently Shutdown Nuclear Power Plants, Brookhaven National Laboratory, NUREG/CR-6451; BNL-NUREG-52498, 1997.
  9. For the wedge model: the contamination level σ = [Q/(θrRd)] exp (-r/Rd) Ci/m² where Q is the size of the release in Curies; θ is the angular width of a down-wind wedge within which the air concentration is assumed to be uniform across the wedge and vertically through the mixing layer, r is the downwind distance in meters; and Rd is the 'deposition length' Rd = Hvw/vd, where H is the thickness of the mixing layer, vw is the wind velocity averaged over the mixing layer, and vd, the aerosol deposition velocity, measures the ratio between the air concentration and ground deposition density. Here the released Cs-137 in a plume is assumed to be distributed vertically uniformly through the atmosphere's lower 'mixing layer' and dispersed downwind in a wedge model approximation under median conditions, that is, mixing layer thickness of 1 km, wedge-angle opening angle of 6 degrees, wind speed of 5 m/sec, and deposition velocity of 1 cm/sec. See details about the model in: Report to the American Physical Society by the study group on light-water reactor safety, Reviews of Modern Physics, 47, Supplement 1, 1975.
  10. US Nuclear Regulatory Commission, Technical Study of Spent Fuel Pool Accident Risk at Decommissioning Nuclear Power Plants (NRC, NUREG-1738, 2001).
  11. Robert Alvarez, Jan Beyea, Klaus Janberg, Jungmin Kang, Ed Lyman, Allison Macfarlane, Gordon Thompson, and Frank von Hippel, Reducing the Hazards from Stored Spent Power-Reactor Fuel in the United States, Science & Global Security, vol.11, no.1, 2003.
  12. V.L. Sailor, K.R. Perkins, J.R. Weeks, and H.R. Connell, Severe Accidents in Spent Fuel Pools in Support of Generic Safety, Brookhaven National Laboratory, NUREG/CR-4982; BNL-NUREG-52093, 1987, p. 52.
  13. As an example, if a core had been loaded into the spent fuel pool five days after shutdown, it could take about eight hours to boil down. For details see: US Nuclear Regulatory Commission, Briefing On Spent Fuel Pool Study, Public Meeting, November 14, 1996;, p. 27.
  14. NRC, Technical Study of Spent Fuel Pool Accident Risk at Decommissioning Nuclear Power Plants, op.cit.
  15. NRC, Technical Study of Spent Fuel Pool Accident Risk at Decommissioning Nuclear Power Plants, op.cit., p. 3-23.
  16. ABS Consulting and Anatech, Deterring Terrorism: Aircraft Crash Impact Analyses Demonstrate Nuclear Power Plant's Structural Strength, December 2002;
  17. For the case of spent fuel transportation cask, it is estimated that 3% of the Cs-137 inventory could be released from the breached spent fuel. For details see: Edwin Lyman, A Critique of Physical Protection Standards for Transport of Irradiated Material, in: Proceedings of the 40th Annual Meeting of the Institute of Nuclear Materials Management, Phoenix, AZ, July 1999, Northbrook, IL: INMM, 1999. Here I took the same fraction of released Cs-137 in the case of spent pool.
  18. NRC, Advisory Committee on Reactor Safeguards, Public meeting, April 9,1999.
  19. World Information Service on Energy (WiseParis), La Hague Particularly Exposed to Plane Crash Risk, Briefing NRA-v4, 26 September 2001;
  20. Les Echos, 13 September 2001, see details in Wise-Paris, op.cit.
  21. Wise-Paris, op.cit.
  22. For more details see and
  23. Robert Alvarez, op.cit.
  24. See details in: George Bunn and Fritz Steinhausler, Guarding Nuclear Reactors and Material From Terrorists and Thieves, Arms Control Today, October 2001.
For more information on this publication: Belfer Communications Office
For Academic Citation: Zhang, Hui. Radiological Terrorism: Sabotage of Spent Fuel Pools.” INESAP: International Network of Engineers and Scientists Against Proliferation, no. 22. (December 2003):