01 Nov 2001 Terrorism and Nuclear Power: What are the Risks? by Gerald E. Marsh and George S. Stanford
Synopsis: In view of how difficult it is to create widespread havoc by attacking nuclear power plants, sophisticated terrorists will not see them as attractive targets. A determined group, however, could cause some disruption and garner a lot of public attention – but they would be unlikely to cause any civilian casualties. Nevertheless, a significant portion of what vulnerability there is could be removed by transferring spent fuel to underground storage at Yucca Mountain.
Is nuclear power’s potential jeopardized by the heightened awareness of the threat of terrorism? The short answer is, “No, because nuclear plants are not attractive targets for terrorists.” There are many targets that would have a higher payoff.
Like other potential targets, nuclear reactors are locked in place – but the spent-fuel storage facilities are not. As discussed below, there is a modest basis for concern relative to those facilities, and there is no fundamental reason why they have to be collocated with reactors. They should be underground. But trying to accomplish that through normal channels would lead to political gridlock. We therefore recommend that the following actions be taken by presidential order:
[1] Storage ponds should promptly be hardened, if at all feasible.
[2] As much spent fuel as possible should be moved into the less vulnerable dry-storage type of cask.
[3] The Yucca Mountain repository should immediately be opened as an interim storage facility, with spent fuel currently in collocated pools moved as quickly as possible to storage pools installed in this secure, underground location. The first pools to be emptied should be the ones that are not below-grade. Moving the spent fuel in “wet” transportation casks would be a very low-risk operation: the casks can withstand severe accidents, although probably not enough are currently available to allow a timely transfer of the relatively large amount of spent fuel now located at reactor sites throughout the country-hence points [1] and [2].
[4] Once the current storage pools have been emptied, the fuel now in surface dry-cask facilities could also be moved to Yucca Mountain.
The public thinks the vulnerability of nuclear plants is much worse than it really is. This creates the potential for widespread panic should these plants or their associated facilities be attacked by terrorists. To make such an event less likely, the suggestions listed above should be put into effect immediately.
There are two classes of reactor accident that have the potential of leading to serious off-site consequences: supercriticality (Chernobyl) and loss of coolant (Three Mile Island). This does not mean that serious consequences are inevitable: at Three Mile Island, where coolant was not completely lost, the off-site release of radioactivity was negligible and there were no casualties, although the utility suffered a significant financial loss and there was some panic due to the lack of credible and timely information on the potential consequences of the accident.
At Chernobyl there was a steam explosion, but it took a persistent graphite fire to inject the radioactivity into the atmosphere. The health consequences of that accident have been grossly exaggerated in the popular press [see endnote ]. Even so, the Chernobyl consequences were much worse than what reasonably could happen in the United States. One reason is that current Western power reactors do not use graphite – there can be no fire, and without a fire there is no plausible way to put such a large amount of radioactivity into the atmosphere, even with a steam explosion that somehow breaches the containment.
Steam explosion. A hypothetical reactor accident that is getting a lot of publicity is a steam explosion that sends the top of the pressure vessel upward through the containment, releasing radioactivity to the atmosphere in a Chernobyl-size disaster. That is a scary scenario, but – as we just pointed out, and for further reasons given below – it is not a realistic one.
The postulated steam explosion must either stem from a major power excursion (“supercriticality”) or come at the end of a chain of events that could only start with complete loss of core cooling. Thus if the terrorists want to have any hope of inflicting off-site damage with a power reactor, they must either cause a reactivity excursion or fully disable all of the reactor’s regular and emergency cooling systems. But even then, as explained below, they would fail to wreak much off-site havoc.
Supercriticality. Achieving gross supercriticality is not as easy as throwing a switch or two to withdraw control rods. The terrorists must first disable a variety of automatic safety systems that will scram the reactor if the power level rises too fast. More obstacles to be overcome, and the consequences of succeeding in that difficult task, are mentioned below.
Loss of cooling. The possibility of an explosion following loss of cooling has been the subject of much research in the United States and the rest of the world for several decades. The current expert consensus is that, while a steam explosion with oxide fuel (the type used in current power reactors) cannot be ruled out as a theoretical possibility, it is highly improbable. This accident is no longer considered realistic by the NRC, even when evaluating “worst case” scenarios.
Attack scenarios and likely outcomes. There are three potential targets at a typical reactor site: the reactor itself, a spent-fuel storage pool, and, in some cases, a dry-cask spent-fuel storage facility. One can imagine various modes of attack against one or the other of the three targets, such as:
1. A truck bomb that explodes beside a critical structure
2. Suicide attack by small aircraft loaded with explosives
3. Frontal assault with small arms
4. Attack with rockets or medium artillery
5. Sabotage of the power lines to and from the plant
6. Infiltration and sabotage from within
7. Suicide crash of a hijacked commercial airliner into the reactor building
8. Suicide crash of a hijacked commercial airliner into spent-fuel storage
Attack Scenario #1: A truck bomb is probably the least effective of the above options. It would be expected to do minimal damage to a reactor containment building or a fuel-storage facility. This would not be a terrorist’s weapon of choice, if he were after more than publicity.
Attack Scenario #2: A small, explosive-laden airplane could be crashed into any of the three targets. Crashing into the reactor containment would do little damage, and the dry-storage casks are highly resistant, being of heavy concrete. Because the airplane can come in from above, it might do some damage to a storage-pool facility, so that is probably the most vulnerable of the three.
However, some years ago General Electric did a comprehensive study of the consequences of a terrorist attack on a fuel-storage pool, using high explosives. The conclusion was that the potential for off-site release of radioactivity was negligible. Even a thousand pounds of high explosive delivered by a small plane crashing into the pool would not seriously disrupt the fuel assemblies, which sit under nine or more feet of water – especially since the explosive would probably be triggered when the plane hit the roof of the building, well above the pool.
Attack Scenario #3: A small-arms assault would give time for an orderly shutdown of the reactor, or at least a scram, and for outside assistance to arrive. From a terrorist’s viewpoint, successful penetration to commit significant sabotage would be very uncertain, at best. In particular, we understand that bringing a shut-down reactor immediately back to full power and beyond would be extremely difficult, if not impossible. See a Attack Scenario #6, below, for more considerations.
Attack Scenario #4: As we understand it, U.S. reactor buildings are designed to absorb an attack by medium artillery without radiological risk to the public. It would take more than a few artillery rounds to penetrate any of the thick concrete structures on a reactor site, and that is before any sensitive components within the buildings are hit. Again, the low probability of causing any harm to the public and the high probability that the perpetrators would be apprehended render this attack mode unlikely to be selected.
Attack Scenario #5. It might be relatively easy to topple the power lines leading into a nuclear plant – in fact, a severe ice storm can have the same effect. For this reason, all nuclear plants have redundant backup systems to permit an orderly shutdown if external power is lost. Specifically, there are two independent, separately-located diesel generator systems, each with enough fuel to provide operational power for thirty days or more. In addition, there are batteries that can provide emergency power long enough to achieve a safe shutdown, with a cushion of some hours to get the diesels restarted.
Thus the first five of the above attack modes are unattractive to terrorists who want to inflict major damage. Even a “successful” attack would cause little more than damage to physical structures at the plant, and perhaps a temporary shutdown of the reactor, but would not in any credible scenario lead to a major radiation release.
The remaining three scenarios deserve more careful consideration, as loss of cooling or supercriticality could occur.
Attack Scenario #6. The primary protection against sabotage from within lies in the stringent clearance and screening procedures that are in place. Nevertheless, a group of technically sophisticated and ruthless infiltrators could do serious damage, if they could disable most or all of the non-collaborating employees (operators, security forces, maintenance technicians, and on-site NRC monitors). Given enough time and materials, such a group could presumably create a criticality accident, or loss of cooling, or both, leading to destruction of the reactor. As far as we know, such an attack cannot be completely ruled out, but it would be many times harder to plan and execute than the World Trade Center attack, and would require far greater technical expertise, along with detailed inside knowledge.
Off-site release of some radioactivity would seem to be a distinct possibility in this scenario, but is by no means assured (as explained above, the Chernobyl dispersal mechanism is not available). The radiological consequences might well be similar to those of TMI – i.e., negligible. Difficulty in infiltrating the power-plant organization, combined with uncertain infliction of major damage, should motivate terrorists to seek easier routes to their goal.
Attack Scenario #7: Nuclear Regulatory Commission News Release No. 01-112 reports that “detailed engineering analyses of a large airliner crash have not yet been performed.” Pending such an analysis, a reasonable speculation is that only a direct hit on the reactor building by one of the heavy engines of the incoming airplane could crack the thick concrete containment. This would require extremely precise guidance of the aircraft by the hijacking pilot. Whether the engine would enter the containment is an open question. Even if it does, the reactor vessel is unlikely to be breached, because it is a heavy steel shell surrounded and protected by thick concrete radiation shielding.
We know of no credible way, in this scenario, that the reactor could go supercritical to cause a steam explosion. The chain reaction would shut down, for a number of reasons, but cooling could be lost. If so, and if, as is likely, the reactor had been operating for some time, the decay heat could melt the core. Since a steam explosion following loss of cooling is unlikely (see Loss of cooling, above), the hot fuel might melt through the reactor vessel after a few hours, and spread out in the substructure, where it would eventually freeze in a subcritical configuration.
Some fraction of the more volatile fission products (such as iodine, cesium, and the noble gases) might escape to the atmosphere. With a timely and orderly evacuation of nearby residents, in accordance with the site’s emergency plan, no serious off-site irradiation of the public should occur.
The burning jet fuel would scarcely aggravate the situation – it would have been distributed over a considerable area, and would have burned off well before the molten reactor fuel penetrated the reactor vessel.
Attack Scenario #8: A jetliner could be crashed into spent-fuel storage. Typically, used reactor fuel is allowed to cool for five or ten years under nine or more feet of water in storage pools, and then, pending final disposition, is transferred to interim dry-cask storage. Both of those facilities tend to be on-site, near the reactor. Such a building, being just one of several low buildings in the complex, would be even trickier for the terrorist-pilot to identify and hit than the reactor containment.
While this event may not yet have been fully analyzed, in light of the World Trade Center disaster, informed speculation can give a reasonable picture of the potential consequences.
The dry casks are made of concrete or thick steel, providing good protection of their contents. If the dry-storage facility were directly hit by the jetliner, a few of those casks might be broken, but the ensuing fire could not disperse a large amount of radioactivity. Nevertheless, local evacuation might be called for. A lesson to be learned from Chernobyl is that the only significant off-site exposure to the public was due to food contaminated with iodine-131, which seeks the thyroid. Since I-131 has a half-life of only eight days, there is very little of it remaining in spent fuel that has been stored for more than a few weeks. Therefore – especially with evacuation of nearby residents – radiological risk to the populace would be very small.
The storage pools are somewhat more vulnerable, although they are not pushovers. For one thing, much of their water would have to be removed if a significant release of radioactivity were to occur, and many such pools are largely below-grade. The burning jet fuel by itself will not remove the water, since it will float on top as it burns, without boiling off much water.
For a limiting, worst-case event, one can visualize the hijackers achieving such a precise hit that the aircraft splashes out most of the water and crushes an appreciable fraction of the fuel elements stored there. Perhaps the shock wave lifts some radioactive debris out of the pool and scatters it near the building. Jet fuel runs into the pool and burns. The fire is not hot enough even to melt the reactor fuel pellets, but radioactive fission products, especially the more volatile ones, could escape from the disrupted fuel assemblies and be transported into the atmosphere by hot gases from the jet-fuel fire.
A local evacuation would undoubtedly be ordered. However, such dispersal of radioactivity from a storage pool would in no way be comparable to what happened at Chernobyl; the stored fuel is five or ten times less radioactive than fuel from an operating reactor, and most important, as mentioned above, the iodine-131 would be largely or entirely missing because of its short half-life. No significant irradiation of members of the public would be expected, the most serious consequences probably being anxiety and possibly panic.
Since the storage-pool building is not nearly as hardened as a reactor containment, a jetliner considerably smaller than a 767 might be sufficient to disrupt it. This fact alone might make the pool a more attractive target than the reactor itself.
Summary: A terrorist assault on a nuclear power plant would attract a lot of attention, and some types of attack could conceivably prompt a limited evacuation. However, the chance of dangerous release of radioactivity to the atmosphere is remote, and there seems to be no credible way that any members of the public could be seriously irradiated. Many easier and more lucrative targets (where damage could be comparable to the World Trade Center disaster) are available for terrorists to attack. Our ultimate protection against terrorism will lie in lack of terrorists, not in scarcity of targets.
Reusing spent reactor fuel in fast reactors is very attractive, because what otherwise would need to be stored for ten thousand years is now consumable fuel. The waste from fast reactors will be much easier to store, since its radioactivity is almost gone in less than 500 years.
The new, pyroprocessed fast-reactor fuel is far more proliferation-resistant than today’s unreprocessed “spent” fuel. In both cases, further chemical processing would be needed to extract the plutonium, but the fuel in a fast-reactor plant with a collocated reprocessor is much more inaccessible. And, in both cases, the resulting reactor-grade plutonium makes very poor bomb material. No nation spending the enormous amount of money needed for a nuclear weapons program would use reactor-grade plutonium – there always are easier options.
Gerald Marsh is a physicist who served with the U.S. START delegation and was a consultant to the Office of the Chief of Naval Operations on strategic nuclear policy and technology for many years. He is an advisory board member of The National Center for Public Policy Research’s John P. McGovern, MD Center for Environmental and Regulatory Affairs.
George Stanford is a nuclear reactor physicist, now retired from Argonne National Laboratory after a career of experimental work pertaining to power-reactor safety.
caused the deaths, within a few days or weeks, of 30 workers and radiation injuries to [a hundred] others. It also brought about the immediate evacuation, in 1986, of about 116,000 people from areas surrounding the reactor and the permanent relocation, after 1986, of about 220,000 people from Belarus, the Russian Federation, and the Ukraine. . . . There have been about 1,800 cases of thyroid cancer in children who were exposed at the time of the accident, and if the current trend continues, there may be more cases during the next decades. Apart from this increase, there is no evidence of a major public health impact attributable to radiation exposure fourteen years after the accident. [Emphasis added]
Reports of tens of thousands of deaths are pure speculation – completely unsupported by any evidence.