Lyman -- INMM Paper 1999 -- Physical Protection

Edwin S. Lyman, Nuclear Control Institute

1000 Connecticut Ave. NW, Washington, DC 20036 USA (202) 822-8444

Presented at the 40^th Annual Meeting of the Institute of Nuclear Materials Management,

Phoenix, AZ, July 1999

Abstract

The Clinton Administration has proposed a $10 billion program to counter the growing threat of terrorism. However, it is paying little attention to the risk of radiological sabotage, even though shipments of spent nuclear fuel (SNF) are projected to increase dramatically within the next decade, and current U.S. standards for the physical protection of SNF transports have not changed substantially since the early 1980s.

In 1979, as a result of a Sandia National Laboratories (SNL) study that predicted serious radiological consequences from SNF transport cask sabotage in a densely populated urban area, the Nuclear Regulatory Commission issued an interim rule (10 CFR 73.37) which specified that SNF transport routes should avoid such areas "where practicable." In 1980, the rule was amended to permit transit of SNF through heavily populated areas with an armed escort. This change was informed by research which showed that the releases of material resulting from a design-basis shaped charge attack on a SNF cask would be smaller than originally thought. In 1984, NRC issued a proposed rule that would have weakened the regulation further by removing the requirement for an armed escort through heavily populated areas. However, the proposal received severe criticism and the rulemaking was never completed.

A recent study by SNL describes two-stage attacks on transport casks which, with certain modifications, could lead to much larger radionuclide releases. A review should be conducted to assess whether the current regulations provide adequate protection against the threat of such attacks.

Introduction

The Clinton Administration has recently announced major new initiatives to combat the threat of terrorism utilizing weapons of mass destruction (WMD). However, the emphasis has been on the use of biological and chemical agents. There has been no visible effort to review and upgrade existing measures aimed at preventing the occurrence of a terrorist attack resulting in a radiological release. In fact, with regard to the risk of radiological sabotage, the bureaucracy seems to be moving in the opposite direction.

Late in 1998, as a result of pressure from the nuclear industry, Nuclear Regulatory Commission (NRC) staff terminated a program known as the Operational Safeguards Response Evaluation (OSRE), which tested the abilities of nuclear power plant security forces to repel terrorist assaults aimed at core damage and radiological release. Although the program was quickly reinstated by former NRC Chairman Shirley Jackson following reports in the media of the termination, the industry and NRC staff have continued their efforts to relax physical protection requirements which they view as excessively burdensome.[1]

Given these circumstances, the public has legitimate reason to be concerned about the depth of the commitment of NRC and the nuclear industry to maintaining a rigorous regime for protection of potential targets for radiological sabotage, which include both operating nuclear plants and highly radioactive materials in transit or storage. At the same time that nuclear plant operators are under unprecedented pressure to reduce costs, including the cost of security and safeguards, the terrorist threat appears to be expanding in breadth and lethality.

Physical protection programs are nominally designed to protect against "design basis" threats (DBT). A credible security plan depends critically on selection of a DBT that is sufficiently realistic and conservative to represent a wide range of contemporary threats. However, it is not clear that this is the case for the DBTs in current use by NRC. While sensitive details of DBTs are not available to the public for security reasons, those details that are publicly available lead one to question their adequacy. For instance, it is known that the size of the attacking force specified in the DBT for sabotage of a nuclear power plant is smaller than that specified in the DBT for a Category I facility containing special nuclear material (SNM). While theft of SNM could potentially be more catastrophic than sabotage of a nuclear facility, both types of event could have devastating physical and psychological impacts on the public.

Physical Protection Regulations for Transport of Irradiated Materials

On June 24, 1999, the Attorney General for the State of Nevada sent a petition to NRC requesting a rulemaking to review and strengthen the regulations for physical protection of spent nuclear fuel (SNF) contained in 10 CFR Part 73.[2] This petition was based largely on an extensive and generally excellent analysis commissioned by Nevada in 1997.[3] Given Nevada's interest in making the transport of SNF to an interim storage or geologic disposal site at Yucca Mountain as difficult and costly as possible, the political motivations for this action are apparent. Nonetheless, the petition raises serious issues concerning the adequacy of the current regulations and has considerable merit.

The current NRC regulations for physical protection of SNF transport originated in 1979 as "interim" measures and have never been finalized.[4] They were instituted in response to the results of a 1978 Sandia National Laboratory draft study ("The 1978 Urban Study"), which estimated the consequences of a successful sabotage attack on a truck cask containing 3 pressurized-water reactor (PWR) spent fuel assemblies in a densely populated urban area. The 1978 Urban Study projected that tens of early fatalities (EF) (from acute radiation exposure) and hundreds to thousands of latent cancer fatalities (LCFs) could result from such an attack. These projections were sufficiently severe that NRC decided to immediately implement an interim rule without first soliciting public comment, pending the results of further confirmatory research.

The "interim final rule" established in 1979 included requirements such as advance NRC notification and approval of spent fuel shipment routes, coordination with local law enforcement on emergency plans, specifications for the number and training of (unarmed) escorts and an immobilization capability for vehicles carrying spent fuel by road. Of particular note was a requirement that the shipment route should be "planned to avoid, where practicable, heavily populated areas." NRC considered this statement to be an effective embargo on shipments of spent fuel through densely populated urban areas.

In 1980, NRC published amendments to the 10 CFR 73 interim final rule which "reduced the stringency of the required physical protection measures," according to a 1982 SNL report.[5] These were issued in response to public comments and to a revised version of the SNL 1978 Urban Study ("The 1980 Urban Study") which projected consequences of an urban sabotage incident that were about a factor of ten lower than those in the first version, primarily as a result of assuming a 14-fold smaller release fraction of respirable particulates from the cask (0.07% instead of 1%).[6] As a result, NRC removed the effective embargo on SNF shipments through heavily populated areas, but required that such shipments be accompanied by an armed escort.

In 1984, NRC attempted to weaken physical protection regulations even further by issuing a proposed rule that would have removed the armed-escort requirement for SNF shipments through heavily populated areas.[7] The basis for this was "research recently completed [that] has shown that the likely respirable release from sabotage and the resulting consequences are but a tiny percentage of the estimated values which originally prompted issuance of the rule." The research referred to was a series of tests in the early 1980s undertaken by SNL of the effect of shaped charge attacks on typical SNF truck casks at that time.[8]

The 1984 proposed rule received a great deal of negative comment and the rulemaking was ultimately suspended, leaving the interim final rule in place.[9] However, the claims underlying the proposal --- that spent fuel casks are relatively invulnerable to terrorist attack and that consequences of such an attack would be extremely limited, even in densely populated urban areas --- has become established wisdom. This situation, unfortunately, may be contributing to unjustified complacency about the potential threat posed by SNF shipments. The State of Nevada's call for a full reevaluation of the technical basis for the existing regulations is clearly warranted.

The threat evaluated by SNL and NRC in the early 1980s involved a single shaped charge attack on a spent fuel shipping cask containing a surrogate SNF assembly composed of depleted uranium. The shaped charge jet penetrated the wall (4.5 cm of stainless steel and 21.3 cm of lead), perforated 50% of the fuel rods and shattered the solid fuel in its path. In addition, it caused the temperature of the fuel mass to rise to greater than 1744C.

The basis for the NRC's contention that the consequences of such an attack are limited stems from the observation that although the cask was penetrated and the SNF was damaged, only a relatively small amount of fuel was actually shattered by the jet, and only a small fraction of the material that was released was small enough to be respirable (less than 10 microns in diameter). The experiments showed that only 4.3x10^-6 of the solid fuel was released in the form of respirable aerosol, corresponding to a release of only 6 grams of depleted uranium oxide from a truck cask containing three SNF assemblies (1.4 tonnes heavy metal). This quantity was then multiplied by 5.6 to adjust for the fact that the experiments used fresh fuel and not spent fuel, based on small-scale correlation experiments. The peak consequences of this release in a densely populated urban area like New York City were found to be zero EFs and seven LCFs.

The question of whether the scenario outlined above is a realistic representation of the contemporary sabotage threat has been the focus of much criticism and is one of the chief concerns raised in the State of Nevada's petition. Here we will focus on two of the many technical issues.

a) The source term extrapolated from the SNL experiments is inaccurate and non-conservative.

The derivation of the single shaped-charge attack source term from the SNL experiments is inaccurate. SNL assumed, in extrapolating from results for fresh fuel to those for spent fuel, that the source term would consist only of two components: the noble gas inventory of the breached fuel rods and the fraction of the solid fuel observed to form a respirable aerosol. Sandia, however, neglected to consider the fuel-cladding gap fraction of semivolatile radionuclides such as tellurium (Te), antimony (Sb) and cesium (Cs), even though at the elevated temperature that was observed one would expect the entire gap inventory of Cs and most of that for Te and Sb to be released in gaseous form from breached fuel rods. In addition, the high temperature would likely have caused further releases of cesium trapped on grain boundaries.

Although SNL acknowledged that enhanced releases of semivolatiles would occur at that temperature, it argued that "these radionuclides are less biologically significant than the actinides and the resultant calculated dose increase would not affect the overall risk estimate." We have conducted an analysis (see below) that shows this is not the case. The gap fraction of Cs isotopes is on the order of 1% of the total fuel rod inventory. In addition, gap releases from spent fuel irradiated to the high burnups experienced today exhibit greater gap releases when punctured. A recent Brookhaven National Laboratory (BNL) study evaluated the consequences of spent fuel pool accidents in which releases of semivolatiles in the gap took place.[10] The Cs gap release fraction from overheated high-burnup fuel in the absence of fire was estimated as 3%.

b) Sabotage scenarios which could lead to a significant enhancement of the release of respirable particles were not adequately considered.

The sabotage scenario which NRC considered in its original rulemaking for the physical protection of SNT transports involved only a one-stage attack using a single shaped charge. The radionuclide release resulting from this scenario was therefore limited to that caused by the initial cask breach and fuel rod damage. However, they did not carry out an adequate assessment of relatively simple measures that an attacker might use to greatly enhance the respirable release from the cask once breached.

NRC stated in its 1984 proposed rule that it considered the possibility that "an adversary could use more than one shaped charge in attacking the cask" and concluded that "the likely result is that the release would be in proportion to the charges used." It said further that "there is no known technology that would allow a disproportionately large increase in production of respirable particles with credible increase in a saboteur's explosive resources."

Even if the amount of radionuclide release were linearly proportional to the number of shaped charges, it is clear from the calculation below that a doubling or tripling of the release could result in additional thousands of LCFs in densely populated areas. However, there are, without a doubt, credible means by which a terrorist could cause an increase in respirable release by an order of magnitude or more.

It is not hard to envision ways to do this. A good example is derived from a 1996 SNL study (the "Red Team Report"), which describes a scenario by which terrorists intercept a shipping cask containing canisters of vitrified high-level waste which themselves contain small cans of immobilized plutonium.[11] The report describes a two-stage attack in which terrorists use a shaped charge to penetrate the lid of the shipping cask, and then inject a low-explosive charge to blow off the lid and facilitate the theft of the canisters within without damaging them. This was intended as a credible theft scenario. However, the same analysis suggests a credible sabotage scenario in which high explosive instead of low explosive is injected, with the objective of causing maximum (rather than minimum) damage to the cask contents.

It is certainly straightforward to conclude that a two-stage attack, as outlined above, could be devised to cause the generation and release of a considerably larger amount of respirable material than a one-stage attack utilizing only a single shaped charge.

This issue was raised by the Nuclear Control Institute when a sea shipment of vitrified high-level waste en route from France to Japan traversed the Panama Canal in 1998. (The ship was boarded by Greenpeace at one end of the Canal, demonstrating that the shipment's security arrangements were not adequate even to protect against interception by non-violent activists.) Subsequently, one of the authors of the Red Team Report, John Hinton, testified for a lawsuit in Puerto Rico that the observation in the Red Team Report "does not support and was not meant to support a conclusion" that storage and transport casks for vitrified high-level waste "were vulnerable to credible threats of radiological sabotage."[12]

However, such a statement violates common sense. If SNL concluded that a shipment could be intercepted, a cask could be penetrated, the lid could be removed with low explosive and the canisters could be safety retrieved, then one is led to conclude that sabotage scenarios are also plausible, especially since they can be simpler (for instance, an escape plan would be unnecessary on a suicide mission).

There does not appear to be data in the open literature regarding the fragmentation behavior of spent fuel to which high explosives have been directly applied. It is well known that direct application of explosives to ceramic fragments generally cause a reduction in the average particle size of the fragments. However, the heating that occurs during the explosion can cause sintering and an increase in particle size as well, depending on the properties of the ceramic. Such information is clearly relevant to an assessment of the consequences of such an action. Therefore, there is a need for experiments of this type, and SNL should be tasked to do them.

A less sophisticated but also effective approach to increasing radionuclide release from a breached SNF cask would be to inject fuel into the cavity and start a fire. This would cause ignition of the Zircaloy cladding, and at a minimum would greatly enhance the release of cesium and other semivolatile elements that remain in the fuel pellets. The BNL spent fuel pool study assumed that 100% of the fuel Cs inventory would be released. Recent results from France indicate that heating at 1500C of high-burnup spent fuel for one hour caused the release of 26% of the Cs inventory.[13]

We performed a consequence assessment using the MACCS2 code[14] for the three source terms given in Table I.

TABLE I Source Terms For Consequence Calculations

source term

Radionuclide release fractions

Sr/Ba

S1: no Cs,Te

gap release

S2: low Cs,Te

gap release

S3: high Cs,Te

gap release

0.34

1.0

2.4E-5

1.0E-2

1.0

2.4E-5

1.0E-2

2.5E-1

2.4E-5

3.6E-4

2.0E-2

2.4E-5

2.0E-3

2.4E-5

8.0E-5

2.4E-5

The first source term in Table I is the one used by Sandoval, et al. (1983). The second is the same source term with an additional contribution from the semivolatile gap fraction released from the fraction of the fuel rods SNL expected would be breached (to take cesium as an example, a 3% gap fraction multiplied by 0.34 yields 0.0102). The third source term represents the releases caused by a high-temperature fire following the initial explosion, and is based on BNL fire release estimates (except for Cs, for which we judged a lower release fraction to be appropriate).

The cask inventory was based on a truck cask carrying 4 ten-year-old PWR assemblies, each with a burnup of 50,000 MWD/t. The inventory was generated using the ORIGEN-S module of the SCALE 4.3 code.

The consequences of a successful attack in an urban area of very high population density were estimated for the three source terms in Table I. Statistical sampling of atmospheric conditions was used in the MACCS calculations. The population distribution was the same as that used by SNL in Sandoval, et al. (1983), which is meant to be representative of a densely populated urban area like New York City (39,000 persons/km² within 10 km of the accident, steadily decreasing to 380 persons/km² between 50 and 88 km from the accident). Results of the calculations are presented in Table II.

TABLE II Consequences of Sabotage Events

LCFs within 80 km (mean/max)

Economic Costs (million US$)

Source term:

34 / 77

1,480 / 3,880

7,120 / 15,500

5000

51,000

The calculations indicated that for the source term with no semivolatile gap fraction, about 35 latent cancer fatalities (LCFs) would result among the population within 80 km of the accident, which is consistent with the estimate of 4 LCFs (mean) given by Sandoval, et al. (1983), considering the former result is twenty years old and used a now-obsolete code based on radiation risk estimates that have been since revised upward. However, when the gap release source term is considered, the estimate jumps to nearly 1,500 LCFs, which is on the order of the results which led NRC to issue the interim embargo against SNF shipments through urban areas in 1979. Therefore, the original neglect of the semivolatile gap fraction resulted in an underestimate of the consequences of the shaped-charge attack by a factor of 40.

The calculated consequences of the S3 source term show that casualties can be further increased by a factor of five by relatively simple means, such as setting a fire.

No early fatalities from acute radiation exposure were predicted for any of the source terms. This was expected because most of the radionuclides associated with high acute exposures would have decayed to very low concentrations in 10-year-old SNF.

Conclusions

The apparent lack of concern among government authorities regarding the threat of radiological sabotage of transports of highly irradiated materials is unwarranted. A new analysis of the radiological releases resulting from the breaching of a SNF truck cask with a shaped charge demonstrates that the original consequence predictions that led NRC to impose an embargo on SNF shipments in 1979 --- hundreds to thousands of latent cancer fatalities --- are indeed valid. Moreover, even greater consequences can be engineered by determined terrorists without expending significantly greater effort. Consequently, the petition of the State of Nevada to re-examine the physical protection regulations for SNF transports should be favorably regarded, and NRC should consider reimposing the embargo on SNF shipments through urban areas or substantially increasing the protection requirements for such shipments.

To support this effort, Sandia National Laboratories should undertake a new research effort to develop more accurate and realistic release fractions from cask sabotage events. These experiments should be based on credible terrorist attacks with the goal of maximizing respirable particle release.

The Nuclear Control Institute will continue to work vigorously to ensure that stringent physical protection measures are maintained (or strengthened where appropriate) on all nuclear facilities and transports that could serve as targets of radiological sabotage. Otherwise, the current exclusive emphasis on chemical and biological attack may well invite terrorist attacks on nuclear materials or facilities as a result of a perception that they are "soft" targets.

References