Nuclear power plant (NPP) risk assessment is broadly separated into disciplines of nuclear safety, security, and safeguards. Different analysis methods and computer models have been constructed to analyze each of these as separate disciplines. However, due to the complexity of NPP systems, there are risks that can span all these disciplines and require consideration of safety-security (2S) interactions which allows a more complete understanding of the relationship among these risks. A novel leading simulator/trailing simulator (LS/TS) method is introduced to integrate multiple generic safety and security computer models into a single, holistic 2S analysis. A case study is performed using this novel method to determine its effectiveness. The case study shows that the LS/TS method avoided introducing errors in simulation, compared to the same scenario performed without the LS/TS method. A second case study is then used to illustrate an integrated 2S analysis which shows that different levels of damage to vital equipment from sabotage at a NPP can affect accident evolution by several hours.
This report updates the Regional Disruption Economic Impact Model (RDEIM) GDP-based model described in Bixler et al. (2020) used in the MACCS accident consequence analysis code. MACCS is the U.S. Nuclear Regulatory Commission (NRC) used to perform probabilistic health and economic consequence assessments for atmospheric releases of radionuclides. It is also used by international organizations, both reactor owners and regulators. It is intended and most commonly used for hypothetical accidents that could potentially occur in the future rather than to evaluate past accidents or to provide emergency response during an ongoing accident. It is designed to support probabilistic risk and consequence analyses and is used by the NRC, U.S. nuclear licensees, the Department of Energy, and international vendors, licensees, and regulators. The update of the RDEIM model in version 4.2 expresses the national recovery calculation explicitly, rather than implicitly as in the previous version. The calculation of the total national GDP losses remains unchanged. However, anticipated gains from recovery are now allocated across all the GDP loss types – direct, indirect, and induced – whereas in version 4.1, all recovery gains were accounted for in the indirect loss type. To achieve this, we’ve introduced new methodology to streamline and simplify the calculation of all types of losses and recovery. In addition, RDEIM includes other kinds of losses, including tangible wealth. This includes loss of tangible assets (e.g., depreciation) and accident expenditures (e.g., decontamination). This document describes the updated RDEIM economic model and provides examples of loss and recovery calculation, results analysis, and presentation. Changes to the tangible cost calculation and accident expenditures are described in section 2.2. The updates to the RDEIM input-output (I-O) model are not expected to affect the final benchmark results Bixler et al. (2020), as the RDEIM calculation for the total national GDP losses remains unchanged. The reader is referred to the MACCS revision history for other cost modelling changes since version 4.0 that may affect the benchmark. RDEIM has its roots in a code developed by Sandia National Laboratories for the Department of Homeland Security to estimate short-term losses from natural and manmade accidents, called the Regional Economic Accounting analysis tool (REAcct). This model was adapted and modified for MACCS. It is based on I-O theory, which is widely used in economic modeling. It accounts for direct losses to a disrupted region affected by an accident, indirect losses to the national economy due to disruption of the supply chain, and induced losses from reduced spending by displaced workers. RDEIM differs from REAcct in in its treatment and estimation of indirect loss multipliers, elimination of double-counting associated with inter-industry trade in the affected area, and that it is intended to be used for extended periods that can occur from a major nuclear reactor accident, such as the one that occurred at the Fukushima Daiichi site in Japan. Most input-output models do not account for economic adaptation and recovery, and in this regard RDEIM differs from its parent, REAcct, because it allows for a user-definable national recovery period. Implementation of a recovery period was one of several recommendations made by an independent peer review panel to ensure that RDEIM is state-of-practice. For this and several other reasons, RDEIM differs from REAcct.
The Radiation Protection Center (RPC) of the Iraqi Ministry of Environment continues to evaluate the potential health impacts associated with the Adaya Burial Site, which is located 33 kilometers (20.5 miles) southwest of Mosul. This report documents the radiological analyses of 16 groundwater samples collected from wells located in the vicinity of the Adaya Burial Site and at other sites in northern Iraq. The Adaya Burial Site is a high-risk dump site because a large volume of radioactive material and contaminated soil is located on an unsecure hillside above the village of Tall ar Ragrag. The uranium activities for the 16 water samples in northern Iraq are considered to be naturally occurring and do not indicate artificial (man-made) contamination. With one exception, the alpha spectrometry results for the 16 wells that were sampled in 2019 indicate that the water quality concerning the three uranium isotopes (Uranium-233/234, Uranium-235/236, and Uranium-238) was acceptable for potable purposes (drinking and cooking). However, Well 7 in Mosul had a Uranium-233/234 activity concentration that slightly exceeded the World Health Organization guidance level. Eight of the 16 wells are located in the villages of Tall ar Ragrag and Adaya and had naturally occurring uranium concentrations. Wells in the villages of Tall ar Ragrag and Adaya are located near the Adaya Burial Site and should be sampled on an annual schedule. The list of groundwater analytes should include metals, total uranium, isotopic uranium, gross alpha/beta, gamma spectroscopy, organic compounds, and standard water quality parameters. Our current understanding of the hydrogeologic setting in the vicinity of the Adaya Burial Site is solely based on villager's domestic wells, topographic maps, and satellite imagery. To better understand the hydrogeologic setting, a Groundwater Monitoring Program needs to be developed and should include the installation of twelve groundwater monitoring wells in the vicinity of Tall ar Ragrag and the Adaya Burial Site. Characterization of the limestone aquifer and overlying alluvium is needed. RPC should continue to support health assessments for the villagers in Tall ar Ragrag and Adaya. Collecting samples for surface water (storm water), airborne dust, vegetation, and washway sediment should be conducted on a routine basis. Human access to the Adaya Burial Site needs to be strictly limited. Livestock access on or near the burial site needs to be eliminated. The surface-water exposure pathway is likely a greater threat than the groundwater exposure pathway. Installation of a surface-water diversion or collection system is recommended in order to reduce the potential for humans and livestock to come in contact with contaminated water and sediment. To reduce exposure to villagers, groundwater treatment should be considered if elevated uranium or other contaminants are detected in drinking water. Installing water-treatment systems would likely be quicker to accomplish than remediation and excavation of the Adaya Burial Site. The known potential for human exposure to uranium and metals (such as arsenic, chromium, selenium, and strontium) at the Adaya Burial Site is serious. Additional characterization , mitigation, and remediation efforts should be given a high priority.
Nuclear security relies on the method of vital area identification (VAI) to inform the sabotage target locations within a nuclear power plant (NPP) that need to be protected. The VAI methodology uses fault trees (FTs) and event trees (ETs) to identify locations in the NPP that contain vital systems, structures, or components. However, the traditional FT/ET process cannot fully capture the dynamics occurring following NPP sabotage or of mitigating actions. A methodology is presented which examines the consequences of sabotage to NPP systems using the dynamic probabilistic risk assessment approach to explore these dynamics. A force-on-force computer code determines the timing and extent of damage to NPP systems and a reactor response code models the effects of this damage on the reactor. These two codes are connected using the novel leading simulator/trailing simulator (LS/TS) methodology. A case study is created using the LS/TS methodology to model an adversary attack on an NPP. This case study models uncertainties in an adversary attack and in the response to determine if reactor core damage would occur, and the time to core damage, as well as the extent of core damage, if damage occurs.
Vital Area Identification (VAI) is an important element in securing nuclear facilities, including the range of recently proposed advanced reactors (AR). As ARs continue to develop and progress to licensure status, it will be necessary to ensure that safety analysis methods are compatible with the new reactor designs. These reactors tout inherently passive safety systems that drastically reduce the number of active components whose failures need to be considered as basic events in a Level 1 probabilistic risk assessment (PRA). Instead, ARs rely on natural processes for their safety, which may be difficult to capture through the use of fault trees (FTs) and subsequently difficult to determine the effects of lost equipment when completing a traditional VAI analysis. Traditional VAI methodology incorporates FTs from Level 1 PRA as a substantial portion of the effort to identify candidate vital area sets. The outcome of VAI is a selected set of areas deemed vital which must be protected in order to prevent radiological sabotage. An alternative methodology is proposed to inform the VAI process and selection of vital areas: Systems-Theoretic Process Analysis (STPA). STPA is a systems-based, top-down approach which analyzes a system as a hierarchical control structure composed of components (both those that are controlled and their controllers) and controlled actions taken by/acted upon those components. The control structure is then analyzed based on several situational parameters, including a time component, to produce a list of scenarios which may lead to system losses. A case study is presented to demonstrate how STPA can be used to inform VAI for ARs.
Domestic nuclear power is facing increased financial pressures from a variety of areas and there is pressure on these utilities to reduce their cost of operation. Currently, about 20%-30% of all on-site personnel are related to physical security. The LWRS Program recognized that R&D related to physical security could play a role in providing nuclear utilities technical and staffing efficiency options to meet their physical security commitments, but utilities often lack the technical basis or the ability to create the technical basis to realize or implement these efficiencies; towards this end, the LWRS Program created the Physical Security Pathway in September 2019. The pathway performs R&D to develop methods, tools, and technologies to optimize and modernize a nuclear power facility’s security posture. The pathway will: (1) conduct research on risk-informed techniques for physical security that account for a dynamic adversary; (2) apply advanced modeling and simulation tools to better inform physical-security scenarios and reduce uncertainties in force-on-force modeling; (3) assess benefits from proposed enhancements and novel mitigation strategies and explore changes to best practices, guides, or regulation to enable modernization; and (4) enhance and provide the technical basis for stakeholders to employ new security methods, tools, and technologies.
The design and construction of a nuclear power plant must include robust structures and a security boundary that is difficult to penetrate. For security considerations, the reactors would ideally be sited underground, beneath a massive solid block, which would be too thick to be penetrated by tools or explosives. Additionally, all communications and power transfer lines would also be located underground and would be fortified against any possible design basis threats. Limiting access with difficult-to-penetrate physical barriers is a key aspect for determining response and staffing requirements. Considerations considered in a graded approach to physical protection are described.
Nuclear power plants must be, by design and construction, robust structures and difficult to penetrate. Ideally, for security, the reactors would be sited underground, beneath a massive solid block, too thick to be penetrated by tools or explosives with all communications and power transfer lines also underground and fortified. Limiting access with difficult-to-penetrate physical barriers is going to be key for determining response and staffing requirements.
Nuclear power plants must be, by design and construction, robust structures and difficult to penetrate. Limiting access with difficult-to-penetrate physical barriers is going to be key for staffing reduction. Ideally, for security, the reactors would be sited underground, beneath a massive solid block, too thick to be penetrated by tools or explosives with all communications and power transfer lines also underground and fortified. Having the minimal possible number of access points and methods to completely block access from these points if a threat is detected will greatly help us justify staffing reduction.
The MACCS (MELCOR Accident Consequence Code System) code is the U.S. Nuclear Regulatory Commission (NRC) tool used to perform probabilistic health and economic consequence assessments for atmospheric releases of radionuclides. It is also used by international organizations, both reactor owners and regulators. It is intended and most commonly used for hypothetical accidents that could potentially occur in the future rather than to evaluate past accidents or to provide emergency response during an ongoing accident. It is designed to support probabilistic risk and consequence analyses and is used by the NRC, U.S. nuclear licensees, the Department of Energy, and international vendors, licensees, and regulators. This report describes the modeling framework, implementation, verification, and benchmarking of a GDP-based model for economic losses that has recently been developed as an alternative to the original cost-based economic loss model in MACCS. The GDP-based model has its roots in a code developed by Sandia National Laboratories for the Department of Homeland Security to estimate short-term losses from natural and manmade accidents, called the Regional Economic Accounting analysis tool (REAcct). This model was adapted and modified for MACCS and is now called the Regional Disruption Economic Impact Model (RDEIM). It is based on input-output theory, which is widely used in economic modeling. It accounts for direct losses to a disrupted region affected by an accident, indirect losses to the national economy due to disruption of the supply chain, and induced losses from reduced spending by displaced workers. RDEIM differs from REAcct in its treatment and estimation of indirect loss multipliers, elimination of double counting associated with inter-industry trade in the affected area, and that it is designed to be used to estimate impacts for extended periods that can occur from a major nuclear reactor accident, such as the one that occurred at the Fukushima Daiichi site in Japan. Most input-output models do not account for economic adaptation and recovery, and in this regard RDEIM differs from its parent, REAcct, because it allows for a user-definable national recovery period. Implementation of a recovery period was one of several recommendations made by an independent peer review panel to ensure that RDEIM is state-of-practice. For this and several other reasons, RDEIM differs from REAcct. Both the original and the RDEIM economic loss models account for costs from evacuation and relocation, decontamination, depreciation, and condemnation. Where the original model accounts for an expected rate of return, based on the value of property, that is lost during interdiction, the RDEIM model instead accounts for losses of GDP based on the industrial sectors located within a county. The original model includes costs for disposal of crops and milk that the RDEIM model currently does not, but these costs tend to contribute insignificantly to the overall losses. This document discusses three verification exercises to demonstrate that the RDEIM model is implemented correctly in MACCS. It also describes a benchmark study at five nuclear power plants chosen to represent the spectrum of U.S. commercial sites. The benchmarks provide perspective on the expected differences between the RDEIM and the original cost-based economic loss models. The RDEIM model is shown to consistently predict larger losses than the original model, probably in part because it accounts for national losses by including indirect and induced losses; whereas, the original model only accounts for regional losses. Nonetheless, the RDEIM model predicts losses that are remarkably consistent with the original cost-based model, differing by 16% at most for the five sites combined with three source terms considered in this benchmark.
Growing interest in compact, easily transportable sources of baseload electricity has manifested in the proposal and early deployment of portable nuclear reactors (PNRs). PNRs are sought because they are scalable, efficient, and cost-effective for meeting energy demands in unique, remote, or contested areas. For example, Russia's KLT-40S Akademik Lomonosov is a floating nuclear power plant (FNPP) that successfully reached the Arctic coastal city of Pevek. It began providing power to the local grid in December 2019. While providing such key advantages as having a highly flexible power generation mechanism, FNPPs appear to directly challenge international norms and conventions for nuclear safety, safeguards, and security. FNPPs are neither a purely fixed nuclear fuel cycle activity nor a purely transportation-based nuclear fuel cycle activity. In response, Sandia's Mitigating International Nuclear Enogy Risks (MINER) research perspective frames this discussion in terms of risk complexity and the interdependencies between safety, safeguards, and security in FNPPs, and PNRs more generally. This systems study is a technically rigorous analysis of the safety, safeguards, and security risks of FNPP technologies. This research's aims are three-fold. The first aim is to provide analytical evidence to support safety, safeguards, and security claims related to PNRs and FNPPs (Study Report Volume I). Second, this study aims to introduce a systems- theoretic approach for exploring interdependencies between the technical evaluations (Study Report Volume II). The third aim is to show Sandia's ability for prompt, rigorous, and technical analysis to support emerging complex MINER mission objectives.
Risk assessment of nuclear power plants (NPPs) is commonly driven by computer modeling which tracks the evolution of NPP events over time. To capture interactions between nuclear safety and nuclear security, multiple system codes each of which specializes on one space may need to be linked with information transfer among the codes. A systems analysis based on fixed length time blocks is proposed to allow for such a linking within the ADAPT framework without needing to predetermine in which order the safety/security codes interact. A case study using two instances of the Scribe3D code demonstrates the concept and shows agreement with results from a direct solution.
The LWRS Program Physical Security Pathway held the first meeting of the Physical Security Stakeholder working group on September 10-12, 2019 at Sandia National Laboratories. This working group is comprised of nuclear enterprise physical security stakeholders and the meeting included over 10 Utilities representing roughly 60 nuclear power plants, two staff from the Nuclear Regulatory Commission, physical security vendors, the Nuclear Energy Institute, the Electric Power Research Institute, and staff from Sandia National Laboratories and Idaho National Laboratory. The working group was established with the objectives of providing stakeholder feedback to the LWRS Program on their research and development needs and priorities, socializing the progress of Physical Security Pathway initiatives, and identifying opportunities for additional engagement and participation of stakeholders in the pathway research activities. The working group also provided a forum for physical security professionals to share common experiences and recommend prioritized activities based on their common needs.
This document details the development of modeling and simulations for existing plant security regimes using identified target sets to link dynamic assessment methodologies by leveraging reactor system level modeling with force-on-force modeling and 3D visualization for developing table-top scenarios. This work leverages an existing hypothetical example used for international physical security training, the Lone Pine nuclear power plant facility for target sets and modeling.
This document details the development of modeling and simulations for existing plant security regimes using identified target sets to link dynamic assessment methodologies by leveraging reactor system level modeling with force-on-force modeling and 3D visualization for developing table-top scenarios. This work leverages an existing hypothetical example used for international physical security training, the Lone Pine nuclear power plant facility for target sets and modeling.