- Email: [email protected]
Analytic study for physical protection system (PPS) in nuclear power plants (NPPs)
Nuclear Engineering and Design 265 (2013) 932–937
Contents lists available at ScienceDirect
Nuclear Engineering and Design journal homepage: www.elsevier.com/locate/nucengdes
Analytic study for physical protection system (PPS) in nuclear power plants (NPPs) Tae Ho Woo ∗ Department of Nuclear Engineering, Seoul National University, 1 Gwanak-ro, Gwanak-gu, Seoul 151-742, Republic of Korea
h i g h l i g h t s • • • •
The physical protection system (PPS) is investigated. General NPPs are modeled in the study. Possible terror cases, likelihood, and consequence are studied. PPS is constructed by analytical methods.
a r t i c l e
i n f o
Article history: Received 28 April 2013 Received in revised form 31 August 2013 Accepted 19 September 2013
a b s t r a c t The nuclear safeguard is analyzed in the aspect of the physical protection system (PPS) in nuclear power plants (NPPs). The PPS is reviewed and its related terror scenarios are investigated. The PPS is developed using analytical methods. In the terror scenarios, there are 8 possible cases for the terror attacks to the NPPs. Then, the likelihood of terror is classified by the general terror incidents. The consequence of terror is classified by Design Basis Threat (DBT) of the International Atomic Energy Agency (IAEA) scale. The physical protection method is suggested by defense-in-depth constraints and severe accident countermeasures. Finally, the advanced PPS is constructed, which could be used for the preparation for the possible terror attacks in the NPPs. © 2013 Elsevier B.V. All rights reserved.
1. Introduction The commercial nuclear power plants (NPPs) are operated normally, if any kinds of accidents by the terror or sabotage are not happened, because the well equipped safety systems of NPPs could continue the normal operations. Hence the analysis of terror or sabotage in physical protection system (PPS) of NPPs’ security is important in the country like the Republic of Korea where the military enemy is under confliction. As it is seen in Fukushima accident at March 11, 2001, the NPPs can produce steam explosion, radioactive material release, and international panics by the natural disaster like the earthquake. This caused the national economic stagnation and international anti-nuclear movement. The suicide airplane crash terror to the World Trade Center (WTC) and the Department of Defense (DOD) building provoked panics and worries, which happened in September 11, 2001. If this terror happened in NPPs, much more horrible results could be produced.
∗ Tel.: +82 2 880 8337; fax: +82 2 889 2688. E-mail address: [email protected] 0029-5493/$ – see front matter © 2013 Elsevier B.V. All rights reserved. http://dx.doi.org/10.1016/j.nucengdes.2013.09.025
It is necessary to estimate the stability of the plant security by the monitoring systems for NPPs. Serious attack like the terror or sabotage is not notified before an incident. So, it is needed to analyze by indirect method like the terror or sabotage related algorithm. The Design Basis Threat (DBT) has been introduced for the terror or sabotage case which was constructed as the similar concept to the Design Basis Accident (DBA). It was also analyzed that the safeguards meant the regulations of the related systems. The safeguard regulations had been prepared simultaneously with the commercial NPPs business from the mid 20th century. It is very important to study analytically in order to strengthen the safeguard of NPPs’ terror. That is, it is necessary to analyze how the terror and sabotage can happen in normal operation and how to prepare. This could be estimated by the analytic method based on the opinions of experts. The purpose of the safeguard was that the trade did not go to the supply of nuclear bombs and the importance of the perceptions is that pending nuclear disarmament, world security is better served with fewer rather than more nuclear weapons and nuclear weapon states (IAEA, 2004). The DBT has been introduced to make the protections of NPPs. DBT is the response against the potential threat in which the radiation sabotage, theft, and usage could be done against the PPS and this is a part of section 73.1 of the Code of Federal Regulations Title
T.H. Woo / Nuclear Engineering and Design 265 (2013) 932–937
933
Fig. 2. Physical protection system.
Fig. 3. Directions of terror attacks.
Fig. 1. Flowchart of study.
10 (10 CFR) in Nuclear Regulatory Commission’s (NRC’s) regulations after 1979 (US NRC, 2012). In addition, the INFCIRC/225/Rev. 4 (Corrected) of nuclear material and facility describes the DBT following the International Atomic Energy Agency (IAEA), which was made in 1999. The object is to describe the reason, intention, and positional possibility against the production and estimation of protection system (IAEA, 2009). The major objects of DBT are impure individual and group in internal and external part, material lost and sabotage, prohibited actions, PPS related arms, utensil, technology, design and estimation of DBT, etc. (IAEA, 2012a). Although this study has a difficulty in finding the internal NPPs, the large scale light water reactor (LWR) near seashore is modeled. The terror scenarios could be obtained by literature survey and expert opinions. The likelihood, consequence, and PPS for terrors can be studied. In the past studies, Borrelli studied that High Reliability Safeguards (HRS) approach in a series of quantitative modeling efforts to develop methodologies for demonstrating the safeguardability of these facilities (Borrelli, 2013). In addition, Park et al. worked for a graded approach to cyber security in a research reactor facility (Park et al., 2013). The object of the study is how to construct the protections in NPPs where the analytic method is done. There are 8 exampled terror cases, likelihoods, and consequences which are analyzed and the strategies are introduced. Since terror cases in NPPs are prohibited to open to public following DBT, the previous general terror cases are considered as the likelihood investigation. The consequences are estimated by the damage of power lines, psychological panic disorder, and so on. The strategy of protection is done by detection, delay, and response of PPS. The flowchart of study is shown in Fig. 1. There is the background for the modeling which is shown in Section 2. Section 3 explains the method of the study.
Section 4 describes results of the study. There are some conclusions in Section 5. 2. Background In order to investigate the terror cases which are related with the PPS, the possible events are considered. There are 3 kinds of classifications in PPS which are in Fig. 2 (Rico and Beasley, 2006). There are 8 possible scenarios for the terror attacks to the NPPs incorporate with a report (NCPA, 2001). Fig. 3 shows the directions of terror attacks. There are 3 ways as land, sea, and air. In the terror scenarios, the 8 possible scenarios are considered for the terror attacks to the NPPs with several subjectively modified applications (NCPA, 2001). There is a list of terror scenarios in Table 1. These scenarios are analyzed in this study. The contents are as follows: Table 1 List of terror scenario. Sort
Number
Event
Explosion
1
A truck bomb
Armed attack
2 3
Attack by boat Suicide attack by small aircraft Frontal assault with small arms Attack with rockets or medium artillery
4 5 Etc.
6 7 8
Sabotage to the power lines Infiltration and sabotage Suicide crash to the reactor building or spent-fuel storage by airliner
934
T.H. Woo / Nuclear Engineering and Design 265 (2013) 932–937
Table 2 Situation of world terror occurrence.
1 2 3 4 5 6 7 8
Sort
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
Explosion Armed attack Etc.
209 222 2
334 281 9
487 323 2
1111 548 29
1569 1030 45
1649 1510 13
1630 1343 10
1680 1486 14
1664 946 88
1768 1302 110
A truck bomb Attack by boat Suicide attack by small aircraft Frontal assault with small arms Attack with rockets or medium artillery Sabotage to the power lines Infiltration and sabotage Suicide crash to the reactor building or spent-fuel storage by airliner
The nuclear terror is analyzed by the aspect of nuclear bomb manufacturing. Nuclear weapons are inherently terrifying due to their lethality (PROS, 2012). The nuclear, chemical, and biological stuffs have been tried to be used in the terrorist related groups. It is said that the nuclear terrorism is initiated from buying the nuclear bomb in the black market or stealing for the nuclear facilities like the NPPs. In the past time, the terrorist organizations and individuals have attempted to make use of the biological weapons which could produce the destructions. The notorious incident, the anthrax letter attacks in the United States showed the public and social confusions widely. Especially, the nuclear terror is a method of attacking to NPPs, stealing nuclear material from NPPs, and producing nuclear bombs by the nuclear material like the Pu-239 or Pu-241.
3. Method These 8 kinds of terror scenarios are analyzed to examine the dangerousness which is analyzed by modified terror consequence and defense-in depth level of terror attacks to nuclear power plants. There are 8 possible cases for the terror scenarios in the exampled NPP.
3.1. Scenario #1: a truck bomb It is considered that the truck bomb could affect on the external part of the site and the least damage on the reactor containment building and nuclear fuel storage facility. Hence, it is less dangerous than the other scenarios. If the terrorist would like to select the crucial method with this method, it is needed to prepare against the possible attack.
Total 12,101 8991 322
3.3. Scenario #3: suicide attack by small aircraft This case could be a stronger method to the reactor building, dry storage cask and nuclear fuel storage pool by aircraft crash method (NCPA, 2001). The most plausible target is nuclear fuel storage pool by airplane collision. According to General Electric’s study, although several thousand bomb installed crash would be happened, the radioactive material contaminations are negligible (NCPA, 2001). 3.4. Scenario #4: frontal assault with small arms With small arms, the NPP could be attacked by the terrorists. Once this case happens, the site is in emergency situation and the secure procedures are in action. The plant is in maximum alert states by Trip and Shutdown methods in order to stop the operations. This case is considered less dangerous than the case of ‘infiltration and sabotage’ and ‘suicide crash to the reactor building or spent-fuel storage by airliner’, because the containment building can withstand against the small arms. 3.5. Scenario #5: attack with rockets or medium artillery This is an attack case comparing to the previous one with stronger arms attack. For example, the portable rocket or bazooka for tank attack is considered. However, this case could be protected by the containment building by the concrete steel materials. It is certain that the attacked building should be recovered as soon as possible for stability. 3.6. Scenario #6: sabotage to the power lines It is very easy to make this attack, because all power lines are not protected from plant site. It is nearly impossible to protect all power lines thoroughly, because the power lines are installed near the lower populated areas. Due to the NIMBY (Not In My Backyard) phenomena for the NPP, the plant site is located around seclusion places. If the external load supply line is disconnected, turbine trip valve is activated to stop the steam supply to turbine and the electricity generation stops. In addition, the battery or diesel driven motor is installed. This is also useful for the motor operation like the case of Fukushima’s flooded motor in order not to happen the coolant supply failure. 3.7. Scenario #7: infiltration and sabotage
3.2. Scenario #2: attack by boat Considering the location of NPPs which are installed near the seashore, the possibility of the attack by boat in the sea is very important. This could be happened in some countries where the plant sites are located on the seashore like the case of the Republic of Korea. The foreign ship and submarine can get to the plant place comparatively easily. The marine police should guard from the terror attack from the sea. However, the guarding could be failed following the situations. Especially, when the weather is very bad, it is very difficult to detect the strange substance in the sea. If the missing of the unidentified object in the sea, the terror attack could be possible easily.
There could be many works that are damaged by the infiltration and sabotage. Usually a labor striking or civilian’s intrusion could be an angry demonstrator who can destruct anything in the site. Therefore this kind of case could be severer than the case of Table 3 Likelihood of event occurrence. Likelihood
Frequency (1/year)
Rare Often Frequently Very frequently
0–100 101–1000 1001–10,000 >10,000
T.H. Woo / Nuclear Engineering and Design 265 (2013) 932–937
935
Table 4 Likelihood of terror occurrence of scenarios. Sort
Scenario number
Likelihood
Related example
Explosion
1
1210.1/year, frequently
Explosion in Oklahoma government complex in April 19, 1995
Armed attack
2 3
899.1/year, often
USS Cole was attacked in Aden, Yemen at October 12, 2000 Small airplane crashed to the Internal Revenue Service (IRS) building in Austin, Texas at February 18, 2010 Gun shooting in Holocaust Museum near the White House by a white people with white supremacy in 2006 Rocket attack to Untied States chancellery in Benghazi, east Libya at September 11, 2012
32.2/year, rare
Disconnection and abstraction to the power lines with attacks by rocket and vehicle by resistance in recovery site in Iraq Occupation and strike in Pyung Tack complex of Ssangyong Motors against the restructuring from May 22, 2000 to August 6, 2000 Airliner crash terror to World Trade Center and Department of Defense building in September 11, 2001
4 5 Etc.
6 7 8
Table 5 Classification by terror attack.
Table 7 Defense-in-depth by level.
Level 7 6 5 4
Major accident Serious accident Accident with wider consequences Accident with local consequences
Accident
3 2 1
Serious incident Incident Anomaly
Incident
0
Deviation
Deviation
Consequence
Consequence
Level
Defense-in-depth condition
High
Low
1
Medium
Low
2
Low
3
Medium
4
Medium
5
Conservative design and high quality in construction and operation Control, limiting and protection systems and other surveillance features Engineered safety features and accident procedures Complementary measures and accident management Off-site emergency response
Low
9/11 terror attack (NCPA, 2001). Since the attacks inside of the plant could provoke the damage of facility, this would be considered to be severer than the outer attack of 9/11. The reason the 9/11 case is compared is that this is imagined as the worst terror case in the history considering unexpected and innocent deaths. But, it is not possible for the intruder or demonstrator to reach to reactor core, because there are many gates to the reactor core in which the permission is necessary to pass each gate. If there is one person who knows well the plan situation, it is easy to get to the reactor core. Even though one could get to the place, it is impossible to steal the nuclear fuel without the suitable equipments. The person could be dead by high radiation exposures if the coarse equipments are used. However, if a guy would like to make a suicide attack in the reactor core, it is very clear the case is the 2nd Fukushima disaster where the building destructions and environmental contaminations would be produced.
could make the steam explosion which can release the radioactive material like the Iodine, Cesium, and noble gases and the core damage can start (NCPA, 2001). Eventually, eternal core damage can start like the cases of the Fukushima, Chernobyl, and Three Mile Island (TMI) cases. If the crash attack is expected, the containment building ventilation should begin to remove hydrogen gas to inhibit the steam explosion. Certainly, the control rod and shutdown system should be operated immediately. If the spent fuel storage facility is attacked, the situation is different from the case of the containment building, because the radioactive material could be released to the atmosphere, although the energy of spent fuel is lower. Usually, the spent fuel is cooled in the storage facility where it is 9–10 feet’ height and 5–10 years’ period. Then, it is sent to the dry cask (NCPA, 2001). Even if it is easy to approach to the spent fuel storage facility, the jet fuel of the crashed airliner is floated on the water of the storage and the water is not to be steamed (NCPA, 2001). However, if
3.8. Scenario #8: suicide crash to the reactor building or spent-fuel storage by airliner Although this case has not been studied by Nuclear Regulatory Commission (NRC), if airliner crashes to the rector building, the reactor core vessel could not be broken, but be cracked in the containment building significantly (NCPA, 2001). The fire by crash Table 6 Consequence of terror attack. Scenario
Consequence
1 2 3 4 5 6 7 8
Low Medium Medium Medium Medium Medium High High
Table 8 Strategy by combinations of detection, delay and response. Defense-in-depth condition
Strategy by combinations of detection, delay and response
Conservative design and high quality in construction and operation Control, limiting and protection systems and other Surveillance features
Detection in initial stage of event regarding Human factor
Engineered safety features and accident procedures Complementary measures and accident management Off-site emergency response
Detection by surveillance facility (core stability and thermal inertia, inherent plant facility like abnormal operation control system) Delay of plan deterioration Delay of plan deterioration. Emergency response of inner-plant part Delay of plan deterioration. Emergency response of external-plant part (external emergency response is a preventions method of accident)
936
T.H. Woo / Nuclear Engineering and Design 265 (2013) 932–937
Table 9 Strategy for physical protection. Scenario
Consequence
Method Detection
Detection
Detection
Barricade Floating barriers, coastguard boat, anti-aircraft gun, barricade, wire entanglement Barricade, anti-aircraft gun, airport security strengthening
Security, police, troops Security, boat, helicopter, fighting airplane, police, repair
1 2, 3, 4, 5, 6
Low Medium
CCTV, guard CCTV, guard (including coastguard), radar, residual current protective
7, 8
High
CCTV, guard, radar
the airplane breaks the storage facility, the fuel is opened to atmosphere and the nuclear fission could be happen in the case of the higher energized spent nuclear fuel. Dry cask could make many radioactive material releases. Especially, the Iodine-131 can affect to the thyroid (NCPA, 2001). Cask should be strong to the airplane crash due to the thick concrete steel. If the airliner’s crash is expected, the cask should be hided or it is installed in the underground. More severe case is mental and psychological panic to the people. Angst, fret, and melancholy could be the big handicaps. Any social and economical behaviors are stopped. As time goes on, the situation is going to be normal by dispersion and diffusion of the radioactive materials. Then, the likelihood of terror is obtained by the general terror incidents which are announced by several agencies. Using these data, the likelihood of terror is made. Also, the consequence of terror is classified by the IAEA scale by DBT. The physical protection method is produced where the defense-in-depth constraints and severe accident countermeasures are considered. Eventually, the PPS is constructed.
4. Results It has been known that it is necessary to strengthen the preparation of the intentional approach and damage in the consequence of safety following the physical damage of the facilities in the operating NPPs after the Fukushima accident. Terrorists attack scenarios are analyzed in this work to their likelihood and potential safety impact on large light-water cooled NPPs, based on past attacks on large-scale public facilities. By qualitative research on PPS, terrorists attack scenarios and safety impacts have been examined for the case of large light water reactors operating in sea shore environments. The study for safeguard in operation is developed using analytical methods which is in Fig. 1. The terror scenarios are introduced by 8 cases. Then, the likelihood of terror is classified by the general terror incidents. The consequence of terror is classified by the IAEA scale by DBT. The physical protection method is suggested by defense-in-depth constraints and severe accident countermeasures for PPS constructions. An analysis for terrorists attack to nuclear power plants is focused on the likelihood and potential safety impact for each scenario, in which these large light water cooled reactors are mostly located on sea shore. IAEA event scale is employed to classify the severity of potential attacks on safety ramifications. As potential counter-measures, phased response options are studies. Based on the likelihood of occurrence of terrorists attack scenarios and consequence on the plant safety, three phases of counter actions are considered for physical protection. The detection phase is performed where the sensor respond to attempts and initiates an alarm. Various information from sensors is reported and analyzed
Security, police, troops, fighting airplane
for potential scenarios. Detected information is assumed to be subjected to personnel assessment and judgment to determine if the alarm reflects true situations. The delay phase provides means of delaying adversary actions. Delaying an adversary action is an effective method of giving the security forces necessary time to respond and to interrupt the adversary attacks. The response phase consists of the actions taken by the counter-terrorism force to prevent full adversary impact based on responding measures, contingency planning, communication and interruption. The situation of world terror occurrence is obtained by the 3 classifications as explosion, armed attack and which are in Table 2 (Terrorism Information Integration Center, 2012). The likelihood of event occurrence in Table 3 is decided basically by expert judgment. For example, the similar system is shown in the risk frequency of the general event (Berg, 2010) which is analogized for the likelihood of event occurrence for terror incident. The common characteristics of the accident in general event and terror in this paper are ‘failure incident’ and ‘unusual incident’. As it is known, the incident in NPPs happens with uncertainty which could produce the failed and unusual event. Table 4 shows the likelihood of terror occurrence of scenarios where related examples are listed by general cases (Chosun Ilbo, 2012; Hankook Ilbo (USA), 2010; Joongang Ilbo (LA), 2006; Joongang Ilbo, 2009, 2012; Wikipedia, 2012a,b, 2013). The classification by terror attack is done by several documentations which are in Table 5 (Hagemann, 2009; IAEA, 1999, 1980, 2012b). Table 6 has the consequence list in each scenario. There is the defense-in-depth by level in Table 7 and the strategy by combinations of detection, delay and response in Table 8 (IAEA, 1996). The strategy for physical protection is shown in Table 9 (KINS, 2011).
5. Conclusions The severe damage to NPPs by terror could produce the dangerous situation like the case of Fukushima disaster. Therefore, it is a conclusion to study the protection systems in security methods. By this background, this work modeled 8 cases of terror incidents. The likelihoods and occurrences of the 8 terror cases have been analyzed. The likelihoods are obtained by the general terror cases, because the data of terror cases in NPPs are not opened to public. So, the likelihood is analyzed by the general terror cases. To make the objective standards of the classification of occurrences, DBT is sorted as IAEA scale. This DBT is categorized as the energy of nuclear material and consequently the destructive degree is classified. Like this situation, IAEA level could show the consequences for how event or accident is destructed in NPPs. That is to say, the ‘terror attack’ is sorted as ‘destructive degree’, then this ‘destructive degree’ can be implied by ‘consequence degree’. ‘A truck bomb’ case is low in consequence. ‘Attack by boat’, ‘Suicide attack by small aircraft’, ‘Frontal assault with small arms’, ‘Attack with rockets or medium artillery’, and ‘Sabotage to the power line’ have medium
T.H. Woo / Nuclear Engineering and Design 265 (2013) 932–937
level consequence. ‘Infiltration and sabotage’ and ‘Suicide crash to the reactor building or spent-fuel storage by airliner’ have highest level in consequence. The IAEA level of DBT is used for the strategy for physical protection which is concluded for the final protection strategies (KINS, 2011). Severity of potential progresses of an initiating accident is taken into consideration to identify appropriate emergency response treatment to minimize hazard to site personnel and the public. It has been suggested to implement a variety of counterterrorism methods including barricade reinforcement, coastguard strengthening, airport security strengthening, anti-aircraft defense system, anti-missile defense as well as measures to counteract potential sabotages. In addition, the international cooperation is needed for successful PPS. Especially, there were announcements in Nuclear Security Summit as control and unification of nuclear security structure, strengthening of IAEA role, usage minimization and safe management of high enrichment uranium and plutonium, safe control of radioactive material, unified approach of nuclear security and safety, strengthening of carrying security, prohibition of illegal nuclear bargaining, developing and cooperation of nuclear identification, and international cooperation (NSS Seoul, 2012; Chun, 2012). The data in this paper are used by general event cases. Hence it is needed to study using the revised data where the possible terror cases in NPPs have tendency of rare, limited, and overwhelming affected damages. It is important to make a successful PPS by adjusting the discrepancy between the real data in NPPs and the general terror data. Additionally, it is suggested to make the newly developed NPPs where the PPS is equipped from the construction. Also, the education of the operating personnel preparing for the possible terror attacks. Finally, the national agency is proposed to control the terror incident in NPPs. The new agency for management in terror of NPPs is imagined under the United Nation (UN), because the cooperation with IAEA, an organization of the UN, is easy. The technology transfer for terror protection to other industries is an advice for the future work. Acknowledgements The author thanks to Dr. I.S. Hwang, Dr. M.S. Jae, and Dr. H.G. Joo for their research discussions.
937
References Borrelli, R.A., 2013. Use of curium spontaneous fission neutrons for safeguardability of remotely-handled nuclear facilities: fuel fabrication in pyroprocessing. Nuclear Engineering and Design 260, 64–77. Chosun Ilbo, 2012. http://news.chosun.com/site/data/html dir/ 2012/09/13/2012091300257.html Chun, B.K., 2012. Estimation and Future Work in Seoul Nuclear Security Summit. IFANS FOCUS. Ministry of Foreign Affairs, IFANS FOCUS 2012-06.pdf. Hagemann, A., 2009. DBT-Basis for Developing a European Physical Protection Concept. Office of Nuclear Security, Department of Nuclear Safety and Security, http://www.eurosafe-forum.org/files/pe 191 24 1 5 10paper.pdf Hankook Ilbo (USA), 2010. http://www.koreatimes.com/article/577968 IAEA, 1980. Convention on the Physical Protection of Nuclear Material, INFCIRC 274/Rev. 1, Vienna. IAEA, 1996. Defense in Depth in Nuclear Safety, INSAG-10. A Report by the International Nuclear Safety Advisory Group. IAEA, 1999. The Physical Protection of Nuclear Material and Nuclear Facilities, INFCIRC 225 Rev. 4 (Corrected), Vienna. IAEA, 2004. Guidelines and Format for Preparation and Submission of Declarations Pursuant to Articles 2 and 3 of the Model Protocol Additional to Safeguards Agreements, IAEA Services Series No. 11. IAEA, 2009. Development, Use and Maintenance of the Design Basis Threat, Vienna. IAEA, 2012a. Design Basis Threat (DBT), http://www-ns.iaea.org/security/dbt.asp?s=4 IAEA, 2012b. INES (The International Nuclear and Radiological Event Scale User’s Manual) 2008 Edition (Revised). Joongang Ilbo (LA), 2006. http://www.koreadaily.com/news/read.asp?art id=860908 Joongang Ilbo, 2009. http://article.joinsmsn.com/news/article/article.asp?ctg=11& Total ID=3946138 Joongang Ilbo, 2012. http://article.joinsmsn.com/news/article/article.asp?total id= 8473956&ctg=1502 KINS, 2011. Pressurized Water Reactor Regulation Guide and Regulation, Korea. NCPA, 2001. National Policy Analysis #374: Terrorism and Nuclear Power: What are the Risks? The National Center for Public Policy Research (NCPA), Washington, DC. NSS Seoul, 2012. Seoul Communiqué. 2012 Seoul Nuclear Security Summit. http://www.seoulnss.go.kr/userfiles/s1.pdf Park, J.K., Park, J.Y., Kim, Y.K., 2013. A graded approach to cyber security in a research reactor facility. Progress in Nuclear Energy 65, 81–87. PROS, 2012. Scenarios of Nuclear Terrorism: An Analysis, Byron, IL. Rico, G., Beasley, J.S.,2006. Physical Protection Systems: Concepts, Analysis, and Practice in the ET Classroom. In: Science, Engineering, & Technology Education Conference. Department of Engineering Technology, New Mexico State University, Las Cruces, NM. Terrorism Information Integration Center, 2012. World Terror Occurrence List, Korea. http://www.tiic.go.kr/ Berg, H.-P., 2010. Risk management: procedures, methods and experiences. Reliability: Theory and Application 5 2 (17), 79–95. US NRC, 2012. Frequently Asked Questions About NRC’s Design Basis Threat Final Rule. http://www.nrc.gov/security/faq-dbtfr.html Wikipedia, 2012a. http://ko.wikipedia.org/wiki Wikipedia, 2012b. http://ko.wikipedia.org/wiki Wikipedia, 2013. http://en.wikipedia.org/wiki/September 11 attacks
Contents lists available at ScienceDirect
Nuclear Engineering and Design journal homepage: www.elsevier.com/locate/nucengdes
Analytic study for physical protection system (PPS) in nuclear power plants (NPPs) Tae Ho Woo ∗ Department of Nuclear Engineering, Seoul National University, 1 Gwanak-ro, Gwanak-gu, Seoul 151-742, Republic of Korea
h i g h l i g h t s • • • •
The physical protection system (PPS) is investigated. General NPPs are modeled in the study. Possible terror cases, likelihood, and consequence are studied. PPS is constructed by analytical methods.
a r t i c l e
i n f o
Article history: Received 28 April 2013 Received in revised form 31 August 2013 Accepted 19 September 2013
a b s t r a c t The nuclear safeguard is analyzed in the aspect of the physical protection system (PPS) in nuclear power plants (NPPs). The PPS is reviewed and its related terror scenarios are investigated. The PPS is developed using analytical methods. In the terror scenarios, there are 8 possible cases for the terror attacks to the NPPs. Then, the likelihood of terror is classified by the general terror incidents. The consequence of terror is classified by Design Basis Threat (DBT) of the International Atomic Energy Agency (IAEA) scale. The physical protection method is suggested by defense-in-depth constraints and severe accident countermeasures. Finally, the advanced PPS is constructed, which could be used for the preparation for the possible terror attacks in the NPPs. © 2013 Elsevier B.V. All rights reserved.
1. Introduction The commercial nuclear power plants (NPPs) are operated normally, if any kinds of accidents by the terror or sabotage are not happened, because the well equipped safety systems of NPPs could continue the normal operations. Hence the analysis of terror or sabotage in physical protection system (PPS) of NPPs’ security is important in the country like the Republic of Korea where the military enemy is under confliction. As it is seen in Fukushima accident at March 11, 2001, the NPPs can produce steam explosion, radioactive material release, and international panics by the natural disaster like the earthquake. This caused the national economic stagnation and international anti-nuclear movement. The suicide airplane crash terror to the World Trade Center (WTC) and the Department of Defense (DOD) building provoked panics and worries, which happened in September 11, 2001. If this terror happened in NPPs, much more horrible results could be produced.
∗ Tel.: +82 2 880 8337; fax: +82 2 889 2688. E-mail address: [email protected] 0029-5493/$ – see front matter © 2013 Elsevier B.V. All rights reserved. http://dx.doi.org/10.1016/j.nucengdes.2013.09.025
It is necessary to estimate the stability of the plant security by the monitoring systems for NPPs. Serious attack like the terror or sabotage is not notified before an incident. So, it is needed to analyze by indirect method like the terror or sabotage related algorithm. The Design Basis Threat (DBT) has been introduced for the terror or sabotage case which was constructed as the similar concept to the Design Basis Accident (DBA). It was also analyzed that the safeguards meant the regulations of the related systems. The safeguard regulations had been prepared simultaneously with the commercial NPPs business from the mid 20th century. It is very important to study analytically in order to strengthen the safeguard of NPPs’ terror. That is, it is necessary to analyze how the terror and sabotage can happen in normal operation and how to prepare. This could be estimated by the analytic method based on the opinions of experts. The purpose of the safeguard was that the trade did not go to the supply of nuclear bombs and the importance of the perceptions is that pending nuclear disarmament, world security is better served with fewer rather than more nuclear weapons and nuclear weapon states (IAEA, 2004). The DBT has been introduced to make the protections of NPPs. DBT is the response against the potential threat in which the radiation sabotage, theft, and usage could be done against the PPS and this is a part of section 73.1 of the Code of Federal Regulations Title
T.H. Woo / Nuclear Engineering and Design 265 (2013) 932–937
933
Fig. 2. Physical protection system.
Fig. 3. Directions of terror attacks.
Fig. 1. Flowchart of study.
10 (10 CFR) in Nuclear Regulatory Commission’s (NRC’s) regulations after 1979 (US NRC, 2012). In addition, the INFCIRC/225/Rev. 4 (Corrected) of nuclear material and facility describes the DBT following the International Atomic Energy Agency (IAEA), which was made in 1999. The object is to describe the reason, intention, and positional possibility against the production and estimation of protection system (IAEA, 2009). The major objects of DBT are impure individual and group in internal and external part, material lost and sabotage, prohibited actions, PPS related arms, utensil, technology, design and estimation of DBT, etc. (IAEA, 2012a). Although this study has a difficulty in finding the internal NPPs, the large scale light water reactor (LWR) near seashore is modeled. The terror scenarios could be obtained by literature survey and expert opinions. The likelihood, consequence, and PPS for terrors can be studied. In the past studies, Borrelli studied that High Reliability Safeguards (HRS) approach in a series of quantitative modeling efforts to develop methodologies for demonstrating the safeguardability of these facilities (Borrelli, 2013). In addition, Park et al. worked for a graded approach to cyber security in a research reactor facility (Park et al., 2013). The object of the study is how to construct the protections in NPPs where the analytic method is done. There are 8 exampled terror cases, likelihoods, and consequences which are analyzed and the strategies are introduced. Since terror cases in NPPs are prohibited to open to public following DBT, the previous general terror cases are considered as the likelihood investigation. The consequences are estimated by the damage of power lines, psychological panic disorder, and so on. The strategy of protection is done by detection, delay, and response of PPS. The flowchart of study is shown in Fig. 1. There is the background for the modeling which is shown in Section 2. Section 3 explains the method of the study.
Section 4 describes results of the study. There are some conclusions in Section 5. 2. Background In order to investigate the terror cases which are related with the PPS, the possible events are considered. There are 3 kinds of classifications in PPS which are in Fig. 2 (Rico and Beasley, 2006). There are 8 possible scenarios for the terror attacks to the NPPs incorporate with a report (NCPA, 2001). Fig. 3 shows the directions of terror attacks. There are 3 ways as land, sea, and air. In the terror scenarios, the 8 possible scenarios are considered for the terror attacks to the NPPs with several subjectively modified applications (NCPA, 2001). There is a list of terror scenarios in Table 1. These scenarios are analyzed in this study. The contents are as follows: Table 1 List of terror scenario. Sort
Number
Event
Explosion
1
A truck bomb
Armed attack
2 3
Attack by boat Suicide attack by small aircraft Frontal assault with small arms Attack with rockets or medium artillery
4 5 Etc.
6 7 8
Sabotage to the power lines Infiltration and sabotage Suicide crash to the reactor building or spent-fuel storage by airliner
934
T.H. Woo / Nuclear Engineering and Design 265 (2013) 932–937
Table 2 Situation of world terror occurrence.
1 2 3 4 5 6 7 8
Sort
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
Explosion Armed attack Etc.
209 222 2
334 281 9
487 323 2
1111 548 29
1569 1030 45
1649 1510 13
1630 1343 10
1680 1486 14
1664 946 88
1768 1302 110
A truck bomb Attack by boat Suicide attack by small aircraft Frontal assault with small arms Attack with rockets or medium artillery Sabotage to the power lines Infiltration and sabotage Suicide crash to the reactor building or spent-fuel storage by airliner
The nuclear terror is analyzed by the aspect of nuclear bomb manufacturing. Nuclear weapons are inherently terrifying due to their lethality (PROS, 2012). The nuclear, chemical, and biological stuffs have been tried to be used in the terrorist related groups. It is said that the nuclear terrorism is initiated from buying the nuclear bomb in the black market or stealing for the nuclear facilities like the NPPs. In the past time, the terrorist organizations and individuals have attempted to make use of the biological weapons which could produce the destructions. The notorious incident, the anthrax letter attacks in the United States showed the public and social confusions widely. Especially, the nuclear terror is a method of attacking to NPPs, stealing nuclear material from NPPs, and producing nuclear bombs by the nuclear material like the Pu-239 or Pu-241.
3. Method These 8 kinds of terror scenarios are analyzed to examine the dangerousness which is analyzed by modified terror consequence and defense-in depth level of terror attacks to nuclear power plants. There are 8 possible cases for the terror scenarios in the exampled NPP.
3.1. Scenario #1: a truck bomb It is considered that the truck bomb could affect on the external part of the site and the least damage on the reactor containment building and nuclear fuel storage facility. Hence, it is less dangerous than the other scenarios. If the terrorist would like to select the crucial method with this method, it is needed to prepare against the possible attack.
Total 12,101 8991 322
3.3. Scenario #3: suicide attack by small aircraft This case could be a stronger method to the reactor building, dry storage cask and nuclear fuel storage pool by aircraft crash method (NCPA, 2001). The most plausible target is nuclear fuel storage pool by airplane collision. According to General Electric’s study, although several thousand bomb installed crash would be happened, the radioactive material contaminations are negligible (NCPA, 2001). 3.4. Scenario #4: frontal assault with small arms With small arms, the NPP could be attacked by the terrorists. Once this case happens, the site is in emergency situation and the secure procedures are in action. The plant is in maximum alert states by Trip and Shutdown methods in order to stop the operations. This case is considered less dangerous than the case of ‘infiltration and sabotage’ and ‘suicide crash to the reactor building or spent-fuel storage by airliner’, because the containment building can withstand against the small arms. 3.5. Scenario #5: attack with rockets or medium artillery This is an attack case comparing to the previous one with stronger arms attack. For example, the portable rocket or bazooka for tank attack is considered. However, this case could be protected by the containment building by the concrete steel materials. It is certain that the attacked building should be recovered as soon as possible for stability. 3.6. Scenario #6: sabotage to the power lines It is very easy to make this attack, because all power lines are not protected from plant site. It is nearly impossible to protect all power lines thoroughly, because the power lines are installed near the lower populated areas. Due to the NIMBY (Not In My Backyard) phenomena for the NPP, the plant site is located around seclusion places. If the external load supply line is disconnected, turbine trip valve is activated to stop the steam supply to turbine and the electricity generation stops. In addition, the battery or diesel driven motor is installed. This is also useful for the motor operation like the case of Fukushima’s flooded motor in order not to happen the coolant supply failure. 3.7. Scenario #7: infiltration and sabotage
3.2. Scenario #2: attack by boat Considering the location of NPPs which are installed near the seashore, the possibility of the attack by boat in the sea is very important. This could be happened in some countries where the plant sites are located on the seashore like the case of the Republic of Korea. The foreign ship and submarine can get to the plant place comparatively easily. The marine police should guard from the terror attack from the sea. However, the guarding could be failed following the situations. Especially, when the weather is very bad, it is very difficult to detect the strange substance in the sea. If the missing of the unidentified object in the sea, the terror attack could be possible easily.
There could be many works that are damaged by the infiltration and sabotage. Usually a labor striking or civilian’s intrusion could be an angry demonstrator who can destruct anything in the site. Therefore this kind of case could be severer than the case of Table 3 Likelihood of event occurrence. Likelihood
Frequency (1/year)
Rare Often Frequently Very frequently
0–100 101–1000 1001–10,000 >10,000
T.H. Woo / Nuclear Engineering and Design 265 (2013) 932–937
935
Table 4 Likelihood of terror occurrence of scenarios. Sort
Scenario number
Likelihood
Related example
Explosion
1
1210.1/year, frequently
Explosion in Oklahoma government complex in April 19, 1995
Armed attack
2 3
899.1/year, often
USS Cole was attacked in Aden, Yemen at October 12, 2000 Small airplane crashed to the Internal Revenue Service (IRS) building in Austin, Texas at February 18, 2010 Gun shooting in Holocaust Museum near the White House by a white people with white supremacy in 2006 Rocket attack to Untied States chancellery in Benghazi, east Libya at September 11, 2012
32.2/year, rare
Disconnection and abstraction to the power lines with attacks by rocket and vehicle by resistance in recovery site in Iraq Occupation and strike in Pyung Tack complex of Ssangyong Motors against the restructuring from May 22, 2000 to August 6, 2000 Airliner crash terror to World Trade Center and Department of Defense building in September 11, 2001
4 5 Etc.
6 7 8
Table 5 Classification by terror attack.
Table 7 Defense-in-depth by level.
Level 7 6 5 4
Major accident Serious accident Accident with wider consequences Accident with local consequences
Accident
3 2 1
Serious incident Incident Anomaly
Incident
0
Deviation
Deviation
Consequence
Consequence
Level
Defense-in-depth condition
High
Low
1
Medium
Low
2
Low
3
Medium
4
Medium
5
Conservative design and high quality in construction and operation Control, limiting and protection systems and other surveillance features Engineered safety features and accident procedures Complementary measures and accident management Off-site emergency response
Low
9/11 terror attack (NCPA, 2001). Since the attacks inside of the plant could provoke the damage of facility, this would be considered to be severer than the outer attack of 9/11. The reason the 9/11 case is compared is that this is imagined as the worst terror case in the history considering unexpected and innocent deaths. But, it is not possible for the intruder or demonstrator to reach to reactor core, because there are many gates to the reactor core in which the permission is necessary to pass each gate. If there is one person who knows well the plan situation, it is easy to get to the reactor core. Even though one could get to the place, it is impossible to steal the nuclear fuel without the suitable equipments. The person could be dead by high radiation exposures if the coarse equipments are used. However, if a guy would like to make a suicide attack in the reactor core, it is very clear the case is the 2nd Fukushima disaster where the building destructions and environmental contaminations would be produced.
could make the steam explosion which can release the radioactive material like the Iodine, Cesium, and noble gases and the core damage can start (NCPA, 2001). Eventually, eternal core damage can start like the cases of the Fukushima, Chernobyl, and Three Mile Island (TMI) cases. If the crash attack is expected, the containment building ventilation should begin to remove hydrogen gas to inhibit the steam explosion. Certainly, the control rod and shutdown system should be operated immediately. If the spent fuel storage facility is attacked, the situation is different from the case of the containment building, because the radioactive material could be released to the atmosphere, although the energy of spent fuel is lower. Usually, the spent fuel is cooled in the storage facility where it is 9–10 feet’ height and 5–10 years’ period. Then, it is sent to the dry cask (NCPA, 2001). Even if it is easy to approach to the spent fuel storage facility, the jet fuel of the crashed airliner is floated on the water of the storage and the water is not to be steamed (NCPA, 2001). However, if
3.8. Scenario #8: suicide crash to the reactor building or spent-fuel storage by airliner Although this case has not been studied by Nuclear Regulatory Commission (NRC), if airliner crashes to the rector building, the reactor core vessel could not be broken, but be cracked in the containment building significantly (NCPA, 2001). The fire by crash Table 6 Consequence of terror attack. Scenario
Consequence
1 2 3 4 5 6 7 8
Low Medium Medium Medium Medium Medium High High
Table 8 Strategy by combinations of detection, delay and response. Defense-in-depth condition
Strategy by combinations of detection, delay and response
Conservative design and high quality in construction and operation Control, limiting and protection systems and other Surveillance features
Detection in initial stage of event regarding Human factor
Engineered safety features and accident procedures Complementary measures and accident management Off-site emergency response
Detection by surveillance facility (core stability and thermal inertia, inherent plant facility like abnormal operation control system) Delay of plan deterioration Delay of plan deterioration. Emergency response of inner-plant part Delay of plan deterioration. Emergency response of external-plant part (external emergency response is a preventions method of accident)
936
T.H. Woo / Nuclear Engineering and Design 265 (2013) 932–937
Table 9 Strategy for physical protection. Scenario
Consequence
Method Detection
Detection
Detection
Barricade Floating barriers, coastguard boat, anti-aircraft gun, barricade, wire entanglement Barricade, anti-aircraft gun, airport security strengthening
Security, police, troops Security, boat, helicopter, fighting airplane, police, repair
1 2, 3, 4, 5, 6
Low Medium
CCTV, guard CCTV, guard (including coastguard), radar, residual current protective
7, 8
High
CCTV, guard, radar
the airplane breaks the storage facility, the fuel is opened to atmosphere and the nuclear fission could be happen in the case of the higher energized spent nuclear fuel. Dry cask could make many radioactive material releases. Especially, the Iodine-131 can affect to the thyroid (NCPA, 2001). Cask should be strong to the airplane crash due to the thick concrete steel. If the airliner’s crash is expected, the cask should be hided or it is installed in the underground. More severe case is mental and psychological panic to the people. Angst, fret, and melancholy could be the big handicaps. Any social and economical behaviors are stopped. As time goes on, the situation is going to be normal by dispersion and diffusion of the radioactive materials. Then, the likelihood of terror is obtained by the general terror incidents which are announced by several agencies. Using these data, the likelihood of terror is made. Also, the consequence of terror is classified by the IAEA scale by DBT. The physical protection method is produced where the defense-in-depth constraints and severe accident countermeasures are considered. Eventually, the PPS is constructed.
4. Results It has been known that it is necessary to strengthen the preparation of the intentional approach and damage in the consequence of safety following the physical damage of the facilities in the operating NPPs after the Fukushima accident. Terrorists attack scenarios are analyzed in this work to their likelihood and potential safety impact on large light-water cooled NPPs, based on past attacks on large-scale public facilities. By qualitative research on PPS, terrorists attack scenarios and safety impacts have been examined for the case of large light water reactors operating in sea shore environments. The study for safeguard in operation is developed using analytical methods which is in Fig. 1. The terror scenarios are introduced by 8 cases. Then, the likelihood of terror is classified by the general terror incidents. The consequence of terror is classified by the IAEA scale by DBT. The physical protection method is suggested by defense-in-depth constraints and severe accident countermeasures for PPS constructions. An analysis for terrorists attack to nuclear power plants is focused on the likelihood and potential safety impact for each scenario, in which these large light water cooled reactors are mostly located on sea shore. IAEA event scale is employed to classify the severity of potential attacks on safety ramifications. As potential counter-measures, phased response options are studies. Based on the likelihood of occurrence of terrorists attack scenarios and consequence on the plant safety, three phases of counter actions are considered for physical protection. The detection phase is performed where the sensor respond to attempts and initiates an alarm. Various information from sensors is reported and analyzed
Security, police, troops, fighting airplane
for potential scenarios. Detected information is assumed to be subjected to personnel assessment and judgment to determine if the alarm reflects true situations. The delay phase provides means of delaying adversary actions. Delaying an adversary action is an effective method of giving the security forces necessary time to respond and to interrupt the adversary attacks. The response phase consists of the actions taken by the counter-terrorism force to prevent full adversary impact based on responding measures, contingency planning, communication and interruption. The situation of world terror occurrence is obtained by the 3 classifications as explosion, armed attack and which are in Table 2 (Terrorism Information Integration Center, 2012). The likelihood of event occurrence in Table 3 is decided basically by expert judgment. For example, the similar system is shown in the risk frequency of the general event (Berg, 2010) which is analogized for the likelihood of event occurrence for terror incident. The common characteristics of the accident in general event and terror in this paper are ‘failure incident’ and ‘unusual incident’. As it is known, the incident in NPPs happens with uncertainty which could produce the failed and unusual event. Table 4 shows the likelihood of terror occurrence of scenarios where related examples are listed by general cases (Chosun Ilbo, 2012; Hankook Ilbo (USA), 2010; Joongang Ilbo (LA), 2006; Joongang Ilbo, 2009, 2012; Wikipedia, 2012a,b, 2013). The classification by terror attack is done by several documentations which are in Table 5 (Hagemann, 2009; IAEA, 1999, 1980, 2012b). Table 6 has the consequence list in each scenario. There is the defense-in-depth by level in Table 7 and the strategy by combinations of detection, delay and response in Table 8 (IAEA, 1996). The strategy for physical protection is shown in Table 9 (KINS, 2011).
5. Conclusions The severe damage to NPPs by terror could produce the dangerous situation like the case of Fukushima disaster. Therefore, it is a conclusion to study the protection systems in security methods. By this background, this work modeled 8 cases of terror incidents. The likelihoods and occurrences of the 8 terror cases have been analyzed. The likelihoods are obtained by the general terror cases, because the data of terror cases in NPPs are not opened to public. So, the likelihood is analyzed by the general terror cases. To make the objective standards of the classification of occurrences, DBT is sorted as IAEA scale. This DBT is categorized as the energy of nuclear material and consequently the destructive degree is classified. Like this situation, IAEA level could show the consequences for how event or accident is destructed in NPPs. That is to say, the ‘terror attack’ is sorted as ‘destructive degree’, then this ‘destructive degree’ can be implied by ‘consequence degree’. ‘A truck bomb’ case is low in consequence. ‘Attack by boat’, ‘Suicide attack by small aircraft’, ‘Frontal assault with small arms’, ‘Attack with rockets or medium artillery’, and ‘Sabotage to the power line’ have medium
T.H. Woo / Nuclear Engineering and Design 265 (2013) 932–937
level consequence. ‘Infiltration and sabotage’ and ‘Suicide crash to the reactor building or spent-fuel storage by airliner’ have highest level in consequence. The IAEA level of DBT is used for the strategy for physical protection which is concluded for the final protection strategies (KINS, 2011). Severity of potential progresses of an initiating accident is taken into consideration to identify appropriate emergency response treatment to minimize hazard to site personnel and the public. It has been suggested to implement a variety of counterterrorism methods including barricade reinforcement, coastguard strengthening, airport security strengthening, anti-aircraft defense system, anti-missile defense as well as measures to counteract potential sabotages. In addition, the international cooperation is needed for successful PPS. Especially, there were announcements in Nuclear Security Summit as control and unification of nuclear security structure, strengthening of IAEA role, usage minimization and safe management of high enrichment uranium and plutonium, safe control of radioactive material, unified approach of nuclear security and safety, strengthening of carrying security, prohibition of illegal nuclear bargaining, developing and cooperation of nuclear identification, and international cooperation (NSS Seoul, 2012; Chun, 2012). The data in this paper are used by general event cases. Hence it is needed to study using the revised data where the possible terror cases in NPPs have tendency of rare, limited, and overwhelming affected damages. It is important to make a successful PPS by adjusting the discrepancy between the real data in NPPs and the general terror data. Additionally, it is suggested to make the newly developed NPPs where the PPS is equipped from the construction. Also, the education of the operating personnel preparing for the possible terror attacks. Finally, the national agency is proposed to control the terror incident in NPPs. The new agency for management in terror of NPPs is imagined under the United Nation (UN), because the cooperation with IAEA, an organization of the UN, is easy. The technology transfer for terror protection to other industries is an advice for the future work. Acknowledgements The author thanks to Dr. I.S. Hwang, Dr. M.S. Jae, and Dr. H.G. Joo for their research discussions.
937
References Borrelli, R.A., 2013. Use of curium spontaneous fission neutrons for safeguardability of remotely-handled nuclear facilities: fuel fabrication in pyroprocessing. Nuclear Engineering and Design 260, 64–77. Chosun Ilbo, 2012. http://news.chosun.com/site/data/html dir/ 2012/09/13/2012091300257.html Chun, B.K., 2012. Estimation and Future Work in Seoul Nuclear Security Summit. IFANS FOCUS. Ministry of Foreign Affairs, IFANS FOCUS 2012-06.pdf. Hagemann, A., 2009. DBT-Basis for Developing a European Physical Protection Concept. Office of Nuclear Security, Department of Nuclear Safety and Security, http://www.eurosafe-forum.org/files/pe 191 24 1 5 10paper.pdf Hankook Ilbo (USA), 2010. http://www.koreatimes.com/article/577968 IAEA, 1980. Convention on the Physical Protection of Nuclear Material, INFCIRC 274/Rev. 1, Vienna. IAEA, 1996. Defense in Depth in Nuclear Safety, INSAG-10. A Report by the International Nuclear Safety Advisory Group. IAEA, 1999. The Physical Protection of Nuclear Material and Nuclear Facilities, INFCIRC 225 Rev. 4 (Corrected), Vienna. IAEA, 2004. Guidelines and Format for Preparation and Submission of Declarations Pursuant to Articles 2 and 3 of the Model Protocol Additional to Safeguards Agreements, IAEA Services Series No. 11. IAEA, 2009. Development, Use and Maintenance of the Design Basis Threat, Vienna. IAEA, 2012a. Design Basis Threat (DBT), http://www-ns.iaea.org/security/dbt.asp?s=4 IAEA, 2012b. INES (The International Nuclear and Radiological Event Scale User’s Manual) 2008 Edition (Revised). Joongang Ilbo (LA), 2006. http://www.koreadaily.com/news/read.asp?art id=860908 Joongang Ilbo, 2009. http://article.joinsmsn.com/news/article/article.asp?ctg=11& Total ID=3946138 Joongang Ilbo, 2012. http://article.joinsmsn.com/news/article/article.asp?total id= 8473956&ctg=1502 KINS, 2011. Pressurized Water Reactor Regulation Guide and Regulation, Korea. NCPA, 2001. National Policy Analysis #374: Terrorism and Nuclear Power: What are the Risks? The National Center for Public Policy Research (NCPA), Washington, DC. NSS Seoul, 2012. Seoul Communiqué. 2012 Seoul Nuclear Security Summit. http://www.seoulnss.go.kr/userfiles/s1.pdf Park, J.K., Park, J.Y., Kim, Y.K., 2013. A graded approach to cyber security in a research reactor facility. Progress in Nuclear Energy 65, 81–87. PROS, 2012. Scenarios of Nuclear Terrorism: An Analysis, Byron, IL. Rico, G., Beasley, J.S.,2006. Physical Protection Systems: Concepts, Analysis, and Practice in the ET Classroom. In: Science, Engineering, & Technology Education Conference. Department of Engineering Technology, New Mexico State University, Las Cruces, NM. Terrorism Information Integration Center, 2012. World Terror Occurrence List, Korea. http://www.tiic.go.kr/ Berg, H.-P., 2010. Risk management: procedures, methods and experiences. Reliability: Theory and Application 5 2 (17), 79–95. US NRC, 2012. Frequently Asked Questions About NRC’s Design Basis Threat Final Rule. http://www.nrc.gov/security/faq-dbtfr.html Wikipedia, 2012a. http://ko.wikipedia.org/wiki Wikipedia, 2012b. http://ko.wikipedia.org/wiki Wikipedia, 2013. http://en.wikipedia.org/wiki/September 11 attacks