Posted at the request of Roger Witherspoon, tour leader who was not able to attend SEJ due to unexpected illness.
Copyright 2001 The Journal News (Westchester County, NY)
All Rights Reserved
The Journal News (Westchester County, NY)
Some say jet attack on Indian Point could put region in danger
The Journal News
The deliberate crash of a wide-bodied jet into Indian Point may leave the massive containment domes around the nuclear reactors substantially intact, according to plant engineers. But outside analysts say that may not prevent a reactor meltdown and the spread of radiation throughout the region.
Those divergent views emerged from an examination of the internal structure of Indian Point 2 and 3 by two officials from Entergy Nuclear Corp., which owns the plants, and two outside engineering experts in the nuclear industry. The four together reviewed the schematic diagrams of the plant's containment buildings and their support structures and systems during a meeting arranged by The Journal News.
The plans have been withheld from the public for security reasons, but Entergy officials allowed The Journal News and outside experts to view them in an effort to explain why they believe the public would not be in danger in the event of an aerial attack on the plants.
Entergy's offer to examine the plans comes amid growing community and political criticism of the plants and their ability to sustain a terrorist attack. Calls to shut the plants or convert them to natural gas reached new heights following the destruction of the World Trade Center by two hijacked jetliners Sept. 11. The hijacked planes flew over Indian Point en route to the Twin Towers.
Since Sept. 11, the U.S. Nuclear Regulatory Commission has said the plants' containment domes were not designed to withstand such an assault. But Entergy officials have insisted there would be no danger to the region if Indian Point were attacked by air, even if the plants were destroyed.
The outside analysts, however, assert that the public would be in danger because all of the systems needed to control the nuclear reactor are outside the containment's protective shell and could not be counted on in such an emergency.
Entergy officials also believe that the more than 600 tons of stored spent fuel in each pool would be protected in a partially underground "bathtub," even if the building around it were destroyed.
They concede, however, that the building is vulnerable to a crashing jet, that the effects of a blast and fire are unknown, and that protecting the spent fuel requires the ability to continually pour water on it from systems that may or may not work.
Layers of protection
Yet Michael Kansler, Entergy's chief operating officer, said residents should not worry that if a plane were to crash into Indian Point, "we'd have a Chernobyl."
"Our contention is that that just can't happen," he said. "There are too many layers of protection."
Those layers, he said, include separate electrical and pumping systems that he argues would enable the plant to keep radioactive fuel in the reactor, cool the spent fuel pool and prevent any massive release of radiation.
"I wasn't saying we can just clean up and start the unit up again," Kansler said. "From the standpoint of radiological release and emergency planning it would be a mess. You hit the containment, I've got systems outside that can get water in there. You hit outside (the containment building), I've got stuff in the containment that can control the reactor.
"You're never going to have a plant that's going to run again. You're going to have a heck of a mess to clean up. But you're not going to have a Chernobyl cloud spreading down to New York City."
Kansler said the strength of the containment building would prevent the destruction of the nuclear reactor itself. And as long as the reactor vessel remained intact after an attack, Kansler said, he believes he could keep coolant water on the nuclear fuel and prevent a meltdown and radioactive release.
His position was challenged by David Lochbaum, a nuclear systems engineer and nuclear safety expert at the Union of Concerned Scientists in Washington, D.C., one of the two nuclear experts asked to review the Indian Point plans by The Journal News.
"Entergy's assertion that the reactor vessel will remain intact following an aircraft impact has little or no relevance to the question of whether the public will be harmed," Lochbaum said. "(Kansler) focuses on whether the containment keeps a plane in or out. The control building, the auxiliary building, all the equipment that cools the stuff inside the containment is located outside containment.
"You don't need to get inside the containment building to cause a core meltdown. Significant fuel damage with release of radioactivity to the atmosphere can occur even when the reactor vessel remains intact."
Consolidated Edison, Indian Point 2's previous owner, said in an August 1996 analysis that the containment dome had a 15 percent chance of failing following a reactor meltdown.
The only area of agreement between Entergy and the outside analysts was that the containment buildings at Indian Point are among the strongest in the industry and are unlikely to be totally destroyed even if directly struck by a Boeing 767, the same kind of plane that hit the World Trade Center. There are no definitive studies, however, on the potential effects of such a blast.
The containment buildings for Indian Point 2 and 3 are each 130 feet in diameter, with a ?-inch steel lining. The side walls are 4y feet thick, made of reinforced concrete, and the domes are 3y feet thick. The steel reactor itself has a 25-ton concrete "blast shield" on top of it, and its lower half sits in a concrete bed with 6-foot-thick walls.
The engines of a 767 airliner could probably punch through the structures, the four men agreed, and the force of the impact would produce "scabbing," in which large chunks of concrete and steel would be knocked from the dome onto the reactor and steam generators below.
"The shell is very strong," said Christian Meyer, a professor of civil engineering at Columbia University who has worked on the design of containment buildings, and who examined Entergy's schematics with Lochbaum. "The whole plane crashing in and destroying the reactor - there is no way. But you can puncture holes, and enough fuel can get in to start a fire."
Kansler speculated that the holes made by a jet's engines would be only 1 or 2 feet wide. But a 1982 Department of Energy study of the impact of airplane crashes into containment buildings, conducted at the Argonne National Laboratory in Illinois, said the holes would be much larger than the diameter of the huge jet engines.
Kansler said some fuel was likely to enter the containment building with the engines, either as a liquid or a gas. "But you're not going to get the bulk of that airplane's fuel through that hole in the containment, even if the engine got through," he said. "And you may have a fire, but you have a lot of protection down here."
That point, too, is disputed by the Argonne report, which said that much of the fuel would form a gas cloud and flow into the containment and other buildings.
Because a 767's 159-foot fuselage is hollow, Kansler said, he believes it would crumble harmlessly outside the containment building, along with the wings.
Meyer did not concur that the impact from the wings would be so negligible. He said each wing holds several thousand gallons of fuel, adding mass to what is otherwise a hollow shell.
Meyer cited a Columbia University forum held last month on the destruction of the World Trade Center, which included a simulation by Ivan Sandler, a specialist on impacts, of jets crashing through steel building supports. The simulation showed a jet's wings easily slicing through supports of up to 2 inches thick. Those supports are more than twice as thick as the lining and reinforced steel bars in Indian Point's containment domes.
"I was surprised to see the wing sheared through so many columns," Meyer said. "If you had asked me before Sept. 11, I would have said it could never cut through. It is overly primitive to say only the engines can go through."
Sandler, of the New York-based firm Weidlinger Associates, said in an interview that the strength of the fuel-laden wings must be considered and that "the forces required to stop that mass of fluid are greater than the simple strength of the wing itself."
In addition, he said, the fuselage would not necessarily crumple and fall harmlessly away from the containment building.
"Because of its length," Sandler said, "it has a fair amount of metal, so it doesn't collapse easily. The fuselage is long and more and more of it keeps arriving. In the end you have a large solid block. It's like putting a straw through a tomato; if the impact's right, you can do it."
But Kansler said even a fuel fire would not be hot enough to melt the zirconium cladding on the fuel rods. As long as he could keep pumping water into the containment building, Kansler said, he has nothing to fear from a jet fuel fire.
The fire and scabbing could destroy the steam generators, however, resulting in a loss of coolant, Kansler said. An accident involving loss of coolant is the most serious in the nuclear industry, and could lead to a core meltdown.
But Kansler said water still could be forced into the containment building, and the fuel kept wet, so it did not reach peak temperatures that would lead to a meltdown and release of radiation.
Radioactive spent fuel pool
Adjacent, but not attached to the containment buildings, is the spent fuel pool, located in a building with a flat, 2-foot-thick concrete roof. The building is on a hill, and 15 feet of the 40-foot-deep pool is below ground level, with a 6-foot-thick concrete lining.
There are about 600 tons of highly radioactive spent fuel in the pools, stored in bundles 12 feet long that stand on the bottom. At ground level, the pool has 3 feet of water over the fuel, about a third of which is highly radioactive plutonium.
If a plane hit the fuel pool building, Kansler said, it would go through the roof and "would be pretty ugly."
"I don't believe it would go through the walls of the pool, and you'd have a heck of a fire," he said.
Richard Drake, Entergy's supervisor of design engineering at Indian Point 3, said the water should absorb much of a crash's shock, thus preventing a plane from destroying the building. He disagreed with an NRC report from October 2000, which stated that a jetliner could crash through the building, cause a loss of coolant and trigger a meltdown and radioactive fuel fire.
Kansler said that because much of the pool is below ground, it is effectively a "big bathtub." He said pipes underneath and above the pool would enable him to keep the contents wet.
If necessary, he said, the volunteer Buchanan Fire Department could pump water onto the spent reactor fuel faster than the burning jet fuel could evaporate the water.
Meyer, again, disagreed, saying: "If somebody wanted to slam into the fuel building, they would absolutely go through. There is no question about that. And if you are able to destroy the integrity of the pool, and the water disappears faster than they can replenish it, then you get radioactivity."
Control, safety systems
A major point of contention between Kansler and Lochbaum lay in the ability of Entergy to maintain control over the plant and its emergency systems in the event of a crash. A 1982 report by Con Edison and the Sandia National Laboratories said that the control building was the only single building which, if hit, could lead to a core meltdown.
A meltdown would mean the release of radiation into the atmosphere, NRC spokesman Neil Sheehan said.
But Kansler said that even if the control building were destroyed, Entergy has backup control panels at several locations around the site and would still be able to shut down the reactor and operate cooling systems. There also is an automatic safety system on the reactor, though Con Edison was cited by the NRC in March for improperly rewiring the system at Indian Point 2. The NRC says the safety system works, however.
Lochbaum said Entergy was relying on the belief that terrorists would come in only one jet and would strike the containment building, the strongest building on the site. He said that building was not the most likely terrorist target, and that it was unsafe to assume there would be only one plane.
Meyer agreed, saying, "If you are a terrorist, you wouldn't want to go for the containment. The World Trade Center showed they did all their homework. They are not only lucky, but smart. You have to be prepared for a worst-case scenario."
Safety systems at Indian Point are vulnerable to disruption from an explosion, concussion and fire, said Lochbaum, who also cited fuel stored on site for diesel generators, a gas pipeline running through the facility and other chemicals that could explode and burn.
All of these factors, he said, would compromise the ability of Kansler's teams to operate Indian Point's emergency systems.
"Look at what happened at Three Mile Island," Meyer said. "Before the accident, we said the probability was .0000001. But it did happen. All you need is a few errors in a series, and an accident will happen."
Reach Roger Witherspoon at firstname.lastname@example.org or 914-696-8566.
From the government studies ...
Excerpts from government studies on the potential impact an airplane crash would have on nuclear power plants.
June 1982: "Evaluation of Aircraft Crash Hazards Analyses for Nuclear Power Plants," Argonne National Laboratory, for the Nuclear Regulatory Commission.
"The crash of an aircraft ... will release large quantities of fuel in the general vicinity of the crash site. ... A portion of the fuel will tend to mix with the surrounding air, forming a potentially explosive cloud. A major portion of the fuel will form pools or wet down the adjacent surfaces. ... Account has been taken of the internal concrete wall which acts as a missile barrier. ... It would appear, however, that this is too optimistic since vaporized fuel, hot gaseous reaction products, and to a certain extent portions of liquid fuel streams will flow around such obstructions.
"... It appears that fire and explosion hazards have been treated with much less care than the direct aircraft impact, and the resulting structural response. Therefore, the claim that these fire/explosion effects do not represent a threat to nuclear power plant facilities has not been clearly demonstrated."
July 15, 1986: Letter from former NRC Chairman James K. Asseltine to Carl Walske, president, Atomic Industrial Forum, regarding Asseltine's May 22 testimony before Congress.
"Given the present level of safety being achieved by the operating nuclear power plants in this country, we can expect to see a core meltdown accident within the next 20 years, and it is possible that such an accident could result in off-site releases of radiation which are as large as, or larger than, the releases estimated to have occurred at Chernobyl.
"I recall reading in the newspapers in recent months statements by senior officials within the nuclear industry that our plants are 'perfectly safe' and we 'will not have a Chernobyl-type plant accident here.' Apparently, such absolute statements are thought to be needed to counter-balance arguments from the other side that there is an immediate threat to the public which requires the shutdown of our nuclear plants. In my view, neither position is accurate. To convey an impression that Chernobyl-type releases are impossible in this country is as inaccurate as conveying an impression that a similar disaster is a certainty."
December 1987: "Evaluation of External Hazards to Nuclear Power Plants in the United States," Lawrence Livermore National Laboratory, for the NRC.
"The effect of an aircraft of sufficient weight, traveling at sufficient speed, crashing at a nuclear power plant site may result in physical damage and disruption to the plant to the extent that damage to the reactor core, damage and release of radioactive material from the reactor core may result. ... No sabotage or deliberate 'kamikaze' crashes are considered."
"Unfortunately, the few probabilistic risk analysis that have considered aviation accidents ... have dismissed aviation accidents on the basis of the aviation accident frequency."
October 2000: "Technical Study of Spent Fuel Pool Accident Risk at Decommissioning Nuclear Power Plants," by the NRC.
"Aircraft damage can affect the structural integrity of the spent fuel pool or the availability of nearby support systems, such as power supplies, heat exchangers, or water makeup sources, and may also affect recovery actions. ... It is estimated that (half the commercial airplanes now flying) are large enough to penetrate 5-foot-thick reinforced concrete wall."
Behind this story
Architectural plans for Indian Point were made available for review by The Journal News at Entergy's White Plains headquarters by Michael Kansler, the company's chief operating officer, and Richard Drake, supervisor of design engineering at Indian Point 3. Kansler, a mechanical engineer with 20 years' experience, heads Entergy's nuclear operations in Massachusetts and New York.
Also reviewing the diagrams were Christian Meyer, a structural engineer and professor of civil engineering at Columbia University, and David Lochbaum, a nuclear systems engineer and nuclear safety expert at the Union of Concerned Scientists in Washington, D.C. Meyer formerly worked at Stone and Webster Engineering Corp., which designs containment buildings, including the Shorham nuclear plant on Long Island. Lochbaum spent 20 years as a nuclear systems specialist in the industry, including three years at Indian Point 3, before joining the UCS.
The analysis of the nuclear plants was divided into the following basic areas: the strength of the containment building and its ability to withstand a crash; the layout of the spent fuel pool and protections around it; the layout of control facilities, electrical, safety and pumping networks; and the ability to prevent or minimize a meltdown in the reactor core or spent fuel pool.