Paper Presented at NPEC/King’s College conference “After Iran: Safeguarding Peaceful Nuclear Energy” held in London, UK October 2-3, 2005.
Oct 01, 2005
AUTHOR: Edwin S. Lyman
Can Nuclear Fuel Production in Iran and Elsewhere Be Safeguarded Again…. (PDF) 96.24 KB
Can Nuclear Fuel Production in Iran And Elsewhere Be Safeguarded Against Diversion?
Dr. Edwin S. Lyman Senior Staff Scientist, Global Security Program Union of Concerned Scientists Washington, DC DRAFT: September 28, 2005
Introduction: Material Accountancy is Still Relevant
The challenges to the nonproliferation regime over the last fifteen years posed by the crises in Iraq, North Korea and Iran have led to an increased preoccupation among the international community with the lack of capabilities of the IAEA to detect undeclared facilities for production of fissile material. However, the foundation of IAEA safeguards remains the ability of the Agency to effectively verify the absence of diversion of special nuclear material from declared facilities. One must assume that the vast quantities of weapon-usable plutonium flowing through commercial reprocessing and MOX fuel fabrication plants will continue to present attractive targets to those looking to covertly acquire small stockpiles of nuclear explosives. Likewise, the huge SWU capacity of large commercial gas centrifuge plants will provide a temptation for those who may wish to divert a small fraction of that capacity toward HEU production. Consequently, such activities should be forbidden in the absence of highly credible assurances that all significant diversions will be detected in a timely manner. The nuclear industry will rightly not be able to increase public confidence in the security of the nuclear fuel cycle if it continues to operate facilities where dozens of bombs’ worth of plutonium or HEU could conceivably go missing annually without being detected.
However, experiences with safeguarding plutonium bulk-handling facilities in Japan and Europe have made clear that the even when discrepancies in material accountancy arise, the response is anything but timely. The Agency’s reluctance to escalate the significance of unresolved discrepancies to the level of violations of safeguards agreements have led to standoffs in which anomalies have remained unresolved for years or even decades. Clearly, this state of affairs is intolerable in the context of the current global threat environment.
The question of whether bulk-handling uranium facilities for conversion or enrichment can be effectively safeguarded against diversion raises somewhat different issues than those at plutonium bulk-handling facilities. Since the facilities under normal operating conditions do not involve weapon-usable process materials, the risks associated with diversion are indirect and are related to the effectiveness of enhanced safeguards measures both to exclude the possibility of reconfiguring declared centrifuge plants to illicitly produce highly enriched uranium, and to exclude the existence of clandestine enrichment plants that could utilize undeclared feed. However, even the IAEA Director of Safeguards has conceded that the additional authority provided to the Agency under the Additional Protocol is not sufficient to ensure that it will be able to discover all undeclared activities at undeclared locations.[1] Thus again, the credibility of safeguards remains dependent on the ability of international inspectors to ensure that significant quantities of nuclear materials cannot be diverted without detection from safeguarded facilities to undeclared ones, even if the materials are not direct-use.
Another reason why detection of diversion remains crucially important is the growing threat that sophisticated subnational groups, perhaps with State assistance, could obtain fissile materials to construct crude nuclear weapons for use in terrorist attacks. The world has only begun to fully appreciate the magnitude and seriousness of this danger in the aftermath of the 9/11 attacks. The diversion of small yet significant quantities of plutonium, which may be less of a concern for states that may be able to acquire and operate clandestine facilities or have massive and rapid breakout capabilities, would be of major import if it were carried out by or on behalf of a subnational group whose objective is to acquire only a small number of weapons for terrorist purposes. And in this case, the notion of timely warning must be reevaluated, since the concept as it applies to States is not directly applicable to terrorist groups that are immune to political pressures and may be able to evade capture for long periods of time if they are able to successfully escape with diverted material. Thus a security and safeguards posture that is stringent enough to deter diverters must be a fundamental goal, because the game may well be over once sufficient material is diverted.
Of course, the IAEA does not have formal authority to address subnational threats, which are the responsibility of State Systems of Accounting and Control (SSACs). However, it is apparent that improving the quality of SSACs of sufficient quality to provide the IAEA with a stringent capability to detect diversions by the operator would also provide the operator with an enhanced capability to detect diversions by insiders.[2] The problem is that aspects of domestic security that are important in countering internal threats, such as access authorization programs, would remain out of the IAEA’s formal domain, even under the provisions of the revised Convention on Physical Protection of Nuclear Material (CPPNM). This dichotomy between state and non-state actors, which appears more and more artificial today in a world where their interests are often intertwined, will hinder efforts to build comprehensive systems to effectively ensure that civil nuclear facilities cannot become covert sources of fissile material for either states or subnational groups.
There are indications that instead of moving to strengthen material accountancy practices, the IAEA is actually moving to weaken them. According to the IAEA 2004 Safeguards Statement, the Standing Advisory Group on Safeguards Implementation (SAGSI) “found that the Safeguards Criteria were basically sound, but that a key priority is the wider implementation of integrated safeguards.”[3] However, for the reasons stated above, the IAEA should avoid an excessive focus on pursuing integrated safeguards at the expense of improving basic material accountancy measures at declared facilities.
The Challenges of Detecting Diversion at Plutonium Bulk-Handling Facilities
In 1990, the Washington, D.C.-based Nuclear Control Institute issued a seminal paper by Dr. Marvin Miller of the Massachusetts Instititute of Technology, entitled “Are IAEA Safeguards on Bulk-Handling Facilities Effective?”[4] This paper illustrated, in simple yet stark terms, that the IAEA, as a result of technical and political obstacles, was unable to meet its detection goals for large-throughput plutonium bulk-handling facilities, e.g. reprocessing and plutonium fuel fabrication plants. Miller argued that this conclusion is significant because he believed that it was reasonable to regard the detection goals as performance criteria for effective safeguards, not only to maintain the credibility of the international safeguards system but also to help ensure that national systems of accountancy and control would be stringent enough to deter subnational diversion.
One purpose of the present paper is to revisit Miller’s arguments in light of any technical and political developments related to nuclear material accountancy over the last fifteen years, and to assess whether the conclusions of his article remain true today.
The IAEA “detection goals” have not changed since Miller’s paper was written, although they are no longer universally applied. The goal remains the detection of a diversion of a “significant quantity” (SQ) of unirradiated direct use nuclear material (8 kilograms of plutonium or 25 kilograms of uranium-235 contained in HEU) within one month; one SQ of irradiated direct use material (about the equivalent of two pressurized-water reactor spent fuel assemblies) within three months; and indirect use material (75 kilograms of uranium-235 contained in low-enriched or natural uranium) within one year. However, these timeliness detection goals may be extended in states that have adopted the Additional Protocol and where the IAEA has concluded that undeclared nuclear materials and activities are absent, as part of the initiative known as “integrated safeguards.”
Miller observed that for large bulk handling facilities, such as the 800 metric ton heavy metal (MTHM)/year Rokkasho Reprocessing Plant (RRP) now undergoing startup testing in Japan, it was not possible with the technologies and practices available at the time to detect the diversion of 8 kilograms of plutonium (1 SQ) — about 0.1% of the annual plutonium throughput — with a high degree of confidence. This is because the errors in material accountancy measurements at reprocessing plants were typically on the order of 1% — that is, a factor of ten greater than an SQ. If after taking a physical inventory, the value of plutonium measured was less than expected (on the basis of operator records) by an amount on the order of 1 SQ, it would be difficult to state with high confidence that this shortfall, known as “material unaccounted for” or MUF, was due to an actual diversion and not merely measurement error.
In the past, the IAEA acknowledged that the 1 SQ detection goal could not be met in practice, and instead adopted a relaxed standard known as the “accountancy verification goal” (AVG), which was “based on a realistic assessment of what then-current measurement techniques applied to a given facility could actually detect.”[5] The AVG was based on a quantity defined as the “expected accountancy capability” E, which is defined as the “minimum loss of nuclear material which can be expected to be detected by material accountancy,” and is given by the formula E = 3.29∂A relative uncertainty in measurements of the plant’s inputs and outputs, and A is the facility’s plutonium throughput in between periodic physical inventories.[6] This formula is derived from a requirement that the alarm threshold for diversion be set at a confidence level of 95% and a false alarm rate of 5%.
Miller estimated that for the RRP, based on an input uncertainty of ±1% (which was the IAEA’s value at the time for the international standard for the expected measurement uncertainty at reprocessing plants), the value of E would be 246 kilograms of plutonium, or more than 30 SQs, if physical inventories were carried out on an annual basis, as was (and is) standard practice. This means that a diversion of plutonium would have to exceed this value before one could conclude with 95% certainty that a diversion had occurred and that the measured shortfall was not due to measurement error.
Apparently, the IAEA no longer uses the AVG as a standard for material accountancy, and the term was not mentioned in the revised Safeguards Criteria issued in 1991.[7] The term also does not appear in the 2001 edition of the IAEA Safeguards Glossary. While some have characterized the elimination of this criterion as an attempt to strengthen material accountancy standards, it could also be regarded as a way of concealing the embarrassingly poor capabilities of conventional material accountancy methods.
Miller also identified other problems which contribute to the difficulty of detecting diversions on the order of 1 SQ, such as the accumulation of plutonium in waste streams such as cladding hulls that are not amenable to accurate assay by non-destructive means. The accumulation of plutonium in such hard-to-measure forms can lead to significant and growing contributions to cumulative facility MUFs.
An Aside on False Alarm Rates
Even if the IAEA were able to meet its detection goals, those goals are arguably inadequate given the evolving trends in the threats from nuclear proliferation and nuclear terrorism that have become especially apparent since the 9/11 attacks.
For instance, the detection probability guidelines of 90 to 95% confidence level and 5% false alarm rate established by the Standing Advisory Group on Safeguards Implementation (SAGSI) in the 1970s do not appear to be sufficiently stringent today. The Agency’s reluctance to pursue higher confidence levels for detection of diversion, at the expense of higher false alarm rates, would seem to be a lesser concern in the context of the heightened security levels that have become standard operating practice around the world since the 9/11 attacks. Today, most people are willing to tolerate a level of sensitivity for security screening at airports and critical facilities that would not have been acceptable in the past because of a common appreciation that the occasional false alarm is an appropriate price to pay to ensure that policy of as close to zero-tolerance as possible for the prevention of another 9/11-scale terrorist attack. Similarly, the standards for assurance that safeguards on plutonium used in the civil sector will be stringent enough to ensure an extremely high level of deterrence against diversion or theft should likewise be increased today, yet it has not been. On the contrary, a growing appreciation of the inability of current measures to meet quantitative detection goals have led to a retreat from the notion that such goals should even be considered as standards for future achievement.
Failures of Material Accountancy
Since the release of Miller’s paper in 1990, numerous examples have come to light of serious lapses in material accountancy at bulk-handling facilities around the world, involving the occurrence of large MUFs that remained unresolved for years or even decades. The reasons for these lapses illustrate some of the fundamental problems encountered at bulk-handling facilities that prevent timely closure of material balances and that must be overcome if the IAEA detection goals are to be met. These problems include accumulation of residual holdup, accumulation of scrap and waste materials in hard-to-assay material forms, inaccuracies in nuclear material estimation methods, and operator complacency/incompetence.
The problem of residual holdup led to a significant material accountancy failure at the Plutonium Fuel Production Facility (PFPF), a MOX fuel fabrication facility at Tokaimura in Japan. Residual holdup is defined as material that remains behind after the in process inventory is removed for measurement prior to the taking of a physical inventory. Residual holdup resulting from the adhesion of powders on process equipment and accumulation in cracks, corners and pores can result in persistent MUFs that grow with time. Ultimately, these MUFs can only be resolved by dismantlement and careful cleaning of process equipment.
At PFPF, operators noticed an unusually severe residual holdup problem soon after the plant started up in 1988. As a result, the plant operator PNC, in conjunction with safeguards experts at Los Alamos, designed an NDA system to measure residual holdup in-situ known as the Glovebox Assay System (GBAS). However, measurement biases contributed to an overall uncertainty of about 15%. By 1994, the plant MUF had grown to about 69 kilograms of plutonium. Even if this entire amount was residual holdup, given the measurement uncertainty associated with the GBAS, the IAEA could not exclude the possibility with a confidence level of 95%, based on NDA measurements alone, that at least 1 SQ had been diverted. Consequently, the IAEA wanted PNC to cut open the plant gloveboxes, remove the holdup directly and measure it with destructive assay (DA) methods. PNC balked at this request, and the dispute remained unresolved until the Nuclear Control Institute (NCI) publicly disclosed the existence of the discrepancy in 1994, after which PNC agreed to shut down the plant, recover the holdup, and install new equipment to reduce further holdup accumulation and improved NDA systems for measuring residual holdup more accurately. After an expenditure of $100 million to remove and clean out old gloveboxes and install new ones, PNC announced in November 1996 that it had reduced the MUF to less than 10 kilograms. Thus resolution of the MUF took more than two years after the situation became public.
Another long-unresolved MUF issue at Tokai-mura was associated with the accumulation of plutonium-laden fuel scrap resulting from decades of MOX research and production activities at the site.[8] Press reports in the mid-1990s indicated that the scrap inventory at Tokai contained between 100 and 150 kilograms of plutonium.[9] However, much of this scrap was in an impure form that could not be accurately measured via NDA methods. An instrument known as the Plutonium Scrap Multiplicity Counter (PSMC), developed by Los Alamos, was good for assaying clean scrap but was much less useful for assaying plutonium that was contaminated with moisture or other substances containing light elements that could generate neutrons through (a,n) reactions. For such heavily contaminated scrap, the measurement precision ranged from 10- 50%, which is well over the 4% uncertainty cited by the IAEA as the acceptable international standard for scrap measurements.[10] At an average precision of 10%, the uncertainty associated with measuring a scrap inventory containing 150 kilograms of plutonium would be greater than 1 SQ, and the 95% confidence level for detecting diversion would be over six SQs. Consequently, the IAEA wanted the plant operator, PNC, to chemically purify the scrap so that it could be made homogeneous and could be more precisely measured using DA. PNC apparently had long-range plans to build a facility for aqueous processing of the scrap but a formal agreement with the IAEA that it would do so was not reached until 1998, when the IAEA reported announced that the plant operator would embark on a five-year program “aimed at reducing the inventory of heterogeneous scrap material,” which would be “gradually homogenized to allow enhanced verification, including destructive analysis.”[11] Aside from a short mention in the IAEA 2000 Safeguards Statement of the implementation of a containment and surveillance approach for the receipt and storage of MOX scrap at something called the “Critical Solution Facility” in Japan,[12] no public information could be located by the author regarding the status or outcome of this program.
Measurement and estimation errors also contributed to substantial material accountancy failures that occurred at the spent fuel reprocessing plant at Tokai since it began operating in 1977. In January 2003, Japan admitted that the cumulative shipper-receiver difference — that is, the difference between the amount of plutonium that was estimated to have been shipped to the reprocessing plant and the amount that had actually been measured -
-was 206 kilograms, or about 25 SQs. This was nearly 3% of the total amount of plutonium estimated to have been processed in the plant over its lifetime. A few months later, Japan revised its figures, claiming that the actual discrepancy was 59 kg, with the remainder either bound in cladding hulls (12 kg), discarded with high-level liquid waste (106 kg), or decayed into americium-241 (29 kg). However, it was unclear how figures as precise as these were derived, given the uncertainties inherent in measuring the plutonium in cladding hulls and in high-level waste, and the uncertainties in determining the initial isotopic composition.
MUF issues have arisen in other countries that produce and process plutonium, including France and the United Kingdom. The Euratom Safeguards Agency reported in 2002 that “the annual verification of the physical inventory of the Cogema-Cadarache plant in France found an unacceptable amount of material unaccounted for (MUF) on the plutonium materials.”[13] The problem was later attributed to issues associated with differences between measurement results taken by inspectors and operators and with the accounting of poorly defined historical materials (although it is unclear why the issue did not arise until 2002, if that were the case). The finding of “high values of MUF” was reiterated in the 2003 report. It was reported in September 2004 that Euratom had “recently” sent a response to Cogema accepting its explanation for the 2002 MUF finding. Thus it took at least two years to resolve the discrepancy (and the time period would potentially be much longer if it was due to long-stored historical materials).
In the U.K., the most recent audit of nuclear materials at Sellafield, published on 17 February 2005, revealed a plutonium MUF of 29.6 kilograms, or about 3.5 SQ. BNFL insisted at the time that the figure did not mean that any material had been removed from its plants and that “the techniques we use to account for our nuclear material are internationally approved and recognized as best practice. In particular, the systems of statistical measurement and control in the Thorp reprocessing plant to estimate the amount of plutonium are the most advanced in the world …”.[14]
BNFL was forced to eat these words only a few months later when the public was informed on May 9 of a massive leak at Thorp that had gone undetected for nine months. The leak, which occurred in a feed pipe to one of the two accountancy vessels, resulted in the accumulation of 83.4 cubic meters of dissolver solution, containing an estimated 19 metric tons of uranium and 190 kilograms of plutonium.[15] In spite of the fact that the leak occurred at an accountancy tank, which is where the initial inventory is measured for the purpose of establishing shipper-receiver differences (SRDs), the steadily increasing loss of material did not attract notice until eight months after it began. To the credit of the plant’s material accounting system, first indications of a problem came not from any safety indicators (several of which were malfunctioning), but from the Safeguards Department, when it detected an anomalous SRD in March 2005. However, an unambiguous finding of a leak did not take place until a month later.
In BNFL’s review of the incident, it commended the role of the Safeguards Department in detecting the leak, but pointed out that the Nuclear Materials Accountancy system “is intended to provide overall accountancy balances,” but “is not designed to (nor is it intended that it should) be responsive to track material on a more real time basis.” BNFL goes on to recommend introduction of “a nuclear material tracking regime … with the objective of promptly detecting primary containment failure or misdirection of material.”[16]
This statement appears completely baffling in view of the claims that BNFL had made previously, and fully supported by Euratom, regarding the status of near real time accountancy at Thorp. For instance, in a paper delivered at an IAEA safeguards symposium in 2001, a joint paper by BNFL and Euratom safeguards officials stated that “Near Real Time Materials Accountancy (NRTMA) is fully operational in the Thermal Oxide Reprocessing Plant (Thorp), providing regular assistance of high quality material control.”[17] One can only conclude that this claim was a bluff — a bluff that has now been called.
Even more troubling than the control failures on the part of the operator was that Euratom also appeared to be asleep at the wheel. Thorp is allegedly under Euratom safeguards, which is charged with verifying that there has been no diversion of plutonium, based on a timeliness criterion identical to that of the IAEA (one SQ within one month). In addition to having access to the operators’ accountancy data, Euratom apparently also had independent access to process data, upon which it performed its own statistical tests.[18] Yet there is no indication that Euratom inspectors were any more successful than the plant operators at detecting the leak and sounding an alarm. If this was indeed the case, this incident does not instill confidence in the ability of Euratom safeguards to detect a diversion.
Have Things Improved?
While the above real-world examples demonstrate the practical difficulties of ensuring through material accountancy methods the timely detection of diversions of significant quantities of plutonium at large, complex, messy, bulk-handling facilities, it is reasonable to ask whether they are representative of the situation today. After all, these facilities by and large are fairly old, and were planned and built decades ago; many of the most challenging material accountancy problems resulted from processes that were not optimized for safeguards effectiveness or from inventories of poorly characterized legacy materials. Can’t we do better now?
Miller observed that his assessment of the limitations of material accountancy could change if improvements were made in the technical capabilities of material accountancy tools. In particular, he cited (1) a reduction in the overall measurement uncertainty in the chemical process area; (2) the use of near-real-time accountancy on a weekly basis to improve the sensitivity of tests for protracted diversion; and (3) a reduction in the measurement error of plutonium in waste streams such as cladding hulls and sludges.
With regard to (1), perhaps the best indication that there has been little progress in reducing measurement uncertainties since Miller’s paper was written is the fact the IAEA “expected measurement uncertainty” associated with closing a material balance at a reprocessing plant remains 1% as of 2001, the same value reported by Miller in 1990.[19]
With regard to (2), near-real-time accountancy (NRTA) is a method in which inventories are taken and material balances closed on a much more frequent basis than the conventional annual physical inventory. By reducing the throughput of material associated with a material balance, the ability to detect diversions is improved. For instance, Miller showed that the threshold for detection of an abrupt diversion of 1 SQ of plutonium at a large bulk-handling plant could be accomplished by use of NRTA with physical inventories carried out on a weekly basis. However, given that the time to take a physical inventory of a large facility is approximately one week, including preparation time, cleanout of process equipment, measurement of the inventory, and reconciliation of anomalies,[20] such a high frequency of physical inventories is utterly impractical. Thus NRTA must utilize inventory measurements of in-process materials where possible, and its effectiveness will depend in large part on the uncertainties associated with these measurements. A major question is, therefore, whether NDA techniques have improved over the past fifteen years to the extent that the benefits of NRTA can be fully realized. The uncomfortable fact of the leak at Thorp, where NRTA was purportedly “fully operational,” tends to raise doubts as to whether NRTA is yet capable of fulfilling its promise.
Finally, with regard to (3), considerable efforts at LANL and elsewhere have been made over the last decade to improve the capabilities of NDA instruments for waste measurements. The development of neutron multiplicity counters and high-efficiency epithermal neutron counters, showed some promise in improving the precision of plutonium in waste drums. However, as was seen above, these instruments perform best when measuring well-characterized and pure materials, but provide marginal benefit when measuring low-assay, contaminated and heterogeneous plutonium materials.
Any comprehensive assessment of the capabilities of material accountancy at large bulk-handling facilities today must include a review of the safeguards approach for the Rokkasho Reprocessing Plant (RRP), which is the only large-scale commercial reprocessing plant where IAEA safeguards are being applied. The safeguards system at Rokkasho, which has been under development since the early 1990s, is the product of a massive multinational effort and should be regarded as the state-of-the-art.
Independent of the technical capabilities of the safeguards system at RRP are two overarching points. First, according to members of the team who developed the safeguards approach, “the most important factor leading to the success” of meeting all the challenges of developing a safeguards system on the scale needed for the RRP is “the open and full cooperation between all parties – the IAEA, the State and the operator.”[21] Therefore, even the most fully developed and technically sophisticated safeguards system will likely fail in the context of an uncooperative or adversarial relationship between these parties, which is exactly the situation of most interest in considering the future of IAEA safeguards as an instrument for controlling the use of nuclear energy not only in friendly states but in potentially adversarial ones. Second, issues of cost and convenience played a major role in development of the safeguards approach and resulted in many questionable compromises. For instance, instead of having its own independent on-site analytical laboratory, the IAEA must share a laboratory with the facility operator. Clearly, this situation raises additional complications, such as the potential for tampering, that must be addressed.
A review of the overall safeguards approach at Rokkasho will be part of the final version of this paper. However, it is notable that no reports on the status of the Rokkasho safeguards system that the author has seen make the claim that the IAEA detection goals can be met at the facility. This fact, together with private communications the author has received, strongly suggest that the IAEA itself is not convinced that the safeguards approach at Rokkasho can meet its detection goals.
Conclusion
The bottom line is that nuclear material bulk-handling facilities, like other industrial facilities, are messy affairs. Although society may tolerate small leaks from a chemical plant to the environment if the hazards are limited, when the material in question can be used to build nuclear weapons, there is no acceptable level of leakage into the hands of hostile states or terrorists. The consequences of a single nuclear weapon falling into the wrong hands would be so catastrophic that there must be a zero-tolerance policy for diversion. If this standard cannot be met, then the underlying basis for claims that the closed fuel cycle can be adequately safeguarded against malevolent uses must be called into question.