Demonstration of the methods

To demonstrate the methods in the previous sections, without revealing details of the OKG specific analysis, the following example is based on a fictive DBT¹.

Two antagonists are defined in this fictive DBT, A1 and A2.

A1: A non-violent group of activists

Motif/Objective: The activists seek public attention to convey an anti-nuclear message through an illegal, but non-violent demonstration at the site. Their objectives may include attempts to penetrate protective barriers, if this is beneficial to the activists in attracting public attention and/or in strengthening their message.

Abilities: The activists have access only to information that is publically available. At site, they may try to break through protective barriers using “burglary type” tools, e.g. ladders, crowbars etc.

Pessimistic postulates: The description has one relevant degree of freedom. Actions including attempts to penetrate protective barriers are judged to be more challenging compared with more benign scenarios.

Such penetration attempts are therefore postulated to take place.

A2: A terrorist cell

Motif/Objective: The terrorists seek to create public fear, by causing a nuclear accident.

Abilities: Apart from publically available information, the terrorists have access to insider information regarding routines associated with normal operation. To achieve their goal they will if necessary use explosives to force protective barriers, with the intent of

1 This fictive DBT is based only on some simplistic assumptions using publically available information. It is developed for illustrational purposes only, and does not imply any similarity with the actual DBT issued by the Swedish regulator.

109 detonating a bomb somewhere in the power plant. Offsite power may be taken out in association with the attack, if this is beneficial to the terrorists with respect to the planned bombing.

Pessimistic postulates: The description has one relevant degree of freedom. Actions including loss of offsite power are judged to be more challenging compared with more benign scenarios. Offsite power is therefore postulated to be non-available.

After applying pessimistic postulates, two scenarios remain to be analyzed.

Scenario 1: A non-violent demonstration, including attempts to force protective barriers Acceptance criteria: Consequences must not exceed the limits defined for the event

class “normal operation”. (It must be possible to continue operation within the limits of the technical specifications.) Vulnerability analysis: The acceptance criteria will be violated if the activists are able

to provoke the operator to shut down the reactor. Given that reactor shut down is the normal operator response to conditions outside the technical specifications; all safety relevant equipment credited must be protected against conditions that may arise during the demonstration. In addition it is also necessary for the operator to be able to detect if the activists go beyond the conditions set for this scenario, since if this happens reactor shut down may very well be the appropriate action.

Protective measures: Safety relevant equipment is required to be placed inside the restricted area, which must have sufficiently robust walls, doors and other openings. It is also required that arrangements are made to detect unauthorized access to the restricted area, resulting in a verified security alarm.

Conclusion: By designing a protection of the safety relevant equipment that will withstand “burglary type” tools, normal operation may continue as long as there is no verified security alarm indicating a breach into the restricted area. Thus, given that the protective measures are implemented, the acceptance criteria for scenario 1 are met.

Scenario 2: A terrorist attack, including loss of offsite power and a bomb detonating somewhere in the power plant

Acceptance criteria: Consequences must not exceed the limits defined for the event class “unanticipated events. (Safe shut down must be achieved.

110

Some outage time is accepted for repairs and replacements of damaged equipment.)

Vulnerability analysis: The acceptance criteria will be violated if the terrorists are able to detonate a bomb at a “weak spot” in the power plant, i.e. in an area where a bomb detonation is likely to cause core damage or damage to spent fuel. The PSA models for the power plant may be used as one source of information to identify weak spots. If any weak spots are found, they may need additional protection, if the terrorists are likely to be able to identify them as targets.

E.g. some potential target areas (the main control room being one) are identified in the Swedish legislation through the requirement to show that the physical protection is sufficient with respect to the DBT. These areas must not fall into the category of “weak spots”, or if they do they need a protection to match. Weak spots due to dependencies that are very difficult to find without the aid of PSA, may not warrant the same priority in design of the physical protection.

Protective measures: Restrictions must be placed on the type of information that is put into documents describing routines for normal operation;

sensitive information regarding dependencies must not be given away. Adequate information security will thus prevent terrorists from selecting a relevant target for the bomb. If an attack involving a breach into the restricted area still occurs, this must be associated with a verified security alarm, triggering the operator to take relevant action. E.g. if a security alarm signals that the main control room is threatened, the operator is required to abandon it. In association with this, measures must be taken to bring the reactor to a safe shutdown mode and to prohibit unauthorized manoeuvres from the control room. In addition to these immediate actions, other measures may also be warranted.

If external intervention is credited as a mean to prevent a bomb from detonating near an identifiable weak spot, obstructing and delaying measures must be implemented to allow assisting forces to arrive in time.

Conclusion: By implementing administrative routines to protect sensitive information, and by making arrangements for security alarms and action plans for the operator to follow in case of an attack, the physical protection as a whole (including obstructing and delaying measures) will be sufficient to enable safe shut down and prevent core damage. Thus, given that the protective measures are implemented, the acceptance criteria for scenario 2 are met.

This demonstration shows how DBT-based analysis may be used to identify different protective measures, and to make an evaluation of the physical protection as a whole. Some

111 indication is also given on how the analysis may support prioritization between different measures. Another example of a decision support application is presented in section 3.2.

3. APPLICATIONS