Hermann Behmel, 71, is no environmental activist. In fact the geologist, who teaches at the University of Stuttgart, has nothing against nuclear power plants.
"My only problem with them," he says, "is when they are in the wrong place."
The government of Germany's southwestern state of Baden-Württemberg asked him for his advice 40 years ago, when plans were on the table to build the Neckarwestheim 2 nuclear power plant, about 40 kilometers (25 miles) north of Stuttgart. Behmel and two colleagues evaluated the site from a geological perspective between 1974 and 1976. Their assessment was unanimous. "The place is a geological time bomb," says Behmel.
But the plant was built nevertheless. The geological assessment disappeared into a file cabinet and Behmel stopped receiving commissions from the government. Today, as he watches images of the nuclear disaster in Japan flicker across his TV screen, he is reminded of all the frustrations he encountered back in the mid-1970s.
'All You Need Here Is a Sinkhole'
"We don't even need an earthquake in Neckarwestheim to have a major accident," says Behmel, who has a white mustache and wears a blue tweed jacket. "All you need here is a sinkhole."
What the state government stubbornly ignored at the time is no secret among geologists: Neckarwestheim sits atop an old quarry, complete with porous layers of gypsum and limestone. "About 1,000 cubic meters of hollow spaces form under the plant each year," Behmel explains. The spaces form when groundwater flushes away the porous rock or it crumbles on its own.
In November 2002, a crater 18 meters (59 feet) deep opened up in a field about five kilometers from Neckarwestheim. It happened "completely without warning," says Behmel.
The plant's cooling tower has already sunk by 40 centimeters. "If the layers of rock give way here, all of the cables could be ripped out," the geologist warns.
In the wake of the Japanese reactor catastrophe, Behmel's expertise could be in demand once again. Now, the state government in Baden-Württemberg -- governed by the conservative CDU in coalition with the pro-business Free Democrats (FDP) -- and Chancellor Angela Merkel suddenly want to know everything about the risks associated with German nuclear power plants -- particularly those posed by nature.
Most of the risks Behmel and other scientists have been warning about for decades have been viewed as negligible residual risk -- about as likely as a comet striking the Earth. And for sticklers for detail, the nuclear engineers were happy to note that the "mean core damage frequency" of a boiling water reactor, for example, is "2.2 x 10-6/a." In other words, this particular type of reactor is likely to explode once every 455,000 years.
Meltdown Just as Possible in Germany
But now, only 25 years after the disaster at Chernobyl, the next nuclear power plant is already on fire. Ironically, the accident has occurred in Japan, a country known for its painstaking attention to detail, which points to the obvious conclusion that a meltdown is just as possible in Germany.
This, for example, is the upshot of a risk assessment by Wolfgang Renneberg, the former director of the reactor safety and radiation protection division of the German Environment Ministry. "None of the plants operating today would satisfy the current international design requirements for new nuclear power plants," he writes. "We should not fool ourselves into believing that we would be able to control a meltdown."
Renneberg also believes that it is technically almost impossible to bring German reactors up to the latest safety standards. "It's like taking an old Citroen Deux Chevaux and trying to install the crumple zone of a modern car," he says. "You can't do it."
The most serious safety issues in German nuclear power plants have been known for a long time. The weakness have been carefully categorized and enumerated in straightforward lists, and are in documents that have been sitting in the files of government agencies for years.
The behavior of the nuclear regulatory agency in the western state of Hesse, which is responsible for the Biblis reactors, has been particularly negligent. In 1987, a potentially dangerous situation unfolded when radioactive cooling fluid leaked from the Biblis A reactor near Frankfurt.
When the public learned of the incident, then-state Environment Minister (and declared supporter of nuclear power) Karlheinz Weimar (CDU) ordered a comprehensive safety analysis. Experts prepared a long list of 49 technical improvements. These safety measures were to be implemented "by no later than the end of the inspection beginning in 1993," Weimar wrote in a 1991 directive.
Only Partially Implemented
But to this day, 20 years later, only 27 of the suggested improvements have been fully implemented. The others, according to the Hessian Environment Ministry, are "being worked on." Seven of the recommendations, which were designed to improve earthquake safety, such as upgrading the backup power systems, were only partially implemented.
Some regulatory officials are so apathetic that they don't even react when a plant's operator proposes fixing an urgent safety problem. For example, in a letter dated Sept. 5, 2007, the energy provider EnBW applied for permission to construct new buildings for backup generators and install a so-called emergency boration system, which provides a tool that was used last week to fight the impending meltdown in Fukushima.
The officials still haven't responded to the EnBW letter. Oskar Grözinger, the head of the state regulatory agency, now says that the cost of the new buildings would be out of proportion with the remaining life of the plant -- as if he were the electric utility's chief accountant.
Such apathy is now a thing of the past. Last week, the Neckarwestheim 1 reactor was shut down, along with six others, as a result of the nuclear moratorium announced by the Berlin government. An uncharacteristically forceful Environment Minister Norbert Röttgen (CDU) said that in the future German reactors would have to comply with requirements that they be protected against "combinations of events," like earthquakes and large-scale power outages.
The Best and the Worst
From now on, nuclear power plants will also be required to have four backup power systems, and each one must be capable of providing sufficient backup power on its own. The government is suddenly insisting that the reactors are brought in line with the "current state of science and technology."
This rhetoric is completely new. After the former Social Democratic (SPD) and Green Party coalition government voted in 2002 to phase out nuclear power, the electricity industry stopped making significant investments in the safety of its power plants. "We've been at a standstill for some time when it comes to safety," says Renneberg. This didn't even change last fall, when the current governing coalition in Berlin ratified plans to extend operating licenses for many nuclear power plants.
Two types of nuclear power plants are currently in use in Germany: boiling water and pressurized water reactors. They stem from different generations, but even the newest plants were built in the 1980s. None of the German plants would withstand a situation like the one in Japan, where all cooling systems failed. There are also significant differences in quality. Some plants are in poor condition while others are in better shape.
A member of the German Reactor Safety Commission has prepared a list of the best and worst power plants for SPIEGEL. At the bottom of the heap are the Brunsbüttel and Isar 1 nuclear power plants, followed by Philippsburg 1 and Neckarwestheim 1. The better plants include Emsland, Neckarwestheim 2 and Isar 2.
From the perspective of the operators, however, all plants are equally safe. This was the case before the Japanese accident, when EnBW was still praising Neckarwestheim 1, now shut down, saying that it could last another 60 years. The attitude remains pervasive today. "If the plants weren't safe, they wouldn't be operating today," RWE-Atom executive Gerd Jäger said testily after being told to shut down the Biblis reactors.
Which nuclear plants could survive the impact of a plane crash was long a state secret. The official explanation was that the government didn't want to aid terrorists in selecting potential targets. On the other hand, this begs the question of whether citizens have the right to know which reactors are especially vulnerable. Armed with this information, they could urge the government and operators to improve protections for the more vulnerable reactors.
One year after 9/11, the International Committee on Nuclear Technology (ILK), an investigative body set up by the German states of Bavaria, Hesse and Baden-Württemberg, reached a devastating conclusion. According to the classified ILK study, "severe to catastrophic releases of radioactive materials could be expected in the event of a crash against the reactor building" in all but three nuclear power plants.
And even for the three most sophisticated power plants that stood a chance of surviving the crash of a jumbo jet, the ILK experts speculated that a crash under unfavorable conditions, such as "a direct hit on the control room," could also lead to a major accident.
The reactors that are most at risk include all boiling water reactors in the early 69 series. "In these reactors, the spent fuel rods are stored in a holding basin directly underneath the roof," says physicist Oda Becker, who has prepared several studies for Greenpeace on the terrorist threat.
The old reactors that were designed before the series of crashes of Starfighter jets in the 1970s are practically unprotected. Prior to the accidents, reactor walls were only required to be about half a meter (about 20 inches) thick. Biblis A and Brunsbüttel near Hamburg are two cases in point. According to Becker, "even small passenger aircraft would expose these reactors down to the core in the event of a crash."
But retrofitting the reactors is practically out of the question. There is no room at the plants for reinforced ceilings, which would require changes to the foundations, or for drainage systems to remove burning kerosene. Besides, such improvements would be unaffordable.
Desperate to come up with solutions, plant operators questioned whether a terrorist in a hijacked plane would even be able to hit the reactor buildings. In response, the German government secretly ordered an analysis to determine whether terrorists with pilot training could meet the challenge.
The analysis consisted of professional and amateur pilots in a flight simulator owned by a major German airline performing virtual plane crashes against nuclear power plants. The results were alarming. The test series produced "a rather high strike rate," confesses Rainer Baake, a state secretary at the federal Environment Ministry from 1998 to 2005.
Response to Industry Pressure
For this reason, government agencies and plant operators have installed smoke screening systems to protect against attacks with commercial aircraft. When a commercial aircraft is approaching at an unusually close range, the system is designed to quickly envelope the reactor building in a thick cloud. The artificial fog is meant to obscure the vision of potential attackers until interceptors from the German military have taken off and either shot down the hijacked airliner or forced it to fly away from the reactor.
But the concept has a key shortcoming: In February 2006, the German Constitutional Court ruled that a law proposed by the federal government that would have permitted the military to shoot down hijacked passenger jets was unconstitutional. "This effectively killed the smoke screening concept," says Baake.
When the extension of plant lifespans was being negotiated, German Environment Minister Norbert Röttgen wanted to force the operators to improve protections against acts of terrorism. But in response to industry pressure, the government removed the anti-terrorism language from a list of required upgrades.
The list also includes no requirement to protect reactors against an attack with a rocket-propelled grenade. This, too, would constitute too much of a technical and financial challenge for companies. The current generation of this type of weapon is now capable of penetrating reinforced concrete three meters thick, so that not even the protective shields used in the latest German nuclear power plants are sufficient.
Money versus Safety
Money is ultimately the reason many plant safety improvements are not implemented. "If the government were to enforce all requirements that would help prevent a catastrophe like the one in Japan, we could go ahead and shut down all 17 nuclear power plants," says Renneberg, explaining the principle of money versus safety. "None of them would be profitable anymore."
Even the ill-fated Fukushima reactors are equipped with precautionary measures that German plants do not have. For example, Fukushima has steam-driven pumps that continue to feed water for cooling into the reactor when there is no electricity. The pumps, combined with powerful batteries, protected the Japanese reactor from immediate meltdown in the first few hours after the earthquake and tsunami. "Such steam pumps are a rarity in Germany," says nuclear expert Helmut Hirsch.
Even more dramatic is a defect found in boiling water reactors like the one in Krümmel in the northern state of Lower Saxony. Unlike the Fukushima plant, there is only one steel pan underneath the reactor containment vessel at the Krümmel plant. By contrast, the Japanese installed an additional concrete plate in their boiling water reactor.
The Society for Plant and Reactor Safety in Cologne issued a report last summer to the Federal Environment Ministry, in which they warned: "Particularly in older plants, a few important safety systems are not state-of-the-art in all respects." According to the report, this defect applies to the power supply, backup diesel generators, digital control systems, the installation of fresh steam lines, emergency feeds and the supply of water for cooling.
At Risk from Earthquakes
A list prepared by the Freiburg Eco Institute for the federal-state working group also reveals some horrifying facts. In older plants, for example, there are still flammable PVC power cables installed inside containment vessels, even though safer cables have existed for a long time, the experts warn.
They also see problems with the fuel supply for the backup generators, which is supposed to be sufficient for 72 hours of backup operation. But in some plants the tanks are apparently smaller. The specialists at the Eco Institute are also worried about earthquake safety, saying: "It is possible that current results deviate significantly from the assumptions made when the plants were designed, and that a reevaluation is needed."
For the four reactors in Neckarwestheim and Philippsburg at risk for earthquakes, the lesson to be learned from Japan could be that the buildings ought to be capable of withstanding quakes that are 10 percent more powerful than the worst earthquake ever recorded in the region. An magnitude 6.9 earthquake that struck Basel, Switzerland in 1356 could serve as a benchmark. The plants are not designed to withstand a quake of that magnitude.
In 2001 E.on, which operates the reactors on the Isar River in Bavaria, declared that the region was practically earthquake-free. But in the foothills of the Alps, "we know of earthquake events in both the more recent and most distant past," Wolfgang Kromp of the Institute for the Study of Safety and Risk at the University of Vienna wrote in an expert report last year.
It isn't just the technology that's outdated in German nuclear power plants. Even the personnel isn't necessarily up-to-date on the latest developments. Because nuclear power plant technology is seen as a dying profession in Germany, there are hardly any engineers or physicists left who specialize in it. The electric utilities are trying to encourage students to specialize in the field by sponsoring professorships at universities and courses of study in nuclear power plant engineering. But the state regulatory agencies are having a hard time recruiting qualified individuals.
Not Familiar with Their Own Plants
One reactor safety expert complains that even the technical directors are no longer as familiar with their own nuclear power plants as they should be. For instance, hardly any engineers have been with a plant since it was first placed into service. Newer employees lack intimate knowledge of the technical details of their power plant -- experience that could be critical in an emergency.
As such, it's hardy surprising that even in a newer plant like Philippsburg 2 in Baden-Württemberg, the personnel made three serious mistakes within the last year and a half. The incidents were revealed when an insider notified the authorities. In mid-May 2009, for example, the containment vessel was open for 12 hours without anyone noticing. Half a year later, it took personnel three days to notice that the backup cooling system had been shut off. "If there had been a plane crash during that time, a meltdown would have been unavoidable," writes the whistleblower.
Five months later, a shutoff valve was inadvertently opened, allowing more than 280,000 liters (73,920 gallons) of cooling fluid to escape unnoticed from the spent fuel rod pool. If water levels had dropped by another six centimeters, the entire cooling system would have been rendered inoperative.
Finally, nuclear power plant employees are also combating sinister threats of the modern age. The new danger resembles that posed by radiation: It can't be seen, felt or smelled, and yet it is real, difficult to control and potentially very dangerous.
There is talk of viruses, worms and harmful programs, and of targeted cyber attacks on the types of industrial control systems used in every power plant. Computer scientists have been warning for years that large-scale attacks are merely a matter of time. The first such attack struck in July 2010. A Belarussian anti-virus company discovered a computer virus so sophisticated as to overshadow everything that had come before it: Stuxnet. The worm specifically infected Siemens control systems, which are used in many power plants.
Experts are now convinced that the high-tech weapon was specifically developed to sabotage the Iranian nuclear program, which it did.
Stuxnet delivered a blow to the idea that it is sufficient to disconnect critical infrastructure from the Internet. The worm spreads through USB sticks. Stuxnet is proof that there is also a digital residual risk.
The German government responded with unusual speed and alarm. The Federal Interior Ministry (BMI) designed a "national cyber security strategy" and set up an operations center in Bonn. A classified report by German security agencies concludes that Germany is poorly prepared for targeted hacker attacks. And a BMI report states: "It took four days for the federal government to reach a decision on how German nuclear power plants or other parts of German industry were affected by the Stuxnet virus, because some of the agencies involved had either no knowledge or incomplete knowledge."
Martin Schallbruch, the IT director at the BMI, sees a particularly "serious threat" to companies like power plant operators, which maintain complicated process control systems, a threat that "the companies ought to address." According to Schallbruch, management in many companies still does not devote the necessary attention to IT security. This, he adds, "is urgently in need of change, because of the changed cyber security situation."
IT experts worldwide have been electrified by the US Department of Homeland Security's successful attempt to use malicious code to hack into the control system of a large diesel backup generator. The engineers were able to overload the generator located at a test nuclear reactor in Idaho until it failed. Malignant software was also discovered in the equipment of several energy utilities. In February, for example, a cyber espionage campaign ("Night Dragon") against at least five international energy companies was uncovered.
Ironically, the potential victims of such attacks are the newest nuclear power plants, such as the one in the northwestern Emsland region, which has digital control systems. Older reactors, on the other hand, are still being run with analog equipment. But computers are also being used more and more in the older plants, because spare parts for the outdated control technologies are getting hard to come by.
Is Germany Prepared?
Would Germany be at least better equipped to handle a nuclear accident than Japan? If a major accident occurred, measuring teams would immediately be deployed throughout the country to assess the spread of radiation. The country recently acquired more than 319 "ABC investment vehicles," which are equipped with state-of-the-art measuring technology that can even detect nuclear radiation at great distances.
The Federal Office of Disaster Assistance purchased the vehicles and made them available to the states. The readings are automatically displayed on a digital map at a central crisis control center. In an emergency, the system would produce a map of devastation that would enable the crisis control center to coordinate the evacuation and emergency activities remotely.
If the population were exposed to radiation, officials would deploy 323 "decontamination trucks" developed by disaster protection experts specifically for nuclear accidents. The trucks are equipped with technology to decontaminate people. They would bring special teams wearing radiation-proof suits, water hoses and iodine tablets to the vicinity of a nuclear power plant to decontaminate the local population. Each truck can decontaminate 50 people per hour.
The federal and state governments have purchased 53,000 radiation suits to enable emergency responders to work in life-threatening situations. But would German emergency workers fight the radiation just as heroically as their Japanese counterparts?
Firefighters and disaster relief workers are only required to work in environments in which they are exposed to a dose of up to 15 millisieverts of radiation. For teams deployed to prevent the spread of a radiation cloud that level is 100 millisieverts, and the limit rises to 250 millisieverts for those teams sent into a contaminated zone to save lives.
On the other hand, technicians working inside a nuclear power plant can leave their posts when a dosimeter records 100 millisieverts on their clothing. These values were exceeded in individual locations at the Fukushima nuclear plant.
Nevertheless, disaster experts are not nearly as pessimistic when it comes to the Germans' willingness to sacrifice themselves for the greater good. Wolf Dombrowsky, a sociologist at the Steinbeis University in Berlin, assesses the results of studies as "pleasantly comforting." According to those results, "a few will flee, but a few will also want to be heroes."
REPORTED BY MATTHIAS BARTSCH, ANDREA BRANDT, MICHAEL FRÖHLINGSDORF, LAURA HÖFLINGER, SIMONE KAISER, GUNTHER LATSCH, CORDULA MEYER, MARCEL ROSENBACH, HOLGER STARK, GERALD TRAUFETTER