**2. Guidance on assessing external events**

128 Nuclear Power – Practical Aspects

**Figure 2.** Experiment of a deflagration according to [1]

**Figure 3.** Detonation as the strongest type of explosion according to [1]

(non-isotropic), due to the extreme rapidity with which it occurs.

consideration.

In contrast to a reversible adiabatic compression, shock compression occurs irreversibly

Both types of explosion pressure waves (caused by detonation of liquids or solid explosives or air-gas mixtures and such pressure waves caused by deflagrations of only air-gas mixtures) have to be taken into account in the safety assessment of the plant under

Figure 3.

is an extremely rapid and sharp compression occurring in a shock wave as one can see from

Since 2005, a revised guideline for a probabilistic safety assessment [2] as well as revised and extended supporting technical documents [3-4] are issued in Germany which describe the methods and data to be used in performing probabilistic safety assessment in the frame of comprehensive safety reviews.

In these documents, probabilistic considerations of aircraft crash, external flooding, earthquakes and explosion pressure waves are required. Also on international level, new recommendations regarding external hazards including explosions pressure waves and the safety assessments to be performed are recently issued (see, e. g., [5-7]).

For the site evaluation for nuclear installations which will be built in the future safety requirements have been developed [8-9]. In that context activities in the region that involve the handling, processing, transport and storage of chemicals having a potential for explosions or for the production of gas clouds capable of deflagration or detonation shall be identified.

Hazards associated with chemical explosions shall be expressed in terms of overpressure and toxicity (if applicable), with account taken of the effect of distance. A site shall be considered unsuitable if such activities take place in its vicinity and there are no practicable solutions available.

The safety assessment should demonstrate that threats from external hazards are either removed, or minimised or tolerated. This may be done by showing that safety related plant buildings and equipment are designed to meet appropriate performance criteria against the postulated external hazard, and by the provision of safety systems which respond to mitigate the effects of fault sequences.

Explosion pressure waves with relevance to the site can be caused by shipping, fabrication, storage and reloading of explosive materials in closer distances to a nuclear power plant.

These different causes lead to two significant different types of risky situations for the site and the plant which have to be assessed within a probabilistic safety assessment:

1. The explosive material is available as a stationary source in the neighbourhood of the plant under consideration (e.g., a storage facility or a fabrication facility).

2. The explosive material is mobile, i.e. it is shipped in close distance to the plant on the road, by train or on ships along a river or the sea nearby.

Probabilistic Assessment of Nuclear Power Plant Protection Against External Explosions 131

safety distance of about 990 m due to the arrangement and size of the tanks and the explosive material loaded according to [18]. This distance is less than the actual distance of 1200 m between the regular waterway and the nuclear power plant and, thus, would not have been led to a hazardous situation for the nuclear power plant, even in the case that the

In a first step, the important areas of the plant are divided into the three classes A, B and C for the analysis of explosion pressure waves to reflect the degree of protection against the impact by the explosion pressure waves. These classes are the same as for the consideration

Class A contains systems, where in case of their damages a hazard state directly arises or where an initiating event may occur which cannot be controlled by the emergency cooling system.

Class B contains systems where in case of their damages a hazard state not directly arises, but where an initiating event may occur which is controlled by the emergency cooling

Examples for class A are the primary coolant circuit, the main steam safety and shut-off

Examples for class B are the network connection with the machine transformers and auxiliary power systems (emergency case), the turbine building (main steam line break, loss of the main heat sink, loss of the main feed water) and the switchgear building. The possibility of false signals in the damage control plants with the consequence of a loss of

Class C (separated emergency building) consists of buildings that are structurally designed to withstand external influences, including those buildings which are designed against external events. In general a destruction of these systems does not lead to an occurrence of an initiating event. If - in addition to emergency cooling system functions - also further system functions are located in the same building, these assumptions have to be reviewed. If

Basic idea in case of explosion pressure waves is a prescribed check if the frequency of core damage states is less than 1E-07 per year for the plant under consideration. This is the case when the total occurrence frequency of the event "explosion pressure wave" (i.e. the sum of all contributions from detonation and deflagration) is determined to be less than 1E-05

the buildings of classes A and C are designed against the load assumptions shown in

transport ship would have been a gas tanker.

Class C contains the safety systems needed for core cooling.

valve equipment in case of PWR or pressure relief valves in case of BWR.

necessary, the results of this review are to be considered in the analysis.

Typical examples of these different classes are [17]:

coolant accident has to be considered.

per year,

Figure 4,

**3. Screening process** 

of aircraft crashes [16].

system.

In the latter case, the situation is not stable and changes with the varying distances. Moreover, the transport way could be a straight line or a bent which has to be addressed in the calculations - see [10] for a straight road and [11-12] for a bent river.

Usually, a uniformly distributed accident probability is assumed along the transport way. However, in reality the accident probability may increase in junctions or confluences and – in case of rivers and roads – in curves or strictures. Such an example is explained later on in more detail.

Accidents with explosive material are not only theoretical considerations but happen in reality, sometimes with catastrophic consequences.

Data for traffic accidents on rail or road involving explosions are provided in reference [13]. From the total number of accidents (1932) in this database 37% occurred on railways and 63% on roads. The accidents are classified into four different types: release, explosion, fire and gas cloud. The analysis has shown that in the majority of accident gas was released, followed by fires. Explosions appeared in 14% and gas clouds in only 6%. The most frequent initiating event with 73.5% of the accidents result from collisions.

One extremely severe transportation accident took place in June 2009 in Viareggio which resulted in comprehensive safety evaluations [14-15]. Although no industrial plant was damaged in this accident, the potential explosion severity is visible. The accident followed the derailment of a train carrying 14 tank cars of liquefied petroleum gas. The first tank car was punctured after the derailment releasing its entire content that ignited causing an extended and severe flash-fire that set on fire several houses and lead to 31 fatalities.

A more recent accident happened in January 2011 on the river Rhine in Germany, fortunately without any environmental consequences. However, a ship capsized and blocked for many weeks the river for other transportation but, in particular, had the potential to lead to an explosion because – in addition to 2400 tons mainly of sulphuric acid – one tank also contained water and hydrogen.

A further event happened on Mach 11, 2011 on the river Elbe where a transport ship had a damage of an engine and, thus, needed to be anchored outside the regular waterway. One of the questions which arise from this event was if the boundary conditions usually applied and discussed below could be violated because the ship leaves the determined waterway and was, therefore, nearer to the nuclear power plant.

For the respective nuclear power plant comprehensive investigations regarding explosions pressure waves have been performed within the periodic safety review. This includes the identification of the types of ships which are running on the river, the TNT equivalent, the real distance between the ships and the nuclear power plant. Information is in particular based on the information of the Water and Shipping Office Hamburg. This information shows that the biggest tanker ever transported gas on the river Elbe required a maximal safety distance of about 990 m due to the arrangement and size of the tanks and the explosive material loaded according to [18]. This distance is less than the actual distance of 1200 m between the regular waterway and the nuclear power plant and, thus, would not have been led to a hazardous situation for the nuclear power plant, even in the case that the transport ship would have been a gas tanker.
