Probabilistic Assessment of Nuclear Power Plant Protection Against External Explosions

1. Introduction

In recent years new threats required safety assessment experts to reconsider the internal and external loads of nuclear installations, in particular nuclear power plants, focusing not only on internal hazards but also on the destructive power of external hazards such as aircraft crash, flooding including tsunamis, severe weather conditions and also explosions and blasts and their combination which can cause significant damage on the plant’s operability, being potentially conducive to severe accidents. The cumulated effects of such external loads include the destruction of buildings and access ways, the debris build-up, the loss of electrical power supply as well as the loss of cooling capacity of the reactor core and the fuel pools.

International experience has shown that internal hazards such as fire and external hazards can be safety significant contributors to the risk in case of nuclear power plant operation. This is due to the fact that such hazards have the potential to reduce simultaneously the level of redundancy by damaging redundant systems or their supporting systems or even to loose all redundancies at once.

This has been strongly underlined by the nuclear accidents at the Fukushima-Daiichi nuclear power plants in March 2011 resulting from a very strong earthquake and a consequential tsunami.

A challenging prerequisite for any effective protection against external hazards is to accurately assess them systematically regarding the adequacy of their existing protection equipment against hazards, in particular those built to earlier standards.

Therefore, comprehensive safety assessments have to be performed in advance with most actual site-specific data und current knowledge of new research results. Potential methods to analyse existing nuclear power plants are deterministic, probabilistic or combined methodologies.

In the past, most of the engineering work in designing safety features for nuclear power plants has been performed on a deterministic basis. Moreover, the use of deterministic safety analysis is still current practice to review the current safety level of operating nuclear power plants against external hazards.

As an observation from other areas, the probabilistic approach provides different insights into design and availability of systems and components supplementing the results from deterministic safety analyses. A more comprehensive risk assessment including the modeling and assessment of external hazards is usually recommended in the frame of periodic safety reviews which are performed about every ten years to get a global picture of the safety level of the nuclear power plant under consideration and which include a comparison to current safety standards and good practices.

In particular in case of probabilistic safety analyses, such an assessment can be very detailed and time consuming. Therefore, it is necessary to have appropriate procedures to screen out, e.g., buildings of a nuclear installation where no further analysis is required or to have a graded procedure for the respective hazard taking into account plant- and site-specific conditions.

The assessment of external hazards requires detailed knowledge of natural processes, along with plant and site layout. In contrast with almost all internal hazards, external hazards can simultaneously affect the whole facility, including back up safety systems and non-safety systems alike. In addition, the potential for widespread failures and hindrances to human intervention can occur. For multi-facility sites this makes the situation even more complex and it requires appropriate interface arrangements to deal with the potential domino effects.

In contrast to other external hazards (e.g., earthquakes, winds, or floods), an explosion has the following distinguishing features:

• The intensity of the pressures acting on a targeted building can be several orders of magnitude greater than these other hazards.

• Explosive pressures decay extremely rapidly with distance from the source.

• The duration of the event is very short, measured in thousands of a second, or milliseconds. This differs from earthquakes and wind gusts, which are measured in seconds, or sustained wind or flood situations, which may be measured in hours.

An explosion is defined as a rapid and abrupt energy release, which produces a pressure wave and/or shock wave. A pressure wave has a certain pressure rise time, whereas a shock wave has zero pressure rise time. As a result of the pressure and/or shock wave, an explosion is always audible. Explosions can be classified into a number of types as illustrated in Figure 1.

Figure 1.

Types of explosion

Explosion is used broadly to mean any chemical reaction between solids, liquids, vapours or gases which may cause a substantial rise in pressure, possibly to impulse loads, fire or heat. An explosion can take the form of a deflagration or a detonation. BLEVE (Boiling Liquid Expanding Vapour Explosion) is a physical explosion also resulting in pressure or shock wave.

The most common type of chemical explosion is the heterogeneous explosion. In heterogeneous explosions, a propagating reactive front clearly separates the non-reacted materials from the reaction products. The reaction front, usually called the reaction zone or flame (front), moves through the explosive mixture as the explosion occurs. In this zone the strongly exothermic reactions occur. Heterogeneous explosions are divided into two types: deflagrations and detonations.

In deflagrations, the reaction zone travels through the explosive mass at subsonic speed, while the propagation mechanism is heat transfer (by conduction, radiation and convection). Reaction zone propagation velocities (flame speeds) of deflagrations may vary over a wide range and so do the corresponding explosion pressures. One example of a deflagration experiment is shown in Figure 2; in this case the deflagration was very short and lasted less than one second.

In some instances, accelerating deflagrations show a deflagration-to-detonation transition (DDT) as shown in Figure 1.

The major characteristic of a detonation is its extremely high speed: the explosion zone moves at a supersonic speed. While, for deflagrations, the flame speeds are relatively low (typically one to several hundreds of metres per second), detonation flame speeds in air can easily reach one to two kilometres per second. The propagation mechanism of a detonation is an extremely rapid and sharp compression occurring in a shock wave as one can see from Figure 3.

Figure 2.

Experiment of a deflagration according to [1]

Figure 3.

Detonation as the strongest type of explosion according to [1]

In contrast to a reversible adiabatic compression, shock compression occurs irreversibly (non-isotropic), due to the extreme rapidity with which it occurs.

Both types of explosion pressure waves (caused by detonation of liquids or solid explosives or air-gas mixtures and such pressure waves caused by deflagrations of only air-gas mixtures) have to be taken into account in the safety assessment of the plant under consideration.

The first step of the assessment is a screening procedure in order to determine scope and content of the assessment to be performed, the second step is to propose an appropriate approach for those cases where a full scope analysis has to be conducted. In the latter case methods which can be applied to evaluate the probability of occurrence of an external explosion event are, e.g., fault tree analysis, event tree analysis and Monte Carlo simulation.

The presented results show that the probability of occurrence of external explosion pressure waves can be successfully assessed by means of the Monte Carlo simulation.

2. Guidance on assessing external events

Since 2005, a revised guideline for a probabilistic safety assessment [2] as well as revised and extended supporting technical documents [3-4] are issued in Germany which describe the methods and data to be used in performing probabilistic safety assessment in the frame of comprehensive safety reviews.

In these documents, probabilistic considerations of aircraft crash, external flooding, earthquakes and explosion pressure waves are required. Also on international level, new recommendations regarding external hazards including explosions pressure waves and the safety assessments to be performed are recently issued (see, e. g., [5-7]).

For the site evaluation for nuclear installations which will be built in the future safety requirements have been developed [8-9]. In that context activities in the region that involve the handling, processing, transport and storage of chemicals having a potential for explosions or for the production of gas clouds capable of deflagration or detonation shall be identified.

Hazards associated with chemical explosions shall be expressed in terms of overpressure and toxicity (if applicable), with account taken of the effect of distance. A site shall be considered unsuitable if such activities take place in its vicinity and there are no practicable solutions available.

The safety assessment should demonstrate that threats from external hazards are either removed, or minimised or tolerated. This may be done by showing that safety related plant buildings and equipment are designed to meet appropriate performance criteria against the postulated external hazard, and by the provision of safety systems which respond to mitigate the effects of fault sequences.

Explosion pressure waves with relevance to the site can be caused by shipping, fabrication, storage and reloading of explosive materials in closer distances to a nuclear power plant.

These different causes lead to two significant different types of risky situations for the site and the plant which have to be assessed within a probabilistic safety assessment:

1. The explosive material is available as a stationary source in the neighbourhood of the plant under consideration (e.g., a storage facility or a fabrication facility).

2. The explosive material is mobile, i.e. it is shipped in close distance to the plant on the road, by train or on ships along a river or the sea nearby.

In the latter case, the situation is not stable and changes with the varying distances. Moreover, the transport way could be a straight line or a bent which has to be addressed in the calculations - see [10] for a straight road and [11-12] for a bent river.

Usually, a uniformly distributed accident probability is assumed along the transport way. However, in reality the accident probability may increase in junctions or confluences and – in case of rivers and roads – in curves or strictures. Such an example is explained later on in more detail.

Accidents with explosive material are not only theoretical considerations but happen in reality, sometimes with catastrophic consequences.

Data for traffic accidents on rail or road involving explosions are provided in reference [13]. From the total number of accidents (1932) in this database 37% occurred on railways and 63% on roads. The accidents are classified into four different types: release, explosion, fire and gas cloud. The analysis has shown that in the majority of accident gas was released, followed by fires. Explosions appeared in 14% and gas clouds in only 6%. The most frequent initiating event with 73.5% of the accidents result from collisions.

One extremely severe transportation accident took place in June 2009 in Viareggio which resulted in comprehensive safety evaluations [14-15]. Although no industrial plant was damaged in this accident, the potential explosion severity is visible. The accident followed the derailment of a train carrying 14 tank cars of liquefied petroleum gas. The first tank car was punctured after the derailment releasing its entire content that ignited causing an extended and severe flash-fire that set on fire several houses and lead to 31 fatalities.

A more recent accident happened in January 2011 on the river Rhine in Germany, fortunately without any environmental consequences. However, a ship capsized and blocked for many weeks the river for other transportation but, in particular, had the potential to lead to an explosion because – in addition to 2400 tons mainly of sulphuric acid – one tank also contained water and hydrogen.

A further event happened on Mach 11, 2011 on the river Elbe where a transport ship had a damage of an engine and, thus, needed to be anchored outside the regular waterway. One of the questions which arise from this event was if the boundary conditions usually applied and discussed below could be violated because the ship leaves the determined waterway and was, therefore, nearer to the nuclear power plant.

For the respective nuclear power plant comprehensive investigations regarding explosions pressure waves have been performed within the periodic safety review. This includes the identification of the types of ships which are running on the river, the TNT equivalent, the real distance between the ships and the nuclear power plant. Information is in particular based on the information of the Water and Shipping Office Hamburg. This information shows that the biggest tanker ever transported gas on the river Elbe required a maximal safety distance of about 990 m due to the arrangement and size of the tanks and the explosive material loaded according to [18]. This distance is less than the actual distance of 1200 m between the regular waterway and the nuclear power plant and, thus, would not have been led to a hazardous situation for the nuclear power plant, even in the case that the transport ship would have been a gas tanker.

3. Screening process

In a first step, the important areas of the plant are divided into the three classes A, B and C for the analysis of explosion pressure waves to reflect the degree of protection against the impact by the explosion pressure waves. These classes are the same as for the consideration of aircraft crashes [16].

Class A contains systems, where in case of their damages a hazard state directly arises or where an initiating event may occur which cannot be controlled by the emergency cooling system.

Class B contains systems where in case of their damages a hazard state not directly arises, but where an initiating event may occur which is controlled by the emergency cooling system.

Class C contains the safety systems needed for core cooling.

Typical examples of these different classes are [17]:

Examples for class A are the primary coolant circuit, the main steam safety and shut-off valve equipment in case of PWR or pressure relief valves in case of BWR.

Examples for class B are the network connection with the machine transformers and auxiliary power systems (emergency case), the turbine building (main steam line break, loss of the main heat sink, loss of the main feed water) and the switchgear building. The possibility of false signals in the damage control plants with the consequence of a loss of coolant accident has to be considered.

Class C (separated emergency building) consists of buildings that are structurally designed to withstand external influences, including those buildings which are designed against external events. In general a destruction of these systems does not lead to an occurrence of an initiating event. If - in addition to emergency cooling system functions - also further system functions are located in the same building, these assumptions have to be reviewed. If necessary, the results of this review are to be considered in the analysis.

Basic idea in case of explosion pressure waves is a prescribed check if the frequency of core damage states is less than 1E-07 per year for the plant under consideration. This is the case when

• the total occurrence frequency of the event “explosion pressure wave” (i.e. the sum of all contributions from detonation and deflagration) is determined to be less than 1E-05 per year,

• the buildings of classes A and C are designed against the load assumptions shown in Figure 4,

• the safety distances according to the BMI guideline [18] are fulfilled, based on the formula (1):

$$R=8\cdot L^{1/3}$$E1

with

R = safety distance (in m) of the place where the explosive gas is handled from to the respective plant which should be larger than 100 m, and

L = assumed mass of the explosive material (in kg).

It should be noticed that the total mass to be assumed depends on the type of explosive material.

For the case that the prerequisites of this prescribed check are met, no further probabilistic considerations are necessary.

Figure 4.

Pressure behaviour at the building for a single pressure wave according to [18]

Otherwise the procedure has to be in accordance with the graded process of evidence regarding explosion pressure waves as presented in Table 1 (see [19]).

Criteria	Extent of analysis
Criterion 1: Occurrence frequency <1E-05 per year; Criterion 2: Classes A and C are designed according to load assumptions and safety distances determined in length lR according to [18]	Verification using the prescribed check
Criterion 1: Not fulfilled; Criterion 2: Fulfilled	Conservative estimation of occurrence frequency
Criterion 1: Not fulfilled; Criterion 2: Not fulfilled	Detailed probabilistic safety analysis required

Table 1.

The graded process of analysing explosion pressure waves

4. Methods as recommended in the German PSA document for nuclear power plants

4.1. Introduction

The German PSA document on methods [3] describes the approaches to be used in the probabilistic safety assessment which have to be performed in the frame of comprehensive safety reviews of nuclear power plants.

One part of this approach is dedicated to the screening process already explained in section 2, the further parts of this document deal in more detail with the occurrence frequency of explosion pressure waves taking into account the site-specific situation, sources of possible explosion pressure waves in the surrounding of the plant, and the procedure for the calculation of occurrence frequencies of accidents during transportation of explosive material by ships, trains or trucks and of accidents of stationary plants near the plant under consideration.

4.2. Assessment

In case that the plant buildings classified as A and C are designed according to the BMI guideline [18] and the safety margins regarding distance and mass of the explosive material are kept, it can be assumed that in the most unfavourable case of an explosion pressure wave event

• no event is initiated which directly leads to a hazard state,

• due to the event explosion pressure wave a system failure occurs in the class B and an initiating event is initiated which can be controlled by the emergency cooling system as designed,

• the emergency cooling system is protected against the effects of the event explosion pressure wave.

In the most unfavourable case, a loss of offsite power with destruction of the secondary plant parts (main heat sink, feed water supply) can be assumed, which occurs with the total occurrence frequency of the event explosion pressure wave. It is assumed for simplifying the analysis that together with the occurrence of this event those systems which are outside of the classes A and C fail.

For the calculation of the frequency of the hazard state, resulting from explosion pressure waves, this initiating event and the incident-controlling functions of the emergency cooling system (stochastic non-availabilities) are to be modelled and quantified in an event tree (or using another appropriate method).

The frequency of the event explosion pressure wave to be chosen is the sum of all contributions of the events detonation and deflagration, as far as they can lead to hazardous states of the plant, resulting from accidents during transportation procedures or the operation of stationary plants in the surrounding of the plant under consideration.

The occurrence frequency of a detonation is several orders of magnitude lower compared with a deflagration [20]. As far as the distance of the area where the deflagration started has a distance larger than 100 m from the plant under consideration (see safety margins in accordance with [18]), no endangerment of the plant buildings has to be assumed.

In case of accidents with materials with the potential of a detonation (in particular explosives, ammunition, gases exothermically disintegrating) the detonation is expected to occur at the accident location, i.e. at a transport route or a fixed industrial installation. Here the approach as provided in formula (2) is applied:

$$H_{E,SMZ}=H_{U,SMZ}\cdot W_Z$$E2

with

H_E,SMZ Annual frequency of a explosion pressure wave by explosives, ammunition or gases exothermically disintegrating in the surroundings of the nuclear power plant,

H_U,SMZ Annual frequency of accidents with explosives, ammunition or gases exothermically disintegrating in the surroundings of the nuclear power plant,

W_Z Conditional probability of the ignition in case of an accident.

The deflagration pressure of maximal 10 bar drops over 100 m around a factor 1E04, so that within the power station pressure values within the range of the wind pressures are reached.

In case of explosive gas air mixtures (combustible gases with air; inflammable steams, e.g. also of liquid gas, with air) clouds can appear and a drifting of these clouds from the place where the accident happened into the direction of the plant is possible.

In this situation the deflagration can take place in the area of the plant buildings. The approach applied for this case is described in the following equation [20]:

$$H_{E,GLG}=H_{U,GLG}\cdot W_M\cdot W_D\cdot W_Z$$E3

with

H_E,GLGAnnual frequency of an explosion pressure wave by gas air mixtures in the surroundings of the nuclear power plant,

H_U,GLG Annual frequency of accidents with combustible gas in the surroundings of the nuclear power plant,

W_MConditional probability for the development of an explosive gas air mixture in case of an accident with combustible gas,

W_DConditional probability for drifting of the gas air mixture to the nuclear power plant (as a result of temporal averaging of the arising wind directions),

W_ZConditional probability of the ignition at the area of the plant.

In a more detailed verification the assumptions introduced can be replaced by plant-specific proofs, considering the different effects of the determined explosion pressure waves.

In the case of a deviation from the BMI guideline [18] partial results of the total occurrence frequency of the event arise which contribute directly to the frequency of the hazard states. These contributions are to be determined by a differentiated view of the assigned explosion pressure waves and their effects.

5. Occurrence frequency of accidents during the transport of explosive materials

One important input for the calculations is the occurrence frequency of accidents during the transport of explosive material with different transportation means. Information has to be gathered from the competent institutions in the respective country. As an example the approach in Germany is shortly described.

5.1. Train accident statistic

According to the accident statistics of the German Railways there was in Germany in the time frame of 10 years no accident of dangerous goods transports with explosive materials. From the zero-error statistics, there is the expectation value for the current admission rate of accidents in Germany in dangerous goods transports by rail with explosive materials (h_UEG,B):

$$h_{UEG,B}=\frac{1}{2\cdot 10a}$$E4

Thus, H_UEG,B is defined as

$$H_{UEG,B}=\frac{h_{UEG,B}}{L_{E,B}}\cdot n\cdot l$$E5

with

H_UEG,Byearly frequency of accidents in case of transports of dangerous goods with explosive materials by rail in the vicinity of the nuclear power plant,

L_E,Btrain transport kilometers per year with explosive materials,

nnumber of transports (trains) per year with an explosive good passing the nuclear power plant,

lsection length l along the nuclear power plant (e.g. l = 2 km) which could lead to a hazardous situation for the nuclear power plant.

The section length l can be calculated from

$$l=2\sqrt{r^2-a^2}$$E6

with

aminimum distance of the railway line to the nuclear power plant,

rradius of the nuclear power plant within which

a) damages are expected in case of a detonation,

b) the drifting of a gas-air cloud (deflagration) has to be expected.

5.2. Ship accident statistics

Ship accidents (provided in Germany by the local Waterways and Shipping Directorate) are provided for a defined time period and the river-km and distinguished by the types of accidents. Information with respect to the participation of gas, liquid gas and ammunition shipments to the accident is usually given. The evaluation is performed according to the procedure in [21].

5.3. Occurrence frequency of accidents with explosive materials in stationary installations

In that context, installations such as industrial plants, loading and discharging stations, storage tanks, gas pipelines have to be taken into account according to [3].

In case of natural gas the formation of an explosive gas mixture is only assumed for the accident area because the specific gravity of natural gas is less than the air and drifts of the gas mixture in the direction of the nuclear power plant are therefore excluded.

6. Monte Carlo simulation

6.1. Basics

6.1.1. Monte Carlo simulation

Detailed basics of the MCS like random sampling, estimators, biasing techniques and performance characteristics (e.g. figure of merit / fom) are specified for example in [22] and [23].

In the references [9, 11, 19, 24] the MCS has been applied and verified successfully in order to estimate the probability of external explosion pressure waves.

6.1.2. Estimators in use

As the last event estimator (lee), introduced in [28], is used to predict the probability of an event (e.g. an explosion event), the observed frequency of explosions within the radius r_P is determined. The sample mean probability is

$${\widehat{P}}_E=\frac{1}{N}\cdot {\displaystyle \sum _{i=1}^N{P}_E(i)}$$E7

where P_E(i) ∈{0, 1} and N = number of trials.

An alternative method is to compute the theoretical probability of an explosion event within the radius r_P in each scenario the wind direction will move the explosive gas mixture to the plant. The advantage over the lee is that each scenario gives a contribution to the probability of occurrence.

By analogy with transport theory, this procedure is called free flight estimator (ffe) also described in [25]. Depending on the accident coordinate (x_i, y_i) and the wind direction φ_i in trial _i the probability of an explosion event within the radius r_P is given by

$$\begin{array}{r}{P}_E(x_i,{\varphi }_i)=\exp \left(-\lambda \cdot 1/v_W\cdot d_1(x_i,{\varphi }_i)\right)\\ -\exp \left(-\lambda \cdot 1/v_W\cdot d_2(x_i,{\varphi }_i)\right)\end{array}$$E8

where d₁(x, φ) and d₂(x, φ) are the distances between the accident coordinate and the intersection of the wind direction and the plant area with radius r_P.

The intersection coordinates (x_I, y_I) of the wind direction φ_i and the plant area with radius r_P are determined by means of

$$x_I^2+{\left(y_i+\tan ({\varphi }_i)\cdot (x_I-x_i)\right)}^2=r_P^2$$E9

and

$$y_I={\left(y_i+\tan ({\varphi }_i)\cdot (x_I-x_i)\right)}^2$$E10

.

The sample mean probability is

$${\widehat{P}}_E=\frac{1}{N}\cdot {\displaystyle \sum _{i=1}^N{P}_E(x_i,{\varphi }_i)}$$E11

where N = number of trials.

6.1.3. Biasing techniques in use

If the forced transition method is used (see, e.g., [26]), the next transition is forced to take place within the area (wind direction, distance, time etc.) of interest.

The modified conditional cdf is

$$\begin{array}{r}P(X\le x|x_1<X\le x_2)=F(x|x_1,x_2)\\ =\frac{F(x)-F(x_1)}{F(x_2)-F(x_1)}.\end{array}$$E12

The weight associated to this bias is

$$w^{*}=F(x_2)-F(x_1)$$E13

6.2. Application

The following application is a case study that represents the evaluation of the probability of occurrence of an external explosion pressure wave that takes place near a plant. The probability of occurrence is assessed on the condition that an accident with combustible gas already occurred.

The application is not restricted to a special field of industry; plants of process industry might be in the focus as well as nuclear power plants. The application is depicted in Figure 5. It consists of plant-1 (in the focus of this study), plant-2 (gasholder e.g.), street 1 and 2 (frequented by tank-lorries that carry explosive liquids) and a river (frequented by gas-tanker that carry explosive liquids). The river is subdivided into 6 subsections; each subsection is characterised by an individual length, width and gas-tanker accident frequency.

Figure 5.

Case study: plant-1, plant-2, river, road and hazardous scenario (gas-tanker accident)

An accident (plant-2, street 1, street 2 or river) at the coordinate (x_i, y_i) may cause the development of explosive gas mixture (gas-tanker accident e.g. - Figure 5).

Depending on the wind direction φ_i the cloud of gas mixture can drift to the plant. An ignition of the gas mixture close to plant-1 (within the radius r_P) is in the focus of this study. All relevant application parameters of Figure 5 are given in Table 2.

Description	Parameters
length of street 1: lS1	4,800m
length of street 2: lS2	800m
width w	1,860m
plant 1	area: 10,000m^2
radius rP	150m
plant 2	area: 13,000m^2

Table 2.

Relevant application parameters

Although the application is described in a generalized way, it incorporates several elements that are typical in order to assess the impact of explosion pressure waves: accident, wind direction, wind speed and ignition.

In the following the example is subdivided into three parts described in sections 6.4 to 6.6: accident at plant-2 (gas holder), accident on street 1 or 2, accident on the river. For each example application the frequency of explosions within the radius r_P is determined.

The probability of an explosion event within the plant area with radius r_P is evaluated by means of the Monte Carlo simulation (MCS). In order to make the MCS more efficient biasing techniques are adopted as shown in [26-28]. The algorithm to model and solve the problem is based on the German probabilistic PSA guideline [2] and the supporting technical document on PSA methods [3].

It should be noticed that the events, boundary conditions, parameters and results given in Figures 5 to 14 and Tables 2 to 6 are only example values and do not represent conditions and results of any specific application. However, the described approach is applicable without any general changes by using explicit site and plant specific data.

6.3. Assumptions

The case study depends on the following assumptions:

Figure 6.

Empirical accident river-section frequencies

• Accident-coordinate:

  • plant-2: Fixed accident-coordinate (x, y) on condition that the accident already occurred.

  • street 1 and 2: Uniformly-distributed accident-coordinate (x_i, y_i) depending on the length l_S1 and l_S2 of the streets on condition that the accident already occurred.

  • river: Uniformly-distributed accident-coordinate (x_i, y_i) depending on the subsection of the river on condition that the accident occurred in the river-section i. It is assumed, that the accident frequency is higher in sections with confluences or curves than in straight river-sections.

• The development of explosive gas mixture occurs with fixed probability w_G.

• Empirical-distributed wind direction.

• Empirical-distributed wind speed.

• Exponentially-distributed ignition probability depending on the time.

• An explosion within the radius r_P around the plant is in the focus of this study.

The parameters and distribution models are given in Figures 6 to 8 and Table 3.

Figure 7.

Empirical wind-direction frequencies

Description	Distribution
plant-2: accident (x, y)-coordinate	fixed coordinate
street 1: accident (x, y)-coordinate	U(a, b) depending on length of 4,800m and width of 10m
street 2: accident (x, y)-coordinate	U(a, b) depending on length of 800m and width of 10m
river: accident river-section	empirical
river: accident (x, y)-coordinate	U(a, b) depending on river-section area
development of explosive gas mixture	fixed probability: 0.3
wind direction φ	empirical
wind speed vW	empirical
time τ to ignition	Exp(λ): Exp(0.01 s^-1)

Table 3.

Parameters and distribution models

Figure 8.

Empirical wind-speed frequencies

6.4. Case study 1 – gas holder accident

The first case study (Figure 9) deals with a gas holder accident at plant-2. The accident at the plant-2 coordinate (x, y) may cause the development of explosive gas mixture. Depending on the wind direction φ_i the cloud of gas mixture can drift to the plant. An ignition of the gas mixture close to plant-1 (within the radius r_P) is in the focus of this study. It is assumed that the accident coordinate (x, y) is fixed. The minimal distance dP2 from plant-2 to plant-1 is approx. 570m. Further relevant application parameters of Figure 9 are given in Table 2 and Table 3.

Figure 9.

Gas holder accident at plant-2

6.4.1. Analysis

The MCS depends on a sequence of single events:

• Accident (x, y)-coordinate: fixed.

• Development of explosive gas mixture: fixed probability (0.3).

• Wind-direction φ: empirical-distributed (Figure 7).

• Wind-speed v_W: empirical-distributed (Figure 8).

• Time τ to ignition: Exp(0.01 s^-1)-distributed.

6.4.2. Results

Different ranges of conditional explosion-probability P_E are depicted in Figure 10. The denotation of the different ranges of the explosion event probability P_E, which is normalised on 1m², is as follows: red area (> 1E-07/m²), orange area (≤ 1E-07/m²), yellow area (≤ 5E-08/m²), green area (≤ 1E-08/m²).

Figure 10.

Gas holder accident - ranges of conditional explosion event probability P_E/1m²

The methods, number of trials, the simulation time and the results like mean value, variance and figure of merit (fom) are listed in Table 4.

The results in Figure 10 reflect the empirical distributed wind-direction, where the cloud of gas mixture is moved in most cases into the direction north-east and north-west.

method	trials	time [s]	mean	variance	fom
MCS-lee	1E05	6.97	3.25E-03	3.24E-03	4.43E06
MCS-lee biased	1E05	25.99	3.26E-03	5.35E-05	7.19E07
MCS-ffe	1E05	7.47	3.28E-03	4.44E-04	3.01E07
MCS-ffe biased	1E05	28.19	3.33E-03	4.49E-05	7.90E07

Table 4.

Gas holder accident - conditional probability of an explosion event within the plant area with radius r_P

As the different Monte Carlo methods (Table 4) are compared it can be found out that all solutions fit a mean about approx. 3.3E-03 which verifies the results as well as the adopted different Monte Carlo algorithms. If the variance and the figure of merit are regarded the MCS in combination with the ffe and biasing techniques is the most efficient approach.

6.5. Case study 2 – tank-lorry accident

The second case study (Figure 11) deals with a tank-lorry accident on street 1 or street 2. It is assumed that the accident coordinate (x_i, y_i) is uniformly-distributed depending on the length of street 1 and street 2. The minimal distance dS1 from street 1 to plant-1 is approx. 595m and the minimal distance dS2 from street 2 to plant-1 is approx. 605m. Further relevant application parameters of Figure 11 are given in Table 2 and Table 3.

Figure 11.

Tank-lorry accident on street 1 or street 2

6.5.1. Analysis

The MCS depends on a sequence of single events:

• Accident (x, y)-coordinate: uniformly-distributed depending on the length and the width of street 1 and street 2 (Table 3).

• Development of explosive gas mixture: fixed probability (0.3).

• Wind-direction φ: empirical-distributed (Figure 7).

• Wind-speed v_W: empirical-distributed (Figure 8).

• Time τ to ignition: Exp(0.01 s^-1)-distributed.

6.5.2. Results

Different ranges of conditional explosion-probability P_E are depicted in Figure 12. The denotation of the different ranges of the explosion event probability P_E, which is normalised on 1m², is as follows: red area (> 1E-07/m²), orange area (≤ 1E-07/m²), yellow area (≤ 5E-08/m²), green area (≤ 1E-08/m²). The methods, number of trials, the simulation time and the results like mean value, variance and figure of merit (fom) are listed in Table 5.

Figure 12.

Tank-lorry accident - ranges of conditional explosion event probability P_E/1m²

method	trials	time [s]	mean	variance	fom
MCS-lee	1E05	6.86	5.40E-04	5.0E-04	2.70E07
MCS-lee biased	1E05	26.69	7.78E-04	6.25E-06	5.99E08
MCS-ffe	1E05	7.04	7.50E-04	8.20E-05	1.73E08
MCS-ffe biased	1E05	27.72	7.70E-04	5.16E-06	6.99E08

Table 5.

Tank-lorry accident - conditional probability of an explosion event within the plant area with radius r_P

As the different Monte Carlo methods (Table 5) are compared it can be found out that most solutions fit a mean about approx. 8.0E-04 which verifies the results as well as the adopted different Monte Carlo algorithms. If the variance and the figure of merit are regarded the MCS in combination with the ffe and biasing techniques is the most efficient approach.

6.6. Case study 3 – gas-tanker accident

The third case study (Figure 13) deals with a gas-tanker accident on the river. The river is subdivided into 6 subsections; each subsection is characterised by an individual length, width and gas-tanker accident frequency. It is assumed, that the accident frequency is higher in sections with confluences or curves than in straight river-sections. The accident-coordinate (x_i, y_i) is uniformly distributed depending on the river-section i.

The vertical distances between the plant and the river are between 440m (dR-1) and 780m (dR-2). In the given application ships can reach every location at the river. Further relevant application parameters of Figure 13 are given in Table 2 and Table 3.

Figure 13.

Gas-tanker accident on the river

6.6.1. Analysis

The MCS depends on a sequence of single events:

• Empirical-distributed accident probability depending on the subsection of the river (Figure 6). It is assumed, that the accident frequency is higher in sections with confluences or curves than in straight river-sections.

• Uniformly-distributed accident-coordinate (x_i, y_i) on condition that the accident occurred in the river-section i.

• Development of explosive gas mixture: fixed probability (0.3).

• Wind-direction φ: empirical-distributed (Figure 7).

• Wind-speed v_W: empirical-distributed (Figure 8).

• Time τ to ignition: Exp(0.01 s^-1)-distributed.

6.6.2. Results

Different ranges of conditional explosion-probability P_E are depicted in Figure 14. The denotation of the different ranges of the explosion event probability P_E, which is normalised on 1m², is as follows: red area (> 1E-07/m²), orange area (≤ 1E-07/m²), yellow area (≤ 5E-08/m²), green area (≤ 1E-08/m²). The methods, number of trials, the simulation time and the results like mean value, variance and figure of merit (fom) are listed in Table 6.

Figure 14.

Gas-tanker accident - ranges of conditional explosion event probability P_E/1m²

method	trials	time [s]	mean	variance	fom
MCS-lee	1E05	7.91	1.24E-03	1.24E-03	1.02E07
MCS-lee biased	1E05	28.02	1.30E-03	1.67E-05	2.14E08
MCS-ffe	1E05	8.52	1.31E-03	1.20E-04	9.80E07
MCS-ffe biased	1E05	28.67	1.27E-03	1.35E-05	2.58E08

Table 6.

Gas-tanker accident - conditional probability of an explosion event within the plant area with radius r_P

Close to the river-sections 2 and 3 the conditional explosion event probability increases, this is due to the higher accident frequency in these sections combined with the specific wind-direction frequencies.

As the different Monte Carlo methods (Table 6) are compared it can be found out that most solutions fit a mean about approx. 1.3E-04 which verifies the results as well as the adopted different Monte Carlo algorithms. If the variance and the figure of merit are regarded the Monte Carlo simulations in combination with the ffe and biasing techniques is the most efficient approach.

6.7. Summary of results

The results of the MCS are evaluated on the condition that the accident already occurred. In order to assess the frequency of occurrence of an external explosion event the frequency of accidents with combustible gas has to be considered. It should be noticed that the results for the frequency of occurrence of an external explosion event will be several magnitudes lower than the results for the conditional explosion event probability given in this paper. Furthermore the events, boundary conditions, parameters and results given in Figures 5 to 14 and Tables 2 to 6 are only example values and do not represent conditions and results of any specific application.

Figures 10, 12, and 14 indicate that the conditional explosion-frequency decreases as the distance to the place of accident increases. This is due to the exponentially distributed ignition probability which depends on the time or the distance to the accident.

The results in Tables 4, 5 and 6 indicate that the conditional probability of occurrence of external explosion pressure waves in consideration of realistic conditions (accident frequency depending on environmental conditions, wind direction & wind speed) can be successfully assessed by means of the MCS.

With the aid of biasing techniques the MCS becomes more efficient, the variance is reduced and the figure of merit (fom) rises. In most cases it can be found out that the solutions fit approx. the same mean which verifies the results as well as the adopted different Monte Carlo algorithms. If the variance and the figure of merit are regarded the MCS in combination with the ffe and biasing techniques is the most efficient approach.

7. Countermeasures to avoid or mitigate the adverse effects of external explosions

Knowledge of the explosion characteristics and the structural impact on buildings of the respective plant is necessary to determine the appropriate countermeasures in order to ensure a safe operation of the nuclear power plant. However, fundamental changes of the plant under consideration are mainly possible only during the design and construction phase.

Basic features of the loads induced on structures by air blasts are described in IAEA Design Guide [5] in terms of a normalized distance that takes into account the amount and type of the explosive charge. The guide presents charts that allow the determination of the peak value of the incident pressure, the total impulse of the positive phase and other relevant design parameters, which are generally used for design or verification purposes of sensitive nuclear structures. For the determination of the resulting actions on structures subjected to a specified blast event, the load-time functions induced by the incident pressure wave must be evaluated in the next step.

In general, it is impossible to protect structures from all man-made and natural hazards. However, assessing the possible damages caused by a defined hazard enables risk-informed decisions about the kinds and number of design changes needed to effectively protect the relevant structures of the nuclear power plants.

This is, in particular, required for the designs of nuclear power plants which are currently under construction or even in the planning phase. Such a hazard assessment has been recently performed [29-30] and for this case a detonation at the highway close to the nuclear power plant has been postulated. For the scenario, the maximum overpressure caused by the explosion has been determined to check if the plant could survive the detonation without damage.

Figure 15 shows the particle velocity field in the pressure wave just before the wave front arrives at the plant under consideration.

Figure 15.

Velocity field at the pressure wave front just before shock wave arrival at the nuclear power plant according to [30]

In case of a plant already operating since several years, the implementation of effective countermeasures is much more difficult or even not possible.

On the one hand, comprehensive calculations can be performed to show that existing assumptions in the calculation provided for the licensing of the plant have been very conservative.

On the other hand, organizational and technical provisions can be taken to reduce the occurrence of an external explosion pressure wave at the plant.

One organizational possibility is to interdict the transport of explosive material, e.g. on a road, in the neighbourhood of the plant. Another solution is to close the road for transit traffic such that the road is only leading to the nuclear power plant.

One technical countermeasure to reduce the explosion frequency on site is the installation of an automatic ignition system placed at a save distance from the site. An assessment has been performed for such an installation which showed that – if the igniters are correctly designed and installed – the shock wave impact after an ignition on the buildings will be limited and will not cause any structural damage.

8. Concluding remarks

The evaluation of external hazards in relation to nuclear power plant design is traditionally considered as a two-step process. The detailed evaluation is preceded by a screening phase where potential scenarios are identified. Many scenarios are screened out on the basis of different criteria, such as distance from the site, probability of occurrence, expected consequence on the plant, or because their effects on the plant are expected to be enveloped by some others. Typically, explosion pressure waves are part of the probabilistic safety assessment as in case of comprehensive periodic safety reviews.

In the German safety guidance document on methods [3] the screening process for the explosion events is explicitly described. The classes of buildings with respect to their protection are the same as for the aircraft crash assessments. Since the updated PSA guideline has been issued in 2005 also requiring the assessment of external events, first practical experience in performing and reviewing the external probabilistic safety assessments are available. One topic is the assessment of the conditional probability of the occurrence of external explosion pressure wave and the discussion of appropriate methods according to the state of the art.

The presented case study and its results (provided in Figures 10, 12, 14 and Tables 4, 5, 6) in the second part of this paper indicate that the conditional probability of occurrence of external explosion pressure waves in consideration of realistic conditions (accident frequency depending on environmental conditions, wind direction and wind speed) can be successfully assessed by means of the Monte Carlo simulation.

As a next step the assessment of explosion events should be extended to include much more realistic boundary conditions regarding

• the extent of the hazard and the explosive gas mixture,

• the ignition probability that depends on environmental conditions [31].

Different ignition models are discussed in [32]. The applied model should be more realistic like the applied exponentially-distributed ignition model; moreover the applicability to integrate the new ignition model into the Monte Carlo algorithm should be given.