SAFETY GUiDES NENTOA TMC NRYAEC, tNA 1996 VtENNA,AGENCY, ENERGY !NTERNAT)ONALATOMtC W!TH!NTHE NUSS PROGRAMMEW!TH!NTHENUSS A PUBUCAHON A Guide ASafety Nuciear Power Piant Design Piant Power Nuciear to Reiation in Man-in Externa) Please This publication see http://www-ns.iaea.org/standards/ is SAFETY SERtES No. 50-SG-D5 (Rev. 1) (Rev. 50-SG-D5 No. SERtES SAFETY no longer
valid
This publication is no longer valid Please see http://www-ns.iaea.org/standards/
CATEGORIES IN THE IAEA SAFETY SERIES
/j new /H'erarc/Hca/ cafegon'xafM??! scheme /MS ^?een :nfroJMceJ, accorA'ng fo wA;'cA fAe /?M^/:caf;'ons /w fAe M E4 ^q/efy ^er/es are grouped as yb//ows;
Safety Fundamentais (silver cover)
Basic objectives, concepts and principles to ensure safety.
Safety Standards (red cover)
Basic requirements which must be satisfied to ensure safety for particular activities or application areas.
Safety Guides (green cover)
Recommendations, on the basis of international experience, relating to the ful filment of basic requirements.
Safety Practices (blue cover)
Practical examples and detailed methods which can be used for the application of Safety Standards or Safety Guides.
Safety Fundamentals and Safety Standards are issued with the approval of the IAEA Board of Governors; Safety Guides and Safety Practices are issued under the authority of the Director General of the IAEA.
There are other publications of the IAEA which also contain information important to safety, in particular in the Proceedings Series (papers presented at symposia and conferences), the Technical Reports Series (emphasis on technological aspects) and the IAEA-TECDOC Series (information usually in a preliminary form). This publication is no longer valid Please see http://www-ns.iaea.org/standards/
EXTERNAL MAN-INDUCED EVENTS IN RELATION TO NUCLEAR POWER PLANT DESIGN
A Safety Guide This publication is no longer valid Please see http://www-ns.iaea.org/standards/ This publication is no longer valid Please see http://www-ns.iaea.org/standards/
CORRIGENDA to External Man-induced Events in Reiation to Nuciear Power Piant Design Safety Series No. 50-SG-D5 (Rev. 1) p. 1 The definition of Normal Operation should read as follows: "Operation of a nuclear power plant within specified operational limits and condi tions including shutdown, power operation, shutting down, starting up, maintenance, testing and refuelling."
The definition of Anticipated Operationai Occurrences should read as follows: "All operational processes deviating from normal operation which are expected to occur once or several times during the operating life of the nuclear power plant and which, in view of appropriate design provisions, do not cause any significant damage to items important to safety nor lead to accident conditions."
p. 2 The definition of Design Basis Accidents should read as follows: "Accident conditions against which the nuclear power plant is designed according to established design criteria."
The definition of Severe Accidents should read as follows: "Nuclear power plant states beyond accident conditions, including those causing significant core degradation." p. 4 Replace "Design Basis Externai Events" with "Design Basis for Externai E vents". p. 3 The definition on this page of Norma! Operation should be deleted, p. 7 The definition of Scabbing should read as follows: "The ejection of irregular pieces of that face of the target opposite the face of missile impact.''
The definition of SpaMing should read as follows: "The ejection of target material from the face of missile impact."
1 This publication is no longer valid Please see http://www-ns.iaea.org/standards/
p. 11, para. Ill, line 3 Replace "impulsive loads" by "impulse loads".
p. 18, para. 225 Replace the first sentence by: "For light water cooled reactors of the types now commonly in use, the following typical structures, systems and components, together with their foundations and sup ports, as listed below, should be protected from the effects of DBEMIEs that affect the entire site or a wide area of the site." p. 19, para. 225 Item (8) should read as follows: "Those portions of the radwaste treatment system whose failure due to DBEMIE effects could result in a potential off-site radiological consequence if prescribed limits are exceeded." p. 20, para. 227 The last sentence should read: "However, the overall structure should be checked against reaction loads from the individual elements or substructures, and its response is generally required to remain broadly within the linear domain, using normal code limits for extreme or abnormal loads." p. 25, para. 311, line 1 Replace "impulse forces" by "impulsive loads", p. 25, para. 312, item (3) The last sentence should read: "These dynamic effects can be analytically expressed by their response spectra at the corresponding locations of the components." p. 38, para. 608 The last sentence should read: "These assumptions are conservative with regard to estimates of gas concentration but not for estimates of filtering of incoming air, prevention of ingress of air during the critical time period by use of recirculation air systems or for determining the amount of bottled air supplies for self-contained breathing apparatus." p. 40, para. 612, line 3 Replace "The leakage" with "To assume leakage". p. 47, para. 1-5. Delete "General Dynamics".
2 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ p. 47, para. 1-6. Replace "two genera! aviation commercial aircraft" with "two civil aircraft". p. 49, para. 11-3. This should commence as follows: "11-3. Furthermore, it has been recommended [28] that lesser standoff distances as given by
W 1/3 Rip = 3.65 where is the static capacity of structural walls (in bar or Pa X 10^)" p. 50, para. 11-4. This should read: "The standoff distances recommended in Refs [18, 23] are intended for use with explosions of solid substances with TNT equivalents in excess of 18 t. Such quantities of explosives produce positive pressure durations of a sufficient length of time that variation in the total incident positive impulse of the pressure-time history has little influence on the structural response as a function of frequency. For explosions with substantially lower TNT equivalent yields, the response is primarily influenced by the total positive impulse, and the standoff distances recommended in Refs [18, 23] become excessively conservative, as shown in Ref. [28]."
3 This publication is no longer valid Please see http://www-ns.iaea.org/standards/
Postulated initiating events Postulated plant (on the basis of NUSS 50-SG-S5) 1 conditions 2
Development of probable scenarios and list of items that require <— ] protection. 3
" 1
Design parameters 4 A no Would there be damage to items <3— important to safety? 5 ^y es
no Are these items needed to meet < !- requirements of Para. 201? 6 ^y es
no Would the damage be sufficient to <3- affect necessary safety functions? 7 ^y es Modify the design to ensure safety by capability of systems, diversity, choice of plant layout, barriers, etc. 8 A
—> No further action required 9
Equipment necessary to perform the required safety functions after the occurrence of a DBMtE, shat) be functionally qualified to the induced environmental conditions, inctuding vibrational loadings.
F/G. 7. Logic Vagram /or o/ evenM ow i'wporrawf ?o
4 This publication is no longer valid Please see http://www-ns.iaea.org/standards/
1 23456789 Time (ms) F/G. 2. LoaJ-fMne /MMcfton ca/cn/afeJ /or secondary (eng/we of a 7%anM?n /!F-4F a:rcra^. 7bM/ maw = 7. 7 impact ve/oc/fy = 700 wA, i^pacf area = 0.7&5 (<%< = 7 /M). /4 d a p ^ /row /?e/! /6/.
Time (ms)
F/G. 3. /<7ea/;ze^ /oa^-Hwe /or a PAa^M/n RF-4F a:rcra/?. 7o;a/ = 20 f, ifnpacf w/oc/fy 27f mA, ;wpacf area = 7/n^ (<^< = 2.96 w). /4^apfe<7 /row /?e/: /20/.
Time (ms)
F/G. 4. Loa^-Ufne ca/cM/afe^ /or a Boe/ng B-720 a!rcra/f w;7/: an Mnpacf ve/oc;'fy of 700 mA. /!<7ap!eJ /row /79/.
5 This publication is no longer valid Please see http://www-ns.iaea.org/standards/
F/G. 9. Drawee venM.s 77V7* egm'va/enf WMM /or a ^Mc/ear power p/an; JeM'gne
Time (ms)
F/G. J. yMncn'on ca/cM/a;^ ^br a Boeing B-707-320 a/rcra/f w;'fA a foM/ /?MM of 97 f an^7 an in%?ac; ve/odfy o f 700 fn/s. ^4<7ap;eJ yrom Re/! /7 9 /
impact area 4 m 10 20 30 40 m^
1 . - L ^ J4 .6 m
Nose section ___ 21.3 m___
Wing main spar section (outer wing fracture begins) -21.3 m-
Wing rear spar section (outer wing fracture begins)
F/G. 6. 7mpacf area ca/cM/afe^ a^ a ^wcn'on o/n'we ybr a Boe/ng 707-320 at'rcra^. ^4<7ap;e<7 yrom 7?ef /79/.
Time (ms) F7G. 7. 7<7ea/i'ze<7 /oa^-nme ca/cM/afe^ /or a Lea^cf 23 aw<7 a CeMwa 270 a/rcra^ an Mnpacf ve/oci'ry of 700 mA. ,4<%apte 6 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ The following States are Members of the International Atomic Energy Agency: AFGHANISTAN HUNGARY PERU ALBANIA ICELAND PHILIPPINES ALGERIA INDIA POLAND ARGENTINA INDONESIA PORTUGAL ARMENIA IRAN, QATAR AUSTRALIA ISLAMIC REPUBLIC OF ROMANIA AUSTRIA IRAQ RUSSIAN FEDERATION BANGLADESH IRELAND SAUDI ARABIA BELARUS ISRAEL SENEGAL BELGIUM ITALY SIERRA LEONE BOLIVIA JAMAICA SINGAPORE BOSNIA AND JAPAN SLOVAKIA HERZEGOVINA JORDAN SLOVENIA BRAZIL KAZAKHSTAN SOUTH AFRICA BULGARIA KENYA SPAIN CAMBODIA KOREA, REPUBLIC OF SRI LANKA CAMEROON KUWAIT SUDAN CANADA LEBANON SWEDEN CHILE LIBERIA SWITZERLAND CHINA LIBYAN ARAB JAMAHIRIYA SYRIAN ARAB REPUBLIC COLOMBIA LIECHTENSTEIN THAILAND COSTA RICA LITHUANIA THE FORMER YUGOSLAV COTE D'IVOIRE LUXEMBOURG REPUBLIC OF MACEDONIA CROATIA MADAGASCAR TUNISIA CUBA MALAYSIA TURKEY CYPRUS MALI UGANDA CZECH REPUBLIC MARSHALL ISLANDS UKRAINE DENMARK MAURITIUS UNITED ARAB EMIRATES DOMINICAN REPUBLIC MEXICO UNITED KINGDOM OF ECUADOR MONACO GREAT BRITAIN AND EGYPT MONGOLIA NORTHERN IRELAND EL SALVADOR MOROCCO UNITED REPUBLIC ESTONIA MYANMAR OF TANZANIA ETHIOPIA NAMIBIA UNITED STATES OF AMERICA FINLAND NETHERLANDS URUGUAY FRANCE NEW ZEALAND UZBEKISTAN GABON NICARAGUA VENEZUELA GERMANY NIGER VIET NAM GHANA NIGERIA YEMEN GREECE NORWAY YUGOSLAVIA GUATEMALA PAKISTAN ZAIRE HAITI PANAMA ZAMBIA HOLY SEE PARAGUAY ZIMBABWE The Agency's Statute was approved on 23 October 1956 by the Conference on the Statute of the IAEA held at United Nations Headquarters, New York; it entered into force on 29 July 1957. The Headquarters of the Agency are situated in Vienna. Its principal objective is "to accelerate and enlarge the contribution of atomic energy to peace, health and prosperity throughout the world". SAFETY SERIES No. 50-SG-D3 (Rev. t) EXTERNAL MAN-INDUCED EVENTS IN RELATION TO NUCLEAR POWER PLANT DESIGN INTERNATIONAL ATOMIC ENERGY AGENCY VIENNA, 1996 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ THIS SAFETY SERIES PUBLICATION IS ALSO ISSUED IN FRENCH, RUSSIAN AND SPANISH VIC Library Cataloguing in Publication Data External man-induced events in relation to nuclear power plant design : a safety guide. — Vienna : International Atomic Energy Agency, 1996. p. ; 24 cm. — (Safety series, ISSN 0074-1892 ; 50-SG-D5 (Rev. 1). Safety guides) On cover: A publication within the NUSS Programme. STI/PUB/984 ISBN 92-0-103-295-1 Includes bibliographical references. 1. Nuclear power plants—Design and construction. 2. Nuclear power plants—Safety measures. I. Nuclear Safety Standards Programme, n. International Atomic Energy Agency. III. Series VICL 95-00138 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ by the IMrector Genera! Nuclear power is well established and can be expected to become an even more significant part of the energy programmes of many countries, provided that its safe use can be ensured and be perceived to be so ensured. Although accidents have occurred, the nuclear power industry has generally maintained a good safety record. However, improvements are always possible and necessary. Safety is not a static concept. The International Atomic Energy Agency, recognizing the importance of the safety of the industry and desiring to promote an improving safety record, set up a programme in 1974 to give guidance to its Member States on the many aspects of the safety of nuclear power reactors. Under this Nuclear Safety Standards (NUSS) programme, some 60 Codes and Safety Guides dealing with radiological safety were published in the IAEA Safety Series between 1978 and 1986. The NUSS programme was developed for land based stationary plants with thermal neutron reactors designed for the production of power but the provisions may be appropriate to a wider range of nuclear applications. In order to take account of lessons learned since the first publication of the NUSS programme was issued, it was decided in 1986 to revise and reissue the Codes and Safety Guides. During the original development of these publications, as well as during the revision process, care was taken to ensure that all Member States, in particular those with active nuclear power programmes, could provide their input. Several independent reviews took place including a final one by the Nuclear Safety Standards Advisory Group (NUSSAG). The revised Codes were approved by the Board of Governors in June 1988. In the revision process new developments in tech nology and methods of analysis have been incorporated on the basis of international consensus. It is hoped that the revised Codes will be used, and that they will be accepted and respected by Member States as a basis for regulation of the safety of power reactors within the national legal and regulatory framework. Any Member State wishing to enter into an agreement with the IAEA for its assistance in connection with the siting, design, construction, commissioning, operation or decommissioning of a nuclear power plant will be required to follow those parts of the Codes and Safety Guides that pertain to the activities to be covered by the agreement. However, it is recognized that the final decisions and legal responsibilities in any licensing procedures rest with the Member States. The Codes and Safety Guides are presented in such a form as to enable a Member State, should it so desire, to make their contents directly applicable to activities under its jurisdiction. Therefore, consistent with the accepted practice for codes and guides, and in accordance with a proposal of the Senior Advisory Group, This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 'shall' and 'should' are used to distinguish for the user between strict requirements and desirable options respectively. The five Codes deal with the following topics: — Governmental organization — Siting — Design — Operation — Quality assurance. These five Codes establish the objectives and basic requirements that must be met to ensure adequate safety in the operation of nuclear power plants. The Safety Guides are issued to describe to Member States acceptable methods of implementing particular parts of the relevant Codes. Methods and solutions other than those set out in these Guides may be acceptable, provided that they give at least equivalent assurance that nuclear power plants can be operated without undue risk to the health and safety of the general public and site personnel. Although these Codes and Safety Guides establish an essential basis for safety, they may require the incorporation of more detailed requirements in accordance with national practice. Moreover, there will be special aspects that need to be assessed by experts on a case by case basis. These publications are intended for use, as appropriate, by regulatory bodies and others concerned in Member States. In order to comprehend the contents of any of them fully, it is essential that the other relevant Codes and Safety Guides be taken into account. Other safety publications of the IAEA should be consulted as necessary. The physical security of fissile and radioactive materials and of nuclear power plants as a whole is mentioned where appropriate but is not treated in detail. Non-radiological aspects of industrial safety and environmental protection are also not explicitly considered. The requirements and recommendations set forth in the NUSS publications may not be fully satisfied by older plants. The decision of whether to apply them to such plants must be made on a case by case basis according to national circumstances. This publication is no longer valid Please see http://www-ns.iaea.org/standards/ CONTENTS DEFINITIONS ...... 1 1. INTRODUCTION ...... 9 Background ...... 9 Objective ...... 10 S c o p e ...... 10 Structure...... 11 2. GENERAL DESIGN PH ILO SO PH Y ...... 11 D esignsafetyobjectives...... 11 Establishing the design basis ...... 12 Gen'eral design approach ...... 13 Design lo g ic ...... 15 Structures, systems and components to be protected against external man-induced events ...... 18 General design approach against impulsive lo a d s ...... 20 Load combinations and behaviour lim its...... 21 Documentation and quality assurance requirements ...... 22 Plantinspection ...... 22 3. AIRCRAFT C R A S H E S ...... 23 General d iscu ssio n ...... 23 D esignm ethodology...... 23 Considerations of system protection...... 25 M ean so fp ro tectio n ...... 25 E ffectso faircraftfu el...... 26 Design b a s is ...... 27 4. FIRES DUE TO MAN-INDUCED E V E N T S ...... 27 F iresof external o rig in ...... 27 Methodology ...... 28 Considerations of system p ro tection...... 29 M ean so fp ro tectio n ...... 29 Design recom m endations...... 29 Modelling of concrete structure for fire lo a d s ...... 29 Fire modelling ...... 30 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 5. EX PLO SIO N S...... 30 General d iscu ssio n ...... 30 Explosive phenom ena...... 31 Explosions of solid su b stan ces...... 32 Design m ethodology...... 32 Considerations of system protection ...... 33 Means of protection ...... 33 Gas cloud explosions ...... 34 Design m ethodology...... 34 Considerations of system protection ...... 34 Means of protection ...... 35 Design basis ...... 35 6. HAZARDS FROM DRIFTING CLOUDS ...... 36 Dispersion of toxic gas clouds and flammable fluids ...... 36 Toxic g ases...... 37 Preliminary evaluation...... 37 Cloud diffusion...... 38 Effects of toxic gas releases ...... 38 M ethodology...... 38 Personnel protection consideration ...... 38 Means of protection ...... 39 Flammable flu id s ...... 39 Sub-cooled liquefied gases ...... 39 Fluid pipelines ...... 40 Means of protection ...... 40 7. CORROSIVE FLUID R E LEA SES...... 41 General d iscu ssio n ...... 41 Design m ethodology...... 41 Considerations of system pro tectio n ...... 41 8. SHIP C O LLISIO N ...... 42 Considerations of system pro tectio n ...... 42 Means of p ro tectio n ...... 42 ANNEX I: AIRCRAFT C R A SH E S...... 43 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ ANNEX II: GAS CLOUD EXPLOSIONS ...... 48 REFERENCES ...... 51 CONTRIBUTORS TO DRAFTING AND R E V IE W ...... 53 LIST OF NUSS PROGRAMME (TITLES)...... 57 SELECTION OF IAEA PUBLICATIONS RELATING TO THE SAFETY OF NUCLEAR POWER PL A N T S...... 63 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ This publication is no longer valid Please see http://www-ns.iaea.org/standards/ DEFINITIONS 77? Plant states Operational states Accidents Anticipated Normal operational Accident Severe operation ] occurrences conditions ] accidents ! t ' DeMgH ) accMfenM ! I /IcciWen; ?na?Mge?ngnf ) Operational States States defined under normal operation or anticipated operational occurrences. Norma) Operation Operation of a spent fuel storage facility within specified operational limits and conditions including fuel handling, storage, retrieval and fuel monitoring, main tenance and testing. Anticipated Operational Occurrences' A11 operational processes deviating from normal operation which are expected to occur once or several times during the operating life of the fuel storage facility and which, in view of appropriate design provisions, do not cause any significant damage to items important to safety nor lead to accident conditions. * * Examples of anticipated operational occurrences are loss of normal electric power, malfunction of individual items of a normally running plant and failure to function of individ ual items of control equipment. 1 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ Accident (or Accident State) A state defined under accident conditions or severe accidents. Accident Conditions Deviations^ from operational states in which the releases of radioactive materials are kept to acceptable limits by appropriate design features. These devia tions do not include severe accidents. Design Basis Accidents Accident conditions against which the spent fuel storage facility is designed according to established design criteria. Severe Accidents Spent fuel storage facility states beyond accident conditions, including those causing significant fuel degradation. Accident Management The taking of a set of actions — during the evolution of an event sequence, before the design basis of the plant is exceeded, or — during severe accidents without allowing unacceptable radionuclide releases to the environment to return the facility to a controlled safe state and to mitigate any consequences of the accident. 2 A deviation may be, for example, a major fuel failure caused by equipment malfunc tion, operator error, etc. 2 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ TAe re/afi'ow^AFp Aefwee/! cerfaw fer/m ^re^Mewf/y M^ed i'n fAe de^;gw area, ;'Mc/tK#/:g fAoje Je^ned Ae/ow, are .sAown ;'w fAe acco/npaMywg J:'agra/n. Plant equipment Items important to safety Items no? important to safety Protection Safety Safety system actuation system systems support features Safety — See Nuclear Safety Nuclear Safety (or simply Safety) The achievement of proper operating conditions, prevention of accidents or mitigation of accident consequences, resulting in protection of site personnel, the public and the environment from undue radiation hazards. Safety Systems^ Systems important to safety, provided to assure the safe shutdown of the reac tor or the residual heat removal from the core, or to limit the consequences of antici pated operational occurrences or accident conditions. 3 Safety Systems consist of the protection system, the safety actuation systems, and the safety system support features. Components of safety systems may be provided solely to per form safety functions or may perform safety functions in some plant operational states and non safety functions in other plant operational states (see diagram). 3 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ Protection System A system which encompasses all electrical and mechanical devices and circuitry, from sensors to actuation device input terminals, involved in generating those signals associated with the protective function. Safety Actuation System The collection of equipment required to accomplish the necessary safety actions when initiated by the protection system. Safety System Support Features The collection of equipment that provides services such as cooling, lubrication and energy supply required by the protection system and the safety actuation systems. Acceptable Limits Limits acceptable to the Regulatory Body. Combustion Reaction of a substance with oxygen, with release of heat, generally accompa nied by flaming and/or glowing and/or emission of smoke. Design Basis External Events The parameter values associated with, and characterizing, an external event or combinations of external events selected for design of all or any part of the nuclear power plant (see design basis external man-induced events and design basis natural events). Design Basis External Mam-Enduced Events (DBEMIE) External man-induced events selected for deriving design bases (see design basis external events). Design Basis Natural! Events Natural events selected for deriving design bases (see design basis for external events). 4 Outside the site boundary. 4 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ Externa! Events Events which originate outside the site and whose effects on the nuclear power plant shall be considered. These events could be of natural or man-induced origin and are identified and selected for design purposes during the siting process. Impulsive Loads Short duration transient loadings which are characterized by a defined momen tum transfer. Missile A mass that has kinetic energy and has left its design location^. Normal Operation Operation of a nuclear power plant within specified operational limits and conditions including shutdown, power operation, shutting down, starting up, mainte nance, testing and refuelling. Overall Missile Effects Those effects which depend to a large extent on the dynamic and other charac teristics of the target (a structure, system or component) subjected to impact and which are therefore not limited to the immediate area of impact. Penetration The state when the impacting missile has formed a notch on the impact face but has not perforated the target. Perforation The state when the impacting missile has passed through the target completely. s The term missile is used in the context of this Safety Guide to describe a moving object in general, but military missiles, whether explosive or not (e.g. bombs, rnckets), are specifical ly excluded from consideration. In general, military projectiles have velocities higher than Mach 1, and are therefore usually beyond the range of applicability of the techniques described in this Safety Guide. However, for non-explosive military projectiles with characteristics falling within the quoted ranges of applicability, the techniques described may be used. 5 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ Physica! Separation (1) Separation by geometry (distance, orientation, etc.), or (2) Separation by appropriate barriers, or (3) Separation by a combination thereof. Postulated Initiating Events (PIE) Identified events that lead to anticipated operational occurrences or accident conditions and their consequential failure effects.6 Primary Missile Effects AH effects on targets by both direct strikes and ricochet strikes from missiles which originate from the initial equipment failure. Redundancy Provision of more than the minimum number of (identical or diverse) elements or systems, so that the loss of any one does not result in the loss of the required func tion of the whole. Region A geographical area, sufficiently large to contain all the features related to a phenomenon or to the effects of a particular event. Regulatory Body A national authority or a system of authorities designated by a Member State, assisted by technical and other advisory bodies, and having the legal authority for con ducting the licensing process, for issuing licences and thereby for regulating nuclear power plant siting, construction, commissioning, operation and decommissioning or specific aspects thereof.*? 6 The primary causes of postulated initiating events may be credible equipment failures and operator errors (both within and external to the nuclear power plant), man induced or natural events. Specification of the postulated initiating events is to be acceptable to the regu latory body for the nuclear power plant. 7 This national authority could be either the government itself, or one or more depart ments of the government, or a body or bodies specially vested with appropriate legal authority. 6 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ Residua! Heat The sum of the heat originating from radioactive decay and shutdown fission and the heat stored in reactor related structures and in heat transport media. Safety Function A specific purpose that must be accomplished for safety. 8 Scabbing The ejection of irregular pieces of that face of the target opposite the face of Missile impacts Secondary Effects All subsequent effects due to the consequences of primary missile effects. Singie Failure A random failure which results in the loss of capability of a component to per form its intended safety functions. Consequential failures resulting from a single ran dom occurrence are considered to be part of the single failure. Site The area containing the plant, defined by a boundary and under effective con trol of the plant management. Spalling The ejection of target material from the face on which the missile impacts. Ultimate Heat Sink The atmosphere or a body of water or a combination of these to which residual heat is transferred. s A list of safety functions is given in the Safety Guide on Safety Functions and Component Classification for BWR, PWR and PTR (IAEA Safety Series No. 50-SG-D1). ? Full penetration of the missile is not necessary to cause scabbing. 7 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 1. TNTRODUCTFON BACKGROUND 101. This Safety Guide, which supplements the IAEA Code on the Safety of Nuclear Power Plants: Design (IAEA Safety Series No. 50-C-D, Rev. 1), forms part of the IAEA's programme, referred to as the NUSS programme, for establishing Safety Codes and Safety Guides relating to land based stationary thermal neutron power plants. A list of NUSS programme titles is given at the end of this publica tion. 102. The present Safety Guide is a revision of the Safety Guide issued in 1982 with in the series of NUSS Guides for design of nuclear power plants. The main changes are as follows: (1) Design information on external man-induced events which previously appeared in Safety Series No. 50-SG-S5 have been considered in this document. (2) Section 2, 'General Design Philosophy', has been considerably expanded, with new information added on 'Structures, Systems and Components to be Protected from External Man-Induced Events' and on 'Load Combinations and Behaviour Limits'. (3) Individual sections have been prepared on aircraft crashes, fires due to man-induced events, explosions, hazards from drifting clouds, corrosive fluid releases, and ship collision. Discussion on each of these topics has been expand ed and updated. Very little material which appeared in the previous edition on each of these topics has been deleted. (4) The organization of the document has been revised. 103. It is emphasized that this Safety Guide and the Safety Guide on External Man-Induced Events in Relation to Nuclear Power Plant Siting (IAEA Safety Series No. 50-SG-S5) are complementary. Whether or not an external man-induced event is included as a postulated initiating event for a particular plant shall be decided on the basis of siting information developed in accordance with Safety Guide 50-SG-S5 and other relevant sources. Design information on external man-induced events which pre viously appeared as annexes in Safety Guide 50-SG-S5 has now been incorporated into this Guide. Since this information has not yet been removed from the annexes to that Guide, some duplication of guidance has resulted. This Guide (50-SG-D5) is intended to serve as the design guide for external man-induced events while 50-SG-S5 serves as the siting guide. 9 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 104. The Safety Guide on Protection against Internally Generated Missiles and their Secondary Effects in Nuclear Power Plants (IAEA Safety Series No. 50-SG-D4) gives guidance for protection against missiles which originate inside the nuclear power plant. OBJECTIVE 105. The purpose of this Safety Guide is to give guidance for the protection of nuclear power plants against the effects of external man-induced events which origi nate outside the site and which have been identified and selected as design basis exter nal man-induced events (DBEMIEs) according to Safety Guide No. 50-SG-S5. This guidance is intended to amplify the general safety requirements given in Sections 2 and 3 of the Code on the Safety of Nuclear Power Plants: Design (IAEA Safety Series No. 50-C-D, Rev. 1), hereinafter referred to as the Code. 106. The above mentioned purpose aims at providing the reader with a generally accepted way to design a nuclear power plant such that a postulated DBEMIE at the site does not jeopardize the safety of the plant, and gives guidance on methods and procedures to analyse and design the plant for the type of postulated events. 107. External man-induced events which are credible or have been identified at a given site during siting shall be reassessed for completeness at an early stage in the design process (see also para. A205 of the Appendix to the Code). SCOPE 108. This Guide is applicable to the design of items important to safety of nuclear power plants with relation to the following list of external man-induced events: Aircraft crashes Fires due to external man-induced events Explosions (deflagrations and detonations) Hazards from drifting clouds and flammable fluids Corrosive fluid releases Ship collision. Other external man-induced events, not included in the list, may be identified and selected as DBEMIE at the site, such as oil spills close to water intakes. All such events should be evaluated in accordance with specific requirements, compatible with the Code, established or developed for them by the Member States. 10 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 109. It is recognized that there may be other procedures for the recommended design and verification of the plant structures, systems and components to resist external man-induced events. Their adequacy to achieve the safety objective shall be deter mined depending on the individual circumstances. It is also recognized that there may be more than one possible engineering solution to these problems and that the approach adopted for one specific nuclear power plant may result in differences in that plant's design when compared to another for which a different approach has been adopted. 110. By definition, external man-induced events are of accidental origin. Therefore considerations related to physical protection of the plant from wilful action by third parties are outside the scope of this Guide. However, the methods described herein may also have certain application to problems of physical protection. STRUCTURE 111. The general design philosophy is presented in Section 2, with the concepts required to develop the list of items to be protected, the general design approach against impact and impulsive loads which are the type of loads that normally corre sponds to external man-induced events. Load combinations and behaviour limits under these loads are also given in Section 2. The specific events are treated individ ually in the subsequent sections. Aircraft crashes and gas cloud explosions are con sidered in the Annexes. 2. GENERAL DESIGN PHILOSOPHY DESIGN SAFETY OBJECTIVES 201. The design for protection against DBEMIEs shall ensure that the general safety design requirements are met as indicated in para. 306 of the Code; i.e. (1) Means shall be provided safely to shut down the reactor and maintain it in the safe shutdown condition in operational states and during and after accident conditions. (2) Means shall be provided to remove residual heat from the core after reactor shutdown, including accident conditions. (3) Means shall be provided to reduce the potential for the release of radioactive materials and to ensure that any releases are below prescribed limits during operational states and below acceptable limits during accident conditions. 11 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 202. In order to protect adequately site personnel, the public and the environment from radiological consequences in the case of external man-induced events, it is nec essary to prevent radioactive substances contained within the plant from leaving their design location. This means that those plant items which contribute directly or indi rectly to the retention of radioactive materials/substances shall be considered in the concept of protection. Reasonable measures to reduce the potential release should be taken. Those plant items which contain radioactive substances shall be protected against the loads generated by external man-induced events unless it is shown that a potential release would remain below prescribed limits. ESTABLISHING THE DESIGN BASIS 203. The first step in evaluating a nuclear power plant design for protection against external man-induced events is to identify those events that are considered credible for a particular site. IAEA Safety Guide No. 50-SG-S5 provides a methodology for selecting those credible events which need to be considered for the site. For other reasons, such as national safety policy, a certain type of initiating man-induced exter nal event may be defined as the design basis on deterministic grounds. The initial operational states to be considered at the time of occurrence of any DBEMIE, such as power, hot shutdown, cold shutdown and refuelling, should be determined on a prob abilistic basis. 204. The selected events and their characteristic parameters constitute the design basis for the plant and shall be taken as the input for the analysis or the design. The analysis shall demonstrate that in each case the safety functions implicit in the gener al design requirements of para. 201 can be fulfilled and that the consequential radio active release remains below acceptable limits. Those design assumptions which are sufficient to show compliance with these criteria are taken as the contribution from external man-induced events to the design basis for the plant items. Provisions assumed in the design to protect the plant against DBEMIEs shall not impair the plant safety response to the internal design basis events. 205. A practical way of designing is to establish the design input parameters by a combination of deterministic and probabilistic methodologies, as described in IAEA Safety Guide No. 50-SG-S5, and to proceed with the design in a deterministic fashion. This enables the designer to minimize complications and it provides adequate assur ance that no undue risk to public health and safety will result from man-induced events. 206. In some cases, even though the preceding combined deterministic and proba bilistic approach might identify a specific external man-induced event as a potential 12 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ design basis event, it may stili be excluded from specific analysis if it is shown that the corresponding effects are bounded by the effects from other design basis events. For example, in most cases there will be no need for a specific design of components to take into account vibrations induced by external explosions if they are already designed to take into account earthquake and aircraft loadings. GENERAL DESIGN APPROACH 207. Since with proper siting of a nuclear power plant the probability of occurrence of external man-induced events is rather low it is general practice to limit the protec tion of the plant strictly to the fulfilment of the objective of paras 201 and 202. Damage to plant items which are not needed for this purpose but which may be required for normal operation of the plant is tolerated. The plant design will normal ly include other means of resistance to withstand many external events. For these rare events, it may be appropriate to accept loading conditions beyond the normal range, i.e. beyond the elastic response range within the ultimate strength level; and non-com- pliance with the single-failure criterion may be justifiable'. 208. Having selected the external man-induced events to be considered for a partic ular site, the designer shall evaluate their effects on the plant, including all credible secondary effects. The possibility of common cause failures shall also be taken into account. If required by the evaluation, adequate design provisions shall be made such that the general safety requirements of para. 201 can be met. To perform the safety functions required for DBEMIEs the designer can foresee ad hoc systems or use the safety systems already present in the plant for internal events. In both cases, the pro tection for the items required to cope with the effects of the occurrence of external man-induced events may be provided by: (1) Designing the plant item to have adequate resistance to withstand the effects of the DBEMIE. (2) Designing the plant so that only a portion of the safety systems is affected by such events, and the remanent part of the systems is left unaffected to ensure that both the requirements of para. 201 of this Safety Guide, and that of the single-failure criterion (paras 329 through 336 of the Code) are met'. This is ' In some Member States the probability of the occurrence of certain man-induced events, such as external explosions or airplane crashes, is considered very low, so that the single-failure non-compliance clause of Section 335 of the Code of Design applies. In some Member States system outage due to repair, test or maintenance and its associated change in plant configura tion is considered one possible mode of a single failure in this context. Some other Member States include the single failure criterion for all DBEMIEs. 13 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ sometimes accomplished by use of barriers or by plant layout where redundant portions of safety systems are separated by a sufficient distance or by a combi nation of these (see definition of Physical Separation). In addition the following aspects shall be considered: (a) Following the occurrence of a DBEMIE the design shall ensure the accessibili ty to the main control room and supplementary control points and to the points, rooms and facilities necessary for meeting the requirements of para. 201. (b The design should ensure that the plant accidental conditions determined by the occurrence of the DBEMIE do not deteriorate during the evolution of the acci dent (with no additional failures) to worse conditions (e.g. LOCA) that cannot be controlled with the systems provided for the protection against DBEMIEs. (c) For the systems not protected against DBEMIEs, the status to be assumed in the accident analysis can be 'operable'or 'not operable', depending on which status is the more conservative for the analysis. Erroneus operations or actuation of systems could be neglected if it can be demonstrated that they can be effective ly countered by operator intervention in accessible areas and in the proper time. No intervention should be considered before a suitable time delay after the ini tiating event (e.g. 30 minutes). 209. The designer should use the features of these approaches which achieve the best balance among safety, operational aspects, economics and other important factors. For example, an inherent capability to withstand an aircraft crash can be provided by spa tial separation of redundant systems, such that the simultaneous failure of the redun dant systems due to the effects of building vibration, debris or fire from aircraft fuel is precluded. Otherwise, it will be necessary to provide additional protection in the form of barriers or to increase the spatial separation by the modification of plant layout. 210. Plant layout is an aspect of plant design which can be used to limit the effects of various external man-induced events. For example, a well spread layout has the advan tage of limiting the effects of aircraft crashes, explosions and fires of external origin. 211. In designing for additional protection it should be remembered that barriers can introduce difficulties for inspection and maintenance, while a greater spread in plant layout may require more staff to handle the increased task of surveillance, as well as long routing of piping, cable trays and ventilation ducts. 212. Any of the above approaches, while sufficient for some of the effects of an external man-induced event, may not cover all possible effects. Also the approach used in designing against the effects of a given external man-induced event may change the resistance to some other event which has to be assessed. 14 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 213. An external man-induced event includes any credible causal effects of that event (see IAEA Safety Guide No. 50-SG-S5). 214. An external man-induced event does not need to be considered in combination with events that may occur independently, such as other external man-induced events, natural phenomena, equipment failures and operator errors, unless a combination of these events is shown to have a sufficiently high probability of occurrence. In this assessment, the possibility of a causal relationship should be duly evaluated^. 215. When justified, the design for external man-induced events which produce pri mary and secondary effects may take into consideration the time delay between such effects in specifying how the primary and secondary effects are to be combined. The necessity for combining events (see the Appendix to the Code, paras A207 to A211) depends on the probability and the radiological consequences of the combinations. DESIGN LOGIC 216. A typical logic diagram for the analysis of effects of external man-induced events on items important to safety is given in Fig. 1 and is described in this section. The following sections of the Guide will show how design input parameters for rele vant man-induced events which have been identified and selected during the siting process are utilized in the design in accordance with the postulated plant conditions (see Boxes 1 and 2 of Fig. 1). Probable scenarios of the consequences for the DBEMIE should be developed and on this basis the list of affected items should be produced (see Box 3). Afterwards, the corresponding design parameters should be identified (see Box 4). 217. The choice of affected locations shall be made very carefully, since the possible effects on any particular function, caused by impairment of a system, may not be obvi- ous3. As examples, the repair time for a power line damaged by a man-induced event may determine the minimum amount of stored fuel required for the diesel generators, if diesel oil supply from sources nearby cannot be guaranteed. Failure of a ventilation system because of an aircraft crash may lead to a temperature rise inside a building, which in turn may cause malfunction of electronic equipment. 2 One Member State practice is that a loss of off-site power is assumed to occur simultane ously with airplane crashes and explosions. ^ In some cases, it may be feasible to formalize the identification of such effects through fail ure mode effect analysis technique. 15 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 218. The first point of interest when performing this accident analysis is to determine which items important to safety can be affected by an external man-induced event, so as to ensure that the requirements of para. 201 can be met (Boxes 5, 6). The designer needs to decide whether the affected area is limited or whether it may extend over the entire plant site. Usually, events such as aircraft crashes and missile strikes have lim ited impact areas (even when more than one missile is considered), while explosions, ground motions and gas clouds can have plant-wide effects. 219. If the impact area is limited and the affected location can be determined, the items important to safety that might be affected can be identified. The need for pro tection of these items arises when the requirements of paras 201 and 202 cannot be met for this postulated initiating event (PIE) (i.e. if the answer to the question in Box 7 is Yes). 220. Once an external man-induced event is identified as relevant, the design to pro tect against it is generally based on a deterministic accident analysis. Different ways of ensuring the safety objectives (Box 8) are: (1) If their inherent capabilities would otherwise be insufficient, to strengthen the items so that they can withstand the impact; (2) To protect them either by passive means (such as barriers) or by active means (such as monitors that actuate closure valves); (3) To provide redundant items in a different location with sufficient separation between them; (4) To limit the consequences of damage. 221. If, on the other hand, the affected area is limited, but is not confined to a spe cific location, the designer shall analyse which functions could be impaired, assuming that the impact area may be anywhere on the site (Box 7). As a case in point, it will not be possible to predict the location of the impact area for an aircraft crash or a missile, but it may be possible to identify areas where aircraft crashes will not be prob able. For example, when a building is near other buildings these may serve to shield against the effects of an aircraft crash. 222. If the affected area is plant-wide, as would be expected in case of ground motion, gas clouds and explosions, items important to safety located anywhere in the plant could be affected coincidentally (and the answer to Box 6 would be Yes). This possible coincidence should be taken into consideration in analysing whether neces sary functions might be affected (Box 7). Therefore, for protection against events which may affect plant-wide areas, separation by distance alone may not be adequate, and special provisions may need to be made to strengthen the items or to protect them 16 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ from the effects (Box 8), for example, to isolate the air intake of the main control room in the event of toxic clouds. After these provisions are made, the new design should be subjected to a complete verification, including the effects of the changes on plant behaviour in relation to other events (return arrow in logic diagram). Postulated initiating events Postutated plant (on the basis of NUSS 50-SG-S5) conditions Development of probable scenarios and list of items that require protection. Design parameters no Would there be damage to items important to safety? yes no Are these items needed to meet requirements of Para. 202? yes no Would the damage be sufficient to affect necessary safety functions? yes Modify the design to ensure safety by capability of systems, diversity, choice of plant layout, barriers, etc. No further action required Equipment necessary to perform the required safety functions after the occurrence of a DBMIE, shall be functionally qualified to the induced environmental conditions, including vibrational loadings. F/G. / . Logic diagram /or ana/y.m o/ o/ maK-ifM/Mced evenfs on imporfanf fo .sa/ery. 17 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ STRUCTURES, SYSTEMS AND COMPONENTS TO BE PROTECTED AGAINST EXTERNAL MAN-INDUCED EVENTS 223. In order to meet the general safety design requirements of para. 201 for the selected external man-induced events, a classification of the plant items is required to provide a rational basis for design. This classification comprises those structures, systems and components which shall be protected against the DBEMIE and includes"*: (1) Items whose failure could directly or indirectly cause accident conditions (see Definitions). (2) Items required for shutting down the reactor, monitoring critical parameters, maintaining the reactor in a shutdown condition and removing residual heat over a long period. (3) Items that are required to prevent radioactive releases or to maintain releases below limits established by the regulatory body for accident conditions (e.g. containment system). 224. The list of structures, systems and components that should be protected against the DBEMIE should comply with the requirements established in the IAEA Safety Guide on Safety Functions and Component Classification for BWR, PWR and PTR (Safety Guide No. 50-SG-D1). 225. For light water cooled reactors of the types now commonly in use, the follow ing typical list of structures, systems and components, together with their foundations and supports, should be protected from the effects of DBEMIEs that affect the entire site or a wide area of the site. For the DBEMIEs where the affected area is limited, the list can be reduced. It should be noted that such a list is design dependent and it should be verified in each case that the list meets the requirements of paras 201 and 202. (1) The reactor coolant pressure boundary. (2) Those portions of the main steam and main feedwater systems^ in PWRs up to and including the outermost isolation valves. ^ For DBEMIEs which affect the entire site or a wide area of the site, e.g. explosions, some Member States recommend including those items which are designed to mitigate the conse quences of accidents smaller than design basis accidents (such as small break LOCA), which may be postulated to occur in the primary pressure boundary, despite the fact that the primary pressure boundary is designed against DBEMIEs. However, the design load combinations are specified in accordance with paras 232 and 233. 3 The system boundary includes those portions of the system required to accomplish the spec ified safety function and connecting piping up to and including the first valve (including a safe ty or relief valve). This is either normally closed or capable of automatic closure when the safe function is required. 18 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ (3) The reactor core and individual fuel assemblies, at all times, including during refuelling. (4) Systems or portions of systems that are required for (1) attaining safe shutdown, (2) residual heat removal, (3) cooling the spent fuel storage pool, (4) mitigating the consequences of a DBEMIE caused PWR steam line breaks, (5) make-up water for the primary system, and (6) supporting the above systems, e.g. cool ing water, ultimate heat sink, air supply, auxiliary feedwater and ventilation. (5) The spent fuel storage pool, to the extent necessary to preclude significant loss of leaktightness of the storage pool and to prevent missiles from coming into contact with fuel within the pool. (6) The reactor scram systems, e.g. control rod drives and boron injection system. (7) The control room or the supplementary control points, including all equipment needed to maintain the control room or supplementary control points within safe habitability limits for personnel and safe environmental limits for DBEMIE pro tected equipment. (8) Those portions of the radwaste treatment system whose failure due to DBEMIE effects could result in potential off-site radiological consequences in exceeding prescribed limits. (9) Systems or portions of systems that are required for monitoring, actuating, and operating those portions of systems protected against DBEMIEs, listed in items (4), (6), (7) and (13). (10) All electric and mechanical devices and circuitry between the process sensors and the input terminals of the actuator systems involved in generating signals that initiate protective actions by portions of systems protected against DBEMIEs and listed in items (4), (6), (7) and (13). (11) Those portions of the emergency core cooling system that would be required to maintain the plant in a safe condition for a sufficient time after a LOCA. (12) Primary reactor containment and other structures important to safety, to the extent that they do not collapse, allow perforation by missiles, or generation of secondary missiles, any of which could cause unacceptable damage to DBEMIE protected items. If the primary containment leaktightness is not maintained, a justification is needed. (13) The emergency power supplies as well as their auxiliary systems needed for the functioning of plant features included in items (1) to (11). (14) The post-accident monitoring system. 6 Alternatively, the main steam system, up to and including a second isolation valve such as a redundant series main steam isolation valve (MSIV), or a turbine stop valve, may be protected. 19 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ (15) Those portions of structures, systems and components whose continued func tion is not required but whose failure could reduce to an unacceptable safety level the functional capability of any plant features included in items (1) to (13) or could result in incapacitating injury to occupants of the control room. GENERAL DESIGN APPROACH AGAINST IMPULSIVE LOADS 226. Many of the loads corresponding to external man-induced events described in subsequent sections and in IAEA Safety Guide No. 50-SG-S5 are impulsive loads. Impulsive loads are short duration transient loadings which are characterized by a defined momentum transfer. The loads are often localized, causing substantial local response of the individual target, but with little effect on massive structures as a whole. It is useful further to subdivide these loads into the following: (1) /wpacf /oaJ arises as the result of the collision between a moving solid body (missile or projectile) against a second body at rest (target structure), during which a finite amount of momentum and kinetic energy are transferred from the missile to the target structure. The impact load transient is determined by the geometrical, inertial and mechanical (e.g. stiffness) properties of the missile and the target structure. In cases such as aircraft impact knowledge of the complete load-time function and impact area are necessary for design purposes. However, for impact loadings, it is sometimes sufficient to define only the momentum transferred to the target structure and the area over which the transfer occurs, rather than the details of the load transient. (2) /wpM/se /oad is also a short duration transient loading, but it is determined by an external source and is not dependent upon target inertial and stiffness properties. Impulse loads are force limited as well as energy limited and must generally be defined by a load-time function. 227. While it is possible to design for impulse and impact loads on an elastic basis using normal code limits, for extreme or abnormal loads the severe local nature of these loads can make such design impractical. Design which utilizes localized plastic deformation to absorb the energy input by the load is acceptable provided that the overall stability of the structure is not impaired. Inelastic behaviour (localized plastic) is generally permissible for individual structural elements (beams, slabs, etc.) where local inelastic deformation would not jeopardize the stability of the structure as a whole, and for protective substructures (restraints, barriers, etc.) whose sole function is to provide protection against impulse and impact loads. However, the overall struc ture should be checked against reaction loads from the individual elements or sub structures and is generally required to remain essentially linear using normal code limits for extreme or abnormal loads. 20 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 228. Design criteria based on test results are particularly appropriate for impact and impulse loads, on account of the wide spread of response predictions observed in non-linear numerical analyses not using benchmarked computer solutions. On the other hand, extreme care should be exercised when empirical or semi-empirical approaches are employed outside the range of parameters of the corresponding data base. 229. Material properties assumed in design against impulse and impact loads may be obtained from standard references, which may also include statistical and strain rate variation considerations. Both types of variation represent increases in strength over minimum guaranteed values. These increases must be taken into account to predict realistically reaction or pass-through loads from a structural element affected by impulse or impact. It is common to take credit for the strain rate strength increase, but not the statistical increase, in designing the affected element itself. The statistical increase is here defined as the difference between the actual value of a material prop erty and the lower bound or minimum guaranteed value assumed in standard refer ences. 230. Furthermore, since the energy dissipation capacity of the structure (e.g. its duc tility) plays a very important role in elements subjected to impact and impulse load ings, it is recommended to give special attention to this issue, e.g. by assuring that the shear strength in reinforced concrete structures exceeds the bending capacity, thus promoting deformation in flexural modes. 231. Additional guidance on the design of structures against impulse and impact loads may be found in Refs [1-5]. LOAD COMBINATIONS AND BEHAVIOUR LIMITS 232. According to the Code on Design (para. 303) plant process loads are grouped as follows: — LI loads due to normal operation — L2 additional loads due to anticipated operational occurrences — L3 additional loads due to accident conditions. 233. Because of their infrequent nature and very short duration, loadings from any single DBEMIE need only be combined with LI loads using unity load factors for all loadings?. Multiple DBEMIE loadings such as aircraft crash and explosions do not 7 One Member State requires a load factor of 1.05. 21 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ have to be combined. However, all effects from a single DBEMIE may need to be properly time-phased combined. Thus, for aircraft crash, the effects of aircraft impact, (missiles, induced vibrations, fuel fires, etc.) should be combined. Furthermore, when a causal relationship exists between events (such as explosions induced by earth quakes), effects may also need to be properly time-phased combined. For further guid ance the reader is referred to IAEA Safety Guide No. 50-SG-D6, Section 3.4. 234. Behaviour or state limits^ for load combinations that include a DBEMIE should in general be the same as those adopted in related practices for extreme or abnormal L3 loadings. However, for impulse and impact loads, some liberalization in behaviour limits in accordance with the discussion in para. 227 is permitted. DOCUMENTATION AND QUALITY ASSURANCE REQUIREMENTS 235. The evaluation of a nuclear power plant for protection against man-induced events shall be documented in a manner suitable for review. As a minimum the docu mentation should identify the events considered, their primary and secondary effects, and the basis for determining the adequacy of protection for each case. 236. The evaluation shall be done in accordance with the requirements established in the quality assurance programme implemented for the design of the nuclear power plant. PLANT INSPECTION 237. The occurrence of external man-induced events should be documented and reported. An extensive plant inspection after the occurrence of an external man-induced event, whether postulated or not for design basis, shall proceed in order to establish the behaviour and consequences on structures, systems and components as identified according to the criteria given in para. 223. ^ Behaviour or state limits should be defined in terms of limits on ultimate capacity, strain, or deformation, as appropriate. This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 3. AIRCRAFT CRASHES GENERAL DISCUSSION 301. Safety Guide No. 50-SG-S5 gives guidance for a site specific review of the potential risk of an aircraft crash on the site and the nuclear power plant itself. The result of this review, which is based on a screening procedure to identify the potential sources of an aircraft crash and on a selected probability limit (value) serves as an input to the design procedure that is outlined in this chapter. 302. If the screening procedures mentioned in para. 301 indicate that an aircraft crash has been identified and selected as a DBEMIE at the site, the information outlined in para. 303 should be collected. Otherwise, there will be no need for a design. 303. General input information for the design includes: — the class, velocity and impact angle of the aircraft; — the mass, stiffness, loading capacity and global ductility of the structural elements of the aircraft or, alternatively, the resulting load-time function that corresponds to the prescribed crash velocity; — the size of the impact area; — consequences in conjunction to those of a single impact, e.g. debris or fuel spills. DESIGN METHODOLOGY 304. The postulated aircraft crash shall be analysed to determine its effects and the steps required to limit their consequences to an acceptable level. The basic data required to perform such analyses will, in most cases, be provided as a by-product of the inves tigation which results in the selection of the aircraft adopted for the postulated initiating event. In some cases, it may not be clear before the structural analysis is completed whether a heavier but slower, or a lighter but faster, aircraft is potentially the more dam aging. In these cases various postulated aircraft crashes should be considered. In some Member States a single load-time function is used to envelop the postulated aircraft crashes. Evaluation for aircraft crash should in general consider gross deformation, localized effects, induced vibrations, secondary missiles, etc. In addition, the effects of fuel fires should be considered in establishing the overall design basis for aircraft crashes. 305. For impact analysis of stiff or massive structures, load-time functions shall be used to define the impulse loading applied to the structure as a result of the postulat ed aircraft crash. 23 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 306. For the determination of overall structural response, including predictions of permanent deformation, amount of cracking, or punch-through shear failure, etc., an effective impact area and location and a load-time function are assumed. The effec tive impact area is usually calculated by assuming a perpendicular impact of the air craft nose against the surface of interest, estimating the increase in contact area as the fuselage crushes. In cases where a load-time function is not available, information about the mass and stiffness distribution of the aircraft, as well as the impact veloci ty, are needed to establish such a function. 307. When the structural analysis is performed, it is not necessary to combine all design loads with the aircraft crash loading. Generally, it will suffice to combine with the aircraft crash loading only those loads expected to be present for significant dura tions, i.e. dead and live loads (not including extreme snow or extreme wind) and normal operating loads. 308. Load-time functions such as those adopted in some Member States and shown in Annex I represent the expected value of the instantaneous load (or reaction) and are applicable for the determination of the global response of structural systems such as a containment building. In other words, although there is no precise agreement in this respect they may be considered as an average representation of a transient random load. Any specific realization of such an event (i.e. an aircraft crash) would never theless result in a load-time function also characterized by short-duration spikes, with large, random amplitudes, randomly distributed throughout the duration of the crash. Although by definition the total momentum of these short lived spikes should be nil, they may influence the structural resistance to penetration, perforation and scabbing, as well as the induced vibrations. The topic has been the subject of recent, or ongoing, research. 309. Most formulae derived for rigid missiles will tend to overpredict the wall thick ness required to prevent perforation and scabbing. The ranges of shape, masses, stiff ness and velocities for which they were developed do not coincide with those of inter est in the aircraft impact problem. Moreover, the data to which the formulae were fit ted came from tests in which the only load applied, along with the impact loading, was the weight of the impacted slabs. An engineering judgement about the applicability of this type of formulae is necessary. More detailed information based on experimental data is available in Refs [5-7]. 310. Depending on the type of the aircraft, the specific location of the impact area and the wall properties, the effect of the impact may be highly non-linear, with a high energy absorbtion. Analytical studies have led to a smoother floor response spectrum with lower maximum acceleration and therefore to less input for the com ponents. 24 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ CONSIDERATIONS OF SYSTEM PROTECTION 311. Since impulse forces associated with aircraft crash may exceed those associat ed with most natural phenomena or other man-induced events, the potential for dam age to any item important to safety shall be assessed. In general it cannot be safely assumed that protection provided for other reasons will suffice against aircraft crash. However, comparison with similar effects associated with other events may show that certain potential consequences of aircraft crash can be accommodated by the protec tion provided for other events. 312. Based upon the design aircraft and the corresponding load-time function the following design aspects should be considered: (1) The overall integrity of structures important to safety should be ensured by pro viding the necessary wall thickness and reinforcement. (2) The protection of redundant items important to safety should be accomplished by adequate physical separation. (3) Components important to safety should withstand the vibrational effects of the aircraft impact on the corresponding building or structure. These dynamic effects can be analytically expressed by their response spectra on the corre sponding locations of the components. Comparing the response spectra for all dynamic loads such as earthquake, or pressure waves from chemical explosions, it may be determined whether or not the dynamic effects due to aircraft impact can be a governing loading case. Adequate measures should then be taken. Spectral acceleration corresponding to sufficiently small spec tral displacement can be ignored^ MEANS OF PROTECTION 313. When protection against aircraft crash and the different associated physical effects is provided by designing to withstand impact, it is important to be aware of the two different physical effects of the crash. One is a local effect which can be coped with by local design measures, such as shielding of components by barriers or by pro viding redundant and sufficiently separated components. The other effect is vibration, which is global and is to be considered for all components important to safety con tained in the affected building. In the reactor building, for example, the vibration induced by the impact is transferred through the structures or foundation to the dif ferent component locations. 9 Some Member States have adopted limiting values for the spectral displacements in the range of 0.5 to 1 mm. 25 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 314. If protective barriers or structures are shown to be insufficient, separation distances should be sufficient to assure that the system will survive the impact. These distances will depend on the dimensions of the aircraft involved in the crash. As a minimum, the distances should be sufficient to prevent the aircraft impact from reduc ing below acceptable levels the system's capability to perform the safety function. Unless intermediate barriers can be counted on to deflect any secondary missiles, such as pieces of the aircraft broken off in the crash, separation distances should be large enough to assure protection from this debris. One factor in selecting the amount of physical separation may be the spread of fire caused by the burning of spilled fuel. 315. When designing against the effects of impact, the following requirements shall be met : (1) Deformation and ensuing vibration in the structures, systems and components resulting from aircraft impact shall be determined whenever required in the safety evaluation. Adequate countermeasures shall be taken to secure the accomplishments of the necessary safety functions. (2) For the containment and for other critical structures, wall and roof structural resistance shall be sufficient to prevent perforation and/or major scabbing by the aircraft or parts thereof and possible spillage of fuel into the interior of the struc ture. (3) Where structural failure (including scabbing) could impair a safety function by causing damage to equipment important to safety, either the structural resistance shall be increased or redundant equipment shall be located at an adequate dis tance. (4) Damage to equipment containing radioactive material shall not result in radio logical consequences above prescribed limits. (5) Distribution systems important to safety such as emergency cooling water ducts located underground shall be protected against aircraft debris (normally the engine) by providing necessary earth covering'" or/and sufficient physical separation. EFFECTS OF AIRCRAFT FUEL 316. The following consequences which may result from the release of fuel carried by the crashing aircraft shall be taken into account: (1) Burning of aircraft fuel outdoors causing damage to exterior plant components important to safety. Earth covering to a depth of about 1.5 to 2.0 m has been used for this purpose. 26 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ (2) Explosion of part or all of the fuel externally to buildings. (3) Entry of combustion products into ventilation or air supply systems, thereby affecting personnel or causing plant malfunction such as electrical faults or fail ures in emergency diesel generators. (4) Entry of fuel into buildings important to safety through normal openings, through holes which may have been caused by the crash, or as a vapour or aerosol through air intake ducts, leading to subsequent fires or explosions. DESIGN BASIS 317. The severity of the effects due to the postulated aircraft crash shall be com pletely determined. 318. The load-time functions for the direct impact of the aircraft on items important to safety should be established. The evaluation should include analyses of the poten tial for structural failure by shear and bending, for perforation of the structure, for spalling of concrete within the structures, and for propagation of shock waves that could affect items important to safety. 319. The aircraft may break up into pieces, each of which becomes a separate missile with its own trajectory. An analysis of the missiles that could be produced and their significance should be made on the basis of engineering judgement, with due regard to the possibility of simultaneous impacts on separate redundant systems. In special circumstances the effects of secondary missiles should be considered. 320. An example from one Member State of the guidelines and design basis for pro tecting a nuclear power plant against an aircraft crash is given in Annex I as well as examples of load-time functions established in some Member States for design basis. 4. FIRES DUE TO MAN-INDUCED EVENTS FIRES OF EXTERNAL ORIGIN 401. Fire that originates outside the site may have safety significance. Precautionary measures should be taken to reduce the amount of combustibles in the vicinity of the plant and near access routes, or adequate protection barriers should be installed. For example, combustible vegetation in close vicinity to the plant should be removed. 27 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 402. The plant design should prevent smoke or heat from fires of external origin from impairing the accomplishment of necessary safety functions. 403. The ventilation system and diesel generators may be affected by smoke or heat. The ventilation system shall be designed to prevent such smoke and heat from affect ing redundant divisions of safety systems so as to cause the loss of a necessary safety function. This can be accomplished by isolation of the ventilation systems from out side air by dampers with reliance on alternative systems to accomplish the ventilation system functions. This can also be accomplished by separating the inlet and exhaust hoods of one ventilation system serving one safety system from the inlet and exhaust hoods serving other redundant safety systems. In these ways a fire of external origin will not prevent the accomplishment of a necessary safety function. Diesel generators require normal air for combustion. Therefore, the plant design shall ensure an ade quate supply of air to all diesels required to perform necessary safety functions. 404. Where the site of a nuclear power plant requires consideration of the effects of aircraft crashes at or near the site, a fire hazards analysis of this accident shall be made. This analysis shall consider that fires may occur at several locations because of the spread of the aircraft's fuel. Smoke may also be produced at several locations. Special equipment such as foam generators and entrenching tools as well as specially trained on-site and off-site fire-fighting personnel may be required to prevent such fires from penetrating structures containing items important to safety. See Fire Protection in Nuclear Power Plants (IAEA Safety Guide No. 50-SG-D2, Section 2). METHODOLOGY 405. A procedure for safety verification in the event of a postulated fire is to deter mine the maximum heat flux arriving at the buildings important to safety and check if the capacity provided by the exterior skin of the building (concrete, steel, doors, penetrations, etc.) is sufficient. 406. The vulnerability of the structures to the thermal environments arising from large external fires should be checked against the inherent capacity of the concrete envelope of the structures to withstand such environmental condition. The verification should be based on the capacity of the concrete to absorb thermal loads without exceeding the appropriate structural design criteria. The capacity of the concrete to resist fires is mainly based on the thickness, the aggregates composition, reinforcing steel cover, and limiting temperature at the interior surface. The limiting structural cri teria may be the temperature at the first reinforcing steel bar location and the ablation of the surface exposed to the fire. As an example, see Ref. [8] for evaluation and doc umentation of nuclear power plant structures subjected to fires. For metal surfaces a cover is typically required for fire protection. 28 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ CONSIDERATIONS OF SYSTEM PROTECTION 407. Should the inherent capacity of the structure not suffice, an additional barrier or distance separation should be provided. An increase in the concrete thickness of the exposed structure may also be recommended if this will enhance the structural capac ity to resist other postulated loads. MEANS OF PROTECTION 408. Protection of the plant against fires may be achieved by minimizing the proba bility of a fire and strengthening the barriers against external fires when needed. It is also recommended to provide other design characteristics such as redundancy of safe ty systems, physical separation by distance, by separate fire compartments or by spe cific barriers, and the use of fire detection and extinguishment systems. 409. Either testing or analysis is an appropriate method for assessing whether fire protection requirements have been met. DESIGN RECOMMENDATIONS 410. It is recommended that any load-bearing concrete structure aimed at protection of systems important to safety against postulated fires has a minimum thickness of 0.15 m for a three hours standard fire. See, for example, Ref. [9]. 411. Construction codes generally provide maximum allowable temperatures of materials. As a guide, the allowable temperature for reinforcing bars and structural steel subjected to short term (less than six hours) Ares is 500°C [10]. This value may be used unless a different one is provided by codes or otherwise justified. MODELLING OF CONCRETE STRUCTURE FOR FIRE LOADS 412. The concrete surface exposed to the fire will attain a higher temperature, but the significant structural portion, i.e. the concrete between steel reinforcement, should remain below temperature limits. Part of the concrete cover of the exposed surface may be eroded during the fire. The limiting temperature for the interior portion may be selected as the short term limit, so that the temperature at the first reinforcing steel bar will be the one used to define the criteria. 413. Other criteria to be checked are the interior face and room air temperature, in order to protect items important to safety housed in the affected rooms. These criteria 29 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ are usually not exceeded if sufficient thickness is provided to satisfy other considera tions. All kinds of penetration should also be checked. 414. In some cases where thick concrete walls or slabs are provided and a fire may occur, a structural analysis may be required with the temperature gradient due to fire plus any additional operating loads under fire conditions (i.e. extinguishing water). In accordance with extreme load conditions the load factor of unity may be used under ultimate load design for postulated fire loading conditions. FIRE MODELLING 415. The characteristics of the postulated fire to be modelled may be described as radiant energy, flame area and flame shape, view factor from the target, and duration. Secondary effects such as spreading of smoke and gases should also be specified when needed. See Refs [11-13] on fire modelling. 5. EXPLOSIONS GENERAL DISCUSSION 501. Explosions during handling, transport, or storage of potentially explosive sub stances shall be considered and the distances from the explosion sources shall be taken into account, in accordance with IAEA Safety Guide No. 50-SG-S5. An analysis of each postulated explosion shall be performed to determine the steps to be taken for limiting the effects to an acceptable level. The effects of explosions which are gener ally of concern when analysing structural response to blast are: — incident and reflected pressure; — time dependence of overpressure and drag pressure; — blast-generated missiles; — blast-induced ground motion. The relative importance of these effects depends mainly on the quantity and type of the chemicals, the distance of the structure being considered from the source of the explosion, and the details of the geometry and spatial arrangements of the structures. For the overpressure range of interest (less than 0.5 bar), overpressures exceed drag pressures by a sufficient amount so that drag pressures can generally be neglected. The 30 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ expected low levels of drag pressures are generally accommodated by the usual design for wind loads. In most cases, it is sufficient to be concerned only with the positive overpressure and not with the following negative pressure. However, for the case of a wall vulnerable to negative pressure, or for elastic response of walls subjected to detonation of solid substances with TNT equivalents less than about 500 kg at distances less than about 50 m, the negative pressure may also be important. 502. While instances have been recorded in which missiles were found thousands of metres from the point of explosion, it is unlikely that any considerable number of large, hard missiles will be propelled for significant distances as a result of an explo sion. If the plant has been designed to accommodate the effects of externally generat ed missiles resulting from other events such as hurricanes, tornadoes or aircraft crash, the effects of missiles generated by an explosion may already have been accounted for. However, if particularly threatening missiles produced by explosions can be identi fied, they should be considered in the plant design. If missiles from aircraft crash or natural phenomena are not included in the design basis, consideration of potential blast-generated missiles is warranted. 503. With regard to blast induced ground motion, in one Member State, in which plants are designed to withstand at least a O.lg vibratory ground motion (both hori zontal and vertical) for the purpose of resisting earthquakes, it was concluded that the intensity of blast-induced ground motion to be expected from above-ground detona tions at overpressures less than 0.5 bar can generally be accommodated. EXPLOSIVE PHENOMENA 504. The word explosion is used in this Safety Guide in a general way for all chem ical reactions which may cause a substantial pressure rise in the surrounding space. An explosion can take the form of a deflagration which generates moderate pressures or of a detonation which generates very high near field pressures. 505. In a deflagration, which can occur when released hydrocarbon gases ignite, the gas bums within a reactive zone and the flame propagates with an appreciable flame speed across a major part of the cloud and creates pressure peaks. The generated pres sure depends mainly on the flame speed. 506. There is evidence that the maximum burning velocity (relative to the non-burn ing gases) increases with gas cloud size and that an upper limit exists for the burning velocity for homogeneous mixtures. This limit would appear to be a function of the power of ignition and the turbulences induced by different obstacles. In the free air and in the absence of significant turbulences the bum velocity will probably not 31 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ exceed some tens of metres per second. The chemical reaction will form a pressure wave travelling with a velocity near the speed of sound, creating a peak overpressure of a few tenths of a bar (up to approximately 0.3 bar (30 kPa)) in the incident wave. With a moderate amount of confinement and a saturated hydrocarbon such as butane, bum velocity will be higher and overpressures of 1 bar are obtainable. If more reactive fuels such as ethylene are present, pressures may rise to 5 bars or more. It is also possible that ignition of a gas cloud initiates a deflagration, which owing to turbulence or partial confinement (e.g. multiple reflection) becomes a detonation affecting only a limited volume. In this case, any overpressure between a few tenths of a bar and values of about 20 bars (2 MPa) may develop in the surrounding space. 507. In a detonation of solid substances and/or a partial detonation of a gaseous fuel- air mixture, the reaction is shock-induced, will travel at velocities higher than the speed of sound, and will produce high peak overpressures. With high explosives (e.g. TNT) the pressure peaks in the near field may be of the order of 1000 bars (100 MPa). However, at standoff ranges of interest, the overpressure will likely be less than 0.5 bar. Reference [14] gives guidance to obtain the relationship between the pressure peak versus explosion yield and the distance from TNT explosion. 508. The values for the overpressure and the duration and shape of the pressure wave are required when designing buildings against the impact of pressure waves. Deflagration and detonation differ in peak overpressure, in the duration of the impulse, in the steepness of the wave front, and in the decrease of overpressure as a function of propagation distance. 509. A deflagration normally results in a slow increase in pressure at the wave front and has a long duration with the peak pressure decreasing releatively slowly with dis tance, whereas a detonation may result in higher overpressure with a steep pressure rise and a short duration. A building designed against deflagration may also withstand a detonation with higher overpressure if the overpressure is of sufficiently short dura tion. The rate of decrease of overpressure with distance of travel differs as between deflagration and detonation. The high detonation peak overpressure decreases quick ly near the source. 510. These characteristics, in addition to being functions of the propagation distance, are also influenced by the weather conditions and the topography. EXPLOSIONS OF SOLID SUBSTANCES Design methodotogy 511. An analysis of the ability of plant structures to resist the effects of explosions can usually be limited to an examination of their capacity to resist the blast overpres 32 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ sure. In estimating the peak overpressure on a structure, the pressure-distance rela tionships developed for TNT can be utilized for the detonation of solid substances. For solid substances whose energy density differs from that of TNT, factors to be used in calculating equivalent weights of TNT are generally available. For substances known to have explosive potential but whose explosive properties have not been investigated and tabulated, it is reasonable, as a first estimate, to assume that their explosive prop erties are equivalent to those of TNT. 512. Blast overpressure loads, incident and reflected if appropriate, should be com bined with LI loads in accordance with paras 232 and 233. Considerations of system protection 513. Structures that have been designed to accommodate extreme loadings such as those resulting from aircraft impacts or tornado generated pressure and missile loads, and which have reinforced concrete walls with a minimum thickness of about 0.5 m, will normally be capable of withstanding substantial overpressures without compro mising the essential functions of the systems important to safety which they house. It often will be unnecessary, therefore, to apply additional design measures to mitigate the effects of postulated off-site explosions, unless their effects are found to be more severe than those corresponding to the other extreme loadings already considered. Systems such as the emergency power supply that are housed in relatively light struc tures, and items exposed in the open, such as components of the ultimate heat sink, are more likely to be vulnerable to the effects of explosions. These shall be evaluated to determine if there is any need for special design provisions to accommodate safely the effects of any postulated off-site explosions. Means of protection 514. Protection against the effects of an off-site explosion can be ensured by design ing structures to withstand explosion effects, or by requiring a suitable distance between the explosion source and the plant. For each safety function required, it is necessary to analyse the effects of the explosion on either the relevant safety system or the housing structures. This includes an evaluation of the effects on the air supply and the ventilation system. In most cases, since the system will be inside a structure, the analysis will consist of ensuring that the structure will not be damaged to the extent that the safety function cannot be accomplished. 515. When calculating distances required to provide protection by means of separa tion, use can be made of the attenuation of peak overpressure as a function of distance from the explosion source. The data available for TNT can reasonably be used for other solid substances by using the proper TNT equivalence. The adequacy of the pro 33 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ tection afforded should be evaluated carefully when the location of the explosion can vary, as is the case in accidents on transportation routes in the site vicinity. A suffi cient number of plausible locations for the explosion should be postulated to ensure that the worst credible situation has been analysed. GAS CLOUD EXPLOSIONS Design methodology 516. Since explosions of gas clouds can affect the entire plant area, the postulated gas cloud should be the most severe credible gas cloud relevant to the site. The primary effect is an external overpressure loading on the plant structures and exposed systems and components. An analysis of the ability of plant structures to resist the effects of gas cloud explosion can normally be limited to an examination of their capacity to withstand the overpressure loading. Among the secondary effects are fire, loss of off- site power, smoke and heated gases, ground and other vibratory motions and missiles resulting from the explosion. 517. The pressure developed is a function of the energy release rate, as well as of the total energy release. Practices vary in Member States as regards estimating the over pressure load associated with gas cloud explosions. Because of the results of some accidental explosions which are thought to have been too destructive to have been caused by a deflagration, some Member States prefer to consider the assumption of a partial detonation. In either case, the overpressure-time history for a particular struc ture is heavily dependent on the layout of the surrounding buildings. The overpressure should be taken as acting over the entire exposed surface, due allowance being made for the shape of the structure. 518. Among secondary effects to be considered in the design are fires resulting from deflagration, which shall be dealt with on the same basis as fires due to other man-induced impacts, and the possibility that a gas cloud may deprive plant person nel and equipment of air. 519. The overpressure loadings should be combined with LI loads in accordance with paras 232 and 233. ComsSderations of system protection 520. As far as protection against overpressure is concerned, the discussion in para. 513 relating to the effects of explosions of solid substances is applicable. The capability of the ventilation systems to withstand the combination of peak overpres 34 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ sure and duration may be of concern. In addition, the possibility of ingress of gas through the ventilation systems shall be considered. Means of protection 521. The approach in paras 514 and 515 is also applicable to gas clouds. In addition, systems penetrating the plant buildings, especially the ventilation systems, should be designed to prevent the ingress of the explosive gases within the plant, except when the resulting concentration is tolerable. The plant ventilation system should also be able to cope with the ventilation needs of all essential areas of the plant under these conditions. Appropriate detectors or other means of early warning, as stipulated in the emergency plans, should be provided to ensure the closure of air intakes when required. 522. Another factor that shall be considered is ignition of gas or vapour accumulat ed in confined external areas of the plant such as courtyards or alleys. Explosions under these conditions may result in high local overpressures. To reduce the likelihood of these, the design should, as far as practicable, provide a compact layout devoid of long alleys and inner courts, or provide adequate openings to prevent the development of an explosive concentration of gases. DESIGN BASIS 523. There are two principal ways of determining the design basis parameters so as to protect the nuclear power plant against damage by pressure waves from explosions: (1) If there is a potential source in the vicinity of the plant which can produce a pressure wave, propagation of the wave to the plant can be calculated and the resulting pressure wave is the basis for the design. (2) If there is already a design requirement to provide protection against other events, e.g. tornadoes, a value can be calculated for the corresponding over pressure. This value will allow the calculation of safe distances between the plant and any potential source. That is, distances from the source are given at which the pressure wave is calculated not to exceed the overpressure corre sponding to the design basis for the other event. This can also be done if there is a design basis for the whole plant against overpressure or if the design basis of the least protected component important to safety is known. 524. If fire or missiles are considered as secondary effects of the explosions, the rec ommendations of Chapter 4 of this Guide or criteria employed for tornado generated missiles may be followed. 35 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 525. Methods are also given for calculating safe distances, and some distance/over pressure relationships are provided in Annex II. 6. HAZARDS FROM DRIFTING CLOUDS DISPERSION OF TOXIC GAS CLOUDS AND FLAMMABLE FLUIDS 601. There are no fundamental differences in the mode of dispersion of toxic gases and flammable gases (before ignition) in the atmosphere. Many toxic and many flam mable gases are much heavier than air when in the undiluted state, and some are lighter than air. Immediately after release, their concentration in air will be high and the density difference will cause the cloud or plume to fall to the ground or to rise in the air. During this phase normal atmospheric turbulence will have little influence on the spreading of the cloud or plume. This phase will be followed by a second phase during which atmospheric turbulence gradually dilutes the gas cloud by mixing it with air. Later still, at some concentration probably well below 1%, dilution will progress to a stage at which dispersion is controlled entirely by atmospheric turbulence. However, the theory of the spreading and dispersion of gases of which the density dif fers markedly from the surrounding air is exceedingly complex; work is being done on this subject, and much of its theory awaits confirmation through large scale exper iments planned or in progress. Meanwhile, therefore, it has to be bome in mind that large errors may be introduced if in consideration of the dispersion of these gases it is assumed that their density is the same as that of air. However, the Safety Guide on Atmospheric Dispersion in Nuclear Power Plant Siting (IAEA Safety Series No. 50-SG-S3) is concerned, strictly speaking, with the dispersion of gases or aerosols of the same mean density as air. Nevertheless, if dense or light gases are released in very small quantities or at a very slow rate, it is likely that atmospheric dispersion will so rapidly dilute the escaping gas that the Safety Guide just mentioned can be applied with confidence. 602. Problems raised by the dispersion of toxic gases and flammable gases are tech nically similar but one may be interested in following the dispersion of toxic gases to rather lower concentrations than that of flammable gases. The lethal limits of concen tration for a common toxic gas such as chlorine vary from about 50 mg/m^ to about 5 g/m3 depending on the duration of exposure, ranging from about ten hours to six seconds, respectively. This is a range of volume concentration from roughly 0.002% to 0.2%. The flammable limits of many hydrocarbon gases are about 1%. Hazard ranges for toxic gas releases are therefore generally greater than for a similar size 36 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ flammable release. For internationally agreed limits of acceptability for the control room in one Member State see Ref. [15]. 603. For both toxic and flammable gases, in selecting the coefficient of atmospheric dispersion attention should be paid to the influence of the buildings of the facility releasing the gas by introducing a building wake adjustment factor in the dispersion equation in conjunction with the appropriate diffusion coefficients for the type of ter rain in question. In particular, the roughness of the terrain, e.g. whether there is a large overwater fetch, treeless plains, forested land, or mountainous areas, should be con sidered in selecting the appropriate diffusion coefficient. TOXIC GASES Prelim inary evaituatiom 604. The dispersion of toxic gases is to a high degree site specific and toxicity depen dent on the chemical composition. For a preliminary evaluation, the values given in Table I may be used [16]. These values are based on the following assumptions: (1) The toxicity limit of the gas is 50 mg/m^ (this can be used for chlorine, the tox icity limit of which (45 mg/m-*) is very close to this figure). (2) The air exchange rate of the control room is 1.2 volume/h (this is a typical value and may be adopted when the actual design value is not available). (3) Modified Pasquill stability is Category F with wind speed 1 m/s. TABLE I. WEIGHT OF TOXIC CHEMICAL REQUIRING CONSIDERATION AS A FUNCTION OF DISTANCE Distance (km) 0.5 1.0 1.5 4.0 8.0 Weight (t) >0.04 >0.18 >0.40 >6.00 >30.0 605. If the toxicity limit and air exchange rates of the control room are significantly different from those assumed in items (1) and (2) above, simple corrections should be made as follows: (1) 7hMCiYy The weights presented are directly proportional to the toxicity limit. For example, if a particular chemical has a toxicity limit of 25 mg/m^ the weights given in the Table should be decreased by a factor of two. 37 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ (2) y4;'r axc/MMge rafe. The weights given are inversely proportional to the air exchange rate. Cloud diffusion 606. For the detailed evaluation required for IAEA Safety Guide 50-SG-S5 it is necessary to have a more precise assessment of the characteristics of the source term (e.g. flow rate, duration of emission, height and atmospheric conditions of the diffu sion). For further reference see methods contained in Atmospheric Dispersion in Nuclear Power Plant Siting (Safety Series No. 50-SG-S3) and for non-neutral buoyancy Refs [17, 18]. Effects of toxic gas releases 607. The effects of any releases of toxic gases on operating staff or equipment shall not prevent the requirements of para. 201 from being met. Safety Guide 50-SG-S5 provides information and recommends procedures which relate to releases of toxic gas. There also exist international and national standards and guides which lay down industrial design requirements, concerning releases of toxic gases, that may be applic able to nuclear power plants. These documents should be used for the identification of the toxic gases to be considered, for the evaluation of the corresponding design para meters, and equipment provision. MethodoHogy 608. Once a toxic gas cloud has been postulated, calculations of gas concentration as the cloud drifts or flows across the plant site are necessary. Extension of the cloud as well as interaction time should be decided on a case-by-case basis, depending on the source and meteorological conditions. If the concentration outside is known, the time dependent concentration of toxic gases inside the plant can be calculated, taking into account air charge and discharge rates. To simplify the calculation, it can be assumed that the concentration in the cloud remains constant during the interaction time with the plant. Furthermore, equal gas concentration in all rooms belonging to one ventila tion system may be assumed. These assumptions are conservative with regard to esti mates of gas concentration but not for estimates of recirculation time or for determin ing the amount of bottled air supplies. Personnel protection consideration 609. Protection of personnel in the control room area, including the control room itself, the computer room, and (if used in emergencies) the shift supervisor's office and sanitary and kitchen rooms shall be assured. Protection of personnel in other loca 38 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ tions shall be determined on an ad hoc basis. If the predicted concentrations of the gases are below the respective permissible toxicity levels, no additional protection is usually required. M eans of protection 610. Toxic gas concentrations within the control room area that may lead to loss of operator capability to control the plant shall be prevented. Acceptable concentration levels for a given interaction time may be derived from industrial standards. Given a known source of toxic gases, gas detectors shall be provided. When gas concentrations exceed the prescribed levels, protective actions shall be initiated with due regard to quick-acting materials such as chlorine gas. These actions may include filtering the incoming air, prevention of ingress of air during the critical time period by use of recirculation air systems, and self-contained breathing apparatus. Some types of toxic gases, e.g. those that may be released along traffic routes, cannot be identified in advance. Although provision of detectors capable of detecting all types of toxic gases is not practical where multiple sources of toxic gases could be a hazard, consideration should be given to providing detectors that would be as versatile as practicable (i.e. capable of detecting groups of gases such as halogens, hydrocarbons, etc.). For such situations, means of protection such as geometric separation of control room air intakes may be necessary. However, the effectiveness of geometric separation may depend upon the ability to detect or otherwise become aware of the presence of a toxic gas in a timely manner. Thus, selection of specific means of protection shall be per formed for each particular site. FLAMMABLE FLUIDS Sutb-cooM [liquefied gases 611. Sub-cooled liquefied gases present complicated problems because the gaseous emission is related to the evaporation rate and therefore to the specific characteristics of the gas involved. The following three approaches should be considered: (1) rAeorcf/ca/ approach. Theoretical evaporation rates have been calculated as a function of flow of the liquid, heat transfer between liquid and ground, and ther mal conductivity of the ground. (2) Approach &ase;f on &Ma /row eAperwnenf. The diffusion of heavy gases of different densities can be simulated in a wind tunnel using a very dense gas such as BCF (bromochlorodifluoromethane) mixed with air in differ 39 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ ent concentrations. Often, hydraulic simulation is used with salt solutions of dif ferent densities. In both the gaseous and the hydraulic case the structures are scaled carefully. While these studies may show certain interesting qualitative aspects of the phenomena (e.g. quasi-laminar flow when wind speed is low), they may lead to erroneous conclusions if extrapolated to give quantitative val ues for large scale phenomena. (3) Approach on dafa /row gApcn'/Mewfj. Experiments have been performed in a range which extends from a few tonnes to a few tens of tonnes of liquefied gas spilled over areas of tens of square metres. The theoret ical calculation of the evaporation rate seems to have been confirmed in these experiments within a factor of two. FHuid pipettines 612. In some Member States there are industrial facilities served by a fluid pipeline which are located near a nuclear power plant. In this case the possibility of rupture of this pipeline shall be considered. The leakage without explosion of hydrocarbons, at least for the amount of time between the rupture alarm signal at the pumping stations and the closure of the closest valves, allowing all fluid between valves to leak and allowing any gas to explode, is a reasonable way to proceed. Means of protection 613. The protection shall consider the following aspects: — fire and explosion outside the structure; — fire inside a room or component due to the diffusion of a drifting cloud of a flammable gas; — the flow of flammable liquids in the vicinity of the plant and in the intake of cooling water systems with the possibility of generating a fire. All these events are considered in other parts of this Guide. See paras 408 and 409 relating to means of protection against fires of external origin and explosions. This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 7. CORROSIVE FLUID RELEASES GENERAL DISCUSSION 701. Releases of corrosive fluid constitute a potential hazard which arises from industrial plants close to the site or from ship accidents and spills, and may also exist for corrosive chemicals stored on the site. Usually, since gaseous releases from such sources are required to be within toxicity limits which are well below corrosive levels, they will not pose a serious threat to the equipment. Among the principal gaseous releases which are considered are chlorine, hydrogen sulphide, ammonia and sulphur dioxide. Liquid effluents from industrial activities as well as spills of chemicals from ships can result in the entry of corrosive liquids into parts of the plant cooling water system. Additionally, particles from oil spills or corroded pipes may adversely affect the function of heat exchangers, pumps and valves. DESIGN METHODOLOGY 702. IAEA Safety Guide 50-SG-S5 provides information concerning releases of cor rosive fluids and recommends procedures for dealing with them. That Guide should be used together with other applicable reference documents for identification and evaluation of the corrosive fluids to be considered in the design of the plant to ensure that the requirements of para. 201 of this Guide are met. 703. In case of a cloud of corrosive gas or vapour, the gas concentration inside the plant shall be calculated on the basis of air charge and discharge rates, thus giving a time dependent concentration. Extension and interaction time of the gas or vapour cloud needs to be determined on an individual basis. 704. In cases where a corrosive liquid mixed with water may enter the cooling water intake, the time dependent concentration should be calculated on the basis of the con centration in the cooling water just before the intake. CONSIDERATIONS OF SYSTEM PROTECTION 705. Corrosive fluids may enter the plant via the cooling water system. Therefore special attention shall be paid to systems that dissipate heat from the plant. 706. Corrosive fluids may also enter the plant via ventilation system intakes, and they may attack any systems susceptible to corrosion. Therefore special attention should be 41 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ given to electric and electronic equipment, because these are known to be very sensi tive to corrosion. 707. Since corrosive fluids may affect outside areas, such as switchyards, special attention should also be given to outside electrical and electronic equipment. 708. It shall be demonstrated that even should the maximum possible rate of corro sion make it possible that corrosion could occur within an inspection interval, this could not impair systems to the extent that loss of a safety function could occur before the affected system could be repaired. Protection of systems may be achieved by pro viding corrosive gas detectors that activate closure valves, by protective coatings, by providing additional wall thickness to allow a certain amount of corrosion or by reducing intervals between inspections. Specific protection measures, combining some of these methods, need to be determined on an individual basis. In particular cases it might even suffice to keep the air temperature or humidity within specified limits, thus slowing down corrosion rates so as to give time for system repair. 8. SHIP COLLISION 801. Consequences of a ship collision against structures, systems and components important to safety, identified during the siting process, shall be assessed and verified. CONSIDERATIONS OF SYSTEM PROTECTION 802. Protection may be satisfied through properly engineered fenders or other pro tective structures such as a chain of adequately spaced vertical cylinders fixed at the bottom of the waterway and arranged so as to prevent the approaching vessel from colliding against the protected structure. The design should consider ship collision under postulated environmental conditions and potential consequences of a vessel collision which may result in oil spills or corrosive fluid releases. MEANS OF PROTECTION 803. The survivability of the systems, structures and components important to safety should be based upon distance separation or redundancy or be assured by specific design of the items in question. 42 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ Annex I AIRCRAFT CRASHES 1-1. As an example, one Member State has specified certain guidelines for estab lishing proper protection of a nuclear power plant against an aircraft crash, Ref. [6], that is summarized as follows: (a) The items important to safety of the plant have to be protected against: — direct impact and corresponding consequences (e.g. scabbing) and deforma tion of the impacted structure; — vibrational effects, considering the behaviour of soil/structure interaction. (b) Protection can be provided either by design or physical separation. If redundant items are more than 40 m apart in separated structures, then it is unnecessary to design for direct aircraft impact but just for the debris. For the impacting aircraft (Phantom RF-4E at 215 m/s) the engine is considered the most potentially dam aging piece of debris. This engine acts as a soft missile with an impact velocity of 100 m/s and the resulting load-time function is shown in Fig. 2 applied over an impact area of 0.8 m^. A heavily reinforced 70 cm concrete wall is consid ered to be sufficient to withstand this engine impact [6]. Figure 2 is based on more recent test data than Fig. A.7 of IAEA Safety Guide 50-SG-S5. (c) Protection against the intake of hot combustion gases can be provided by phys ical separation of the air intakes of the redundant diesel engines. The corrosive effect of these gases can generally be neglected. However, the contacts of elec trical devices should be protected against the soot from the gases. (d) Buried pipings, ducts, etc., important to safety, with a minimum separation dis tance of 13 m, need only be protected against debris. (e) For a spherical reactor building designed to withstand direct impact of the air craft fighter Phantom RF-4E with the corresponding load-time function accord ing to Fig. 3 and an impact area of 7 m2, the following should be considered: — a reinforced concrete wall thickness of about 1.8 m; — on equipment and components, a 0.5g static-equivalent horizontal load covering the vibration effects induced by the impact should be applied, pro vided that the impact is not transmitted directly to the floor supporting the item. EXAMPLES OF LOAD-TIME FUNCTIONS 1-2. Some examples of load-time functions are derived for the impact normal to the target surface of the shell or plate under consideration. A stable and stiff structure is assumed. An impact velocity of about 100 m/s is generally used because this velocity is not exceeded during normal take-off and landing of commercial aircraft and no 43 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ Time (ms) F/G. 2. /MMCf;on ca/cM/a;e<^ /or secondary (engine of a PAawfom RF-4E ai'r- cra/ij (aJapfetf/wm Re/! /6j). Time (ms) * Totat mass: 20 ( * tmpact velocity: 215 m/s * impact area: 7 m^ (D = 2.96 m) F7G. J. Mea/;ze^ /ood-fwe/MMCfionybr a McDoMwe//-OoKg/a^ P/MMfow RF-4E (a<^apfe<^yrow Re/. f20j). 44 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ Time (ms) * Totai gross mass: t * impact veiocity: 100 m/s F/G. 4. /i/McH'oM ca/cM /afe d /o r a Boeing B-720 /rom /?e/. /79/). Time (ms) * Totai gross mass: 91 t * tmpact veiocity: 100 m/s F/G. 5. Lcmd-f/we/MMC&'on ca/cM?a;e 45 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ impact area 4 m 10 20 30 40 m2 Nose section .21.3^ t <3 m_____ t. — -) ___ Wing main spar section (outer wing fracture begins) -21.3 m. Wing rear spar section (outer wing fracture compiete) F7G 6. 7/wpac; area ca/cM/afed a^ a ^/ncHon o/ H'/ne ybr a Boeing 707-320 (adapted /row w . ^97). Time (ms) * impact veiocity: 100 m/s F7G. 7. 7dea/;zec/ /oaJ-H?ne /Mncf/on ca/cii/ared ybr a Genera/ /4v/aH'on Lear Ve? 23 and a CeMna 270 a/rcra/ir (adapted/rom 7?e/! 7707). 46 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ records of accidents with large aircraft within a certain distance of an airport have shown higher velocities. However, if the probability of impact during a particular phase of flight is not low enough, then such an impact should be taken into account with the appropriate speed. In this regard, an impact velocity of about 215 m/s is used in some Member States for flying conditions of a military aircraft. Reference [19] gives the basic approach for deriving the impact load-time function against a rigid target, confirmed by full scale tests reported in Ref. [7]. 1-3. Some load-time functions for large commercial aircraft have been derived. For this type of aircraft Ref. [19] gives load-time functions for the Boeing B-720 and B 707-320 at a typical velocity for landing and take-off (100 m/s). Examples are given in Figs 4 and 5, respectively. 1-4. Implementation of these load-time functions for structural analysis requires the impact area to be known. Figure 6 gives the area as a function of time during impact. The average values of impact area chosen for the calculations were about 37 m^ for flat surfaces and about 18 m2 for spherical surfaces. For further details see Ref. [19], 1-5. Another load-time function which was originally derived for the crash of a mil itary aircraft (General Dynamics Phantom RF-4E with an impact velocity of 215 m/s) is shown in Fig. 3. The effective impact area for this event was determined to be 7 nA For further information see Ref. [20]. This load-time function covers a wide range of military and commercial aircraft. 1-6. Other load-time functions that have been derived to deal with the impact of two general aviation commercial aircraft, a Cessna 210 and a Lear Jet 23, are shown in Fig. 7 with an impact velocity of 100 m/s. The average impact area chosen for the calculations was about 4 and 12 m^, respectively. 47 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ Annex II GAS CLOUD EXPLOSIONS LOAD-TIME FUNCTIONS 11.1 Some sources which are useful on the subject of explosions are Refs [14, 21-28]. The evaluation of pressure waves generated by detonations of TNT or other substances which can be equated to TNT is well understood and fully described in these sources. However, for gas cloud explosions the available literature is not always in agreement on how to predict overpressures. The use of scaling laws from TNT explosions is inadvisable. Because in a free gas cloud there is no evidence that a defla gration will exceed a maximum pressure of about 0.3 bar, one Member State uses this overpressure with a long duration as a conservative approach. It is understood that the gas is unconfined and has drifted away from the source. The corresponding load-time function, which assumes deflagration of a spherical gas cloud with about 50 m dia meter next to a building important to safety is shown in Fig. 8 [24]: Time after start of pressure rise (s) F/G. & PreMMre paHern ow fAe wc/ear power p/aw; (a^apfe^^rom /?e/! /24J). This Member State has concluded that structures designed for the load-time function shown in Fig. 8 will also accommodate detonations with standoff distances in excess of Rip> 8 xW'/3 for distances > 100 m where R;p is the distance from an exploding charge (m) and W is the mass of TNT or the TNT equivalent of the mass of the exploding material (kg). This publication is no longer valid Please see http://www-ns.iaea.org/standards/ Another Member State assumes a partial detonation (5 to 30% of the volume) centred at the source of the gas cloud and uses incident overpressure-time histories appropri ate for gas cloud detonating volume and distance, and reflection factors appropriate for the structure geometry. Peak overpressures near the source are lower than for TNT. Both the peak overpressure and total positive phase impulse reduce more slowly with distance than for TNT [28]. DISTANCE-OVERPRESSURE RELATIONSHIP 11-2. One Member State has judged that structures, systems and components impor tant to safety which have been designed for high extreme wind loads are capable of withstanding an explosion-induced peak positive incident overpressure of at least 0.07 bar (7 kPa). Based upon this judgement, that Member State does not require design for explosion-induced overpressure as long as the following equation for standoff distance is met [23]: Rip = 18 W"3 where Rjp is the distance from an exploding charge (m) and W is the mass of TNT or the TNT equivalent of the mass of the exploding material (kg). This relationship is shown in Fig. 9. << F /G . 9. D;.s;ance ver-suy 7 W maM / o r a MMc/ear p o w er p /an f aga/nyf a re/Zecfe^ overpreMMre o /7 11.3. Furthermore, it has been recommended [39] that lesser standoff distances as given by where P^ is the static pressure capacity of structural walls (1 bar, or 100 kPa), are 49 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ acceptable without design for explosion loads for reinforced concrete walls with static pressure capacities in excess of 0.1 bar (10 kPa), with a minimum thickness of 45 cm and a minimum tensile steel area percentage of 0.2%, as long as these walls are per mitted to undergo inelastic deformation corresponding to a ductility factor of three. Thus, for such a wall with a static pressure capacity of 0.2 bar (20 kPa), the minimum standoff distance to avoid the need for evaluation and design for explosion loads is R;p = 10.7 (W)i/3.Standoff distances are also given in Ref. [18] for other permissible duc tility levels of one (elastic) to five. 11-4. The standoff distances recommended in Refs [18, 34] are intended for use with explosions of solid substances with TNT equivalents in excess of 18 t which produce positive pressure durations of sufficient time that variation in the total incident posi tive impulse of the pressure-time history has little influence on the structural response. For explosions with substantially lower TNT equivalent yields, the response is primarily influenced by the total positive impulse, and the standoff distances recommended in Refs [18, 34], become excessively conservative, as shown in Ref. [28]. 50 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ REFERENCES [1] STEVENSON, J.D., et al., Structural Analysis and Design of Nuclear Plant Facilities, ASCE Manual No. 58, Am. Soc. Civil Engineers, New York (1980). [2] "Report of the ASCE Committee on impactive and impulsive loads", Civil Engineering and Nuclear Power (Proc. 2nd ASCE Conf. New York, 1980), Vol. V, Am. Soc. Civil Engineers, New York (1980). [3] AMERICAN CONCRETE INSTITUTE, "Special provisions for impulsive and impactive loads", Appendix C, Code Requirements for Nuclear Safety Related Concrete Structures, Rep. ACI349-85, American Concrete Institute, Detroit, MI (1985). [4] BART, P., Guidelines for the Design and Assessment of Concrete Structures Subjected to Impact, Rep. SRD R 439, United Kingdom Atomic Energy Authority, Centra! Electricity Generating Board, National Nuclear Corporation, London (1990). [5] CENTRE D'ETUDES DE BRUYERES-LE-CHATEL, Concrete Structures under Impact and Impulsive Loading, Bulletin d'information No. 187, CEB (1988) (in French). [6] Auslegung baulicher Anlagen von Kernkraftwerken gegen Flugzeugabsturz, DIN-Fachbericht, Nke 3 No. 9-90 (1990). [7] HADJIAN, A.H. (Ed.), Structural Mechanics in Reactor Technology (Proc. Conf. Anaheim, CA, 1989), Vol. J, Am. Assn for Structural Mechanics, Los Angeles, CA (1989). [8] DIAZ-LLANOS, M., VELASCO, V.S., PREYSLER, I.C., "Fires during nuclear power plant construction", Evaluation and Report of Fire Damage to Concrete, Rep. ACI-216- SP-92, American Concrete Institute, Detroit, MI (1986). [9] LEES P.L., Loss Prevention in the Process Industries, Butterworth, London (1980). [ 10] ELECTRICITE DE FRANCE, Regies de conception et de construction du genie civil des centrales nucleates, Rep. RCC. G 85-Rev. 2, Electricite de France (1988). [11] MUDAN, K.S., Thermal radiation hazard from hydrocarbon poolfires, Prog. Energy Combust. Sci. 10 (1984) 59-80. [12] CONSIDINE, M., Thermal Radiation Hazard Ranges from Large Hydrocarbon Fires, Rep. R 297, United Kingdom Atomic Energy Authority, Safety and Reliability Division, Risley, UK (1984). [13] SAX, N.I, Dangerous Properties of Industrial Materials, Van Nostrand Reinhold, New York (1988). [14] DEPARTMENT OF THE ARMY (USA), Technical Manual TM5-1300, Structures to Resist the Effect of Accidental Explosions (1969). [15] WING, J., Toxic Vapor Concentrations in the Control Room Following a Postulated Accidental Release, Rep. NUREG-0570 (1979). Available from INIS. [16] HAVENS, J.A., A Description and Assessment of the SIGMET LNG Vapour Dispersion Model, US Coast Guard Report CG-M-3-79 (1979). [17] UNITED STATES ATOMIC ENERGY COMMISSION, Assumptions for Evaluating the Habitability of a Nuclear Power Plant Control Room during a Postulated Hazardous Chemical Release, USAEC Regulatory Guide 1.78, Washington, DC (1974). [18] KENNEDY, R.P., BLEJWAS, T.E., BENNETT, D.E., Capacity of Nuclear Power Plant Structures to Resist Blast Loadings, NUREG/CR-2462, United States Nuclear Regulatory Commission, Washington, DC (1983). 51 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ [19] RIERA, J.D., On the stress analysis of structures subjected to aircraft impact forces, Nucl. Eng. Des. 8 (1968) 415-426. [20] DRITTLER, K., GRUNER, P., SUTTERLIN, L., Zur Austegung kemtechnischer Anlagen gegen Einwirkungen von Aussen. Teilaspekt: Flugzeugabsturz, Rep. IRS-W-7, Institut fur Reaktorsicherheit, Cologne (1973). [21] SCHARDIN, H., MOLITZ, H., SCHOENER, G„ Wirkungen von Spreng- und Atombomben auf Bauwerke, Ziviler Luftschutz 12 (1954). [22] KOGARKO, S.M., ADUSHKIN, V.V., LYAMIN, A.G., An investigation of spherical detonations of gas mixtures, Int. Chem. Eng. 6 3 (July 1966). [23] UNITED STATES NUCLEAR REGULATORY COMMISSION, Evaluation of Explosions Postulated to Occur on Transportation Routes near Nuclear Power Plant Sites, USNRC Regulatory Guide 1.91, USNRC, Washington, DC (1978). [24] Richtlinie fur den Schutz von Kemkraftwerken gegen Druckwellen aus chemischen Reaktionen durch Auslegung der Kemkraftwerke hinsichtiich ihrer Pestigkeit, Bundesanzeiger 179, S.1-3, Bonn (22.9.1976). [25] UNITED KINGDOM ATOMIC ENERGY AUTHORITY SAFETY AND RELIABILI TY DIRECTORATE, The Hazard to Reactors from Oil Industry Operations: A Study based upon the Hunterston Proposals, UKAEA' (SRD), Harwell (1973). [26] DUCO, J., LE QUINIO, R., Risque sur les rgacteurs nucMaires dus au voisinage d'installations et de transports p6troliers, Rep. DSN No. 38, D6partement de surete nucMaire (1974). [27] LE QUINIO, R., Effect of the Industrial Environment on the Siting of Nuclear Power Plants, Nuclex 1975, Basel (1975). [28] KENNEDY, R.P., "Separation distances recommended for hydrogen storage to prevent damage to nuclear power plant structures from hydrogen explosion", Appendix to Guidelines for Permanent BWR Hydrogen Water Chemistry Installation, Rep. NP-4500-SR-LD, Electric Power Research Institute, Palo Alto, CA (1986). 52 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ CONTRIBUTORS TO DRAFTING AND REVIEW During the development phase (1976-1981) the following experts participated in one or more of the meetings: Becker, K. International Organization for Standardization Bello, R. Mexico Beninson, D. Argentina Berdnek, J. Czechoslovakia Budin, J.P. Switzerland Cobb, E.C. United Kingdom Costello, J.F. United States of America Dastidar, PR. India Donvez, G.A. International Electrotechnical Commission Duff, C.G. Canada Fischer, J. IAEA Franzen, L.F. IAEA Gausden, R.A. United Kingdom Gronow, W.S. United Kingdom Guimbail, H. International Union of Producers and Distributors of Electrical Energy Gunther, K. Germany, Federal Republic of Hatle, Z. IAEA Hurst, D. Canada Iansiti, E. IAEA Ingolfsrud, L.J. Canada Isaev, A. Union of Soviet Socialist Republics Ishizuka, M. Japan Jansson, E. Sweden Kakodkar, A. India Karkhanavala, M.D. India Kollmannsberger, J. Germany, Federal Republic of 53 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ Konstantinov, L.V. IAEA Kovalevich, O.M. Union of Soviet Socialist Republics Mehta, S.K. India Messiah, A. France Minogue, R.B. United States of America Nilson, R. International Organization for Standardizati Norberg, J.A. United States of America O'Brien, J. United States of America Olivier, J.P. OECD Nuclear Energy Agency Osmachkin, V. IAEA Pete, J.P. Commission of the European Communities Ramachandran, V. India S&nchez, J. Mexico Skrabal, J. Czechoslovakia Specter, H. IAEA Sokolovsky, A. France Stadie, K.B. OECD Nuclear Energy Agency Suguri, S. Japan Togo, Y. Japan Vinck, W. Commission of the European Communities Wenzinger, E.C. United States of America Yaremy, E.M. Canada Zuber, J.F. Switzerland During the revision phase (1990-1991) the following experts participated in one or more of the meetings: Barbe, B. France Baumgartner, G. Switzerland Diaz-Llanos Ros, M. Spain Fujitsuka, F. Japan 54 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ Godoy, A. IAEA (ES/NENS) Giirpinar, A. IAEA (ES/NENS) Hintergraber, M. Germany, Federal Republic of Inkester, J.E. United Kingdom Isaev, A. Union of Soviet Socialist Republics Katiberda, I.V. Union of Soviet Socialist Republics Kennedy, R. United States of America Kuntze, W.M. Germany, Federal Republic of Madonna, A. Italy Riera, J.D. Brazil Soucek, V. Czechoslovakia Tobioka, T. Japan This publication is no longer valid Please see http://www-ns.iaea.org/standards/ This publication is no longer valid Please see http://www-ns.iaea.org/standards/ LEST OF NUSS PROGRAMME TITLES A &g MofgJ f/mf :'w r/:e ^ene^ /way &e revMe^ ;w near ^fure. 77:oje fAaf Aave a/ready %?eeM rew'jeJ are :W:cafe^ &y fAe a&f:7:oH o / (Kev. 7)' fo fAe nHwber. 1. GOVERNMENTAL ORGANIZATION SO-C-G (Rev. 1) Code on the safety of nuclear power plants: Governmental1988 organization Sa/efy GKM?M 50-SG-G1 Qualifications and training of staff of the regulatory body 1979 for nuclear power plants 50-SG-G2 Information to be submitted in support of licensing 1979 applications for nuclear power plants 50-SG-G3 Conduct of regulatory review and assessment during the 1980 licensing process for nuclear power plants 50-SG-G4 Inspection and enforcement by the regulatory body for 1980 nuclear power plants 50-SG-G6 Preparedness of public authorities for emergencies at 1982 nuclear power plants 50-SG-G8 Licences for nuclear power plants: Content, format and 1982 legal considerations 50-SG-G9 Regulations and guides for nuclear power plants 1984 2. SETING 50-C-S (Rev. 1) Code on the safety of nuclear power plants: Siting 1988 Sa/eiy GKK?M 50-SG-S1 (Rev. 1) Earthquakes and associated topics in relation to nuclear 1991 power plant siting 50-SG-S3 Atmospheric dispersion in nuclear power plant siting 1980 50-SG-S4 Site selection and evaluation for nuclear power plants 1980 with respect to population distribution 57 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 50-SG-S5 External man-induced events in relation to nuclear power 1981 plant siting 50-SG-S6 Hydrological dispersion of radioactive material in relation 1985 to nuclear power plant siting 50-SG-S7 Nuclear power plant siting: Hydrogeological aspects 1984 50-SG-S8 Safety aspects of the foundations of nuclear power plants 1986 50-SG-S9 Site survey for nuclear power plants 1984 50-SG-S10A Design basis flood for nuclear power plants on river sites 1983 50-SG-S10B Design basis flood for nuclear power plants on coastal 1983 sites 50-SG-S11A Extreme meteorological events in nuclear power plant 1981 siting, excluding tropical cyclones 50-SG-S11B Design basis tropical cyclone for nuclear power plants 1984 3. DESIGN 50-C-D (Rev. 1) Code on the safety of nuclear power plants: Design 1988 GMMfa: 50-SG-D1 Safety functions and component classification for 1979 BWR, PWR and PTR 50-SG-D2 (Rev. 1) Fire protection in nuclear power ptants 1992 50-SG-D3 Protection system and related features in nuclear 1980 power plants 50-SG-D4 Protection against internally generated missiles and 1980 their secondary effects in nuclear power plants 50-SG-D5 External man-induced events in relation to nuclear 1982 power plant design 50-SG-D6 Ultimate heat sink and directly associated heat transport 1981 systems for nuclear power plants 50-SG-D7 (Rev. 1) Emergency power systems at nuclear power plants 1991 50-SG-D8 Safety-related instrumentation and control systems for 1984 nuclear power plants 58 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 50-SG-D9 Design aspects of radiation protection for nuclear 1985 power plants 50-SG-D10 Fuel handling and storage systems in nuciear power plants 1984 50-SG-D11 General design safety principles for nuclear power plants 1986 50-SG-D12 Design of the reactor containment systems in nuclear 1985 power plants 50-SG-D13 Reactor coolant and associated systems in nuclear power plants 1986 50-SG-D14 Design for reactor core safety in nuclear power plants 1986 50-SG-D15 Seismic design and qualification for nuclear power plants 1992 4. OPERATION 50-C-0 (Rev. 1) Code on the safety of nuclear power plants: Operation 1988 50-SG-02 In-service inspection for nuclear power plants 1980 50-SG-03 Operational limits and conditions for nuclear power plants 1979 50-SG-04 Commissioning procedures for nuclear power plants 1980 50-SG-05 Radiation protection during operation of nuclear 1983 power plants 50-SG-06 Preparedness of the operating organization (licensee) 1982 for emergencies at nuclear power plants 50-SG-07 (Rev. 1) Maintenance of nuclear power plants 1990 50-SG-08 (Rev. 1) Surveillance of items important to safety in nuclear 1990 power plants 50-SG-09 Management of nuclear power plants for safe operation 1984 50-SG-010 Core management and fuel handling for nuclear 1985 power plants 50-SG-011 Operational management of radioactive effluents and 1986 wastes arising in nuclear power plants 50-SG-012 Periodic safety review of operational nuclear 1994 power plants 59 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 5. QUALITY ASSURANCE 50-C-QA (Rev. 1) Code on the safety of nuciear power plants: 1988 Quality assurance 50-SG-QA1 Establishing of the quality assurance programme for a 1984 nuclear power plant project 50-SG-QA2 Quality assurance records system for nuclear 1979 power plants 50-SG-QA3 Quality assurance in the procurement of items and 1979 services for nuclear power plants 50-SG-QA4 Quality assurance during site construction of nuclear 1981 power plants 50-SG-QA5 (Rev. 1) Quality assurance during commissioning and operation 1986 of nuclear power plants 50-SG-QA6 Quality assurance in the design of nuclear power plants 1981 50-SG-QA7 Quality assurance organization for nuclear power plants 1983 50-SG-QA8 Quality assurance in the manufacture of items for 1981 nuclear power plants 50-SG-QA10 Quality assurance auditing for nuclear power plants 1980 50-SG-QA11 Quality assurance in the procurement, design and 1983 manufacture of nuclear fuel assemblies SAFETY PRAC77CES 50-P-l Application of the single failure criterion 1990 50-P-2 In-service inspection of nuclear power plants: 1991 A manual 50-P-3 Data collection and record keeping (or the 1991 management of nuclear power plant ageing 50-P-4 Procedures for conducting probabilistic safety 1992 assessments of nuclear power plants (Level 1) 50-P-5 Safety assessment of emergency power systems for 1992 nuclear power plants 50-P-6 Inspection of fire protection measures and fire fighting 1994 capability at nuclear power plants 60 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 50-P-7 Treatment of externa) hazards in probabilistic 1995 safety assessment for nuclear power plants 50-P-8 Procedures for conducting probabilistic safety 1995 assessments of nuclear power plants (Level 2) 50-P-9 Evaluation of fire hazard analyses for nuclear 1995 power plants 50-P-10 Human reliability analysis in probabilistic safety 1995 assessment for nuclear power plants 61 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ This publication is no longer valid Please see http://www-ns.iaea.org/standards/ SELECTION OF IAEA PUBLICATIONS RELATING TO THE SAFETY OF NUCLEAR POWER PLANTS SAFETY SERIES 115-1 International basic safety standards for protection against 1995 ionizing radiation and for the safety of radiation sources: Interim edition 67 Assigning a value to transboundary radiation exposure 1985 69 Management of radioactive wastes from nuclear 1985 power plants 72 Principles for establishing intervention levels for the 1985 protection of the public in the event of a nuclear accident or radiological emergency 73 Emergency preparedness exercises for nuclear 1985 facilities: Preparation, conduct and evaluation 75-INSAG-1 Summary report on the post-accident review meeting 1986 on the Chernobyl accident 75-INSAG-2 Radionuclide source terms from severe accidents to 1987 nuclear power plants with light water reactors 75-INSAG-3 Basic safety principles for nuclear power plants 1988 75-INSAG-4 Safety culture 1991 75-INSAG-5 The safety of nuclear power 1992 75-INSAG-6 Probabilistic safety assessment 1992 75-INSAG-7 The Chemobyl accident: Updating of INSAG-1 1993 77 Principles for limiting releases of radioactive 1986 effluents into the environment 79 Design of radioactive waste management systems 1986 at nuclear power plants 81 Derived intervention levels for application in 1986 controlling radiation doses to the public in the event of a nuclear accident or radiological emergency: Principles, procedures and data 84 Basic principles for occupational radiation monitoring 1987 63 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 86 Techniques and decision making in the assessment 1987 of off-site consequences of an accident in a nuclear facility 93 Systems for reporting unusual events in 1990 nuclear power plants 94 Response to a radioactive materials release 1989 having a transboundary impact 97 Principles and techniques for post-accident 1989 assessment and recovery in a contaminated environment of a nuclear facility 98 On-site habitability in the event of an 1989 accident at a nuclear facility: Guidance for assessment and improvement 101 Operational radiation protection: A guide to optimization 1990 103 Provision of operational radiation protection 1990 services at nuclear power plants 104 Extension of the principles of radiation protection 1990 to sources of potential exposure 105 The regulatory process for the decommissioning 1990 of nuclear facilities 106 The role of probabilistic safety assessment 1992 and probabilistic safety criteria in nuclear power plant safety 110 The Safety of Nuclear Installations 1993 118 Safety assessment for spent fuel storage facilities 1994 TECHNICAL REPORTS SERIES 249 Decontamination of nuclear facilities to permit 1985 operation, inspection, maintenance, modification or plant decommissioning 262 Manual on training, qualification and certification 1986 of quality assurance personnel 267 Methodology and technology of decommissioning 1986 nuclear facilities 268 Manual on maintenance of systems and components 1986 important to safety 64 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 271 Introducing nuclear power plants into electrical power 1987 systems of limited capacity: Problems and remedial measures 274 Design of off-gas and air cleaning systems at nuclear 1987 power plants 282 Manual on quality assurance for computer software 1988 related to the safety of nuclear power plants 292 Design and operation of off-gas cleaning and 1988 ventilation systems in facilities handling low and intermediate level radioactive material 294 Options for the treatment and solidification 1989 of organic radioactive wastes 296 Regulatory inspection of the implementation 1989 of quality assurance programmes: A manual 299 Review of fuel element developments for water cooled 1989 nuclear power reactors 300 Cleanup of large areas contaminated as a result 1989 of a nuclear accident 301 Manual on quality assurance for installation and 1989 commissioning of instrumentation, control and electrical equipment in nuclear power plants 306 Guidebook on the education and training of technicians 1989 for nuclear power 307 Management of abnormal radioactive wastes 1989 at nuclear power plants 327 Planning for cleanup of large areas contaminated as a 1991 result of a nuclear accident 328 Grading of quality assurance requirements: A manual 1991 330 Disposal of waste from the cleanup of large areas 1992 contaminated as a result of a nuclear accident 334 Monitoring programmes for unrestricted release 1992 related to decommissioning of nuclear facilities 338 Methodology for the management of ageing of 1992 nuclear power plant components important to safety 354 Reactivity accidents 1993 367 Software important to safety in nuclear power plants 1994 65 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 368 Accident management programmes in nuclear power 1994 plants: A guidebook IAEA-TECBOC SEMES 332 Safety aspects of station blackout at nuclear power plants 1985 341 Developments in the preparation of operating procedures 1985 for emergency conditions of nuclear power plants 348 Earthquake resistant design of nuclear facilities with 1985 limited radioactive inventory 355 Comparison of high efficiency particulate filter testing 1985 methods 377 Safety aspects of unplanned shutdowns and trips 1986 379 Atmospheric dispersion models for application in 1986 relation to radionuclide releases 387 Combining risk analysis and operating experience 1986 390 Safety assessment of emergency electric power systems 1986 for nuclear power plants 416 Manual on quality assurance for the survey, evaluation and 1987 confirmation of nuclear power plant sites 424 Identification of failure sequences sensitive to 1987 human error 425 Simulation of a loss of coolant accident 1987 443 Experience with simulator training for emergency 1987 conditions 444 Improving nuclear power plant safety through 1987 operator aids 450 Dose assessments in nuclear power plant siting 1988 451 Some practical implications of source term reassessment 1988 458 OSART results 1988 497 OSART results n 1989 498 Good practices for improved nuclear power plant 1989 performance 499 Models and data requirements for human reliability analysis 1989 66 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 508 Survey of ranges of component reliability data 1989 for use in probabilistic safety assessment 510 Status of advanced technology and design for 1989 water cooled reactors: Heavy water reactors 522 A probabilistic safety assessment peer review: 1989 Case study on the use of probabilistic safety assessment for safety decisions 523 Probabilistic safety criteria at the 1989 safety function/system level 525 Guidebook on training to establish and maintain 1989 the qualification and competence of nuclear power plant operations personnel 529 User requirements for decision support systems 1989 used for nuclear power plant accident prevention and mitigation 538 Human error classification and data collection 1990 540 Safety aspects of nuclear power plant ageing 1990 542 Use of expert systems in nuclear safety 1990 543 Procedures for conducting independent peer reviews of 1990 probabilistic safety assessment 547 The use of probabilistic safety assessment in the 1990 relicensing of nuclear power plants for extended lifetimes 550 Safety of nuclear installations: Future direction 1990 553 Computer codes for Level 1 probabilistic safety 1990 assessment 561 Reviewing computer capabilities in nuclear power plants 1990 570 OSART mission highlights: 1988-1989 1990 581 Safety implications of computerized process control 1991 in nuclear power plants 586 Simulation of a loss of coolant accident with rupture 1991 in the steam generator hot collector 590 Case study on the use of PSA methods: 1991 Determining safety importance of systems and components at nuclear power plants 591 Case study on the use of PSA methods: 1991 Backfitting decisions 67 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 592 Case study on the use of PSA methods: 1991 Human reliability analysis 593 Case study on the use of PSA methods: 1991 Station blackout risk at Millstone Unit 3 599 Use of probabilistic safety assessment to evaluate nuclear 1991 power plant technical specifications 600 Numerical indicators of nuclear power plant safety 1991 performance 605 OSART good practices: 1986-1989 1991 611 Use of plant specific PSA to evaluate incidents at 1991 nuclear power plants 618 Human reliability data collection and modelling 1991 631 Reviewing reactor engineering and fuel handling: 1992 Supplementary guidance and reference material for IAEA OSARTs 632 ASSET guidelines: Revised 1991 edition 1991 635 OSART guidelines: 1992 edition 1992 640 Ranking of safety issues for WWER-440 model 230 1992 nuclear power plants 648 Procedures for conducting common cause failure analysis 1992 in probabilistic safety assessment 658 Safety related maintenance in the framework of the 1992 reliability centered maintenance concept 659 Reactor pressure vessel embrittlement 1992 660 Expert systems in the nuclear industry 1992 669 Case study on the use of PSA methods: Assessment 1992 of technical specifications for the reactor protection system instrumentation 670 Pilot studies on management of ageing of nuclear 1992 power plant components: Results of Phase I 672 Safety aspects of nuclear power plant automation 1992 and robotics 681 OSART mission highlights: 1989-1990 1993 694 Safety assessment of proposed improvements of RBMK 1993 nuclear power plants 68 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ 710 Applicability of the leak before break concept 1993 711 Use of probabilistic safety assessment for nuclear 1993 installations with large inventory of radioactive material 712 Safety aspects of designs for future light water reactors 1993 (evolutionary reactors) 719 Defining initiating events for purposes of probabilistic 1993 safety assessment 722 Safety assessment of design solutions and proposed 1993 improvements to Smolensk Unit 3 RBMK nuclear power plant 724 Probabilistic safety assessment for seismic events 1993 737 Advances in reliability analysis and probabilistic safety 1994 assessment for nuclear power reactors 740 Modelling and data prerequisites for specific applications 1994 of PSA in the management of nuclear plant safety 742 Design basis and design features of WWER-440 model 213 1994 nuclear power plants: Reference plant: Bohunice V2 (Slovakia) 743 ASCOT Guidelines 1994 744 OSART Guidelines — 1994 Edition 1994 749 Generic initiating events for PSA for WWER reactors 1994 751 PSA for shutdown mode for nuclear power plants 1994 763 Pre-OSART mission highlights: 1988-1990 1994 773 The safety of WWER and RBMK nuclear power plants 1994 774 Guidance for the application of the leak before break 1994 concept 778 Fire hazard analysis for WWER nuclear power plants 1994 780 Safety assessment of computerized control and 1995 protection systems 790 Reliability of computerized safety systems at 1995 nuclear power plants 797 OSART mission highlights: 1991-1992 1995 821 Experience with strengthening safety culture 1995 in nuclear power plants 69 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ PROCEEDINGS SERIES STI/PUB/673 IAEA safety codes and guides (NUSS) in the light of 1985 current safety issues STI/PUB/700 Source term evaluation for accident conditions 1986 STI/PUB/701 Emergency planning and preparedness for nuclear 1986 facilities STI/PUB/716 Optimization of radiation protection 1986 STI/PUB/759 Safety aspects of the ageing and maintenance of 1988 nuclear power plants STI/PUB/761 Nuclear power performance and safety 1988 STI/PUB/782 Severe accidents in nuclear power plants 1988 STI/PUB/783 Radiation protection in nuclear energy 1988 STI/PUB/785 Feedback of operational safety experience 1989 from nuclear power plants STI/PUB/803 Regulatory practices and safety standards 1989 for nuclear power plants ST1/PUB/824 Fire protection and fire fighting in nuclear installations 1989 STI/PUB/825 Environmental contamination following a 1990 major nuclear accident STI/PUB/826 Recovery operations in the event of a nuclear accident or 1990 radiological emergency STI/PUB/843 Balancing automation and human action in nuclear 1991 power plants STI/PUB/878 Probabilistic safety assessment for operational safety — 1992 PSA '91 STI/PUB/880 The safety of nuclear power: Strategy for the future 1992 0) r- m N o ta m 70 This publication is no longer valid Please see http://www-ns.iaea.org/standards/ -^r T^r !rt the United States of America and Canada, the exclusive sates agent for IAEA publications, to whom ail orders and inquiries should be addressed, is: UNIPUB, 4611-F Assembly Drive, Lanham, MD 20706-4391, USA *i^ )nthe toHowing countries IAEA pubiications may be purchased from the sources listed below, or from major iocal booksellers. Payment may be made in local currency or with UNESCO coupons. ARGENTINA Comisidn Nacional de Energia Atdmica, Avenida del Libertador 8250, RA-1429 Buenos Aires AUSTRALtA Hunter Publications, 58A Gipps Street, Collingwood, Victoria 3066 BELGIUM Service Courrier UNESCO, 202, Avenue du Roi, B-1060 Brussels CHiLE Comisidn Chiiena de Energia Nuclear, Venta de Publicaciones, Amunategui 95, Casilla 188-D, Santiago CH!NA IAEA Pubiications in Chinese: China Nuclear Energy Industry Corporation, Transiation Section, P.O. Box 2103, Beijing IAEA Publications other than in Chinese: China National Pubtications tmport & Export Corporation, Deutsche Abteiiung, P.O. Box 88, Beijing FRANCE Office International de Documentation et Librairie, 48, rue Gay-Lussac, F-75240 Paris Cedex 05 GERMANY UNO-Verlag, Vertriebs- und Verlags GmbH, Dag HammarskjiSld-Haus, Poppelsdorfer Allee 55, D-53115 Bonn HUNGARY Librotrade Ltd., Book Import, P.O. Box 126, H-1656 Budapest !ND)A Oxford Book and Stationery Co., Scindia House, New Delhi-110 001 iSRAEL YOZMOT Literature Ltd., P.O. Box 56055, IL-61560 Tel Aviv ITALY Libreria Scientifica Dott. Lucio di Biasio "AEIOU", Via Coronelli 6, 1-20146 Milan JAPAN Maruzen Company, Ltd, P.O. Box 5050, 100-31 Tokyo Internationa) NETHERLANDS Martinus Nijhoff International, P.O. Box 269, NL-2501 AX The Hague Swets and Zeitlinger b.v., P.O. Box 830, NL-2610 S2 Lisse PAKISTAN Mirza Book Agency, 65, Shahrah Ouaid-e-Azam, P.O. Box 729, Lahore 3 POLAND Ars Poiona, Foreign Trade Enterprise, Krakowskie Przedmie^cie 7, PL-00-068 Warsaw ROMANiA llexim, P.O. Box 136-137, Bucharest RUSSIAN FEDERATtON Mezhdunarodnaya Kniga, Sovinkniga-EA, Dimitrova 39, SU-113 095 Moscow SLOVAK REPUBHC Alfa Publishers, Hurbanovo ndmestie 3, SO-815 89 Bratislava SOUTH AFRiCA Van Schaik Bookstore (Pty) Ltd, P.O. Box 724, Pretoria 0001 SPAIN Diaz de Santos, Lagasca 95, E-28006 Madrid Dfaz de Santos, Balmes 417, E-08022 Barcelona SWEDEN Fritzes Information Centre, S-106 47 Stockholm UNITED KINGDOM HMSO, Publications Centre, Agency Section, 51 Nine Elms Lane, London SW8 5DR YUGOSLAVIA Jugostovenska Knjiga, Terazije 27, P.O. Box 36, YU-11001 Belgrade *A* Orders (except for customers in Canada and the USA) and requests for information may also be addressed directly to: ^ Sales and Promotion Unit ^ ^ international Atomic Energy Agency Wagramerstrasse 5, P.O. Box 100, A-1400 Vienna, Austria This publication is no longer valid Please see http://www-ns.iaea.org/standards/ ISBN 92-0-103295-1 ISSN 0074-1892