CC BY
113
RISK ASSESSMENT OF AIRCRAFT CRASH ONTO A NUCLEAR POWER PLANT
H.-P. Berg •
Bundesamt fur Strahlenschutz, Salzgitter, Germany e-mail: hberg@bfs.de
ABSTRACT
External hazards can provide safety significant contributions to the risk in case of nuclear power plant operation because such hazards have the potential to reduce simultaneously the level of redundancy by damaging redundant systems and lines or their supporting systems. Therefore, risk assessment of all potential external hazards to the plant under consideration is part of the overall safety assessment. In this paper, the procedure for assessing the external hazard aircraft crash is described in more detail. The first step is an appropriate screening procedure in order to determine scope and content of the assessment, taking into account plant- and site-specific conditions. The second step is to determine the methodical approach for those cases where a full scope analysis has to be performed and the inclusion into the used overall risk model. The considerations regarding this hazard do not cover an intended aircraft crash.
1 INTRODUCTION
International experience has shown that internal hazards such as fire and flooding as well as external hazards such as earthquakes, flooding and air craft crash can be safety significant contributors to the risk in case of plants with the potential high hazardous risk such as process plants or nuclear power plants. This risk results from the fact that such hazards potentially can reduce simultaneously the level of redundancy - implemeted for increasing the overal reliability and safety of the plant - by damaging redundant components, systems and lines or their supporting systems (energy, water etc.).
Therefore, arrangements should be implemented by the operator of the plant for assessing the vulnerability of plant and structures, determining how the safe operation of a plant is affected, and introducing measures to prevent the hazard at all, to prevent that it develops and to mitigate against its effects in case it nevertheless develops. These arrangements and their effectiveness and efficiency has to be justified to the regulatory body and approved.
Methods to analyse operating plants with a higher risk potential systematically with respect to the adequacy of their existing safety protection equipment against hazards can be deterministic as well as probabilistic.
In particular in case of probabilistic analyses, the assessment can be very detailed and time consuming. Therefore, it is necessary to develop procedures to screen out, e.g., rooms or buildings of a plant where no further analysis is required or to have a graded procedure for the respective hazard taking into account plant- and site-specific conditions.
Since October 2005, a revised guideline as well as revised and extended technical documents are issued in Germany which describe the methods and data to be used in performing probabilistic safety assessment in the frame of comprehensive safety reviews for nuclear power plants (Berg 2005) which have to be performed every ten years to achieve a current overall snapshot of the safety level of the plant.
In these documents, probabilistic considerations of aircraft crash, external flooding, earthquake and explosion pressure waves are required and described in (FAK PSA 2005). Also on international level, new recommendations are issued such as the Safety Guide on Level 1 PSA (IAEA 2010) and the updated US Standard (ASME 2008) taking into account external hazards to a larger extent.
In this paper, the procedure for probabilistic assessment of the external hazard aircraft crash is described in more detail. The first step is to define an appropriate screening procedure in order to determine scope and content of the assessment to be performed. The second step is to determine the methodical approach for those cases where a full scope analysis has to be performed. The third step is to include this hazard analysis into the used overall risk model of the plant under consideration.
The consideration regarding the external hazard aircraft crash usually does not cover an intended aircraft crash for already operating plants.
However, the aspect of an intended aircraft crash onto a plant with a potential high hazardous risk is also discussed since many years although a probabilistic evaluation of the behaviour of terrorists is very difficult to address.
As a result of the difficulties to adequately model an intended aircraft crash, new nuclear power plant projects take into account such an event in their design. For example, in the design of the European Pressurized Reactor as currently constructed in Finland (see Figure 1), the reactor building as well as the surrounding auxiliary buildings which house safety related equipment are structurally strengthened to the extent needed for surviving the impact of a large commercial aircraft (Kuznetsov 2007). Moreover, redundant safety equipment is spatially separated in a strictly manner.
Figure. 1. Layout of the European Pressurized Reactor showing features for protection against aircraft impact
Both, crashes of military aircrafts and of commercial aircrafts contribute to the plant risk. The location of the nuclear power plant under consideration is important, both with respect to the distance from a nearby airport and to a close-by air lane. Moreover, it has to be taken into account whether the plant is situated in an area of landing and take-off traffic.
2 FLIGHT SITUATION IN GERMANY
Because of the central position of Germany within Europe, there is a close-meshed net of civil air lanes with a high density of flights. Although the military flight activities have changed after 1990 due to the new political situation in Eastern Europe, German and, in particular, US Air Force units are stationed in Germany and, in addition, a lot of air traffic resulting from military units stationed outside Germany but crossing the German airspace has to be considered. Thus, there might be a non-negligible hazard due to aircraft crashing onto nuclear sites.
German nuclear power plants can be divided in three generations with respect to air craft crash depending on the load assumptions which had been the basis for the structural design of the building structures to protect against hints of aircrafts or wracked aircraft parts.
The consequences of hints in case of buildings which are not protected depend on the plant specific layout of buildings and systems, in particular the missing strict spatial separation of redundant safety equipment.
These design differences are reflected and evaluated within the safety assessment performed in the frame of comprehensive (periodic) safety reviews.
3 SCREENING
In the following guidance is given to perform a probabilistic safety analysis of nuclear power plants for the initiating event aircraft crash. A conservative approach in form of a rough analysis is described which allows the estimation of an upper limit for the frequency of plant hazard states caused by an aircraft crash.
Further methods are described which are appropriate to replace the conservative considerations of the rough analysis by more detailed validation procedures. Application of these methods with a larger analysis effort lead to a more realistic validation compared to the rough analysis.
Requirements with respect to aircraft crash are laid down in a document of the German Reactor Safety Commission (RSK 1984). A load function for buildings to be protected (reactor building etc.) has been defined mainly based on theoretical calculations assuming an impact of the military aircraft "Phantom F4" (see Figure 2) which was the mostly used aircraft in the military fleet at that time.
force [MM]
110 55
10 20 30 40 50 60 70 time|m5|
Figure 2. Load time diagram
Table 1 provides on overview of the graded screening process with respect to aircraft crashes applied in probabilistic safety assessments in the frame of periodic safety reviews for German nuclear power plants (Berg 2010a).
Table 1. The graded process of evidence regarding aircraft crash impact.
Criterion Extent of analysis
Structures are designed according to the diagram in Fig. 1 and not located in a military zone for fly maneuver drills Analysis is not necessary
Contribution is negligible compared to the other contributions in the PSA A conservative rough-analysis regarding the consequences of impact on important areas A, B, C where A: e.g. primary circuit B: e.g. turbine building C: separated emergency building
Not negligible Detailed probabilistic analysis of all plant areas, e.g. by using Monte-Carlo-methods
4 DETERMINATION OF THE FREQUENCY OF AN AIRCRAFT CRASH
The plant-specific determination of the frequency for the occurrence of an aircraft crash is performed on the basis of flight accident statistics valid for the respective location, taking into account the types of aircrafts and the weight classes which can be set. The following input information is needed:
• the air traffic lanes in the near field of the plant,
• data concerning civil and military small and middle airports (in the range of about 50 km) and large airports (in the range up to 150 km) such as distance and adjustment of the starting and take-off runways.
The crash frequencies are determined separately in three different traffic categories:
• The landing and take-off phase,
• the air lane traffic and waiting loop traffic,
• the free air traffic.
The aircrafts can be grouped into different weight classes. One example is shown in Table 2. Furthermore, the weight classes can be correlated to accidents.
Table 2. Aircraft crash rates outside the airports onto the ground according
to (Hoffmann et al. 1997).
Weight class (Mg) Aircraft crashes per km flown
1 > 20 2.08-10-10
5.7 - 20 3.21-10-09
2 2 - 5.7 5.44-10-08
3 < 2 1.1110-07
The annual frequency of impact for each weight class and flight phase is calculated, based on global crash rates valid for Germany as reported in (BFU 2010) and further processed as shown in see Table 2, the local flight density and the impact area of the plant or the silhouette areas of the buildings.
Conservatively, crash angles are assumed as 30° to the horizon. The silhouette areas result from the projection of the crash angle over the up-stations of the building onto the power plant surface (over the four directions). However, the definition of the silhouette area is not unique and allows different calculations as shown in equations (1) and (2), illustrated in Figure 3.
FZa = 6>/3 + 2 -12 (1)
FZb = 6V3 + 2 + 22 (2)
Q ■
Figure 3. Determination of the silhouette area
As already explained, further hits can result from wracked aircraft parts, even if the aircraft crashes outside the defined silhouette areas.
An area of 1000 m outside the silhouette areas is assumed as a possible hazard range. Tthe probability of a hit by a wracked part is estimated as 20%. More than one hit per crash is not assumed.
Relevant for the generation of such wracked parts are mainly aircrafts of the weight classes 1 and 2 as well as fast flying military aircrafts. The wracked part is treated like an aircraft of the weight class 3.
5 CRASH FREQUENCY IN COMMERCIAL AIR TRAFFIC
Most of the air crashes occur during take-off and landing phases of flight. Hence existence of an airport in the site vicinity increases the potential of aircraft crash hazard on the plant under consideration (e. g.. a nuclear power plant or a chemical plant). The location of site with respect to the distance to major and minor air fields, including military airports is identified. In case of establishing a new installation with a higher hazardous risk, some countries like the Netherlands and United Kingdom define prescribed quantitative criteria (Berg 2010b). If the distances of the planned plant are greater than the prescribed value for respective types of airports, the location of site is considered as acceptable.
If the site falls within this prescribed value for different types of airfields, a comprehensive probabilistic study of aircraft crashes onto the installation considering flight frequencies are carried out. If this probability is not acceptably low the site is considered unsuitable for establishing the planned installation.
With the advances made in assessing the hazards from aircraft impact including the effects of mechanical impact, fire and explosion, one can now estimate the consequences of impact. However, this needs to be investigated in detail in a case-by-case basis.
Up to 10 km from the end of the runway, the crash rate decreases exponentially with distance R. For each weight class and different angular segment (or sector) of flight directions, this decrease has been calculated based on data of worldwide crash vectors (see Figure 4).
Figure 4. Worldwide crash vectors of aircraft crashes during landing and take-off phase (weight class 2).
The landing range before the touch-down and the take-off range after the start are subdivided into three different sectors (see Figure 5):
Sector 1: ± 15° to the landing and take-off axis (30° sector angle),
Sector 2: outside of segment 1 to ± 45° to the landing and take-off axis (90° sector angle), Sector 3: outside of sector 2 to ± 90° to the landing and take-off axis (180° sector angle). The number of crashes hi,j within definite angular sectors are summed up for rings of AR= 1000 m and approximately expressed by the following formula (Fürste & Glupe 1974):
h,,j = ^. exp(- bl,j . R) (3)
cl
with
i = Weight class,
j = Annular segment with corresponding Cj as portion of the total sector as provided in
Table 3,
ai,j; bi, j = Constants to approximate the observed number of crashes in weight class i and sector j,
ci = number of landing and take-offs in the weight class I and within the observation time.
Figure 5. Subdivision of sectors for the landing and take-off range
Based on the number of yearly flying operations (take-offs and landings) of the airport to be considered, the number of the yearly crashes Hi,j can be calculated for an impact area of the plant in a given annulus:
H ^
dglobal, * A t F
(4)
Figure 6. Exponential decrease of the number of worldwide crash vectors in the annular segment with the distance from the runway
One result for an observation time of 19 years and the number of global flying operations per year according to (ICAO 1995) is shown in Figure 6.
For the calculation of the crash frequency at lateral locations to air lanes, it has been assumed that the frequency distribution will be governed by a Gaussian distribution at right angles to the air lane with a standard deviation of a.
The fraction of the expected number of crashes onto the area of the NPP is explained in Figure 7.
Figure 7. Determination of the crash frequency of aircrafts flying along air lanes
The aircraft crash rates outside the airports in correlation to the weight class has been listed in
Table 3.
Passenger aircrafts are only part of the aircrafts in weight class 1. Resulting from data of the German Federal Bureau of Aircraft Accident Investigation (BFU) a lower crash frequency in the range of 10-12 to 10-11 per flight km can be assumed.
Table 3. Correlation between sectors and aircraft weight classes.
Sector Weight class 1a Weight class 1b Weight class 1c
> 20 Mg 14 up to 20 Mg 5,7 up to 14 Mg
a1a,j b1a,j c1a a1b,j b1b,j C1b a1c,j b1c,j c1c
1 90.7 0.0005 2.7-108 10.4 0.0004 7.1107 13.3 0.0006 6.3107
2 17.4 0.0005 3.4 0.0005 9.2 0.0006
3 10.6 0.0006
Outside a distance of 10 km from the airport each flight direction becomes equally probable within the free air traffic. The number of crashes Hi will be calculated by multiplying the global crash rate with the local flight density (the number of take-offs and landings of the considered airport):
H = a 1,1 2xR
b
■di,j ■ hs
(5)
With equation (5) the contributions to the overall crash frequency are calculated as shown in Figure 8.
v
Figure 8. Determination of the crash frequency of aircrafts in the free air traffic
The average flying speed in the respective weight class as described in Figure 8 (Hoffmann et a. 1997) is given in Table 4.
Table 4. Average flying speed correlated to weight classes.
Weight class (Mg) Average flying speed km/h
1 > 20 833.4
5.7 - 20 463.0
2 - 5.7 333,4
3 < 2 203.7
6 CRASH FREQUENCY IN MILITARY AIR TRAFFIC
The following considerations are not valid for large military aircrafts, which are used to transport military equipment, goods or soldiers. They use the air lanes of the commercial air traffic and have to be treated for the flying operation outside the landing and take-off phase as described earlier.
The plant-specific crash frequency of military aircrafts has to be calculated according to the procedures applied for the free air traffic taking into account the crash frequency per flying hour and the number of take-offs and landings on the neighbouring military airports.
In addition, the statistics of the local crash history which took place in the square of 30 km x 30 km around the power plant area is to be evaluated.
Figure 9 shows the statistics of crashes of fast flying military aircrafts from Germany and abroad with more than 7.5 Mg in Germany for the time frame of 1984 to 2000 and of 2000 up to 2008.
As one can see, changes in the military flying operation resulted in a significant reduction of the crash frequency. This is the result of twofold changes: due to the political situation less military flights have taken place, but also the aircraft type, mainly used in the eighties, was replaced by a modern and more reliable type.
Therefore, for current calculations it has been recommended to take into account only events since 1991.
For the hazard analysis, the buildings are divided into classes to reflect the degree of protection against aircraft crash impact: one which is designed against air plane crash and another which is not specifically designed against it. It will be distinguished between a direct hit frequency and a penetration frequency.
18 16 14 12 I 10 I 8
z
6
4
2
0
1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009
Years
Figure 9. Number of military aircraft crashes since 1984 up to 2009
In case the kinetic energy of the projectile is greater than the penetration energy of the outer shell a total damage of the building with all equipment in it is postulated.
In the detailed assessment, a plant-specific probability for the penetration can be determined, using, e.g., Monte Carlo procedures which allow calculations with a large number of possible impact points and impact angles to determine the position where design loads of the buildings are exceeded.
A transient or an initiating event leading to a core damage situation will be caused only, if systems in other buildings, necessary to mitigate that event, fail stochastically. For that case, the core melt frequency will be calculated in an event tree analysis.
For penetrations leading directly to core melt accidents, the initiating frequency is assumed to be equal to the core melt frequency. For the buildings, not specifically designed against air plane crashes, additional hits by parts of the wracked aircraft are taken into account. 7 CONCLUDING REMARKS
Aircraft crash onto a nuclear power plant or a chemical plant is an external hazard which has to be taken into account in a comprehensive safety assessment.
Methods to analyse plants systematically regarding the adequacy of their existing protection equipment against hazards can be deterministic as well as probabilistic.
In case of probabilistic safety assessments experience has shown that is reasonable to have procedures to screen out, e.g., rooms or buildings of the plant under consideration where no further analysis is required or to establish a safety graded procedure taking into account plant- and site-specific conditions such as design of buildings against aircraft crash impact as well as distance to smaller and larger airports including the current travel situation for commercial and military aircrafts.
This information has to be site-specific and has to be collected from the respective national organizations (e.g., for commercial flights from the National Department of Civil Aviation).
Some guidance to perform frequency calculations is given in (USDoE 2006), describing the determination of the number of operations, aircraft crash rates and crash location probability including some (unfortunately older) data.
More recently, a guide to assess aircraft accidents and incidents with the focus on fires and explosions has been published (NFPA 2010).
For the free air traffic, also international data bases can be taken into account (see for example references (ICAO 2007) and (NTSB 2009a and b). However, such databases have to be used very carefully because they cover all aircraft crash statistics including those from countries which are well known for a high risk of aircraft crashes due to the age of the aircrafts used, the reduced maintenance activities and an unsufficient flight control system.
In the past the flights along fixed air lanes (i.e. airspace monitored by air traffic controller and marked by radio navigation equipment) as discussed in section 3 were the regular case; a deviation was only allowed in exceptional cases (e. .g. in case of a storm). Today only 20 % of the flights are follwing the prescribed air lanes as stated by the German Aeronautical Information Service. The air traffic controller try to allocate an optimal short lane the pilots independently from the usually used air lanes (Felbermeier 2010).
8 OUTLOOK
Looking ahead, the km flown are increasing from year to year, however, up to now there is no systemetic increase of the crash rates per year.
As described aircraft crash rates are determined according to weight classes because of the different impact and resulting consequences for the plant under consideration. New and bigger aircrafts are on the market and partially already in operation. These aircrafts are constructed with new material such as fibre reinforced composite materials which leads to a reduction of the weight of the structures.
On the other hand, during the take-off phase the amount of fuel is bigger compared to older aircrafts.
As explained earlier, external hazards like aircraft crash are analysed in the frame of periodic safety reviews in case of operating nuclear power plants. This review on the one hand investigates the current plant safety status based on the operational experiences in the last ten years, but also should look forward for the next ten years period.
Because elements of the of periodic safety review might also be used in the frame of assessing the safety level with respect to an extended life time, the confidence in the results of the probabilistic safety assessment has to be justified to a larger extent, in case of the external hazard aircraft crash by taking into account the prognosis of aircraft movements in the next ten to twenty years which may enhance the aircraft crash frequency to be assumed.
One earlier forecast of the expected traffic increase is provided in Figure 10 reflecting the political situation after the changes in Eastern Europe.
Figure 10 illustrates that this strong increase of the expected number of flights in 2020 compared to 1997 and the additional airways needed for these flights particularly affect the German airspace.
Figure 10. Traffic growth and expected increase of air traffic in 2020
A more recent study describes the forecast of aircraft traffic by 2030 (EUROCONTROL 2008). With the available capacity, the new forecast is that by 2030 there will be 1.7 to 2.2 times the number of flights in Europe seen in 2007.
Figure 11 shows the areas where extra flights per day are expected in 2020 compared to 2007. Also in this new forecast, Germany seems to be the most impacted area in Europe.
The terrorist attacks of September 11th 2001 prompted new activities and investigations of aircrafts impacting nuclear power plants. New ideas - beside the existing building concepts against aircraft crash - were born to prevent the impact at the plant, for example to obscure the plant by fog or to erect additional structures in front of the plant as shown, for example in (Eibl 2003). These investigations are still ongoing.
New technologies originating from automotive crash analysis have been developed and are used by few researchers to investigate the crash of a plane into a building. The Airbus 320 represents the type of city liners which are most frequently flown. This aircraft was chosen for a crash simulation.
The outer surface corresponds to the real structure. The stiffness of the different surface components as fuselage or wing is modelled by shell elements with equivalent thickness. Because no detailed information about the structural parts is available from the aircraft producers, most of the stiffening components are represented in a simplified manner, whereas important stiffening parts, e.g. wing box, are modelled realistically. The turbines are defined as rigid body with point mass.
Figure 11. Extra flights through the airspace in 2030 compared to 2007
Figure 12 shows the end state of the simulation where almost two-thirds of the fuselage is collapsed. The right wing is broken into two halves. While one part is still connected to the fuselage, the other shows a tailspin behaviour. This asymmetric behaviour for a symmetric model and load is caused by small numerical effects, which have a great influence onto the buckling behaviour. This leads finally to the effect that the right turbine has contact before the left one what causes the cut of the right wing.
Figure 12. Final state of aircraft crash simulation
More details can be found in (Henkel & Klein 2007): However, further investigations require a better data base of the structure of the airplane. The investigations then can be extended for coupled analysis of airplane and structure.
9 REFERENCES
American Society of Mechanical Engineers (ASME). (2008) Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plants, ASME/ANS RA-S-2008.
Berg, H.P. (2005). Screening procedures for the probabilistic analyses of internal and external hazards. Proceedings of the 9th International Conference on Structural Safety and Reliability (ICOSSAR 2005), Rome, 2005, 3663 - 3670.
Berg, H.P. (2010a). Aircraft crash onto a nuclear power plant - screening procedure and approach for a probabilistic analysis. Journal of Polish Safety and Reliability Association, Summer Safety & Reliability Seminars, Volume 1, Gdynia, Poland, June 20 - 26, 2010, 27 - 33.
Berg, H.P. (2010b). Quantitative safety goals and criteria as a basis for decision making, Reliability & Risk Analysis: Theory and Applications, Vol. 1, No. 2, June 2010, 62 - 78.
Bundesstelle für Flugunfalluntersuchung (BFU). (2010). Jahresbericht 2008, Unfälle und Störungen beim Betrieb ziviler Luftfahrzeuge. Bericht V 173, Braunschweig, Juli 2010 (published in German).
Facharbeitskreis Probabilistische Sicherheitsanalyse für Kernkraftwerke (FAK PSA). (2005). Methoden zur probabilistischen Sicherheitsanalyse für Kernkraftwerke, Stand: August 2005. BfS-SCHR-37/05, Salzgitter, October 2005 (published in German).
European Organisation for the Safety of Air Navigation (EUROCONTROL). (2008). Challenges of growth 2008, Summary report, November 2008.
Eibl, J. (2003). Airplane impact on nuclear power plants, Transactions of the 17th International Conference on Structural Mechanics in Reactor Technology (SMiRT 17), Prague, Czech Republic, Paper J03/6.
Felbermeier, B. (2010). Probabilistische Behandlung der Gefährdung durch unfallbedingten Flugzeugabsturz, Tagungsunterlagen des Behördenseminars zu übergreifenden Einwirkungen von außen, GRS Köln, September 2010 (published in German).
Fürste, W. & Glupe, G. (1974). Absturzhäufigkeit von Flugzeugen auf Kernkraftwerke. TÜ (Technische Überwachung) 15, Nr. 4, April, 115 - 119 (published in German).
Henkel, F.-O. & Klein, D (2007). Variants of analysis of the load case airplane crash, Transactions of the 19th International Conference on Structural Mechanics in Reactor Technology (SMiRT 19), Toronto, Canada, Paper J03/2.
Hoffmann, H. H., Skoff, G. & Berg, H.P. (1997). Probabilistic safety analysis of external events in German nuclear power plants. Transactions of the 14th International Conference on Structural Mechanics in Reactor Technology (SMiRT 14), Lyon, France, 1997, Vol. 10, 87 - 94.
International Civil Aviation Organization (ICAO). (2007). Annual report of the Council for 2006, Montreal, Canada.
International Atomic Energy Agency (IAEA). (2010). Development and Application of Level 1 Probabilistic Safety Assessment for Nuclear Power Plants, Special Safety Guide SSG-3, IAEA, Vienna, April 2010.
International Civil Aviation Organization ICAO). (1995). Civil Aviation Statistics of the World 1994. Doc. 9180/20, 20th Annual Edition, Montreal, Quebec, Canada.
Kuznetsov, V. (2007). Advanced nuclear plant design options to cope with external events. Transactions of the 19th International Conference on Structural Mechanics in Reactor Technology (SMiRT 19), Toronto, Canada, Paper S01/2.
National Fire Protection Association (NFPA). (2010). Guide for Aircraft Accident / Incident Response Assessment. NFPA 422, 2010 Edition, NFPA, 1 Batterymarch Park, Quincy, MA.
National Transport Safety Board (NTSB). (2009a). Accidents and Accident Rates 1983 -2008. US Aviation, www.ntsb.gov/aviation/stats.htm.
National Transport Safety Board (NTSB). (2009b). Annual Review of Aviation Aircraft Data 2005. NTSB/ARF-09/01, National Transport Safety Board, Washington.
Reactor Safety Commission (RSK). (1984). Guidelines for Pressurized Water Reactors. 3rd Edition, October 18, 1981, amended 1982 and 1984.
US Department of Energy(USDoE). (2006). Accident Analysis for Aircraft Crash into Hazardous Facilities. DOE-STD-3014-2006.
