Vulnerability of VVER-1000 Nuclear Power Plants to Passenger Aircraft Crash

2. Standard of protection of a VVER-1000 plant:

Reactor building:

The building containing the reactor and the primary circuit consists of a cylinder with a dome on top. The building material is pre-stressed concrete with a thin steel liner on the inside. Wall thickness is about 1.2 m for the cylinder and 1.1 m for the dome [GRS 2000].

The reference case for aircraft crash for Temelin NPP is the crash of a small business plane with a mass of 7 t and a speed of 100 m/sec. It is also claimed that the reactor building should be able to withstand the crash of a 20 t plane with 200 m/sec 'in principle'; however, this latter statement is not qualified further [GRS 2000]. It seems plausible, however, to assume that the building is able to withstand loads somewhat greater than the reference case.

Rivne NPP should be able to withstand the crash of 10 t airplane with a speed of 208 m/sec [HOFER 1998].

All in all, regarding solely the strength of the walls and roof of the building, it can be assumed that the standard of protection of the VVER-1000/320 reactor building is roughly equivalent to that of the older German NPPs which are built to 'Starfighter-standard' (10 t plane crashing at 180 m/sec). There are four German plants in this category, Biblis-B, Neckar-1, Unterweser and Isar-1. They have started operation between 1976 and 1978, well over twenty years ago.

However, there are special aspects for VVER-1000s which tend to increase the vulnerability of the reactor building.

Whereas in German PWRs, the reactor control room is in a separate building (switchgear building), the main as well as the emergency control room of a VVER-1000 are located at the lower levels of the reactor building, below the containment structure [HOFER 1998].

Thus, the control rooms are protected to some extent by the building structures above them. On the other hand, they will have to be evacuated in case of melt-through of the containment.

At least at K2R4, the ventilation system for the control rooms is not seismically qualified [HOFER 1998] and hence also likely to be vulnerable to the tremors associated with the crash of a commercial aircraft.

Problems with the pre-stressed concrete the reactor building is built from have been notorious with VVER-1000 plants. Unexpected high tension losses of the steel tendons have occurred, sometimes even break of tendons. The tendons at Temelin power plant appear to be fabricated of a somewhat higher quality material than typical tendons of Ukrainian plants [GRS 2000].

Loss of tension of pre-stressing tendons is particularly hazardous in case of a loss-of-coolant accident which results in pressure build-up inside the containment. As far as it is accompanied, however, by a general loss of containment building stability, it can increase the vulnerability of this building in case of the crash of an aircraft, increasing the likelihood that the containment is destroyed even if the aircraft is comparatively small or only 'grazes' the building.

Other buildings and components:

Usually, available sources are vague regarding the design of other buildings against crash of an aircraft. However, at Temelin NPP, it is known that there is no emergency feedwater system building designed to the same standard as the reactor building [ANDREEVA 2000], in contrast to modern German PWRs.

Generally, the layout of VVER-1000s has weaknesses which make safety systems, in spite of their redundancy, vulnerable to external hazards [WENRA 2000].

For example, there is no adequate separation of the four steam lines between steam generators and the first isolation valves. Steam lines leave the containment in pairs. Outside the containment, all four steam lines get close together and enter a neighbouring building which also houses, in close vicinity to each other, all isolation valves. Thus, an external impact can destroy more than one or even all steam lines, leading to a severe under-cooling transient of the reactor with possible catastrophic consequences.

In modern German NPPs, steam and feedwater lines are separated by concrete walls; in old plants, other measures have been taken to reduce the risk of a simultaneous steam line break. In modern French NPPs, steam lines are spatially separated and only get close to each other behind the isolation valves [HIRSCH 2001a].

Scope of safety analyses:

No complete safety analyses concerning crash of an aircraft have been performed so far for VVER-1000s. This is of high significance since safety analyses in principle tend to unveil shortcomings which had not been recognised so far, and may give indications which are helpful for the implementation of measures increasing safety.

In the case of Temelin, which is arguably the VVER-1000 plant for which the most extensive safety analyses have been performed, only the reactor building complex and the ponds for the emergency service water have been considered in aircraft crash analyses. The possible effects of skidding of a crashing aircraft have not been taken into account. Furthermore, only impacts were considered, leaving out post-crash kerosene fires and explosions [AR 2001].

In the case of K2R4, analyses concerning aircraft crash which are part of the modernisation program concentrate solely on the reactor building; other buildings are not included. In particular, the emergency service water building has not been considered in spite of the fact that this building is of particular relevance since it is shared among multiple units both at the Khmelnitsky and Rivne sites. Thus, an aircraft crash destroying this building could result in a multi-unit accident [HOFER 1998].

In the past, safety analyses for aircraft crash in Germany as in other countries operating nuclear power plants have almost solely concentrated on comparatively small military aircraft. Thus, more comprehensive analyses for VVER 1000 plants according to the international practice would not have been sufficient by far to give a complete picture of the hazards in case of the crash of a passenger aircraft. They could have been helpful, however, to a point, in identifying weaknesses and achieving better understanding of the general risks of external impacts.

Given the lack of comprehensive analyses and the resulting possible deficits in identifying shortcomings, it is plausible to assume that the general standard of other buildings at the reactor site, like that of the reactor building, is definitely lower than that of modern German PWRs, and probably even worse than that of older German NPPs which were going into operation in the late seventies.

3. Loads in the event of a passenger plane crash:

In the paper on the hazards to nuclear power plants in Germany from crashes of passenger aircraft [HIRSCH 2001b], examples of medium and large aircraft from Boeing and Airbus which are being used by airlines in Western Europe are given.

Basically, the same types of aircraft are also flown by western airlines and, to some extent, by airlines from Central and Eastern Europe and countries of the former Soviet Union in the regions where VVER-1000 plants are built and operated. For example, Boeing 767 aircraft are operated by Aeroflot and other eastern airlines [UW 2001].

Furthermore, there are aircraft from Russian manufacturers which are of a size comparable to that of large 'western' aircraft. For example, the maximum take-off weight of the Tupolev Tu-204, in operation since 1997, is 103.000 kg; the maximum take-off weight of the Iljuschin IL-96M, in operation since 1995, is 270.000 kg (i.e., between that of the Boeing 767 and the Airbus A-340) [MÜLLER 2001]. Accordingly, the volume of kerosene in the tanks of those aircraft will also be comparable.

Thus, as is the case for 'western' NPPs, a crash of a medium or large passenger aircraft on a VVER-1000, accidentally or by design, cannot be excluded. Such a crash will give rise to loads far above the design basis, and also, the effects of flying debris and kerosene fires will far exceed the design basis.

Even a modern German NPP designed against the crash of a Phantom jet is not likely to withstand the loads from the crash of a medium-sized passenger aircraft, let alone the loads from a large aircraft. This holds even more for a VVER-1000 which generally, at best, only achieves the 'Starfighter-Standard' of older German NPPs.

4. Effects of a crash, counter-measures:

It is clear from the above that the crash of a passenger aircraft on a VVER-1000 NPP will, as in the case of German NPPs, very likely lead to catastrophic radioactive releases. If the reactor building is hit and destroyed, the releases may even exceed those from the Chernobyl accident in 1986.

As for German NPPs, the reactor would have to be shut down a considerable time before the crash (a quarter of a year to a year), to achieve a degree of protection. If the reactor building is destroyed, even a standstill period of this order of magnitude will not significantly ameliorate the effects.

NPPs of the earlier type VVER-440 have one advantageous feature as compared to German NPPs: Their coolant inventories are larger, and hence the thermal inertia of the primary coolant circuit is higher. This leads to slower heating-up in case of an accident where cooling is completely lost but the primary circuit remains intact. Hence, more time would be available for intervention.

However, the VVER-1000 reactor has lost nearly all the inherent safety features of the smaller VVER plants [WENRA 2000].

In one respect, the chance for effective counter-measures is considerably smaller for VVER-1000 plants than for German NPPs. In German NPPs, symptom-based emergency operating procedures (EOPs) have been implemented for severe accidents (as in the other countries of the European Union). Based on those procedures, severe accident management guidelines (SAMGs) have been developed, which have the purpose of mitigating and limiting severe accidents.

This is not generally the case for VVER-1000 plants, where EOPs fall short of the western standard, and no SAMGs have been implemented so far. Mostly, event-based EOPs are foreseen, which are less flexible and less effective.

For example, in Temelin NPP, sympton-based EOPs have only been partly implemented up to now [ANDREEV 2001]. More significantly, no SAMGs have been developed and implemented yet [ATPP 2001].

In K2R4, exclusively event-based EOPs are to be implemented [HOFER 1998].

EOPs and SAMGs are not specifically implemented to ameliorate the effects of a plane crash. Indeed, they are designed mainly for other possible accident scenarios. Well-developed SAMGs, however, generally increase the chances of successful intervention in an accident situation and hence can be expected also to be useful, within certain limits, in the case of the crash of a passenger plane on an NPP.

Generally, the discussion of counter-measures in [HIRSCH 2001b] also applies for VVER-1000 plants. The conclusion holds that shutting down nuclear power plants does not eliminate all risks, but leads to a definite risk reduction in the longer term. If sufficient time is available for intervention, the chances of improvising counter-measures even if no severe accident management guidelines exist are improved. Thus, standstill times should rather be longer for VVER-1000s than for German NPPs, for which about three months was determined to be the minimum period to achieve relevant safety gains.

The discussion regarding other counter-measures in the paper on German nuclear power plants also holds for VVER-1000s. In particular, it cannot be recommended to deploy anti-aircraft missiles at NPP sites. Loading spent fuel into dry storage casks after the reactor has been shut down has some potential for risk-reduction, but also creates new problems. (For more details regarding those points, see [HIRSCH 2001b].)

References:

ANDREEV 2001
Andreev, I. et al.: Gesamt-UVP Temelin – Bericht an die Österreichische Bundesregierung; Umweltbundesamt, Wien, Juni 2001

ANDREEVA 2000
Andreeva, I. et al.: Teil-UVE II Temelin – Bericht an die Österreichische Bundesregierung; Umweltbundesamt, Wien, November 2000

AR 2001
Austrian Report to the Expert Mission with Trilateral Participation According to Chapter IV of the Protocol of the Negotiations between the Czech and the Austrian Government led by Prime Minister Zeman and Federal Chancellor Schüssel with the Participation of Commissioner Verheugen; Rev. 1, January 2001

ATPP 2001
Austrian Technical Position Paper – Safety Aspects of Temelin Nuclear Power Plant, Vienna, July 2001

GRS 2000
Gesellschaft für Anlagen- und Reaktorsicherheit mbH: In-Depth Analysis of Seven Selected Safety Issues Relating to the Temelin NPP, Draft; study for the German Ministry for the Environment, Nature Conservation and Nuclear Safety, August 2000

HIRSCH 2001a
Hirsch, H.: Atomkraftwerk Temelin – Sicherheitsdefizite; Stellungnahme für das Land Oberösterreich, Hannover, 16. März 2001

HIRSCH 2001b
Hirsch, H.: Danger to German nuclear power plants from crashes by passenger aircraft; study performed for Greenpeace Germany, Hanover/Hamburg, November 2001

IAEA 1999
International Atomic Energy Agency: Final Report of the Programm on the Safety of WWER and RBMK Nuclear Power Plants; IAEA-EBP-WWER-15, Vienna, May 1999

HOFER 1998

Hofer, P., Kromp, W., Seidelberger, E. & Sholly, St.: Comments on the Safety of Khmelnitsky Unit 2 and Rivne Unit 4 in the Frame of the Public Participation Procedure of EBRD; Report to the Austrian Government, Vienna, October 1998

MÜLLER 2001
Müller, C.: Flugzeuge der Welt 2001; Motorbuch Verlag Stuttgart, 2001

UW 2001
Website of the University of Würzburg, Faculty for Physics and Astronomy, cip.physik.uni-wuerzburg.de/~pschirus/aviation, as seen November 16, 2001

WENRA 2000
Western European Nuclear Regulators' Association: Nuclear safety in EU candidate countries; October 2000

---

	home > newsletter > search > about us > links > back to contents