5.3.3.1 General notes

Airplane crash must be considered as an exceptional, extremely rare event which, unlike earthquakes or floods, is not rated as an anomaly at safety level 3, but as a beyond design system status condition at safety level 4 (cf. Section 2.5). An airplane hitting a building has dynamic effects on that building which can be defined as a load
over time function. It is appropriate here to distinguish between the different dimen­sions of military aircraft (small compact) and commercial ones (large).

Crashing fast-flying military aircraft was included as a fundamental design event when building new nuclear power plants in Germany, particularly after military aircraft (mainly Starfighter) crashes piled up in the 1970s. In the first instance, therefore, a load over time function was developed for a Starfighter crash and used as the basis for design. Even while designing the Convoy plants and their immediate predecessors, known as pre-Convoy plants, it had been decided to use a more robust design based on a Phantom F-4 crashing at a speed of 215 m/s. The requirements involved, including the load over time function, can be found in the RSK guidelines, and became the design standard for German nuclear power plants since the Convoy and pre-Convoy models.

Unlike Germany, other countries — with a few exceptions — did not allow for the impact of a fast flying military aircraft when designing and building nuclear power plants. That was evidently because such a scenario was highly unlikely, and the additional construction costs were high.

When terrorists flew aircraft into the World Trade Center on 11 September 2001, however, ideas about using airplane crash as a basic design principle changed. Many countries, especially in Europe and the USA, now take airplane crash into account when building new nuclear power plants. It may be assumed that Europeans require new installations to be designed to withstand the impact of both military and commercial aircraft. When designing for airplane crash, it should be borne in mind that redundantly proposed building which are physically separate need not be designed expressly for aircraft impact, as the redundancy means that a aircraft impact can only destroy one of those buildings.