1An external event is an event that is unconnected with the operation of a facility or the conduct of an activity that could have an effect on the safety of the facility or activity [5]. Such events normally originate outside the site, and their effects on the nuclear installation need to be considered. Events originating on the site but outside safety related buildings are treated the same as off‑site external events. External events could be of natural or human induced origin and are identified and selected for design purposes during the site evaluation process.

2A design basis external event is an external event, or a combination of external events, that is considered in the design basis of all or any part of a facility [5]. Design basis external events are independent of the installation layout.

3The term ‘beyond design basis external event’ is used to indicate a level of external hazard exceeding those hazard levels considered for design, derived from the hazard evaluation for the site. The purpose of identifying beyond design basis external events is to ensure that the design incorporates features to enhance the capability of the installation to withstand such events. In addition, the identification of such events is used in evaluating the margins that exist in the design and in identifying potential cliff edge effects

4INTERNATIONAL ATOMIC ENERGY AGENCY, External Events Excluding Earthquakes in the Design of Nuclear Power Plants, IAEA Safety Standards Series No. NS‑G‑1.5, IAEA, Vienna (2003).

5A cliff edge effect is an instance of severely abnormal conditions caused by an abrupt transition from one status of a facility to another following a small deviation in a parameter or a small variation in an input value [5].

6The term ‘missile’ is used to describe a mass that has kinetic energy and has left its design location. This term is used to describe a moving object in general; military missiles, whether explosive or not, are specifically excluded from consideration. In general, military projectiles have velocities higher than Mach 1 and are therefore usually beyond the range of applicability of the techniques described in this Safety Guide. However, for non‑explosive military projectiles with characteristics lying within the quoted ranges of applicability, the techniques described may be used.

7In many States, a target frequency of exceedance of 10^‑4 per year or less is used for design basis external events for natural hazards.

8In some States, the probability of occurrence of certain human induced events, such as external explosions or aircraft crashes, is considered very low, and passive components are usually assumed to be designed, manufactured, inspected and maintained to an extremely high quality. Therefore, the single failure non‑compliance clause in para. 5.40 of SSR‑2/1 (Rev. 1) [1] can be applied to the passive components. In some States, system outage due to repair, testing or maintenance, with its associated change in installation configuration, is considered one possible single failure mode in this context. Other States include the single failure criterion for all design basis external events.

9In some States, a value for the probability of 10⁻7 per reactor‑year is used in the design of new facilities as an acceptable limit on the probability value for interacting events that have serious radiological consequences. This is considered a conservative value for the screening probability level if applied to all events of the same type (e.g. all aircraft crashes, all explosions). Some initial events may have very low limits on their acceptable probability and need to be considered in isolation [9].

10The design limit is an interpretation of acceptance criteria in terms of design parameters (e.g. elasticity, maximum crack opening, no buckling, maximum ductility).

11Perforation is the state when an impacting missile has passed completely through the target.

12Scabbing is the ejection of irregular pieces of the face of the target opposite the impact face as a result of a missile impact.

13In addition to seismic hazards, probabilistic safety analyses have been performed for external hazards such as floods and extreme winds.

14For example, the repair time for a power line damaged by an event may determine the minimum amount of stored fuel needed for the diesel generators, if the supply of diesel oil from sources nearby cannot be guaranteed. As another example, the failure of a ventilation system due to an aircraft crash might lead to a temperature rise inside a building, which in turn might cause the malfunctioning of electronic and pneumatic equipment far away from the crash area.

15In some States, the design basis wind speed for extreme events is determined on the basis of a 100 year return period (1% annual frequency of exceedance) [7], whereas rare design events are typically chosen with a much longer return period.

16In this Safety Guide, the term ‘hazard‑agnostic’ is used to indicate a situation where the protection against a hazard is provided without complete knowledge of the size and frequency of the hazard. Generally, a standardized envelope design for external hazards constitutes a hazard‑agnostic approach.

17In some States, the design basis extreme wind speed is chosen on the basis of a 100 year return period (1% annual frequency of exceedance), whereas design rare events causing high winds (e.g. tornado, typhoon) are typically chosen with a much longer return period [7].

18For the structural design of nuclear installations, time averaging of gust speeds over 1–3 seconds is usually necessary.

19Penetration is the state when an impacting missile has formed a notch on the impact face but has not perforated the target.

20Spalling is the ejection of target material from an impact face as a result of a missile impact.

21A detonation of explosives is characterized by a sharp rise in pressure that expands from the centre of the detonation as a pressure wave impulse at or above the speed of sound in the transmission media. It is followed by a much lower amplitude negative pressure impulse, which is usually ignored in the design, and it is accompanied by a dynamic wind caused by air behind the pressure wave moving in the direction of the wave.

22A deflagration normally results in a slow increase in pressure at the wave front and, compared with a detonation, has a longer duration and a peak pressure that decreases relatively slowly with distance. These characteristics are also influenced by the weather conditions (e.g. temperature inversion) and the topography, which both need to be considered. A major difference between deflagrations and detonations is the heat or fire load on the target structure. In general, the heat or fire load from a detonation is not considered a part of the design basis for a target structure but is considered as such for a deflagration.

23Dilution is usually expressed relative to the source of the release. For example, it can be expressed as the average gas or vapour concentration at a point, divided by the release rate at the source or divided by the concentration at the source.

24For example, in some States, when ice clogs the intake screens, warm cooling water is pumped from a discharge basin.

25Unacceptable radiological consequences are doses to workers or the public that exceed acceptable limits established by the State.