On April 26, 1986, the worst accident in the history of commercial nuclear power generation occurred at the Chernobyl Nuclear Power Station some 60 miles north of Kiev in the Ukraine, on the Pripyat River not far from the town of Pripyat (poplation then 49,000). The site at that time had four 1000-MW(e) RBMK reactors operational and two more under construction. The four reactors were built in pairs, sharing common buildings and services. Construction of Units 3 and 4 started in 1975-76; Unit 4 became operational during 1984. The main elements of the reactor are described in Section 2.4.6.

The Expe^ment. Ironically the immediate cause of the accident that wrecked the No. 4 Unit was an experiment designed to improve the safety of the plant. The objective of this experiment was to see whether the mechanical inertia in a turbine generator isolated from both its steam supply and the grid could be used to supply electricity via the station distribution system to impor­tant station auxiliary loads (including the emergency cooling pumps) for a short period (4(}.50 seconds). In essence, this was an attempt to use the turbine gen­erator as a mechanical flywheel coupled to the pumps electrically.

A turbine generator unloaded normally would take about 15 minutes to come to rest from 3000 rpm, but when coupled to the pump motors might pro­vide a few tens of seconds’ supply. Even so, given the rapid coast-down of the main circulating pumps without this provision and the long time required to shut down the reactor and start the auxiliary diesel generators and diesel, this “flywheel” effect could have provided a valuable margin in the safety case. In the experiment, to simulate the load from the ECCS, the generator was coupled to four of the main circulating pumps (each rated at 5.5 ^W) and the feedwa­ter pumps.

The experiment had been attempted twice before, in 1982 and 1984. On the latter attempt, following isolation of the generator from the grid, the voltage level in the unit system fell rapidly and the operators were unable to arrest the drop by manual control of the voltage regulator. The fall in voltage resulted in the pump motors slowing down much faster than the generator.

For the fateful experiment on April 26 an automatic voltage regulator, acting on the generator excitation current, had been fitted that maintained the voltage level in the unit system so that the pump motors ran down in step with the main generator at synchronous speed, drawing on the stored kinetic energy of the turbine generator.

The planned experimental initial conditions required the reactor to be at about 25% full power with one of its turbine generators shut down and the other supplying the grid, four main circulating pumps, and two feed pumps. The remaining auxiliary plant was fed from the grid.

The experiments had been badly planned, the safety case was inadequate and had not been properly reviewed, and as we shall see in the following sec­tions, the operators failed to achieve the chosen plant conditions, departed from the laid-down procedures, and violated several operating mles.

Status of the Plant before the Accident. On April 25, 1986, all four units at Chernobyl were operating. The No. 4 unit was due to be shut down for maintenance work. A total of 1,659 channels were loaded with fuel, most of it (75%) from the initial fuel charge, having been utilized to an extent (“burn — up") of 12-15 MW, day kg. What follows is an abbreviated and simplified ac­count of the sequence of events that took place. For ease of description the accident is divided into a series of logical phases. Diagrams illustrate the con­dition at each phase.

Phase 1: Prelude [01.00-23.10 h, April 25 (Figure 5.12)]. The reactor was at nominal full power conditions [1000 MW(e), ca. 3000 MW(t)]. The oper­ators started to reduce power at 0.100 h, on April 25, and about 12 hours later, at 13.05 h, with the reactor at 1600 MW(t), turbo generator No. 7 was discon­nected from the grid. Four of the main circulating pumps and two of the feed­water pumps were connected to turbo generator No. 8 in preparation for the test.

At 14.00 h, the emergency core cooling system was disconnected from the primary circuit. This was in accordance with the experimental plan (presumably because it was anticipated it would be spuriously initiated by the expected low level in the steam drum during the experiment).

However, the grid controller requested the unit to continue supplying to the grid until 23.10 h. Operation with the emergency core cooling system disen­gaged was a violation of the operating rules (violation l—one of many to come), but it does not appear to have had any significance in the accident se­quence. However, disabling of the reactor protection system seems to have been regarded rather lightly both in the operating procedures and by the oper­ators themselves.

Figure 5.12: Phase 1: prelude (01.00-23.10 h, April 2), 1986) (X indicates compo­nents not in operation at time of accident).

Phase 2: Preparations for the Experiment (23.10 h, April 25, to 01.00 h, April 26). At 23.] 0 h, the operators start ed to reduce power to obtain the test condition of 700-1000 MW(t). The local automatic control (LAR) system, which operated 12 control rods, was disengaged at 00.28 h on April 26. Here the op­erator made a major error ( violation 2) in failing to reset the set point of the au­tomatic regulation (AR) system and was then unable to control the reactor power with a combination of the manual and overall automatic control (AR3), the latter using only four control rods. The result was that the reactor power dipped to below 30 MX'(t).

The first reduction from 100% power nearly 24 h earlier had initiated a xenon poisoning transient. The fission product Xe-135 is of considerable im­portance in thermal reactors because it has a very high neutron capture cross section. Only a sma11 proportion of Xe-135 is formed directly by fission; most comes from the radioactive decay of I-135 (half-life 6.7h). The xenon is re­moved partially by decay (half-life 9.2h) and partly by its capture of neutrons. About 2% of all neutrons are captured by Xe-135, so it is an important item in

the overall neutron balance (see Section 2.2). The balance of formation of xenon and its destruction are such that a fall in reactor power (and thus of neu­tron flux) leads to a rise in xenon concentration.

Figure 5.13a shows the reactor power-time history together with (Figure 5.13 b) the poisoning effect of the xenon present. It will be seen that the peak in the transient (at about 12-14 h after the initital decrease in power) had passed but that the uncontrolled drop in power to around 30 MW(t) had induced a sharp increase in the xenon poisoning by the time the experiment started. Be­cause of the sharply increasing xenon the operator had considerable difficulty in raising reactor power with the small operating reactivity margin he had avail­able. Finally, at 01.00 h on April 26, the power was stabilized at 200 MW(t)— well below the power level proposed for the experiment.

Phase 3: The Experiment [01.00-23.40 h, April 26 (Figure 5.14)]. At

01.3 and 01.07 h, respectively, the operators started the main standby circulat­ing pumps (see 4 in Figure 5.14), one on each main loop, so that at the end of the experiment, in which four pumps were to operate “tied” to the No. 8 tur-

bine generator, four pumps would remain coupled to the grid to provide reli­able cooling of the core.

The reactor power was lower than intended; so too were the steam voidage in the channel and the pressure drop along the fuel. As a result the coolant flow rate was higher than anticipated with all eight pumps operating. Such an oper­ating mode was normally prohibited because of the possibility of single-pump trip leading to cavitation and vibration of the main feed piping (violation 3).

Because the reactor power was only 7% of full power and the coolant flow rate through the core was 115-120% of normal, the enthalpy rise across the core was only 6% of nominal, or equivalent to just 4QC. Thus although the entire pri­mary coolant system was only slightly subcooled and still very close to boiling, there was very little steam being generated in the core.

Under these conditions the coolant voidage would have been much re­duced. The water was absorbing more neutrons, so the control rods were cor­respondingly further withdrawn. The decrease in steam generation resulted in a drop in steam pressure and disturbances to other reactor parameters. The oper-

ators tried to control both the steam pressure and the drum level manually but were unable to hold these parameters above the normal “trip” point settings (5 in Figure 5.14). To avoid the reactor’s tripping, the operators overrode the trip signals with respect to these variables (violation 4).

At 01.09 h (4 minutes before the initiation of the test), the operator opened the main feed valve (6 in Figure 5.14) to increase the water level in the steam drum. With the feedwater flow increased by a factor of 3, the desired water level was reached 30 seconds later. However, the operator continued to feed the drum. As the cold water from the drum passed into the core, the steam gen­eration rate fell noticeably, resulting in an even further reduction in steam voidage. To compensate, all the 12 automatic control rods moved upward to a “fully withdrawn” position (7 in Figure 5.14).

To maintain reactor power at 200 MW(t) the operator had also to move a number of manual control rods up. This allowed one group of automatic con­trol rods to reenter the core by 1.8 m.

The cool feedwater and the decrease in steam generation led to a small fall in pressure. At 01.19.58 h, a steam bypass line to the condenser was closed, but the steam pressure continued to fall (by 5 bars) over the next few minutes.

At 01.21.50 h, the operator sharply reduced the feedwater flow rate, which resulted in an increase of water temperature passing to the inlet water with a delay of the transit time (20 s) from the steam drums to the reactor inlet. The au­tomatic control rods started to lower into the core to counter the effect of the in­creased voidage.

At 01.22.30 h, the operator looked at the printout of the reactor parameters, especially the residual reactivity margin left in the control rods. Over this period the control rods remained substantially withdrawn.

A “safe” operating level was set to ensure that the control rods “dipping” into the core were effective when they moved. The operator noticed that the reac­tivity margin was at a value (less than 15 rods inserted into the core) that re­quired him to trip the reactor. The test was, however, continued in violation of this operating restriction (violation 5).

Calculations have shown that the number of control rods in the core at this stage was 6 to 8—less than half the design “safe” minimum and a quarter of the minimum number of 30 inserted rods given in the operating instructions (re­lated to a negative reactivity insertion rate of 0.5-0.7% / s).

It should be observed that measurements from in-core flux monitors showed the neutron flux profiles to be normal in the radial plane but doubly peaked in the axial direction with the higher peak in the upper region of the core. This was caused by high xenon levels in the central part of the reactor, coupled with steam generation in the upper parts of the core.

At 01.23.04 h, the experiment was initiated and the main steamline valves to turbine generator No.8 were closed (8 in Figure 5.14). The protection provided to trip the reactor when both turbine generators were tripped had been disen­gaged to allow the reactor to continue to operate. However, this was not part of the original plan for the experiment and was done apparently to enable the test to he repeated if the first test was unsuccessful. Needless to say this was a fur­ther violation of the operating procedures (violation 6). The operation of the re­actor after the start of the experiment was not required.

The No. 8 turbine generator together with the four main circulating pumps (see 2 in Figure 5.14) and two feedwater pumps (6 in Figure 5.14) started to run down. With the closure of the main steam and bypass valves the steam pressure rose slightly and the steam generation in the core correspondingly decreased slightly (01.23.10 h). However, the main coolant flow and the feedwater flow re­duced, causing an increase in both water inlet temperature and steam generation. An increase in reactor power was noted at 01.23.31 h. An attempt was made to compensate with the 12 automatic control rods, but this was ineffective.

A power excursion was experienced, and at 01.23.40 h, the shift manager at­tempted a manual ‘’scram” of the reactor. All the control rods and emergency rods began motoring into the core. However, the rods could not be fully inserted. Be­cause the rods were in a nearly withdrawn position, a delay of about 10 s oc­curred before the reactor power could have been reduced. Indeed, the very act of driving in the “overdrawn” control rods may have contributed to the initiating event for what followed. The control rod “followers” (see Figure 2.14) displaced the neutron-absorbing water on reinsertion to start the power excursion.

In this time a prompt critical power excursion driven by the increased steam generation in the core (due to the pump rundown) and the strong positive void coefficient led to severe fuel damage and fuel channel disruption. After 3 s the reactor power had reached 530 MW(t) and continued to increase exponentially to much higher levels. Only the negative fuel temperature coefficient (Doppler effect) was acting to reduce the neutron population over this period. The spe­cific energy deposited in the fuel was estimated to be greater than 1.2 MJ/kg. There were two excursions in power. It has been suggested that the second power peak was from additional voiding caused in turn by the rupture of the pressure boundary during the first excursion.

The condition of prompt criticality (see Section 2.3) is believed to be what occurred in the last stages of the accident at Chernobyl. Complete voiding of the RRMK core would have produced about a 3% increase in k, greater than the delayed neutron fraction.

At 01.24 h, witnesses heard two explosions, one after the other. Molten and burning fragments flew up from the Unit No. 4 plant and some fell on the roof of the turbine generator building, starting a fire.

Phase 4: Explosion and Fire [01.23.40-5.00 h, April 26 (Figure 5.15)].

The precise sequence of events following the reactivity insertion will probably never be known, but based on analysis, actual observations, and previous ex­perimental work a plausible picture can be put together.

One particularly relevant experiment is that undertaken in 1979 at the Power Burst Facility (PBF), Idaho Falls, as part of the Thermal Fuels Behavior Program for the USNRC A single unirradiated U02 fuel rod, operating under conditions representative of hot stait-up of a boiling-water reactor (i. e., veiy similar to the

conditions at Chernobyl) was subjected to a power burst, resulting in a total en­ergy deposition of 1.55 MJ/kg U02 (cf. Chernobyl about 1.2 MJ/kg UO).

Extensive amounts of molten fuel debris were expelled into the flow channel and against the pressure tube wall. A pressure pulse of 350 bars, suggesting an energetic molten fuel-coolant interaction, was observed. Following the model­ing of the accident, it would appear that in the case of the Chernobyl transient the energy deposited in the fuel from the power transients probably resulted in fuel melting or fuel fragmentation and dispersion. The fuel cladding initially re­mained intact until voiding in the channel-induced “dryout,” after which the clad temperature increased at 250°C/s. The subsequent explosive formation of steam caused a sharp increase in the pressure within the fuel channel sufficient to increase the steam drum pressure at -10 bars/s and to stop or even reverse the primary coolant flow. This is known because the check valves downstream of the pumps closed at 01.23.45 h. This further voiding of the fuel channels re­sulted in a second, larger power surge to about 440 times full power.

Fuel ejected from the fuel pins under the driving force of fission gas pressure impinged on the pressure tubes, causing failure and releasing steam into the graphite moderator space. With the pressure relieved at 01.23.47 h, water rushed back into the fuel channels to interact with the fuel being ejected from the fuel pins. A conservative estimate of the total thermal energy deposited in the fuel is 50-100 GJ. Assuming a 1% efficiency for the conversion to mechani­cal energy in an energetic fuel coolant interaction (FCI), a conservative explo­sive energy of 0.5-1 GJ is estimated. This is broadly equivalent to 100-200 kg of TNT (but, in the case of the explosive, detonation is much more rapid than in the FCI). The conditions were also appropriate for other chemical reactions in­cluding molten zirconium-steam and hot graphite-steam reactions. At 0.23.48 h, two explosions were noted in succession; the first could have resulted from the fuel-coolant interaction and the second from hot hydrogen and carbon monoxide mixing with air and exploding as the containment of the reactor vault failed. These detonations, together with the buildup of steam pressure, blew the 1000-ton top shield off and rotated it through 90° (Figure 5.16). It also broke all the pressure tubes and lifted some of the control rods. Some of the graphite blocks from the reflector were ejected, the charge face was destroyed, and damage was done to the charge hall and some of the structural parts of the building. Fragments of core materials fell onto the roofs of the reactor and tur­bine buildings. The refueling machine that stood on the charge face “leapt up and down,” causing further pipework failures. Over 30 fires were started in var-

-(:hernobyl unit no. 4 befori

Chernobyl unit no. 4 after

Upper lid

Debris (graphite ^blocks, sti’JCtural elements. concrete)

Lower lid (dropped 4 m) 9 m level

Nuclear fuel masses (‘lava) under reactor rooms .

Figure 5.16: Chernobyl Unit 4 before and after the accident.

ious areas due to mptured fuel lines, damaged cables, and thermal radiation from the exposed core.

By 01.30 h, the firefighters on duty had been called out and were reinforced with firefighting units from Pripyat and Chernobyl. Graphic accounts have been given of the extreme heroism of these firefighters, many of whom have since perished as a result of their exposure to lethal doses of radiation. By 05.00 h, the fires on the reactor and turbine buildings had been extinguished. Amaz­ingly, the three other units at the station continued to operate. The No. 3 Unit, which was adjacent to the damaged unit, was not shut down until 05.00 h. The other two units continued to operate until the early hours of the following morning, some 24 h after the accident. Fuel temperatures, initially high due to the energy deposited in the transient, fell as the heat was transmitted to the graphite and other reactor components.

Phase 5: The Aftermath (05.00 h, AprU 26 to May 6). With the reactor core badly damaged and the cooling system not functional, the Soviet engineers started to consider how to fight the graphite fire and how to reduce core tem­peratures, deal with the decay heat, and limit fission product release. They ini­tially tried to cool the core by the use of emergency and auxiliary feedwater pumps to provide water to the core. This was unsuccessful. Given the continu­ing graphite fire and ongoing significant release of fission products, the decision was taken to cover the reactor vaults with boron compounds, dolomite, sand, clay, and lead. The boron was to stop any recriticality; the dolomite gave off C02 as it heated up (which reduced the access of oxygen to the graphite fire); the lead absorbed heat, melted into gaps, and acted as shielding; while the sand acted as an efficient filter.

Over the period April 27-May 10, over 5000 tons of materials were dropped by military helicopters. The reactor core was thus covered by a loose mass that effectively filtered the fine aerosol fission products. Around May 1, some 6 days after the accident, fuel temperatures started to increase due to fission product decay heating and graphite combustion. To reduce temperatures, compressed nitrogen was fed into the space beneath the reactor vault. Fuel temperatures peaked about May 4-5 at around 2000°C and then began to drop. It is believed that about 10% of the core graphite was consumed during this period. By May 6, the discharge of fission products had virtually ceased, having decreased by a factor of several hundred.

Phase 6: Stab^teation and Entombment [from May 6 (Figure 5.17)].

From early May the situation at the damaged reactor improved. Monitoring de­vices to measure temperatures and air speed were lowered into the debris. The exact disposition of the fuel in the damaged reactor is not known. By May 6 at least 60-80% of the fuel had been released from the reactor vessel itself. About 130 tons of the molten radioactive material from the core formed into a “lava” most of which found its way to the lower parts of the reactor building.

From May 6, temperature conditions in the reactor vault were stable at several hundred degrees centigrade but falling at 0.5°C/day, fission product releases were down to tens of curies/day, and radiation levels in the areas immediately adjacent to the reactor were at levels of single sieveits per hour. Further fires broke out on May 23 in the plant areas above the damaged reactor. Although these were in high-radiation zones, they were successfully dealt with.

The worry was that the molten debris would melt through the last 50 cm of a 2-m-thick concrete slab at the 9-m level. A flat concrete slab incorporating a heat exchanger was designed and installed in the area beneath the reactor vaults by the end of June. A decision was taken to entomb the critically dam­aged unit in protective concrete walls 1 m thick. This included a perimeter wall enclosing the turbine and reactor blocks as well as internal and dividing walls between Units 3 and 4 and a protective cover over the turbine and reactor blocks. An internal recirculating ventilation-cooling system was installed, and the entombed reactor was maintained at reduced pressure (in respect of atmos­pheric pressure) and the exhausted air discharged through filters and a stack. This work was completed by early autumn of 1986. However, the “sarcopha­gus,” as it is known, did not remain leak-tight for long and there continue to be concerns about its integrity and the up-ended top shield-reactor roof.

Consequential Events and Core Damage. The reactor core was very se­verely damaged by the explosion, which also caused structural damage to the reactor building. A considerable discharge of fission products took place (Fig­ure 5.18), and it is estimated that excluding the noble gases, 70 megacuries (when related to the time of the reactor shutdown, ~ 2.6 x 10IH Bq) were re­leased in essentially two periods: the initial explosion and early stages of the graphite fire (April 26—27) and the later heat-up transient (May 2-5). This total release corresponds to 3-3.5% of the total fission product inventory—some 6—7 tons of material.

Of this, some 0.3-0.5°% (0.6—1 ton) is estimated to have remained on the site,

Figure 5. 18: Daily radioactive releases into the atmosphere from the accident (with­out radioactive noble gases) (1 MCi = 37 x 10b Bq = 37E Bq).

with 1.5-2.0% (3-5 tons) being deposited within 20 km and 1.0-1.5% (2-3 tons) being transported to greater distances. Particle sizes of the released material ranged from below 1 micron to lOs of microns.

Table 5.1 shows the estimated fractional releases of fission products during the accident. Most of the gaseous fission products (Xe, Kr) were released to­gether with significant amounts of 1131 and cs137 as well as smaller amounts of fuel aerosol material produced by corrosion of U02 exposed in the mechanical and thermal disruption of the reactor core. Table 5.1 shows the corresponding releases for the accident at Three Mile Island, both for the release from the re­actor core and the release to the environment.

It will be seen that the extent of fuel damage and fission product release from the core in the two accidents is very comparable. However, the effective­ness of the containment and the ECCS in preventing any significant release to the environment in the case of TMI-2 is dramatically clear.

At Chernobyl two operators were killed hy falling debris and burns < luring

Table 5.1 • Three Mile Island and Chernobyl Releases Compared TMI-2: Outside the Core TMI-2: To Environment Chernobyl: To Environment Noble gases 48% 1% 76 (Xe, Kr) I 25% 3 x 10 ’% 15-20% Cs 53% not detected 10-13% Ru 0.5% not detected 2.9% Ce (group) ML not detected 2.3-2.8%

the first few hours after the accident. Up to the end of August 1986, a further 29 people, all involved in firefighting or other accident recovery methods, had died of massive doses of radiation. About 200 staff received high radiation doses and burns.

A 30-km radius control zone was established around the Chernobyl site. Pripyat, Chernobyl, and other population centers were evacuated from April 27 onward: in all, about 135,000 people plus several thousand livestock. In 1990,

50,0 more people were evacuated, and further evacuations have occurred since, although the average doses delivered by the environment directly are now low.

A massive effort was undertaken to decontaminate the Chernobyl site (to permit entombment of the No. 4 Unit and the return to operation of the other undamaged units) and the surrounding 30-km zone. Special measures were de­vised to protect ground and surface water from contamination by way of cur­tain walls between the reactor site and the Pripyat River. In all, about 650,000 persons involved in the cleanup of the plant site and the 30-km zone were ex­posed to radiation.

Very extensive areas of the former Soviet Union and beyond its frontiers were affected by fallout. The plume from the initial fission product releases reached a height of 1200 m. The cloud was generated over several days (Fig­ures 5.19 and 5.20). Initially the cloud traveled northwest, missing Pripyat, across the Soviet Union and northeast Poland to Scandinavia. Some days later it changed direction and swung southward across Poland and Central Europe. Figure 5.19 shows the likely trajectories of materials reduced from Chernobyl on April 26.

Heavy rain on April 30 and May 1 led to wet deposition of radioactivity across France, Switzerland, southern Germany, and Czechoslovakia. On Friday, May 2, the cloud reached Britain. While the cloud cleared southern and eastern Britain on May 2 and 3, heavy rain occurred in North Wales, Cumbria, and Scot­land, causing relatively high levels of Cs137 activity (Figure 5.20). From May 3, the cloud passed more to the south, over Yugoslavia, Italy, and Greece.

An assessment of the implications of this spread of radioactivity over Europe can only be approximate. The United Kingdom’s National Radiological Protec­tion Board has estimated a collective effective dose integrated over all time of

80,0 man Sv. Current estimates indicate perhaps 30,000 fatal cancers resulting over the next 40 years in the affected parts of Russia and Western Europe. This value needs to be compared with over 30 million cancer deaths expected in the same population over the same time period.

In 1991 the International Atomic Energy Agency issued the results of a major study, the International Chernobyl Project, looking at the health effects of the accident. It involved about 200 independent experts from 22 countries and seven international organizations. It concluded at that stage that there were no health disorders that could be directly attributed to radiation exposure and

Figure 5.19: MESOS trajectories orginating from Chernobyl at 09 00 h, 12.00 h, and 15.00 h. GMT on April 26, 1986 (ApSimon, et a!., 1986).

Figure 5.20: Caesium-137 (Bq m 2) in vegetation in the United Kingdom. (From the Institute of Terrestrial Ecology.)

there were also no indications of an increase in leukemias and cancers. There were, however, significant non-radiation-related health disorders in the popula­tion surrounding Chernobyl. Nine years after the accident, many of the ex­pected health effects had not become apparent because of the latency period for some radiation-induced cancers. So the health effects can be summarized as:

• Acute radiation sickness and burns from P radioactivity to some 200 people causing 28 deaths.

• Childhood thyroid cancer in children living in and around Belarus and the northern district of Ukraine. So far nearly 500 cases of childhood thyroid cancer (associated with the uptake of 1131) have been detected in a population of 3 million children at risk.

• Nonradiological effects from stress-related conditions in a population of 10 million living in the most affected regions.

On the basis of past experience, some further health effects may be observed in the 100-km-radius regions around the plant, particularly in relation to breast cancer and skin and lung cancers.

In Britain, restrictions were imposed on the movement and slaughter of sheep and lambs grazing on caesium-contaminated grass in North Wales, Cum­bria, and Scotland; originally about 4 million sheep out of a national flock of 25 million were subjected to controls. By March 1988, the number had been re­duced to 300,000, but some controls were still in place as recently as 1995. The extra radiation dose received due to inhalation from deposited activity or through the food chain is expected to be on average about 3.5% above the nor­mal annual dose due to natural background radiation (70 micro Sv. in about 2000 micro Sv.). This increase, however, varies from 10°% in the north and west to just 1 % in the south of the country.

Causes of the Accident. Given the magnitude and severity of the accident and the fact that other reactors of this type were still in operation, the (then) So­viet Union established a Government Commission to study the causes of the ac­cident. In its report to the IAEA Chernobyl Post Accident Review Conference in August 1986, the Soviet delegation acknowledged that a number of factors had contributed to the accident. Underlying the specific design and operational as­pects of the accident were the institutional and organizational shortcomings of the Soviet nuclear industry. Since the accident, many analyses have been un­dertaken and published. The general conclusion from these analyses of the Chernobyl accident is that no new reactor safety issues have been identified.

One unusual, perhaps remarkable, feature of the Chernobyl accident is that failure of equipment played no part in the events leading up to the explosion. Likewise, only one of the actions taken by the operators—violation 2, failing to reset the set point of the automatic regulation system at 00.28 h on April 26— can be considered a mistake. All the other violations of the operating rules were deliberate with the specific objective of completing the voltage regulation ex­periment.

Design Shortcomings. First, the concept and design of the reactor itself was the major contributory factor. While the RBMK reactor has some inherent features that made it quite attractive (including the lack of a thick-walled pressure ves­sel, the absence of steam generators, the capability to replace fuel on load, and ease of construction on remote sites), it also has features that were shortcom­ings:

1. Positivepower coefficient at low power levels. The power coefficient and de-

sign of a reactor dictates its behavior and stability. If the power coefficient is negative, any power rise will be self-limiting; if positive, the converse. The power coefficient is made up of a number of individual components, but in the case of the RBMK, two components are dominant: the negative effect of fuel temperature (Doppler) increases and the positive effect of an increase of steam voidage in the core. At power levels below 20%, the pos­itive void coefficient becomes much stronger than the negative fuel tem­perature coefficient. As a result the power coefficient is overall positive and the reactor unstable.

2. Slow shutdown system. The reactor control and protection system was too slow and inadequate in design. The shutdown system was dependent for its effectiveness on appropriate operation of the reactor control system, which was complex and largely manual. Because computers were rudimentary and unreliable when the RBMK reactor was originally conceived, the designers assumed that human operators would be more reliable. They failed to see the need for engineered safeguard features to counteract the operator’s dri­ving the reactor into extreme situations for which the slow shutdown system would be ineffective.

3. “Positive scram. ’’ Associated with the poor design of the protection system is the design feature that with the control rods fully withdrawn, the initial effect of insertion is to increase reactivity in the lower parts of the core, due to the displacement of water by the graphite followers. Normally, the entry of the boron carbide absorbers would reduce reactivity at the top of the core and overwhelm this increase. However, in the specific sequence of April 26, 1986, because of the double-peaked axial flux profile resulting from the xenon transient, this was not the case. The converse happened: entry of the control rods initially produced either a neutral or even a slight increase in re­activity—’’positive scram.”

4. Design of containment. This was inadequate to cope with this extreme acci­dent. The RBMK reactors do not have a common containment to cover both the reactor and primary circuit.

These unfavorable features, either individually or in combination, are inconsis­tent with Western safety design principles and would not have been licensed or built in the West.

Operator Violations. Clearly the operators had violated a number of operat­ing regulations vital for the safe operation of the plant, but these only magnified the design shortcomings, particularly at low power. The most serious violations have been highlighted earlier.

It is appropriate to ask why the operators seemed prepared to violate so many operating rules. The explanation seems to be that no serious consideration had been given to the safety aspects of the experiment. The Soviet Government Com­mission report states: “Because the question of safety in these experiments had not received the necessary attention, the staff involved were not adequately pre­pared for the tests and were not aware of the dangers." It seems the experiment was regarded as simply another electrical test. At the same time, operators report­edly felt they were under extreme pressure to complete the planned experiment that night since they knew it could be a full year before they had another chance. Other factors could also have influenced the operators to cut corners: The Cher­nobyl station was “top of the league" for availability, the experiment was delayed (by grid control) and came at the end of a working week early in the morning, and it was the eve of the May Day holiday.

Institutional and Organizational Shortcomings. In addition, shortfalls in managing the safe operation of the power plant were a major contributory cause, and a number of local and central government staff were removed from their positions and convicted of negligence. A separate Ministry of Nuclear En­ergy was set up alongside the Ministry of Power and Electrification. Professor Legasov, head of the Soviet delegation to the August 1986 IAEA Conference, in his memoirs (he died on April 27, 1988, the second anniversary of the accident) noted the many instances when expediency overcame quality—poor con­struction, defects in design and manufacture not rectified, etc. Most of all he was critical of the management of safety in the Soviet Union. “The level of preparation of serious documents for a nuclear power plant was such that someone could cross out something and the operator could interpret, correctly or incorrectly, what was crossed out and perform arbitrary operations.” This has been described succinctly as a lack of a safety culture.

1he Remedies. Russia and Ukraine have now implemented a number of measures to improve the safety characteristics of the RBMK reactors, but the measures also produce some increases in unit generating costs.

1. The control rod positional set points have also been reset so that all the con­trol rods “dip" into the core at least 1.2 m, with the physical capability to pre­vent their being withdrawn outside that limit. At the same time the positive scram effect has been eliminated by lowering the rods 0.7 m-1. 2 m.

2. The minimum number of control rods in the reactor at any one time has been doubled to 7(^$0. This limits the influence of the positive void coefficient and ensures a less rapid reactivity insertion.

3. As a longer-term measure the void coefficient has been significantly reduced so that the reactor cannot become prompt-critical. This has been done by in­creasing the number of fixed absorbers in the core. To compensate for the associated loss of activity, the fuel enrichment has been increased from 2% to

2.4% U-235.

4. Additional instrumentation has been provided to measure subcooling at the inlet to the main circulating pumps.

5. An additional independent “fast” shutdown system with an insertion time of 1-2 seconds has been introduced. The reactor will be automatically tripped without operator intervention if the reactivity margin for control reduces below a preset level.

In addition, wide-ranging improvements in technical management and operator training have been implemented at Chernobyl and the other RBMK reactors.

Given that no accident of such magnitude had previously happened to any nuclear power plant in the world, the coordination and response of the many Soviet recovery services appear to have been exemplary. However, the re­source and monetary cost to the Soviet economy is impossible to estimate—it must be at least one order of magnitude greater than the $1 billion for TMI-2.