CHERNOBYL

DISASTER
Location
The Chernobyl disaster was a nuclear reactor accident in the Chernobyl
nuclear power plant in the Soviet Union. It was the worst nuclear power plant
accident in history and the only instance so far of level 7 on the International
nuclear event scale.

The Process and the Plant

The Chernobyl nuclear power station is situated in a region which at the time
was relatively sparsely populated. There were some 1,35, 000 people within a 30
km radius. Of these 49,000 lived in Pripyat to the west of the plant's 3 km safety
zone and 12,500 in Chernobyl 15 km to the south-east of the plant. There were four
nuclear reactors on the site. The first pair had been built in the period 1970-77 and
the second pair was completed in 1983.

Unit 4 at Chernobyl was designed to supply steam to two turbines each with
an output of 500 MWe. The reactor was therefore rated at 1000 MWe or 3200 MWt.
The reactor is a boiling water pressure tube, graphite moderated reactor. The
reactor is cooled by boiling water, but the water does not double as the moderator,
which is graphite. The design of the reactor avoided the use of a large pressure
vessel. Instead, use was made of much smaller individual pressurized fuel channels.
The reactor contained 192 te of uranium enriched to 2%. The subdivision of the
uranium into a large number of separately cooled fuel channels greatly reduced the
risk of total core meltdown.

The reactor was cooled by water passing through the pressure tubes. The
water was heated to boiling point and partially vaporized. The steam-water mixture
with a mass steam quality of 14% passed to two separators where steam was
flashed off and sent to the turbines, while water was mixed with the steam
condensate and fed through down comers to pumps which pumped it back to the
reactor. There were two separate loops each with four pumps, three operating and
one standby. This system constituted the multiple forced circulation circuit (MFCC).
The moderator used was graphite. The reactor contained a stack of 2488 graphite
blocks with a total mass of 1700 te. An emergency core cooling system (ECCS) was
provided to remove residual heat from the core in the event of loss of coolant from
the MFCC. The reactor was provided with a control and protection system (CPS).
The control system incorporated a control computer. There was a control system
which controlled the power output of the reactor by moving the control rods in and
out. Reactor shut down was effected by the insertion of control rods and conditions
which would trigger shut down included loss of steam to the turbines and loss of
level in the separators.

The reactor was housed in a containment built to withstand a pressure of 0.45

MPa. There was a 'bubble-condenser designed to condense steam entering the
containment from relief valves or from rupture of the MFCC. An important operating
feature of the reactor was its reactivity margin, or excess reactivity. Below a certain
power level the reaction would be insufficient to avoid xenon poisoning. It was
therefore necessary to operate with a certain excess reactivity. This reactivity could
be expressed in terms of the number of CPS control rods which would need to be
inserted to counter it. The operating instructions stated that a certain excess
reactivity was to be maintained; the equivalent number of control rods was 30.
Another important operating characteristic was the reactor's 'positive void
coefficient*. An increase in heat from the fuel elements would cause increased
vaporization of water in the fuel channels and this in turn would cause increased
reaction and heat output. There was therefore an inherent instability, a positive
feedback, which could be controlled only by manipulation of the control rods.
Control of the reactor at normal power output presented little problem, but this
feature made the reactor highly sensitive at low outputs.

Events Prior to the Release

The origin of the accident was the decision to carry out a test on the reactor.
Electrical power for the water pumps and other auxiliary equipment on the reactor
was supplied by the grid with diesel generators as back-up. However, in an
emergency there would be a delay of about a minute before power became
available from these generators. The objective of the test was to determine
whether during this period the turbine could be used as it ran down to provide
emergency power to the reactor. A test had already been carried out without
success, so modifications had been made to the system, and the fresh test was to
check whether these had had the desired effect. A programme for the test was
drawn up. It included provision to switch off the ECCS during the test, apparently to
prevent its being triggered during the test.

At 1.00 on 25 April the reduction of power began. At 13.05 Turbogenerator 7

was switched off the reactor. At 14.00 the ECCS was disconnected. However, a
request was received to delay shutting down since the power output was needed. It
was not until 23.10 that power reduction was resumed. At some stage the trip
causing reactor shut down on loss of steam to Turbogenerator 8 was disarmed,
apparently so that if the test did not work the first time, it could be repeated. This
action was not in the experimental programme. The test programme specified that
rundown of the turbine and provision of unit power requirements was to be carried
out at a power output of 700-1000 MWt, or 20% of rated output. The operator
switched off the local automatic control, but was unable to eliminate the resultant
imbalance in the measurement function of the overall automatic controls and had
difficulty in controlling the power output, which fell to 30 MWt. Only at 1.00 on 26
April was the reactor stabilized at 200 MWt, or 6% of rated output. Meanwhile the
excess reactivity available had been reduced as a result of xenon poisoning. It was
nevertheless decided to continue with the test. At 1.03 the fourth, standby pump in
one of the loops of the MFCC was switched on and at 1.07 the standby pumps in
the other loop.
The Release - 1
With the reactor operating at low power, the hydraulic resistance of the core
was less and this combined with the use of additional pumps resulted in a high flow
of water through the core. This condition was forbidden by the operating
instructions, because of the danger of cavitation and vibration. The steam pressure
and water level in the separators fell and other process parameters changed. The
reactivity continued to fall and at 1.22.30 the operator saw from a printout of the
reactivity evaluation program that the available excess reactivity had fallen below a
level requiring immediate reactor shut down. Despite this the test was continued.
At 1.23.04 the emergency valves on Turbo generator 8 were closed. The reactor
continued to operate at about 200 MWt, but the power soon began to rise. At
1.23.40 the unit shift foreman gave the order to press the scram button. The rods
went down into the core, but within a few seconds shocks were felt and the
operator saw that the rods had not gone fully in. He cut off the current to the servo
drives to allow the rods to fall in under their own weight.

Within four seconds, by 1.23.44, the reactor power had risen, according to
Soviet estimates, to 100 times the nominal value. At about 1.24, according to
observers outside Unit 4, there were two explosions, the second within some 3
seconds of the first, and debris and sparks shot into the air above the reactor.

It is thought that the fuel fragmented, causing a rapid rise in steam pressure
as the water quenched the fuel elements, so that there was extensive failure of the
pressure tubes. The explosive release of steam lifted the reactor top shield,
exposing the core. Conditions were created for reaction between the zirconium and
steam, producing hydrogen. An explosion, involving hydrogen, occurred in and
ruptured the containment building, and ejecting the debris and sparks were seen.
Some 30 fires broke out. The accident was aggravated by the fact that the 200 te
loading crane fell onto the core and caused further bursts of the pressure tubes.

The Emergency and the Immediate Aftermath

The fire brigades from Pripyat and Chernobyl set out at 1.30. The fires in the
machine hall over Turbo generator 7 were particularly serious, because they
threatened Unit 3 also. These therefore received priority. By 5.00 the fires in the
machine hall roof and in the reactor roof had been extinguished. However, the
heating up of the core and its exposure to the air caused the graphite to burn. The
residual activity of the radioactive fuel provided another source of heat. The core
therefore became very hot and the site of raging fire. During the next few days the
fire raged and a radioactive plume rose from the reactor. The accident had become
a major disaster. It was necessary to evacuate the population from a 30 km radius
round the plant and deal with the casualties and to take a whole range of measures
to dampen and extinguish the fire, to cover and enclose the core, and to deal with
the radioactivity in the surrounding area. Three evacuation zones were established:
a special zone, a 10 km zone and 30 km zone. A total of 135000 people were
 evacuated.
A decision
had to be
made
whether to
let the fire
burn itself
out or to
smother it.
In view of
the hazard
to the
surrounding
area, the
latter
course was
chosen. A
specialist
team was
assembled
who began
to cover the
damaged
reactor with
compounds
of boron,
dolomite,
sand, chalk
and lead.
Between 27
April and 10
May some
5000 te of
material were dropped on the reactor by helicopter. By May 6 the release of
radioactivity had decreased to a few hundred Ci/d and had ceased to be a major
factor.
At the same time the core temperature was tackled by pumping nitrogen
under pressure from the compressor station into the space beneath the reactor
vault. This reduced the oxygen concentration and the temperature. By 6 May the
temperature rise had been halted and the temperature began to decline.
Meanwhile experts were concerned about the hazard of the large amount of water
directly beneath the reactor. If the core were to come into contact with this water,
there could be massive and explosive vaporization into steam. Engineers went
down through dark passages flooded with radioactive water and succeeded in
opening two large valves to allow the water to drain out. Next an attempt was
made to put a large concrete slab fitted with cooling coils beneath the core to
prevent material from the core contaminating the ground and watercourses
beneath it. Tunneling in the soil at this point was difficult and it was necessary to
resort to freezing the soil using liquid nitrogen. The construction of this concrete
bed was complete by the end of June. Subsequently the reactor was entombed in
concrete.

There was also intense activity to counter the effects of radioactivity in the
surrounding area. 7000 wells were sealed. The water supply to Kiev could no longer
be taken from water near the plant and a new water supply for the city had to be
constructed. A system of dikes was constructed to catch radioactive rain water from
the area around the plant. A system of bore holes and barriers was created to
prevent contamination of water courses. The measures taken were to remove
debris and contaminated equipment, decontaminate roofs and outer surfaces of
buildings, remove a 5-10 cm layer of soil into containers, lay where necessary
concrete or fresh earth on the ground, and coat certain surfaces with film-forming
compounds.

The death toll from Chernobyl cannot be known with certainty, since most
deaths will be excess cancers. Of those on site at the time, two died on site and a
further 29 in hospital over the next few weeks. A further 17 are permanent invalids
and 57 returned to work but with seriously affected capacity. The others on site,
some 200, were affected to varying degrees. There is apparently no detailed
information on the effects on the military and civilian personnel brought in to deal
with the accident. 1240 fatal leukemia cases and 38000 fatal general cancers were
reported in later reports(1990).

Critical Findings in Investigation

The report criticises both the experimental programme and the conduct of
the test. The quality of the programme was poor and the section on safety
measures was drafted in a purely formal way. The report highlights the positive void
coefficient as a problem feature of the reactor design. It lists six violations of the
operating instructions by the operators and gives the motivation for and
consequences of each. The test programme specified that the ECCS should be
disconnected. In addition, the reactor shut down trip based on turbo generator shut
down was disarmed. During the actual test the reactor shut down trip based on
coolant parameters was disarmed. These three actions were all taken to facilitate
the test. The three other violations were the reduction in the reactivity margin, the
switch from local automatic power control to manual control and the switching on of
the standby pumps. The first was connected with attempts to deal with the
poisoning problem and it rendered the protective system ineffective. The second
was an operator error and it made the reactor much more difficult to control. The
third was done to make doubly sure of adequate cooling and it resulted in loss of
level in the separator and the decision to disable the reactor shut down trip based
on coolant parameters. The report also points out that at low power levels the
measurement of power density in the core is less accurate. The report gives an
account of the release from the damaged reactor and of the emergency measures
taken. The report records a number of measures being taken to prevent a
repetition. They include changes to the organization responsible for the reactors
and to the inspection organization and intensification of research on safety aspects.
An important design modification mentioned is the use of uranium fuel enriched to
2.4% rather than 2% in order to try to avoid the positive void coefficient problem.

Repot said the plant was one of the best in the country with good operators
who were so convinced of its safety that they 'had lost all sense of danger.

Table Timetable of events at Chernobyl

A Events prior to initial explosion

25 1.00 Reduction of power started
April 13.05 Turbo generator 7 disconnected
14.00 ECCS disconnected
23.10 Power reduction resumed
26 00.28 Operator switches off local automatic control, but is unable to
April eliminate resultant imbalance in measurement function of the overall
automatic controls Power output falls to 30 MWt
1.00 Reactor stabilized at 200 MWt (6% rated output)
1.03 Standby pump switched on in one loop of MFCC
1.07 Standby pump switched on in other loop of MFCC
befor
1.19
e Trips on low steam pressure and low water level disabled
1.22. Printout confirming fall in excess reactivity
1.23.
30 To begin test, stop valve on steam to Turbo generator 8 closed Trip on
04 closure of both turbo generator steam stop valves disabled
1.23. Scram button pressed to drop control rods
1.23.
40 Operator hears banging noises and sees rods stopping before they
44 reach bottom; disengages servo drives to allow rods to fall under own
weight Rapid increase in power
1.23. First explosion - extensive failure of pressure tubes, explosive release
48 of steam, top lifted off reactor
1.24 Second explosion - explosion within reactor space, possibly involving
hydrogen, pressure increase to several MP, rupture of containment
building Numerous fires
B Events after initial explosion
26 2.54 Fire fighting units from Pripyat and Chernobyl arrive
April 3.34 Most of fires in turbine room roof out
3.54 Fire on reactor building roof out
 5.00 All fires, other than those in core, out Unit 3 shut down
27 1.13 Units 1 and 2 shut down
27
April Start of smothering operation using helicopters
6 May
April Discharge of radioactivity drops to several hundred Ci/h

Some Lessons of Chernobyl

Management of, and safety culture in, major hazard installations
The management of the organization at the Chernobyl plant was clearly
inadequate for the operation of a major hazard installation. The defects highlighted
particularly in the foregoing account are a weak safety culture and overconfidence,
a potentially lethal combination.

Adherence to safety-related instructions closely

At Chernobyl a number of such instructions were violated by the operators. These
violations included disconnecting the ECCS and disabling two sets of trip systems.

Inherently safer design of plants

The Chernobyl reactor had a low degree of inherent safety, due particularly
to the positive temperature coefficient. The reactor did have some features,
however, which might be claimed to be inherently safer. Thus by avoiding the use
of a single large pressure vessel the design eliminated the hazard of catastrophic
rupture of such a vessel and by subdividing the fuel into individually cooled
channels it reduced the risk of total core meltdown. On the other hand in addition
to the sensitivity inherent in the positive temperature coefficient, the design also
involved massive graphite blocks which could burn. Chernobyl thus also illustrates
the fact that inherently safer design does not have a single dimension, but is multi-
dimensional.

Sensitivity and operability of plants

Closely related to inherently safer design is the sensitivity and operability of
plants. The nuclear reactor at Chernobyl had a regime, that of low excess reactivity,
at which it was close to instability and difficult to control. This is an undesirable
characteristic in any plant. This fact is recognized in the recommendation made
that the uranium fuel enrichment be increased to 2.4%.

Disarming of protective systems

The disarming of protective systems is a permissible practice in certain cases,
but these need to be well defined and there must be proper procedures for doing.

Planning and conduct of experimental work on plants

When work is to be done on a plant, whether engineering work or
experimental testing, it is necessary, particularly if the work involves modification
to safety-related features such as the disarming of trips, to review the potential
hazards and to have specific authorized arrangements for the safe operation of the
plant. Once the test is under way, unauthorized modifications should not be made
to the equipment or to the test procedure itself which have potential safety
implications.

Accidents involving human error and their assessment

The Chernobyl disaster was caused by a series of actions by the operators of
the plant. It appears to be a case of human error which is virtually impossible to
foresee and prevent. No doubt the probability of any one of the events would have
been assessed as low and that of their combination is virtually incredible. But there
was a common factor, namely the determination to carry out the test. There is a
need for the development of techniques, both for design and for hazard assessment
of plant, for identifying potentially hazardous operator intervention sequences.

Emergency planning for large accidents

The scale of the accident at Chernobyl was such that the resources required
to deal with the emergency exceeded those available locally. In the event, the
authorities responded by mobilizing resources on a military scale. Large numbers of
military and civilian personnel were drafted in to work on the reactor itself, on
evacuation and on decontamination. The evacuation on 27 April required some
1000 buses.