THE SITE AND ACCIDENT SEQUENCE
At the time of the Chernobyl accident, on 26 April 1986, the
Soviet Nuclear Power Programme was based mainly upon two types
of reactors, the WWER, a pressurised light-water reactor, and
the RBMK, a graphite moderated light-water reactor. While the
WWER type of reactor was exported to other countries, the RBMK
design was restricted to republics within the Soviet Union.
The Chernobyl Power Complex, lying about 130 km north of Kiev,
Ukraine (Figure 1), consisted of four nuclear reactors of the
RBMK-1000 design, Units 1 and 2 being constructed between 1970
and 1977, while Units 3 and 4 of the same design were completed
in 1983 (IA86). Two more RBMK reactors were under construction
at the site at the time of the accident.
Figure 1. The site of the Chernobyl nuclear power complex (modif. from
To the South-east of the plant, an artificial lake of some 22
km2, situated beside the river Pripyat, a tributary of the Dniepr,
was constructed to provide cooling water for the reactors.
This area of Ukraine is described as Belarussian-type woodland
with a low population density. About 3 km away from the reactor,
in Pripyat, there were 49,000 inhabitants. The town of Chernobyl,
which had a population of 12,500, is about 15 km to the South-east
of the complex. Within a 30-km radius of the power plant, the
total population was between 115,000 and 135,000.
The RBMK-1000 reactor
The RBMK-1000 (Figure 2) is a Soviet designed and built graphite
moderated pressure tube type reactor, using slightly enriched
(2 per cent uranium-235) uranium dioxide fuel. It is a boiling
light water reactor, with
Figure 2. The RBMK reactor
direct steam feed to the turbines, without an intervening heat-exchanger.
Water pumped to the bottom of the fuel channels boils as it progresses
up the pressure tubes, producing steam which feeds two 500-MW(e)
[megawatt electrical] turbines. The water acts as a coolant and
also provides the steam used to drive the turbines. The vertical
pressure tubes contain the zirconium-alloy clad uranium-dioxide
fuel around which the cooling water flows. A specially designed
refuelling machine allows fuel bundles to be changed without shutting
down the reactor.
The moderator, whose function is to slow down neutrons to make
them more efficient in producing fission in the fuel, is constructed
of graphite. A mixture of nitrogen and helium is circulated between
the graphite blocks largely to prevent oxidation of the graphite
and to improve the transmission of the heat produced by neutron
interactions in the graphite, from the moderator to the fuel channel.
The core itself is about 7 m high and about 12 m in diameter.
There are four main coolant circulating pumps, one of which is
always on standby. The reactivity or power of the reactor is controlled
by raising or lowering 211 control rods, which, when lowered,
absorb neutrons and reduce the fission rate. The power output
of this reactor is 3,200 MW(t) [megawatt thermal] or 1,000 MW(e),
although there is a larger version producing 1,500 MW(e). Various
safety systems, such as an emergency core cooling system and the
requirement for an absolute minimal insertion of 30 control rods,
were incorporated into the reactor design and operation.
The most important characteristic of the RBMK reactor is that
it possesses a "positive void coefficient". This means
that if the power increases or the flow of water decreases, there
is increased steam production in the fuel channels, so that the
neutrons that would have been absorbed by the denser water will
now produce increased fission in the fuel. However, as the power
increases, so does the temperature of the fuel, and this has the
effect of reducing the neutron flux (negative fuel coefficient).
The net effect of these two opposing characteristics varies with
the power level. At the high power level of normal operation,
the temperature effect predominates, so that power excursions
leading to excessive overheating of the fuel do not occur. However,
at a lower power output of less than 20 per cent of the maximum,
the positive void coefficient effect is dominant and the reactor
becomes unstable and prone to sudden power surges. This was a
major factor in the development of the accident.
Events leading to the accident (IA86, IA86a)
The Unit 4 reactor was to be shutdown for routine maintenance
on 25 April 1986. It was decided to take advantage of this shutdown
to determine whether, in the event of a loss of station power,
the slowing turbine could provide enough electrical power to operate
the emergency equipment and the core cooling water circulating
pumps, until the diesel emergency power supply became operative.
The aim of this test was to determine whether cooling of the core
could continue to be ensured in the event of a loss of power.
This type of test had been run during a previous shut-down period,
but the results had been inconclusive, so it was decided to repeat
it. Unfortunately, this test, which was considered essentially
to concern the non-nuclear part of the power plant, was carried
out without a proper exchange of information and co-ordination
between the team in charge of the test and the personnel in charge
of the operation and safety of the nuclear reactor. Therefore,
inadequate safety precautions were included in the test programme
and the operating personnel were not alerted to the nuclear safety
implications of the electrical test and its potential danger.
The planned programme called for shutting off the reactor's emergency
core cooling system (ECCS), which provides water for cooling the
core in an emergency. Although subsequent events were not greatly
affected by this, the exclusion of this system for the whole duration
of the test reflected a lax attitude towards the implementation
of safety procedures.
As the shutdown proceeded, the reactor was operating at about
half power when the electrical load dispatcher refused to allow
further shutdown, as the power was needed for the grid. In accordance
with the planned test programme, about an hour later the ECCS
was switched off while the reactor continued to operate at half
power. It was not until about 23:00 hr on 25 April that the grid
controller agreed to a further reduction in power.
For this test, the reactor should have been stabilised at about
1,000 MW(t) prior to shut down, but due to operational error the
power fell to about 30 MW(t), where the positive void coefficient
became dominant. The operators then tried to raise the power to
700-1,000 MW(t) by switching off the automatic regulators and
freeing all the control rods manually. It was only at about 01:00
hr on 26 April that the reactor was stabilised at about 200 MW(t).
Although there was a standard operating order that a minimum of
30 control rods was necessary to retain reactor control, in the
test only 6-8 control rods were actually used. Many of the control
rods were withdrawn to compensate for the build up of xenon which
acted as an absorber of neutrons and reduced power. This meant
that if there were a power surge, about
20 seconds would be required to lower the control rods and shut
the reactor down. In spite of this, it was decided to continue
the test programme.
There was an increase in coolant flow and a resulting drop in
steam pressure. The automatic trip which would have shut down
the reactor when the steam pressure was low, had been circumvented.
In order to maintain power the operators had to withdraw nearly
all the remaining control rods. The reactor became very unstable
and the operators had to make adjustments every few seconds trying
to maintain constant power.
At about this time, the operators reduced the flow of feedwater,
presumably to maintain the steam pressure. Simultaneously, the
pumps that were powered by the slowing turbine were providing
less cooling water to the reactor. The loss of cooling water exaggerated
the unstable condition of the reactor by increasing steam production
in the cooling channels (positive void coefficient), and the operators
could not prevent an overwhelming power surge, estimated to be
100 times the nominal power output.
The sudden increase in heat production ruptured part of the fuel
and small hot fuel particles, reacting with water, caused a steam
explosion, which destroyed the reactor core. A second explosion
added to the destruction two to three seconds later. While it
is not known for certain what caused the explosions, it is postulated
that the first was a steam/hot fuel explosion, and that hydrogen
may have played a role in the second.
The accident occurred at 01:23 hr on Saturday, 26 April 1986,
when the two explosions destroyed the core of Unit 4 and the roof
of the reactor building.
In the IAEA Post-Accident Assessment Meeting in August 1986 (IA86),
much was made of the operators' responsibility for the accident,
and not much emphasis was placed on the design faults of the reactor.
Later assessments (IA86a) suggest that the event was due
to a combination of the two, with a little more emphasis on the
design deficiencies and a little less on the operator actions.
The two explosions sent a shower of hot and highly radioactive
debris and graphite into the air and exposed the destroyed core
to the atmosphere. The plume of smoke, radioactive fission products
and debris from the core and the building rose up to about 1 km
into the air. The heavier debris in the plume was deposited close
to the site, but lighter components, including fission products
and virtually all of the noble gas inventory were blown by the
prevailing wind to the North-west of the plant.
Fires started in what remained of the Unit 4 building, giving
rise to clouds of steam and dust, and fires also broke out on
the adjacent turbine hall roof and in various stores of diesel
fuel and inflammable materials. Over 100 fire-fighters from the
site and called in from Pripyat were needed, and it was this group
that received the highest radiation exposures and suffered the
greatest losses in personnel. These fires were put out by 05:00
hr of the same day, but by then the graphite fire had started.
Many firemen added to their considerable doses by staying on call
on site. The intense graphite fire was responsible for the dispersion
of radionuclides and fission fragments high into the atmosphere.
The emissions continued for about twenty days , but were much
lower after the tenth day when the graphite fire was finally extinguished.
The graphite fire
While the conventional fires at the site posed no special firefighting
problems, very high radiation doses were incurred by the firemen.
However, the graphite moderator fire was a special problem. Very
little national or international expertise on fighting graphite
fires existed, and there was a very real fear that any attempt
to put it out might well result in further dispersion of radionuclides,
perhaps by steam production, or it might even provoke a criticality
excursion in the nuclear fuel.
A decision was made to layer the graphite fire with large amounts
of different materials, each one designed to combat a different
feature of the fire and the radioactive release. Boron carbide
was dumped in large quantities from helicopters to act as a neutron
absorber and prevent any renewed chain reaction. Dolomite was
also added to act as heat sink and a source of carbon dioxide
to smother the fire. Lead was included as a radiation absorber,
as well as sand and clay which it was hoped would prevent the
release of particulates. While it was later discovered that many
of these compounds were not actually dropped on the target, they
may have acted as thermal insulators and precipitated an increase
in the temperature of the damaged core leading to a further release
of radionuclides a week later.
By May 9, the graphite fire had been extinguished, and work began
on a massive reinforced concrete slab with a built-in cooling
system beneath the reactor. This involved digging a tunnel from
underneath Unit 3. About four hundred people worked on this tunnel
which was completed in 15 days, allowing the installation of the
concrete slab. This slab would not only be of use to cool the
core if necessary, it would also act as a barrier to prevent penetration
of melted radioactive material into the groundwater.
In summary, the Chernobyl accident was the product of a lack
of "safety culture". The reactor design was poor from
the point of view of safety and unforgiving for the operators,
both of which provoked a dangerous operating state. The operators
were not informed of this and were not aware that the test performed
could have brought the reactor into explosive conditions. In addition,
they did not comply with established operational procedures. The
combination of these factors provoked a nuclear accident of maximum
severity in which the reactor was totally destroyed within a few