Chernobyl

Dr. Rohan Desai, the reactor physicist, leads the Chernobyl session because the accident cannot be understood without reactivity feedback. "Every reactor you will analyse at Darlington has strong negative feedback when the coolant boils," he tells Hana. "Well, almost every reactor. CANDU has a small positive coolant void coefficient, which is why we spend so much effort on shutdown system design. The RBMK at Chernobyl, in the state it was in that night, had a large positive one, and a shutdown system that made things worse in its first seconds. Read INSAG-7 before we start. It is the IAEA's revised account, and it is much fairer to the operators than the first one."

The RBMK reactor

Chernobyl Unit 4, near Pripyat in what was then the Ukrainian Soviet Socialist Republic, was an RBMK-1000, a graphite-moderated, light-water-cooled, channel-type reactor of 3 200 megawatts thermal. The core was a large cylinder of graphite blocks about 12 metres across and 7 metres high, pierced by about 1 660 vertical fuel channels. Ordinary water flowed up through the channels and boiled, and the steam went directly to the turbines. The reactor had no containment building of the kind used in Western light water reactors; parts of the primary system were enclosed in compartments designed for limited pipe breaks.

Because graphite does the moderating, the water in the channels acts mainly as an absorber of neutrons. When the water boils and its density falls, fewer neutrons are absorbed and reactivity rises. This gives a positive void coefficient. In the RBMK, the size of the void coefficient depended strongly on the state of the core: it was most positive at low power, with low enrichment fuel at high burnup and with few control rods inserted. At normal full power, the negative fuel temperature coefficient dominated and the overall power coefficient was negative; at low power it could become positive.

# Point-kinetics toy with void feedback (illustrative only; not RBMK design data).
# One delayed group. A void coefficient alpha_v adds reactivity as power raises voiding.
beta, lam, Lgen = 0.0050, 0.08, 1e-3
def run(alpha_v, rho_ext=0.0005, t_end=20.0, dt=1e-3):
    n, c = 1.0, beta / (lam * Lgen)
    void = 0.0; t = 0.0
    while t < t_end:
        void += (0.3 * (n - 1.0) - void) * dt / 1.0      # void follows power with a 1 s lag
        rho = rho_ext + alpha_v * void
        dn = ((rho - beta) / Lgen * n + lam * c) * dt
        dc = (beta / Lgen * n - lam * c) * dt
        n += dn; c += dc; t += dt
        if n > 100: return t, n
    return t_end, n
for a in (-0.01, 0.0, +0.01):
    t, n = run(a)
    print(f"void coefficient {a:+.2f} per unit void: relative power {n:7.2f} at t = {t:5.2f} s")

void coefficient -0.01 per unit void: relative power    1.12 at t = 20.00 s
void coefficient +0.00 per unit void: relative power    1.32 at t = 20.00 s
void coefficient +0.01 per unit void: relative power  100.06 at t =  6.97 s

The toy model shows why the sign of the feedback matters. With negative void feedback, an increase in boiling reduces power and the plant settles to a new state. With positive feedback, an increase in boiling raises power, which increases boiling further, and once the reactivity exceeds the delayed neutron fraction the reactor becomes prompt critical and power rises in a fraction of a second. Real reactors also have fuel temperature feedback, which is negative in all designs and limits the power excursion, but in the Chernobyl accident it could not act fast enough to prevent the destruction of the core.

The shutdown system design

The RBMK control rods had a further design weakness. Each rod had a graphite displacer attached below its absorber section. When a fully withdrawn rod began to move into the core, the graphite displaced water from the lower part of the channel before the absorber arrived. Since water absorbs neutrons and graphite moderates them, this first motion added reactivity in the lower core. In addition, the rods moved slowly, taking about 18 seconds to insert fully. In most conditions this positive scram effect was small, but in a core with a flattened axial power distribution, few rods inserted and a positive void coefficient, it could be enough to start an excursion. The effect had been seen at the Ignalina plant in 1983 but the information had not been effectively acted on.

The test and the accident

The accident occurred early on 26 April 1986, during a test of whether the turbine generator, coasting down after the steam supply was cut off, could supply enough electricity to run cooling pumps until the diesel generators started. The test had been scheduled during a planned shutdown. It was delayed for many hours at the request of the grid controller, so it was carried out by a night shift that had not prepared for it, with the reactor operating at reduced power for an extended time, which built up xenon poisoning in the core.

When the power was reduced further for the test, it fell much lower than intended, to around 30 megawatts thermal, because of the xenon and control difficulties. The operators withdrew many control rods to raise the power, which reached about 200 megawatts, well below the 700 to 1 000 megawatts intended in the test program. The number of rods remaining in the core was far below the minimum then specified in operating rules, although the importance of this limit was not adequately explained in the documentation. Additional main circulation pumps had been started as part of the test, so the coolant flow was high and the water entering the core was close to boiling. Several automatic trips had been disabled to allow the test to proceed or to be repeated.

At 1:23:04 the test began and the turbine stop valves were closed. As the turbine coasted down, the pumps it supplied slowed, the flow through the core fell, and boiling increased. In this state, with a large positive void coefficient, power began to rise. About 36 seconds after the start of the test, the emergency protection button was pressed and the control rods began to move in. The graphite displacers added reactivity at the bottom of the core, and within seconds the power rose to many times full power. The fuel fragmented, the channels ruptured, and steam explosions lifted the 1 000-tonne upper plate of the reactor and destroyed the building. A second explosion followed seconds later. Hot fragments of fuel and graphite were scattered and started fires on the roofs, and the graphite in the open core burned for days.

INSAG-1 and INSAG-7

The first international account, INSAG-1, published by the International Nuclear Safety Advisory Group in 1986 on the basis of Soviet information presented in Vienna, placed most of the blame on violations of operating procedures by the operators. INSAG-7, published in 1992 after new information became available, revised that view. It concluded that while operator actions contributed, the design deficiencies of the reactor, particularly the positive void coefficient and the control rod design, were major causes, and that some of the actions described as violations were not prohibited by the rules in force or by the documents available to the operators. INSAG-7 also concluded that the accident reflected a deficient safety culture throughout the Soviet nuclear power program, from design and regulation to operation, and the term safety culture, introduced in INSAG-1, became central to the industry.

Consequences

Chernobyl is the most serious accident in the history of nuclear power and is rated level 7, a major accident, on the International Nuclear and Radiological Event Scale. Two plant workers died on the night of the accident, and 28 of the emergency workers and plant staff with acute radiation syndrome died within a few months. Large amounts of iodine-131, caesium-137 and other radionuclides were released over about ten days, contaminating large areas of Ukraine, Belarus and Russia and, at lower levels, much of Europe. About 116 000 people were evacuated in 1986, and later relocations brought the total to more than 300 000.

The most clearly documented long-term health effect is an increase in thyroid cancer among people who were children or adolescents at the time, mainly from drinking milk contaminated with iodine-131 in the first weeks before protective measures were effective. Thousands of cases have been diagnosed, although the great majority were treated successfully. The UN Scientific Committee on the Effects of Atomic Radiation and the Chernobyl Forum have reported that other health effects among the general public are hard to detect against the background of other causes, while psychological and social effects of relocation and uncertainty have been severe. A shelter, often called the sarcophagus, was built over the ruined unit in 1986, and the New Safe Confinement, an arch-shaped structure, was slid over it in 2016.

What changed

Remaining RBMK reactors were modified to reduce the void coefficient, by increasing fuel enrichment, adding fixed absorbers and requiring more control rods to remain in the core, and the control rods and shutdown system were redesigned to insert faster and without the positive scram effect. Internationally, the accident led to new conventions: the Convention on Early Notification of a Nuclear Accident and the Convention on Assistance in the Case of a Nuclear Accident or Radiological Emergency in 1986, and later the Convention on Nuclear Safety, which entered into force in 1996 and requires periodic peer review of national safety programs. Operators formed the World Association of Nuclear Operators, WANO, in 1989 to share operating experience and conduct peer reviews worldwide.

For CANDU designers, Chernobyl prompted a careful re-examination of the positive coolant void coefficient. CANDU reactors are designed so that the void reactivity is limited and two independent, fast-acting shutdown systems, shutoff rods and liquid poison injection, each able to shut down the reactor alone, act within about two seconds. Large break loss-of-coolant accidents, which produce the fastest voiding, are analysed with both shutdown systems credited separately. Newer designs, such as the Enhanced CANDU 6 and advanced fuel concepts, aim to reduce the void coefficient further.

The emergency response

The response to the accident was carried out under extreme conditions. Firefighters from the plant and from Pripyat climbed onto the roofs of the turbine hall and the adjacent unit to put out fires that threatened unit 3, receiving very high doses. Over the following days, helicopters dropped thousands of tonnes of sand, clay, lead, boron carbide and dolomite onto the ruined reactor in an attempt to smother the burning graphite and reduce releases. Pripyat, a town of about 50 000 people, was evacuated on 27 April, about 36 hours after the accident, and the evacuation of a 30-kilometre zone followed in early May. Hundreds of thousands of workers, often called liquidators, took part in the cleanup over the following years.

The delay in informing the public, both in the Soviet Union and internationally, was itself a lesson. The release was first detected abroad by radiation monitors at a nuclear plant in Sweden. The conventions on early notification and assistance that followed were designed so that countries would be informed promptly and could request help.