Safety and major accidents

The last question at the information session was the one Hana had expected from the start: what about Chernobyl and Fukushima? Dr. Brennan's view is that the accidents must be explained plainly, because they shaped every reactor built since, including the one planned for Clinch River. This lesson describes how reactor safety is organized, why decay heat is the central safety problem, what happened in the three best-known accidents and what the industry changed as a result.

The safety problem

The fundamental safety objective is to protect people and the environment from the harmful effects of radiation. For a reactor, that means three safety functions must be kept at all times: control the reactivity, so the chain reaction can always be stopped; cool the fuel, including after shutdown; and contain the radioactive material. Lesson 5 showed that shutdown is quick and reliable. Cooling is harder, because the fission products keep producing heat. If that heat is not removed, the fuel overheats, the cladding fails and, eventually, the fuel can melt and release radioactive material into the reactor vessel and containment.

Decay heat

Lesson 4 showed that about 7 percent of fission energy comes from the decay of fission products. When the chain reaction stops, that heat continues, falling over time as the short-lived products decay away. The Way-Wigner approximation, a simple formula fitted to the sum of many decay chains, estimates decay heat as a fraction of the previous power from the time since shutdown and the time the reactor operated.

Here \(t\) is the time since shutdown and \(T\) the operating time, both in seconds. More accurate standards sum the contributions of hundreds of nuclides, but this formula is good to within tens of percent and shows the shape: decay heat falls quickly at first and then slowly. The program applies it to the reference plant.

# Decay heat after shutdown (Way-Wigner approximation) for a reactor that
# ran at 870 MW of heat for two years, and the water it could boil away.
P0 = 870.0                    # MW thermal before shutdown
T_op = 2 * 365 * 86400        # seconds of operation
def decay_heat(t):
    """Decay heat in MW, t seconds after shutdown."""
    return P0 * 0.0622 * (t ** -0.2 - (t + T_op) ** -0.2)
for label, t in (("1 second", 1), ("1 minute", 60), ("1 hour", 3600), ("1 day", 86400),
                 ("1 week", 7 * 86400), ("3 months", 90 * 86400), ("1 year", 365 * 86400)):
    p = decay_heat(t)
    print(f"{label:>9}: {p:7.2f} MW ({p/P0:.2%} of full power)")

# Water boiled off per hour if no heat is removed one day after shutdown
h_fg = 2.26e6                  # J/kg to turn water at 100 C into steam
boil = decay_heat(86400) * 1e6 * 3600 / h_fg / 1000
print(f"\nWater boiled per hour at one day: about {boil:.0f} t")

 1 second:   52.62 MW (6.05% of full power)
 1 minute:   22.37 MW (2.57% of full power)
   1 hour:    9.03 MW (1.04% of full power)
    1 day:    4.08 MW (0.47% of full power)
   1 week:    2.29 MW (0.26% of full power)
 3 months:    0.81 MW (0.09% of full power)
   1 year:    0.34 MW (0.04% of full power)

Water boiled per hour at one day: about 7 t

One day after shutdown, the reference plant still produces about 4 MW of heat, enough to boil away about 7 metric tons of water an hour if nothing removes it. That is why all reactors have several independent ways to cool the core after shutdown, and why the loss of all of them is the scenario that safety analysis takes most seriously. A week later the heat is about half as much again; a year later it is a few hundred kilowatts, which is why used fuel pools still need cooling for years.

Defense in depth

Reactor safety is organized on the principle of defense in depth: several independent layers of protection, so that if one fails, the next is there. The International Atomic Energy Agency describes five levels. The first prevents abnormal operation through conservative design, quality construction and well-trained staff. The second detects and controls failures through alarms and control systems. The third controls design-basis accidents, such as a pipe break, with automatic shutdown and emergency core cooling. The fourth limits the consequences of severe accidents, in which fuel is damaged, with containment, hydrogen control and filtered venting. The fifth protects the public off site through emergency planning.

Alongside the levels are physical barriers: the ceramic fuel pellet, which retains most fission products; the cladding; the reactor coolant system boundary; and the containment building. Safety systems follow design principles that make them robust: redundancy, with more systems than needed; diversity, with systems that work in different ways so a single cause cannot disable them all; physical separation; and fail-safe behavior, so a loss of power or signal moves the system to its safe state. Engineers analyze what could go wrong both deterministically, by checking that the plant copes with a defined set of accidents, and probabilistically, by estimating the likelihood of every sequence that could damage the core.

Three Mile Island, 1979

At Three Mile Island Unit 2, a PWR in Pennsylvania, a feedwater problem tripped the turbine and the reactor shut down as designed. A relief valve on the pressurizer opened to relieve pressure and then stuck open, while an indicator in the control room suggested that it had closed. Coolant escaped for over two hours. Operators, misled by the instrument and by a rising pressurizer level, reduced the emergency cooling flow. About half the core melted. The containment held, and the release of radioactive material was small; studies found the average dose to people nearby was about 0.01 mSv, far below a year of natural background.

The accident had no measurable health effects, but it ended the first wave of reactor construction in the United States and changed the industry. Control rooms were redesigned around the needs of operators; training moved to full-scale simulators; the industry created the Institute of Nuclear Power Operations to share operating experience and set standards of excellence; and regulators required plants to analyze and prepare for accidents beyond the design basis.

Chernobyl, 1986

At Chernobyl Unit 4 in Ukraine, then part of the Soviet Union, operators were running a test of whether the turbine could power cooling pumps during a loss of electricity. The RBMK reactor was graphite moderated and cooled by water boiling in pressure tubes, and at low power it had a strongly positive void coefficient: when the water turned to steam, reactivity rose. Several safety systems had been disabled for the test, and the reactor had been run in an unstable condition at low power. When the test began, coolant flow fell, steam formed, power rose, and more steam formed. An attempt to shut down added reactivity at first because of the design of the control rod tips. Power surged to many times its rated value within seconds, and steam explosions destroyed the reactor and its building, which had no containment of the Western kind. The exposed graphite burned for days.

The accident released a large fraction of the core's volatile radioactive material, mainly iodine-131 and cesium-137, across Europe. Two workers died in the explosions and 28 firefighters and workers died of acute radiation syndrome within months. Over 6000 cases of thyroid cancer were later diagnosed among people who were children at the time, largely from drinking milk contaminated with iodine-131 before protective measures were taken; most were treated successfully, and about fifteen were fatal by 2005. A zone of about 30 km around the plant remains restricted. The accident is rated level 7, the highest on the International Nuclear and Radiological Event Scale.

The lessons were sweeping. Remaining RBMK reactors were modified to remove the positive void effect, change the control rods and add independent shutdown capacity, and most have since closed. The World Association of Nuclear Operators was founded to share experience internationally. Safety culture, an organizational commitment to put safety first and to question unsafe practices, became a central concept in the industry. As Lesson 5 noted, licensing now requires negative feedback.

Fukushima Daiichi, 2011

On 11 March 2011, a magnitude 9.0 earthquake off the coast of Japan caused all the operating reactors at the Fukushima Daiichi plant to shut down automatically, as designed. The earthquake cut off-site power, and emergency diesel generators started. About 50 minutes later, a tsunami roughly 14 meters high, far above the plant's seawall, flooded the site, disabling the generators, the electrical switchgear and the seawater pumps. Units 1, 2 and 3 lost all ability to cool their cores. Over the next three days, decay heat boiled off the water, the fuel melted, and the reaction of hot zirconium cladding with steam made hydrogen, which leaked into the reactor buildings and exploded in three of them.

Large releases of radioactive material, smaller than at Chernobyl but also rated level 7, contaminated land to the northwest. About 160 000 people were evacuated or left the area. No one died from radiation exposure in the immediate aftermath; one worker's later lung cancer death was attributed to radiation by the Japanese government. The United Nations Scientific Committee on the Effects of Atomic Radiation concluded that future health effects among the public from radiation are unlikely to be discernible. The evacuation itself, carried out in haste, caused many deaths, especially among elderly residents of hospitals and care homes, and long displacement brought great hardship. Decontamination has allowed most of the evacuated area to reopen, though some zones remain closed.

Fukushima was a failure to protect a plant against a natural hazard larger than its design had assumed, and a failure to provide cooling when every power source was lost. Afterward, regulators worldwide, including the NRC, required plants to reassess external hazards, add portable pumps and generators stored where floods and earthquakes cannot reach them, add connections for emergency water, install hydrogen recombiners and filtered containment vents, and improve emergency planning, including the decisions about when evacuation does more good than harm.

Passive safety in new designs

Each accident pushed designers toward safety that depends less on active systems and operator action. New designs, including the small boiling water reactor planned for Clinch River, rely on natural forces: gravity to drain water into the core, natural circulation to move heat, and large water pools that can absorb decay heat for days without pumps or electricity. Lesson 5 described isolation condensers that remove heat by boiling water in a pool above the reactor. The goal is that, if everything electrical fails, the plant will cool itself for at least a week without any human intervention, by which time decay heat is small and help can arrive.

Hana summarizes the lesson for her public session in three sentences. Nuclear plants have had serious accidents, and the industry learned from each one. Most of the harm from the worst accidents came from releases that better design, preparation and decisions could have prevented or reduced. Measured by deaths per unit of electricity, nuclear energy remains among the safest sources, comparable with wind and solar and far safer than fossil fuels, whose air pollution causes millions of premature deaths worldwide each year.