Chernobyl - Sequence of Events

The Chernobyl Power Complex, lying about 130 km north of Kiev, Ukraine, and about 20 km south of the border with Belarus, consisted of four nuclear reactors of the RBMK-1000 design, Units 1 and 2 being constructed between 1970 and 1977, while Units 3 and 4 of the same design were completed in 1983. Two more RBMK reactors were under construction at the site at the time of the accident.

To the South-east of the plant, an artificial lake of some 22 square kilometres, situated beside the river Pripyat, a tributary of the Dniepr, was constructed to provide cooling water for the reactors.

This area of Ukraine is described as Belarussian-type woodland with a low population density. About 3 km away from the reactor, in the new city, Pripyat, there were 49 000 inhabitants. The old town of Chernobyl, which had a population of 12 500, is about 15 km to the South-east of the complex. Within a 30-km radius of the power plant, the total population was between 115 000 and 135 000.

The RBMK-1000 is a Soviet designed and built graphite moderated pressure tube type reactor, using slightly enriched (2% U-235) uranium dioxide fuel. It is a boiling light water reactor, with direct steam feed to the turbines, without an intervening heat-exchanger. Water pumped to the bottom of the fuel channels boils as it progresses up the pressure tubes, producing steam which feeds two 500 MWe [megawatt electrical] turbines. The water acts as a coolant and also provides the steam used to drive the turbines. The vertical pressure tubes contain the zirconium-alloy clad uranium-dioxide fuel around which the cooling water flows. A specially designed refuelling machine allows fuel bundles to be changed without shutting down the reactor.

The moderator, whose function is to slow down neutrons to make them more efficient in producing fission in the fuel, is constructed of graphite. A mixture of nitrogen and helium is circulated between the graphite blocks largely to prevent oxidation of the graphite and to improve the transmission of the heat produced by neutron interactions in the graphite, from the moderator to the fuel channel. The core itself is about 7 m high and about 12 m in diameter. There are four main coolant circulating pumps, one of which is always on standby. The reactivity or power of the reactor is controlled by raising or lowering 211 control rods, which, when lowered, absorb neutrons and reduce the fission rate. The power output of this reactor is 3 200 MWt (megawatt thermal) or 1 000 MWe, although there is a larger version producing 1 500 MWe. Various safety systems, such as an emergency core cooling system and the requirement for an absolute minimal insertion of 30 control rods, were incorporated into the reactor design and operation.

The most important characteristic of the RBMK reactor is that it possesses a "positive void coefficient". This means that if the power increases or the flow of water decreases, there is increased steam production in the fuel channels, so that the neutrons that would have been absorbed by the denser water will now produce increased fission in the fuel. However, as the power increases, so does the temperature of the fuel, and this has the effect of reducing the neutron flux (negative fuel coefficient). The net effect of these two opposing characteristics varies with the power level. At the high power level of normal operation, the temperature effect predominates, so that power excursions leading to excessive overheating of the fuel do not occur. However, at a lower power output of less than 20% the maximum, the positive void coefficient effect is dominant and the reactor becomes unstable and prone to sudden power surges. This was a major factor in the development of the accident.

Events leading to the accident

The Unit 4 reactor was to be shutdown for routine maintenance on 25 April 1986. It was decided to take advantage of this shutdown to determine whether, in the event of a loss of station power, the slowing turbine could provide enough electrical power to operate the emergency equipment and the core cooling water circulating pumps, until the diesel emergency power supply became operative. The aim of this test was to determine whether cooling of the core could continue to be ensured in the event of a loss of power.

This type of test had been run during a previous shut-down period, but the results had been inconclusive, so it was decided to repeat it. Unfortunately, this test, which was considered essentially to concern the non-nuclear part of the power plant, was carried out without a proper exchange of information and co-ordination between the team in charge of the test and the personnel in charge of the operation and safety of the nuclear reactor. Therefore, inadequate safety precautions were included in the test programme and the operating personnel were not alerted to the nuclear safety implications of the electrical test and its potential danger.

The planned programme called for shutting off the reactor's emergency core cooling system (ECCS), which provides water for cooling the core in an emergency. Although subsequent events were not greatly affected by this, the exclusion of this system for the whole duration of the test reflected a lax attitude towards the implementation of safety procedures.

As the shutdown proceeded, the reactor was operating at about half power when the electrical load dispatcher refused to allow further shutdown, as the power was needed for the grid. In accordance with the planned test programme, about an hour later the ECCS was switched off while the reactor continued to operate at half power. It was not until about 23:00 hr on 25 April that the grid controller agreed to a further reduction in power.

For this test, the reactor should have been stabilised at about 1 000 MWt prior to shut down, but due to operational error the power fell to about 30 MWt, where the positive void coefficient became dominant. The operators then tried to raise the power to 700-1 000 MWt by switching off the automatic regulators and freeing all the control rods manually. It was only at about 01:00 hr on 26 April that the reactor was stabilised at about 200 MWt.

Although there was a standard operating order that a minimum of 30 control rods was necessary to retain reactor control, in the test only 6-8 control rods were actually used. Many of the control rods were withdrawn to compensate for the build up of xenon which acted as an absorber of neutrons and reduced power. This meant that if there were a power surge, about 20 seconds would be required to lower the control rods and shut the reactor down. In spite of this, it was decided to continue the test programme.

There was an increase in coolant flow and a resulting drop in steam pressure. The automatic trip which would have shut down the reactor when the steam pressure was low, had been circumvented. In order to maintain power the operators had to withdraw nearly all the remaining control rods. The reactor became very unstable and the operators had to make adjustments every few seconds trying to maintain constant power.

At about this time, the operators reduced the flow of feedwater, presumably to maintain the steam pressure. Simultaneously, the pumps that were powered by the slowing turbine were providing less cooling water to the reactor. The loss of cooling water exaggerated the unstable condition of the reactor by increasing steam production in the cooling channels (positive void coefficient), and the operators could not prevent an overwhelming power surge, estimated to be 100 times the nominal power output.

The sudden increase in heat production ruptured part of the fuel and small hot fuel particles, reacting with water, caused a steam explosion, which destroyed the reactor core. A second explosion added to the destruction two to three seconds later. While it is not known for certain what caused the explosions, it is postulated that the first was a steam/hot fuel explosion, and that hydrogen may have played a role in the second.

Some media had reported a seismic origin of the accident, however the scientific credibility of the paper at the origin of this rumour has been discarded.

The accident

The accident occurred at 01:23 hr on Saturday, 26 April 1986, when the two explosions destroyed the core of Unit 4 and the roof of the reactor building.

In the IAEA Post-Accident Assessment Meeting in August 1986, much was made of the operators' responsibility for the accident, and not much emphasis was placed on the design faults of the reactor. Later assessments suggest that the event was due to a combination of the two, with a little more emphasis on the design deficiencies and a little less on the operator actions.

The two explosions sent fuel, core components and structural items and produced a shower of hot and highly radioactive debris, including fuel, core components, structural items and graphite into the air and exposed the destroyed core to the atmosphere. The plume of smoke, radioactive fission products and debris from the core and the building rose up to about 1 km into the air. The heavier debris in the plume was deposited close to the site, but lighter components, including fission products and virtually all of the noble gas inventory were blown by the prevailing wind to the North-west of the plant.

Fires started in what remained of the Unit 4 building, giving rise to clouds of steam and dust, and fires also broke out on the adjacent turbine hall roof and in various stores of diesel fuel and inflammable materials. Over 100 fire-fighters from the site and called in from Pripyat were needed, and it was this group that received the highest radiation exposures and suffered the greatest losses in personnel. A first group of 14 firemen arrived on the scene of the accident at 1.28 a.m. Reinforcements were brought in until about 4 a.m., when 250 firemen were available and 69 firemen participated in fire control activities. By 2.10 a.m., the largest fires on the roof of the machine hall had been put out, while by 2.30 a.m., the largest fires on the roof of the reactor hall were under control. These fires were put out by 05:00 hr of the same day, but by then the graphite fire had started. Many firemen added to their considerable doses by staying on call on site. The intense graphite fire was responsible for the dispersion of radionuclides and fission fragments high into the atmosphere. The emissions continued for about twenty days, but were much lower after the tenth day when the graphite fire was finally extinguished.

The graphite fire

While the conventional fires at the site posed no special firefighting problems, very high radiation doses were incurred by the firemen, resulting in 31 deaths. However, the graphite moderator fire was a special problem. Very little national or international expertise on fighting graphite fires existed, and there was a very real fear that any attempt to put it out might well result in further dispersion of radionuclides, perhaps by steam production, or it might even provoke a criticality excursion in the nuclear fuel.

A decision was made to layer the graphite fire with large amounts of different materials, each one designed to combat a different feature of the fire and the radioactive release. The first measures taken to control fire and the radionuclides releases consisted of dumping neutron-absorbing compounds and fire-control material into the crater that resulted from the destruction of the reactor. The total amount of materials dumped on the reactor was about 5000t including about 40t of borons compounds, 2400t of lead, 1800t of sand and clay, and 600t of dolomite, as well as sodium phosphate and polymer liquids (Bu93). About 150 t of material were dumped on 27 April, followed by 300t on 28 April, 750t on 29 April, 1 500t on 30 April, 1900t on 1 May and 400t on 2 May. About 1800 helicopter flights were carried out to dump materials onto the reactor.

During the first flights, the helicopter remained stationary over the reactor while dumping materials. As the dose rates received by the helicopter pilots during this procedure were too high, it was decide that the materials should be dumped while the helicopters travelled over the reactor. This procedure caused additional destruction of the standing structures and spread the contamination. Boron carbide was dumped in large quantities from helicopters to act as a neutron absorber and prevent any renewed chain reaction. Dolomite was also added to act as heat sink and a source of carbon dioxide to smother the fire. Lead was included as a radiation absorber, as well as sand and clay which it was hoped would prevent the release of particulates. While it was later discovered that many of these compounds were not actually dropped on the target, they may have acted as thermal insulators and precipitated an increase in the temperature of the damaged core leading to a further release of radionuclides a week later.

The further sequence of events is still speculative, although elucidated with the observation of residual damage to the reactor. It is suggested that the melted core materials settled to the bottom of the core shaft, with the fuel forming a metallic layer below the graphite. The graphite layer had a filtering effect on the release of volatile compounds. But after burning without the filtering effect of an upper graphite layer, the release of volatile fissions products from the fuel may have increased, except for non-volatile fission products and actinides, because of reduced particulate emission. On day 8 after the accident, the corium melted through the lower biological shield and flowed onto the floor. This redistribution of corium would have enhanced the radionuclide releases, and on contact with water corium produced steam, causing an increase of radionuclieds at the last stage of the active period.

By May 9, the graphite fire had been extinguished, and work began on a massive reinforced concrete slab with a built-in cooling system beneath the reactor. This involved digging a tunnel from underneath Unit 3. About four hundred people worked on this tunnel which was completed in 15 days,allowing the installation of the concrete slab. This slab would not only be of use to cool the core if necessary, it would also act as a barrier to prevent penetration of melted radioactive material into the groundwater.

In summary

The Chernobyl accident was the product of a lack of "safety culture". The reactor design was poor from the point of view of safety and unforgiving for the operators, both of which provoked a dangerous operating state. The operators were not informed of this and were not aware that the test performed could have brought the reactor into an explosive condition. In addition, they did not comply with established operational procedures. The combination of these factors provoked a nuclear accident of maximum severity in which the reactor was totally destroyed within a few seconds.

Return to Main Paper,  

World Nuclear Association, Carlton House, 22a St James's Square, London, SW1Y 4JH, UK.

 Email : wna@world-nuclear.org