The reasons of the accident were analyzed by organizations and individual experts both in the former USSR and abroad. One can formulate three main reasons set conditions for pre-accident reactor status and its catastrophic power runaway:
- Before the accident the reactor facility was in such physical and thermo-hydraulic state of stability which could be disturbed even by minor excitations. Such state of the reactor was caused by personnel actions and occurred prior to the tests of generator running-out operation. All reactor parameters before start of the tests, except for operating reactivity margin, were within the limits authorized by the process regulations;
- A direct impulse for the accident occurrence was emergency reactor shutdown system activation that due to defective design of control and protection rods led to positive reactivity insertion and start of reactor power excursion;
- This runaway reached disaster proportions because of a large steam coefficient of reactivity peculiar to high power channel-type reactors (RBMK-1000), and impact of which is notably strong at a low level of power (small void fraction).
Thus, the direct causes of the accident became neutron and physical, and design peculiarities of RBMK-1000 reactor implementation of which was promoted by personnel actions. To the main shortcomings of RBMK-1000 reactor in its operation as of 1986 one should relate:
- Low speed efficiency of reactor control and protection system (control and protection rods were inserted into the reactor for 18 seconds, while at reactors of other types it took 2-4 seconds) that did not allow the control and protection system to deal with transient processes;
- Design of control and protection rods which led to the fact that under certain circumstances the emergency protection did not shut down a reactor, but inserted a positive reactivity into the reactor and became an initiator of reactor power excursion;
- Unacceptably high coolant density (steam) reactivity coefficient as a result of which, firstly, at some operations the reactor total coolant density coefficient of reactivity became positive and, secondly, the decrease of coolant density in the reactor, regardless of the reason, led to catastrophic power rise;
- Double-peak throughout the height power density field which together with shortcomings of reactor control and protection system predetermined formation at reactor’s bottom half of quasi-individual reactor core with unacceptably high speed of power rise in case of actuating reactor emergency protection under the condition of low operating reactivity margin.
These particular shortcomings of RBMK-1000 reactor caused the accident at Chornobyl NPP Power Unit No. 4 on April 26, 1986. They were the consequence of the made deviations by reactor’s creators from safety requirements formulated in ITKa 04-74 («Nuclear Safety Rules for Nuclear Power Plants») and 3nB–73 («General Provisions on Safety Assurance of Nuclear Power Plants during Design, Construction and Operation»). Both documents were in force during designing the Chornobyl NPP’s Second Generation.
To all of this one should add that RBMK-1000 reactor and a Design of the Chornobyl NPP on the whole also contained other considerable departures from requirements of normative documents. In particular, the NPP’s Design envisaged the limited accident containment system the sealed circuit of which included only a part of the reactor and systems of its cooling. Also, that is more important, the Design did not envisage control and information devices for an operator regarding the operating reactivity margin, to say nothing about automatic reactor protection under the conditions of deviations of this parameter from the fixed limits. This particular parameter in the event of its decreasing lower than a certain value transformed the emergency protection, which in any circumstances must have shut down the reactor, into the instrument of its power runaway.
Analysis of personnel actions disputes concerning which are still underway revealed that the personnel in fact made some mistakes, but a level of their guilt was consciously overestimated in information provided by the USSR to IAEA in 1986. The accident which in virtue of its scales concerned many countries demolished a myth about impeccability of the soviet nuclear science and engineering. One failed in concealment of the accident scales and consequences. It was necessary to find reasons which would to the least give the low-down on state of affairs and not challenge a quality of the soviet engineering. Thus the slogan «personnel is guilty» appeared. This approach was authorized by the state political leaders.
A critical part in initiating and developing the accident was played by creators of RBMK-1000 reactor, who, having known about its shortcomings, had not informed about this the operating personnel and not instructed them about how they must have acted to prevent their appearances. As a result, the process regulations and instruction on reactor operation specified directions the actions pursuant to which at certain operations could have led to disaster consequences. For example, following the completion of generator running-out tests at night on April 26, 1986, it was strongly forbidden to shut down the reactor by pushing AZ-5 button as it was envisaged by the process regulations on RBMK-1000 reactor operation, but the personnel did not know about this. Unfair practices of RBMK-1000 reactor creators to conceal information on its shortcomings known to them caused inadequate preparation of the personnel for actions during unscheduled situations.
The results of investigation of the organization - Chief Designer of RBMK-1000 reactor, published in 1993, make it possible to stop disputes on technical reasons of the accident. The reactor’s designers showed that nuclear-physical and thermo-hydraulic characteristics, as well as design defects led to destruction of RBMK-1000 reactor even in the event of design-basis accident at low power. Also it was confirmed that solely «implementation of measures, carried out after the accident at the Chornobyl NPP, leads to the fact that at all range of initial power, being under study, a maximum design-basis accident with de-energization does not give rise to a dangerous change of power, and a fast emergency protection shuts down the reactor». Thus, the Chief Designer confirmed that the reactor was doomed by virtue of its design characteristics and only waited for implementing the respective initial conditions. On April 26, 1986, such conditions were created by personnel actions.
Specific details of the accident can be defined more exactly, but the main conclusions will remain the same. The accident was caused by underestimation and disregard to the possible negative effects of the known physical phenomenon. It’s overwhelmingly important with the objective to learn lessons for future to understand what led to the possibility of multi-years operation of the nuclear facility with the shortcomings that caused the disaster, and to realize what one must do in order to prevent an accident in future.
The shortcomings of RBMK-1000 reactors were known long before the accident. And this fact has been confirmed by many documents. There were plans for upgrading such reactor facilities.
However, they either had not been implemented, or were implemented very slowly. For instance, a positive overshoot of reactivity during insertion of control and protection rods into reactor core, been a trigger for the disaster, was experimentally specified and documented in December 1983 during commissioning tests of Ignalina NPP Unit No. 1 and Chornobyl NPP Unit No. 4. This effect and its possible consequences for safety had been considered by the I.V. Kurchatov Atomic Energy Institute (Scientific Manager of RBMK-1000 Design) and Scientific and Research Institute of Energy Technologies (RBMK-1000 Chief Designer) and the results of this discussion had been known to managers of all NPPs with RBMK-1000 reactors and higher organizations.
However, neither the Scientific Manager, nor the General Designer bore responsibility for the NPP safety. In the USSR at that time there was not operating organization, defined by civilized world, absolutely responsible for the safety. In the state including the high national level was absent that nowadays recognized worldwide as «safety culture». The importance of occurring concerns regarding the safety was underestimated. The measures that could have prevented the disaster were not implemented.
The USSR undoubtedly achieved considerable success in developing nuclear science and engineering, especially in military industry. However, this success was too much politicized. At the same time, shortcomings and errors that led to large disasters both at civil (Leningrad NPP, 1975, Chornobyl NPP, 1982, etc.) and military nuclear facilities (Cheliabinsk, 1957, Chazhma Bay, 1985, etc.) were concealed. There was not a proper state control over the activity of nuclear institutions (actually, such control was absent until 1984). All this resulted in the fact that infallibility moods become firmly established in the nuclear engineering. Their best closest main point is presented by the formula «The Soviet nuclear reactors are the best in the world». This was also eloquently seen in response to the accident happened at the American «Three Mile Island NPP» in 1979, when the leaders of the USSR nuclear industry announced that «such accident was impossible under socialism». The state political prestige dominated and strangled the basic condition for a peaceful use of nuclear energy that is the assurance of its safety.
At the beginning of 1980’s, after the accident at the American «Three Mile Island NPP», tendencies for a critical overestimation of NPPs’ safety emerged in the USSR. But, objective safety assessments of national reactors were blocked by authorities and leaders of the soviet nuclear science and engineering. The role of peer review first of all from the state nuclear safety regulation bodies was almost null. Prior to the accident of 1986 a strong and independent nuclear regulation authority that is the basis for the state nuclear safety system was almost absent.
Politicization of the USSR nuclear science and engineering, image of its exclusiveness and infallibility, created by years, absence of independent nuclear regulation and efficient state control over the nuclear power engineering are the fundamental reasons of the Chornobyl tragedy.
The myth, that the nuclear science and techniques of USSR had unlimited financial and material resources continues to exist till now. It is fair if to speak about what has been intended for the military purposes. Really the nuclear power felt chronic shortage of funds, first of all for exploratory developments for a safety and reliability substantiation, experimental try-out of the equipment etc. It is enough to say, that expenses for the Nuclear Power Plants Safety substantiation in USSR were more than in 10 times lower, than in USA – but it became known only after «Iron Curtain» falling. Absence of funds for creation of experimental testbed base, procurement of modern computing techniques, to perform researches and try-out of technology for Radioactive Waste and Spent Nuclear Fuel Management, creation of qualitative dosimetric equipment, creation of training simulators – all that to some extent appeared during the accident and in process of its consequences liquidation. It can be absolutely soundly stated that economic bases for Nuclear Safety assurance in USSR haven’t been arranged and the reason of such position was misunderstanding of a problem or absence of funds it doesn’t matter. It is important, that Nuclear Energy Safety hasn’t been provided economically.
True causes of the accident have been formulated for the first time by the Governmental commission on investigation of the accident causes at Chornobyl NPP and liquidation of its consequences. Really, Governmental commission named Chornobyl NPP managers as responsible for accident, who «have made serious errors in the plant operation and haven’t ensured its safety». However, only these conclusions became known to the USSR’s population and to wide world community – the commission’s deed has been hush-hushed. In fact, the Governmental commission also named as responsible for the accident:
- Ministry of Energy and Electrification, which has tolerated malpractice to perform various tests and not regulated works in night time, and absence of control for these works; tolerantly reacted to physical and technical lacks of RBMK-1000 reactors; hasn’t insisted the Chief Structural Engineer and the Research Adviser for realization of actions to improve these reactors reliability; hasn’t provided appropriate training for operational staff;
- Ministry of Medium Machinery Manufacturing, which hasn’t taken timely measures for RBMK type reactors reliability improvement in full conformity with the requirements of «General provisions of Nuclear Plants safety assurance during designing, construction and operation»; hasn’t provided sufficient technical solutions for the reactor safety assurance;
- State Nuclear Supervisor, which hasn’t provided appropriate control of nuclear and technical safety rules and norms execution; not in full exercised the provided to it rights; acted irresolutely, hasn’t stopped violation of safety norms and rules by the employers of ministries and departments, nuclear plants, enterprises supplying the equipment and devices.
Governmental commission has considered engineering and technical aspects of the accident. In particular, the Commission has noted that the reactor protection emergency system hasn’t executed its functions and the accident has occurred because of reactor lacks, in particular:
presence of positive steam reactivity factor;
occurrence of the positive general power reactivity factor, which should be negative at normal and emergency operation;
unsatisfactory design of a reactor control and protection system roads, which entered positive reactivity during their initial movement to core;
absence in the reactor installation design of the device showing value of an operative reactivity allowance and preventing about approach to dangerous border.
In essence, Governmental commission even in May 1986 recognized that the RBMK-1000 reactor had the serious constructive lacks, which became the reason of its explosion with catastrophic consequences.
Bitter and hopelessly tardive confession of the accident causes, political assessment of occurred were given by last CPSU congress (the newspaper «Pravda» dated 7/14/1990): «In the conditions of administrative and command system the former country leaders made the great miscalculations in scientific and technical policy development in the field of nuclear power and population protection in extreme conditions. Ministry of Energy, Ministry of Medium Machinery Manufacturing, State Committee of Hydrometeorology, State Nuclear Energy Supervisor, Academy of Sciences, Civil Defence have shown inability to secure population’s life and health, were unprepared to apply necessary urgent actions... Overconfidence and irresponsibility of some leading scientists, heads of the ministries and the departments involved in Nuclear Power Plants designing, construction and operation, their statement about absolute safety of Nuclear Power Plants, have led to real absence of the state system of works in emergency situations».
Decision of the commission of Ministry of Medium Machinery Manufacturing (May 1976), created after the accident at Leningrad NPP in 1975 is acknowledgement of the fairness of Governmental commission deed and the resolution of last CPSU congress. At that time the commission has come to a conclusion that the problem of positive steam effect of reactivity isn’t resolved, there are no means for immediate moderation chain reaction of fission which could compensate the positive reactivity released under condition of fast growth of steam content in reactor core. The position of Kurchatov institute about necessity to introduce additional faster emergency protection is stated at the same document. Thus, the main reasons which have caused accident have been named ten years before the accident.
But elimination actions have not been realized and designers haven’t prevented operational personnel about consequences of the miscalculations realization made during designing of the reactor and haven’t provided recommendations to the personnel how to act in critical situations, till the actions excluding design defects of the reactor will not be realized.
It is difficult to explain sluggishness in elimination of the revealed deficiencies in RBMK-1000 safety, but set of negligence and self-confidence with a lack of knowledge became one of key causes of the accident. An incontestable fact is also that important details for safety consciously weren’t communicated to the personnel. The personnel practically knew nothing about the accident at Leningrad NPP in 1975 and about other operational incidents at this main NPP from a series with RBMK-1000 type reactors. One of the most important safety principles – taking into account operating experience of the same Units was ignored.
IAEA General Director has created the International Nuclear Safety Advisory Group (INSAG) for the analysis of Chornobyl accident reasons. Its first Report pursued this purpose. The emphasis in it has been made on personnel errors. Obviously INSAG didn’t carry out independent collection of materials about the accident and was guided by the mispresented information given by the Soviet side in 1986. Later, on the basis of the researches carried out by the Soviet and foreign experts, Report INSAG-1 has been revised and the new report, INSAG-7, which is recognized today around the world as the most true-to-life document about Chornobyl accident reasons and circumstances was issued in 1993.
Coming back to the accident, it needs to provide in brief the information about course of events on April 25-26th 1986 at Chornobyl Unit 4 led to the accident. Decrease in Unit’s capacity for planned repair performance has been started at about 1 o’clock in the morning on April, 25th and up to 4 o’clock in the morning power unit’s capacity has been stabilized at the level of 50 % from the nominal. It has been started preparation of the unit for testing and repair. However, the command of the power supply system dispatcher at 14.00 has arrived to continue operation at the level of 50 % from nominal till overcoming of maximum loadings. The permission of the dispatcher shutdown unit has been obtained only at 23.10. It should be noted that throughout several hours, approximately from 7 am till 14 pm designed operative reactivity margin was a little below admissible, but the NPP’s Chief Engineer on the basis of the available at the moment information about the equipment status and being guided by operating procedure, permitted to continue unit operation under capacity.
At 00.28 during regular operation of transition from one control system to another the Senior Engineer of the reactor control (SERC) was not capable to make it and capacity of the reactor has decreased up to 30 Mwatt thermal. Near one SERC renewed automatic control of the reactor and stabilized its capacity at the level 200 Mwatt thermal established by the head of tests. That was a deviation from the tests program which should be carried out at the capacity 700 Mwatt thermal. However, operation at the capacity 200 Mwatt thermal wasn’t forbidden by operating procedure for RBMK – 1000 reactor.
Till now heated discussion proceed, attempts to find the one who has given a command about renewal of the reactor capacity, considering, what namely this command has led to the accident. Such command wasn’t necessary. The operator has made a mistake and tried to correct it. From a today’s position it should be noted that it was the fatal decision – it would be correctly to stop the reactor.
Tests were started at 1.23 under the stable parameters of the reactor confirmed by last records of parameters registration by computer complex «Skala». At 1.23,40 ‘ in the absence of any deviations in an operating mode of the reactor and warning or alarm system signals, tests were completed and according to the Unit Shift Supervisor command SERC performed regular action – presses AZ-5 button to reactor shutdown. Last record in operative log of the reactor operator: «01.24. Hard knocks. CPS roads have stopped without reaching bottom trailing edges. The key of a muffs feeding is removed».
Pushing of АZ-5 button became a direct impulse to start emergency process. The imperfect design of control and protection roads has caused introduction of positive reactivity in a reactor core. Speeding up of its capacity has started. It became catastrophic because of big (approximately 5β eff.) steam factor of the reactivity, which influence was especially high under condition of close to zero steam content in reactor core.
Low value of ORM not only worsened condition of the reactor control, which was known to the personnel, but also has left the reactor without emergency protection, that wasn’t known to the personnel. The device for ORM control hasn’t been provided by the design. The regular system of ORM calculation according to «Prisma» program didn’t provided the operator with information as worked unstably at low capacity level – ORM value at the moment of AZ-5 button pressing has been identified by calculation already after the accident. The operator could make ORM assessment on poisoning curves which has been provided in the reactor operation instruction. Such assessment would provide him with ORM value at one o’clock in the morning on April 26th – MC 15–16 roads (unit unloading was starved in April 25 at 23.10 under condition of ORM in 26 MC roads).
Low reactor power and high coolant flow, which is close to zero-point core inlet subcooling of coolant, conditioned high sensitivity of reactor to external impacts. Thus, the proximate reasons of the accident were neutron-physical, thermal-hydraulic and structural peculiarities of RBMK-1000 reactor, and personnel actions make their realization possible. It is obvious that reactor was doomed due to its design characteristics and just waited for implementing corresponding post-conditions. On April 26, 1986, these conditions were created. The details of accident process can be specified, but main conclusions remain the same.
Personnel really took some actions, which worsened the situation. Stability of connection system for accessory main circulation pumps was highly affected. But this operation was not prohibited by the process regulations, and it was provided by the testing program. Prohibition for such operation appeared already after the accident. The USSR information provided to IAEA contained personnel accusation in deactivating some shielding. As it is, whole reactor shielding was activated by physical parameters, including power overshoot and expanding capacities rates. The linings of process shielding were in positions prescribed by 1986 operational documentation. The only deviation is that shielding setting regarding water level in drum-separators was changed, but this did not influence on neither initiation nor development of the accident.
Personnel really made the emergency core cooling system out of operation. However, first of all, this was provided by the testing program and, secondly, this was not prohibited by the process regulations. But emergency core cooling system had to be put into normal operation mode upon condition to postpone time for shutdown and Unit testing upon the command of energy system supervisor.
It should be mentioned that even if all actions incriminated to personnel by USSR information provided to IAEA in 1986 were actually taken, they by no means would not influence on initiation and development of the accident process.
According to Item 10.12 of Reactor Operation Regulations and Item 12.4 of Process Regulations, the reactor is stopped by pressing AZ-5 button. Lead engineer for reactor control did just the same thing having received the command to stop reactor after testing completion. And just this regulation action was fatal one. Reactor protection system in case of low operative reactivity margin played the part of launching trigger for accident, and high positive density effect of reactivity led to accident development of catastrophic magnitudes. Incontrovertible fact is that high-level emergency protection not only did not save the reactor, but also caused the accident.
Neither Management of nuclear power plant, nor operational personnel particularly chose the equipment they should use. The NPP’s staff had to master the provided equipment and learn to control this equipment. But the time has come when operator was not able to cope with the reactor. The reactor developers did not provide him with required information. Those limitations, ignorance of which was referred to personnel fault later, were not indicated in the process regulations and instructions. Operators fell into a mode, which was not described and was not prohibited by any acting document until the accident.
Some primary reasons of accident were already mentioned above. There should be added some more. There was no nuclear legislation in USSR. Only at the end of 80’s of the last century, understanding became forming that the law is required, which regulates activity in nuclear field, including authorization system, rights and commitments of its participants. But this law was never accepted in USSR.
Fewer claims could be laid to the regulatory framework available at that time. But also it contained many concessions for RBMK reactor. Moreover, its developers could not meet a lot of regulatory requirements mentioned above. Attempts to denote them and also any criticism to RBMK-1000 were blocked by Management of the Ministry of Middle Engineering. The deserts of this Ministry, especially in military field and in creating nuclear shield of the country are indisputable. The Ministry included intellectual elite of the country, outstanding scientists and specialists. But to convert it into state in the state, actually leave without control, and make its managers infallible oracles is a great mistake of the country’s leaders, which resulted in tragic consequences.
The security system, in which Soviet nuclear science and machinery existed, should also be referred to root causes of the accident. Undoubtedly, first of all, the Soviet party suffered from this system. Creating peculiar «iron curtain» around national nuclear power industry, USSR was losing ability to compare its developments with those in other countries of the world, being behind more and more from the most important trends.
It is sufficient to make one example. In the world’s practice in the 60’s of the last century, prior to decision-taking about NPP construction, to analyze its safety comprehensively became a practical activity. The American standard RG 1:70, regulating requirements to the structure and content of a report summarizing results of such analysis, became an example for the world nuclear community. No such matter was in USSR, and practice in licensing nuclear power plants in USSR was lacking. The State greatly fell behind in creating methods of safety analysis and their mathematical support. The world advanced in analysis methodology for not only design accidents, but also beyond design basis ones. Chornobyl tragedy opened eyes to this unpleasant fact, and only in the middle of 80’s the practice in NPP licensing, developing and providing substantiation of safety for new and active nuclear units began developing.
Not only international self-isolation played the negative part in creating conditions resulted in catastrophe. Nuclear energy for all intents and purposes was closed from public control in its own country. And this is also one of the root causes of the accident.
The accident magnitudes were very large. Vast resources are spent and being spending for their elimination. A lot of territories are lost for a long time for common economic activity. Tens of villages have lost their inhabitants and transformed into silent monuments of the catastrophe. It affected fates of million people. Tens of thousands people lost their health, and many of them lost lives. This is terrible price for mistakes made when creating RBMK-1000 reactors.
The accident inflicted the great loss to nuclear energy industry in the whole world and deferred its development for many years. The accident showed that consequences from error of an operator or NPP creators go beyond the international boundaries. Responsibility for national nuclear energy safety is transforming into responsibility to world community. And this regards not only to nuclear facility creators and its operating personnel, but also to national regulators and high level state authorities.
Chornobyl accident gave one more lesson learned, i.e. need in supporting efficient international safety measures for nuclear energy. The world community promptly learned this lesson that is confirmed by IAEA activity, conclusion of certain international conventions, first of all, the convention on nuclear facility safety.
The important lesson learned is a necessity for independent state and public control for nuclear energy safety. Only society has a right to take decision on nuclear energy development to be precisely documented in legislation. But for such responsible decision, population should be prepared appropriately. It has to know what NPP is, what its potential hazard is, and what is done to have this hazard so minor to neglect it. It is required to have routine and methodical public relations.
Availability of independent and competent regulatory authority is an indicator of nuclear safety culture in the country. Lack of such authority or financial and human resources sufficient for performing its functions, lack of actual independence in taking important safety-related decisions mean the lack of nuclear energy safety culture in the country and violation of its international safety measures.
Equally important lesson learned from Chornobyl accident is compulsory availability of qualified operating organization, which is able to solve nuclear energy problems and has the potential for safety assessment and control of nuclear facilities being under operation.
Finally, one more lesson learned is continuous NPP safety analysis, revelation of safety deficiencies and their elimination. This should include intensive scientific research of factors influencing on NPP safety; continuous improvement of regulatory framework; creation of specific safety-oriented psychological climate in the operators’ teams; continuous advanced training of personnel and sense of responsibility for accident-free operation of nuclear power units.
The analysis of the thing happened on April 26, 1986 at Chornobyl NPP is not a goal in itself and should not be retrospective. The primary goal is to learn lessons for nuclear safety today and in future, and to prevent the potential for accident repetition having significant radiological consequences. All who in some or other way are involved in nuclear safety assurance, whose decisions could directly or meanly have an effect on nuclear safety, should understand why one was able to operate the facility, which did not meet the safety requirements, why deficiencies were not eliminated for years, which were known and resulted in accident with catastrophic consequences. This should be recognized, and appropriate conclusions should be made.