On April 26th, 1986 (at approximately 1:25 am) a Level-7 Accident occurred in Unit 4, of the Chernobyl nuclear power station in Ukraine, Soviet Union. In the initial steam explosion and subsequent fires, large amounts of radioactive material were released in the form of gases and dust particles and part of the reactor building was destroyed. The energy released in the explosion was equivalent to 40 tons of TNT and resulted in discharge of about 4% of the reactor’s nuclear fuel to the environment.
The reactor core was completely destroyed and approximately 150 tons of reactor fuel melted and flowed downward through the lower levels of the building, which included the pressure suppression pool.
At 9 PM on the 28th of April, the Soviet Union announced to the world that an accident had occurred. This was two days and nineteen hours after the accident. The Soviet Union has been criticized for inadequate safety procedures and for keeping quiet about the event for so long. The criticism is justified.
Basic deficiencies plagued the RBMK reactor. The Russian-designed RBMK has a graphite moderator and it is cooled by boiling ordinary water. Because of this it is possible to use natural uranium for fuel. A cost and convenience benefit that likely caused the Soviets to “overlook” some of the design issues.
One unfortunate characteristic of the RBMK reactors is that increasing the proportion of steam to water makes the reactivity increase. Increasing reactivity means increasing power (heat), which causes more steam and so on. An uncontrolled positive feedback loop occurs and precipitates a runaway condition. This is referred to by engineers as a positive power coefficient.
Paradoxically, this condition is not created by providing excess power to the reactor but too little. Because of this instability, there was a rule that extended operation was not permitted below 700 MW. Manual intervention by workers was necessary during planned shutdowns to make sure excess steam did not occur as the power dropped below the crucial power level causing instability.
Like U.S. nuclear plants, the Soviet plants have diesel generators to take over if transmission line connections are lost. These generators would supply power for essential components and services but they take nearly a minute to start up and come on line. In previous tests, (presumably at a different RBMK reactor), it was found that as the turbine generator slowed down, the output voltage fell more rapidly than was desired dipping below the 700 MW level.
A new control circuit had just been added to the Unit 4 generator to compensate for the voltage reduction. The accident took place during an experiment conducted at the start of a normal reactor shutdown to test this new circuit. The test was to determine the ability to continue to draw electrical power from a turbine generator coasting down. Startup and shutdown required taking the power level through regions of instability below about 600 MW.
During the test, the staff at the reactor focused their attention on the question of how well the electromechanical equipment worked, and they did not pay attention to reactor effects. The test was under the control of an engineer from the company that supplied the new voltage control equipment.
At 1:00 in the morning of April 25, the plant operators began to reduce power for the scheduled shutdown. To avoid damage to fuel channels from too rapid cooling, the power was decreased slowly. About twelve hours later (1:00 pm), the power had been lowered to 1600 MW.
Soon after, the grid controller asked that the plant be kept on line to supply electricity for the national electrical grid. Power reduction was stopped to comply with this request and turbine 8, which was scheduled to be used in the test, continued to supply electricity to the grid and to three main circulation pumps. This put the test on hold.
At 11:00 pm the grid controller released the reactor from its requirement to supply power. The reduction in power level resumed. About 90 minutes later, an event occurred that set the stage for the accident.
The reactor power was dropped to the 700 MW level viewed as minimum for the test; regulations prohibited operation below this level. Operation became unstable below this value.
At this power level it is necessary for the operator to switch control modes. In doing this the operator neglected to adjust the control system to hold the power level steady. The power level began to decrease rapidly, and it fell about 30 MW before the operator could halt the drop by control rod motion.
Controlling a reactor with a positive power coefficient is like trying to balance a baseball on the tip of a pool stick. So after the operator had stopped the steep power drop, he coaxed it back up again, and managed to achieve a steady power level of 200 MW. It was decided to run the test under these conditions, in absolute violation of regulations.
Big, BIG mistake!
The regulations also required a minimum number of 30 control rods in the reactor so the operator has the ability to reduce reactivity quickly At this point the number of control rods in the reactor was far lower than regulations permitted.
Notably, at the post-accident meeting in Vienna the Soviet experts said that the state of the reactor at this point absolutely demanded that it be shut down. Yet this was not done!
With reactor destruction only a little more than 20 minutes away. Another step was taken which complicated the situation significantly, and may have contributed to both the possibility of the accident and its magnitude.
Two main circulation pumps were turned on, one powered from the grid and the other from turbine #8 which was powered by the Unit 4 reactor. This action led to a circulation flow greater than normally expected at full power, when only six pumps are normally used. The increased flow rate caused the pumps to begin to become ineffective due to cavitations
The Final Five Minutes
At 1:19:10 am, the operator began to increase the rate of feed-water return to the point at which it joins the recirculation flow at the steam drums. He did this to reduce the recirculation flow, because he decided that the water level in the steam drums had fallen too low.
Feed-water is cooler than recirculation flow and is a strong determinant of the sub-cooling. The feed-water rose to about three times the equilibrium rate required for 200 MW operation. The steam drum water level did begin to slowly increase, but the reduced temperature of inlet water to the reactor core reduced the rate of boiling. At about 1:19:45, boiling stopped altogether. No boiling – no steam. The boiling-water reactor operated for about two minutes as a pressurized water reactor – which was contrary to design!
The elimination of steam reduced the reactivity, and control rods were withdrawn, some completely out of the reactor, and some to positions of low effectiveness. The Soviets later reported that only 6 to 8 rods were in the reactor at this point, rather than the required 30.
Next, to avoid a reactor trip, the operator locked out the specific SCRAM circuits associated with the control rods. SCRAM circuits and procedures control actions to accomplish a safe planned or emergency shutdown.
At 1:21:55, the operator began to reduce feed-water flow, which by this time was up to four times the equilibrium rate.
At 1:22:10 boiling began again in the core. The effect on reactivity was dramatic.At 1:22:10, rod bank AR1 began to drive into the reactor, reaching 90% insertion in 20 seconds.
At 1:22:25 rod bank AR3 began to enter the reactor again. At this point, feed-water flow was about 2/3 the equilibrium rate for 200 MW. Rod bank AR1 responded violently for nearly a minute as the operator tried to establish the right setting.
Even with these issues, at 1:23:04 the planned test began with closure of the turbine stop valve for turbine 8. This stopped steam flow to the turbine and effectively turned the turbine off to start its “coastdown”.Shortly before this, the operator had committed his sixth (and most deadly) violation of safety requirements; he blocked the SCRAM circuit that would have shut the reactor down as a result of a turbine trip. If he had not blocked this SCRAM circuit, then the accident would never have happened, in spite of his five previous violations. If the operator had not done this then all control rods would have been automatically re-inserted and a controlled shut down would have occurred.
Even with all of this, the reactor’s remaining automatic circuits attempted to restore stability by inserting control rods, but the program was confused by the unusual data and repeatedly inserted and removed rods over the next few seconds. In a period of less than three seconds the reactor power increased from 200 MW to 3200 MW, far above normal operating specifications.
The operator tried to manually re-activate the SCRAM circuits that he had blocked, but it was too late. Within two seconds the power of the reactor was at a level estimated to be a hundred times normal higher than normal operating power, or above 300,000 MW.
One second after that the reactor was destroyed.