Dmytro Gumenyuk: “It is impossible to completely prevent accidents at NPPs, but it is quite possible to minimize the risks of accidents”

NPP safety has always been one of the key issues in the global energy policy. Following the Fukushima accident in 2011, the international community introduced new standards and measures to improve nuclear facility resistance to natural and man-induced disasters. The full-scale war in Ukraine and the occupation of the Zaporizhzhia NPP revealed a new and extremely hazardous risk factor: military actions that threaten the stability and safety of nuclear energy. Shelling of critical infrastructure led to multiple blackouts, increasing the risk of a nuclear accident caused by loss of external power supply required to cool the reactors.

Head of the Safety Analysis Unit at the State Scientific and Technical Center for Nuclear and Radiation Safety (SSTC NRS) Dmytro Gumenyuk as an expert often gives comments to Ukrainian and foreign media on events occurred at Ukrainian NPPs. The Uatom Editorial Board talked to Dmytro Gumenyuk and found out how up-to-date nuclear power plants are adapted to new hazards and whether the war has affected approaches to nuclear safety.

– For experts, there is a difference between accidents and operational events, but the media and social networks often misuse the term “accident” to make the news more sensational. Explain the differences between an operational event and accident using examples.

I don’t think this is a deliberate misuse, most often all negative events at NPPs are called accidents due to incomplete knowledge of what an accident is. It seems to me that the simplest thing is to refer to our regulatory framework, where there is a clear definition of what an accident is, and what an operational event is.

“An accident is an operational event at nuclear power plants, which results in release of radioactive substances or radiation beyond the limits of the established design…”.

That is, there is a large amount of radioactive substances at a nuclear power plant, which according to the design and normal technological process are in appropriate places. For example, the radioactive coolant is in the reactor and in the primary system, beyond which there should be no release of radioactive substances. If such a release occurs, then we proceed to the second part of our definition:

“…and in the amount exceeding the operational safety limits defined in the nuclear power plant design”.

This means that the design establishes permissible values that can enter the environment. If there is an event resulting in a leak of radioactive substances in the amount greater than that allowed in the design, this is already an accident. That is, not every operational or initiating event leads to an accident.

In this context, I propose considering something that is very familiar to us. Let’s imagine a situation: shelling and instability of the power system leads to NPP scram. Is this an accident? No, it is an operational event. Why? Because there was an NPP abnormal occurrence with scram, but without release of radioactive substances beyond the limits established in the design.

Let’s consider another option: a situation occurred conditionally, when spurious actuation of a safety valve in the pressurizer occurred at an NPP unit. There was a coolant leak from the primary system under the reactor containment. In order to determine whether this was an accident or an operational event, it is necessary to analyze radiation consequences – whether the standards for release of radioactive substances beyond the limits established in the design were exceeded.

Therefore, most of things that occur at our plants cannot be called accidents. After all, these are operational events.

However, why is the public worried? Because most people associate the word “accident” with the Chornobyl disaster. Or they think that a certain event leads to negative consequences, thus it will already be an accident.

A nuclear power plant is a complex system containing radioactive substances, as well as nuclear fuel, and any operational event at this plant can potentially lead to negative consequences. The Fukushima, Chornobyl, Three Mile Island accidents also started from something insignificant.

We are the world that has experienced these disasters, so people are very cautious about nuclear power. A golden mean is needed here: nuclear power plants should not be treated carelessly, but there is no need to be afraid either, nuclear power should be approached with cold mind and without relying on emotions. The public should be informed, should refer to official information sources and competent authorities in case of an NPP accident. Going to extremes and raising a fuss only because of the words “core”, “reactor”, “scram”, swallowing potassium iodide tablets, hiding in basements from radiation – all this should not be done.

Counteracting panic and disinformation is part of our work at the SSTC NRS. I think, we are doing it successfully.

– To complete with accidents, what are the types of accidents?

In the development of nuclear power plant designs, no matter now or in the past, designers understand that failures of the plant are possible and these failures can be different. Both the design, construction and operation of a nuclear power plant are based on a conservative approach, in simple words “consider the worst-case scenario”. Accordingly, within this approach, events that can lead to accidents are provided for and analyzed in detail in the NPP design. That is, accident probability is considered and analyzed at the design stage. Such accidents are called design basis accidents.

“For these (design basis) accidents, the NPP design defines initiating events and final conditions and provides for the safety systems limiting their consequences to the established limits (taking into account the single failure principle of the safety system (system train) or one additional human error independent of the initiating event)”.

There are also beyond design basis accidents, although this term is not used (currently, the updated regulatory document “General Safety Provisions for Nuclear Power Plants” uses the term “design extension conditions”), but for easier understanding, I would use the term “beyond design basis accidents”, that is, those that are not provided for in the design. They can be caused by initiating events not envisaged in the design, or by multiple equipment failures and human errors. Examples of such accidents are the Fukushima and Chornobyl disasters.

Beyond design basis accidents are also divided into two types. The first type includes accidents without severe core damage, that is, personnel made numerous errors, a lot of equipment failed, but in the end, the other systems were actuated perfectly, the core did not melt, the conditional “Chornobyl” did not occur, everyone was lucky and the unit can continue operation. However, there are beyond design basis accidents with severe core damage, when all the bad things happened: a tsunami, an earthquake like at the Fukushima Daiichi NPP, a flawed design, the Communist Party said that it knows better how to bypass the laws of physics, as it was during the Chornobyl accident. This accident leads to core melting that is called severe core damage.

Therefore, accidents can be conditionally divided into three types: design basis accident, beyond design basis accident without severe core damage, and beyond design basis accident with severe core damage. The worst option is the third. This is what happened at the Three Mile Island, Fukushima Daiichi and Chornobyl NPPs, as well as at other lesser-known NPPs, where the core was partially damaged.

– Ukrainian NPPs were designed in the last century. At that time, there was no question of hostilities and impact on nuclear facilities; moreover, the probability of occupation was not envisaged. So, what internal and external hazards were incorporated in the design of Ukrainian NPPs?

Let’s start with the fact that no power units were designed considering military actions. I don’t think this will be considered in the future either. Perhaps Ukraine’s experience will be taken into account, but if hostilities are considered in NPP construction, its cost will be extremely high – producing candles is cheaper.

However, any power units were constructed taking into account that they must withstand certain external and internal hazards. Radioactive substances are protected by several barriers (there are five such safety barriers in total, each one has a function of confining fission products, if the previous one fails. For example, if nuclear fuel is damaged anyway, fission products will be released beyond the primary system, and the reactor containment should prevent their release into the environment. The VVER-1000 containment is a fairly large structure made of reinforced concrete, with a volume of about 60 thousand cubic meters, about 60 meters in height, and 40 meters in diameter. These concrete structures were designed to withstand natural hazards such as hurricanes, floods, tornadoes, etc., and internal hazards such as fire inside power units or, for example, piping ruptures. Fire extinguishing systems, accident management systems, and the like are in place for this purpose.

That is, if we are talking about peacetime, then NPPs are adequately protected. However, in the context of war I can say, if russians at the occupied Zaporizhzhia NPP set a goal to damage equipment of the nuclear power plant, they will do it, and no systems will stop them.

– Following the Fukushima accident, a number of measures were implemented to improve NPP safety around the world. Which measures contributed to the safety of Ukrainian NPPs during military operations?

After the Fukushima disaster, the world was divided into two main camps: supporters of the idea that nuclear power is extremely hazardous, such as Germany that started closure of its nuclear power plants, while others looked critically at the nuclear power plants in their countries, they conducted the so-called stress tests, discovered challenges in the areas and started strengthening the weak points indicated by the stress-test results. Ukraine chose the second option: we developed a number of measures, due to which specific systems were developed at the power units, which significantly improved the protection and reliability of Ukrainian NPPs.

I can say for sure that the implementation of the post-Fukushima measures has given the public and nuclear workers more confidence in the fact that even in case of a negative event at a nuclear power plant, there are additional systems that can impact and reduce consequences.

In particular, as part of the post-Fukushima measures, it was proposed to implement additional mobile diesel generators that can be moved in case of failures, interruptions or events related to the loss of power supply to a power unit. Additional (mobile) systems were implemented for feeding steam generators, spent fuel pools and spray ponds. The system for hydrogen removal from under the containment and containment overpressure protection system were implemented. Most importantly, the recommendations (guidelines) were developed on how to use this equipment.

Already during the full-scale invasion of russia into Ukraine, high power mobile diesel generators were additionally installed for Ukrainian NPPs with the support of the US Department of Energy and the Argonne National Laboratory. They look like a truck or a small wagon, but such a diesel generator can be moved around the NPP territory, if desired, and feed some core cooling systems, emergency steam generators, etc.

– Since the beginning of the full-scale invasion, multiple blackouts occurred at both the occupied Zaporizhzhia NPP and the plants on the controlled territory. What are the risks of disconnection from the grid? How long does it take for a blackout to cause severe damage to the reactor core?

I emphasize, what is happening at the Zaporizhzhia NPP is NOT normal and designed, but the diesel generators are still being actuated there in loss of power. However, no NPP can be operated using diesel generators forever. It will be operated as long as fuel is available. If we are talking about the Zaporizhzhia NPP, then we don’t know how much fuel is stored by the russians.

The amount of fuel should provide at least 10 days of operation at our NPPs, that is, the reactor will be cooled during this time without external power supply. On the other hand, there are other options for how the plant can prevent core damage.

For example, in 2022, when two power units were still operated at the Zaporizhzhia NPP, the NPP has lost connection with the Ukrainian power network due to russian shelling of the power transmission lines. As a result, one power unit was in operation for more than three days and supplied power to the systems of all six power units by generating electricity. That is, not every loss of external power supply leads to blackout and automatically to an accident.

In fact, damage to nuclear fuel occurs when it is not cooled down. A nuclear power plant is not a burner that you can turn off and it will cool down. Nuclear fuel releases heat for a long time. For example, after three years of outage in shutdown, the Zaporizhzhia NPP still releases heat that should be removed.

If heat is not removed, a Fukushima-like scenario could occur. Nuclear fuel is cooled down by the reactor coolant, and if it is lost somehow – either due to piping rupture or due to boiling away when the cooling systems do not function –nuclear fuel will start melting. Such accidents have occurred at the Three Mile Island, Fukushima and Chornobyl NPPs.

If we are talking about blackouts, then the best solution in loss of power is either diesel generators or operation of at least one power unit for auxiliary power supply, as at the ZNPP in 2022.

Let’s consider a situation when everything is wrong: the VVER-1000 unit is under operation, then blackout occurs with complete loss of power supply, and the diesel generators have not been actuated, none of three DGs. Then core melting will start in about three hours. The containment will confine radioactive fission products for quite a long time. That is, some time is available when something can still be restored. In three hours, you can either bring diesel fuel, or transfer a mobile diesel generator or a team for restoration from another unit or even from another NPP. Conventionally speaking, three hours is the shortest period.

If we are talking about such a hypothetical accident at the occupied Zaporizhzhia NPP, which has been in cold shutdown for quite a long time, time is determined there not in hours, but in days and in weeks, because the reactors are cooled down.

I emphasize that the probability of such accidents is not unexpected; NPPs are prepared for them, their management guidelines have been developed, and personnel are trained.

– Shelling of the energy infrastructure leads to the wear of NPP equipment. What threats does this pose to Ukrainian NPPs?

Power system shelling may have a negative impact on the power units. Such attacks may result in unloading of units and the impact on power unit equipment is probable.

Why? Because in the failure of a part of the power generating or transmitting capacities, the frequency in the network changes sharply. The generators that generate current in the network are very sensitive to changes in this frequency. These fluctuations lead to changes in turbine operation: it can start vibrating, be damaged, etc. This is only one example of sensitive equipment at a nuclear power plant, and there is a lot of such equipment there.

Counteraction to shelling impact has not yet been found, except for the Armed Forces of Ukraine. Strengthening our air defense is a counteraction.

– Nuclear and radiation safety experts are currently working on updating approaches due to Zaporizhzhia NPP occupation and military operations. Tell us about SSTC NRS projects in this area. What does Ukraine propose to change in the approaches to NPP safety?

Military threats have not yet prompted the world to update its approaches to NPP safety. Are there already any developments? At least, I do not see any. However, the world is surely analyzing what is happening in Ukraine, particularly at the Zaporizhzhia NPP. I am not trying to analyze the deep concern of the IAEA, how they work with their missions. The world is still following the political path: condemnation, prevention and concern. I can’t say that additional protection against military actions is incorporated into the NPP designs. Moreover, there is not even a methodology to consider hostilities for the currently operating power units.

Another question is whether this should be taken into account. It seems to me that it would be very difficult to design a nuclear power plant considering possible war, because no one thought that in the 21st century, in the center of Europe, the largest nuclear power plant would become a military base.

Our experience has demonstrated that the world is rather cool towards our problems. Because this is not happening to them, firstly. And secondly, what could their actions be? What they can, they do: they condemn, they call on russians not to shell the power grids, to leave the Zaporizhzhia NPP, but those who are capable of nuclear terrorism don’t want to listen to these calls.

The world is also taking a number of actions to increase protection of our NPPs. That is, if we think about the beginning of 2022: we had neither Patriot, nor Gepard, nor Himars, nor F-16. Strengthening Ukraine’s military potential, assistance to the Armed Forces – this is the protection of nuclear power plants that we need.

Regarding the SSTC NRS projects, we support the SNRIU in the development of the procedures and recommendations for restoring regulatory control at the Zaporizhzhia NPP after de-occupation. This is quite a unique work that no one in the world has ever done. The great challenge is that unfortunately no one in Ukraine has any influence on what is happening at the occupied Zaporizhzhia NPP.

We do not control modifications and equipment transfer or nuclear fuel condition – maybe it was taken out and a new one of a different type was brought in. We do not know. This is a loss of regulatory control.

Sooner or later, I believe that the Zaporizhzhia NPP will be de-occupied. When it is demined, the question will arise of what needs to be done next. The operator should enter it to figure out what the condition of the plant is, and the regulator should support all this. Thus, we are developing a list of actions and recommendations for the regulator.

In addition, the SSTC NRS has performed and is performing a lot of analyses aimed at forecasting probable consequences, including these resulting from military actions. However, the spread of a radioactive cloud depends little on what caused this cloud. Therefore, we do not have any military-specific modeling.

We simply do this forecasting more intensively and for different sites and different conditions. If we are talking about the Zaporizhzhia NPP, then we have calculated all possible conditions: at the time of occupation, in six months, in one year, at the time of the loss of the Kakhovka hydroelectric power plant, how much time is left, who can be affected, whether it is necessary to drink potassium iodide, is there iodine in the core, etc. This is the auxiliary thing, what can be influenced in this situation.

– In December 2023, the State Nuclear Regulatory Inspectorate of Ukraine extended the license for operation of PNPP Unit 1 until 2 December 2033. In your opinion, is it safe to provide long-term operation for Ukrainian NPP units? Under what conditions is it hazardous?

We have 15 power units in Ukraine, and long-term operation was not yet provided only for three of them. Long-term operation of some units was provided several times. Therefore, I think that long-term operation for these three and for all others will be provided. The decision on the possibility of power unit long-term operation is made by the SNRIU based on the periodic safety review report. The review is performed once per 10 years by the operator for each unit. The safety review is comprehensive and considers all areas and aspects of the power unit’s ability to continue operation over the next 10 years: will the vessel stand up, will the equipment withstand the load, will the systems be able to continue operation or should they be replaced, etc.

Based on this analysis results, if there are no significant contradictions, a decision is made on the possibility of power unit long-term operation. If there are questions, that is, if some system is not compliant, then this system and equipment can be replaced. In general, everything that is not critical is subject to replacement, and the only thing that cannot be replaced is the reactor and the building where it is located.

I will answer the main question “Is it possible to completely prevent an accident at a nuclear power plant?”: It is surely impossible to prevent it completely, but the risks of an accident can be minimized by additional systems, improving safety culture, developing recommendations, and training personnel. All this takes place at our power units.

Uatom.org Editorial Board