Chornobyl. A Look Through the Years

Introduction

The accident at Chornobyl NPP Unit 4, one of the largest man-made disasters of the twentieth century, occurred on 26 April 1986. In wide circles of the public, its causes are commonly considered to be «incredible violations by the personnel» or «fatal combination of circumstances». These are simple and understandable statements, but they are false. Chornobyl was not an accident. It was the result of numerous decisions and actions (or inactions) of many people long before that night.

1. Versions of the accident

The investigation performed in the first days after the accident attributed its cause to a human error, which led to the failure (cavitation) of the reactor coolant pumps. This allegedly resulted in core steaming and uncontrolled reactor power excursion. The version was understandable and convenient, as it required no detailed assessment of personnel actions, no analysis of the RBMK-1000 design, or no evaluation of the causes behind the catastrophic accident scale. This version was already refuted in May by investigations conducted by institutes of the USSR Ministry of Medium Machine Building and USSR Ministry of Energy.

In the first days of May, Head of the RBMK Reliability and Safety Group (V. P. Volkov) reported to his supervisor, Director of the Kurchatov Institute of Atomic Energy, A. P. Alexandrov, that the accident «was not caused by actions of the operating personnel but by the reactor core design and incorrect understanding of the neutronic processes in the core».

Analysis of the data recorded by instruments and subsequent calculations allowed experts of the USSR Ministry of Energy to conclude that the accident was caused by the fundamentally incorrect concept of the control rods (graphite tip effect) and the positive void and prompt power coefficients of reactivity. It was shown that the Chief Designer had not established any limitations for reactor low-power operation either in the design or in the operating procedures. This contributed most significantly to the manifestation of RBMK-1000 negative design features.

In May, the Scientific Supervisor of the RBMK-1000 project at the Kurchatov Institute of Atomic Energy analyzed 13 possible versions of the accident. Only one version, specifically the graphite tip effect of the control rods that led to the introduction of positive reactivity and the onset of the reactor power excursion, did not contradict the data recorded by the DREG diagnostic program (equivalent to the black box in aviation). The catastrophic scale of the accident was predetermined by the large positive void coefficient of reactivity.

The Interdepartmental Scientific and Technical Council on Nuclear Energy (ISTC), which was effectively under the control of the USSR Ministry of Medium Machine Building, disregarded the experts’ opinion at two of its meetings in early June 1986. The Chairman of the ISTC was Aleksandrov, Scientific Supervisor of the RBMK-1000 project. Mykola Dollezhal, Chief Designer of the reactor, was also a member of the ISTC. The decision adopted by the ISTC was aimed at protecting the RBMK-1000 designers. It was precisely the ISTC that opened the way to the formation of distorted information on the causes and circumstances of the accident.

By the end of June, the Government Commission headed by Deputy Chairman of the Soviet Union Government, Borys Shcherbyna, completed a report on the causes and circumstances of the accident. The report pointed out human errors. However, the Commission’s principal attention was directed at the design deficiencies and at the failures in the actions of managers and experts of the USSR Ministry of Energy, Ministry of Medium Machine Building, and Gosatomenergonadzor, as well as their subordinate organizations, which contributed to the accident. The causes of the accident identified in the report were:

• positive void and prompt power coefficients of reactivity;
• graphite tip effect of the control rods;
• absence of a device indicating the operating reactivity margin (ORM) in the reactor design.

The Commission reached a fundamental conclusion: «…one should not begin the construction of new nuclear power plants with reactors of this type».

At the beginning of July 1986, at a meeting of Politburo of the Central Committee of the Soviet Union Communist Party, then the highest governing body of the state, the conclusions of the Government Commission were approved. The report of the Government Commission on the causes and circumstances of the Chornobyl NPP accident and the decision of Politburo of the Central Committee of the Soviet Union Communist Party were classified and known only to a limited circle of individuals.

2. Why it was impossible to tell the truth

The accident created an obvious conflict of interests. On the one hand, it was necessary to identify the real causes and circumstances of the accident, without that understanding it would be impossible to develop and implement measures to prevent the recurrence of such events in the future. On the other hand, open acknowledgment of the actual causes and circumstances of the accident would have undermined the notion of «the safest nuclear power in the world» and posed a threat to contracts for the construction of Soviet NPPs in other countries. Disclosure of the actual causes and circumstances of the accident would have demonstrated to the entire world the systemic failures, including the absence in the country of a legislative system for nuclear safety regulation and independent safety assessment.

On 20 July 1986, Pravda newspaper published a notice that provided society with a distorted account of the causes of the catastrophe: «Politburo of the Central Committee of the Soviet Union Communist Party, at a special meeting, discussed the report of the Government Commission on investigating the causes of the accident that occurred at the Chornobyl NPP on 26 April 1986… It was established that the accident resulted from a series of gross violations of reactor operating rules committed by the employees of this power plant…».

3. Distorted information conquers the world

From 25 to 29 August 1986, the IAEA convened a meeting of experts from its member states in Vienna to review information on the Chornobyl NPP accident. At the meeting, the Soviet Union presented a report (referred to as the Soviet report), which contained truth, half-truth, and outright falsehood, enough to convince the experts of a distorted version of the accident. As a result of the meeting, the International Nuclear Safety Advisory Group issued a report, INSAG-1, according to which: «…The primary cause of the accident was an extremely improbable combination of violations of operating procedures and rules committed by the personnel of the power unit».This is what was written in the Soviet report. The report said nothing about the accident having been initiated by the introduction of positive reactivity as a result of the defective design of the control rods (graphite tip effect). The experts invited to the IAEA meeting were not provided with the operating procedures, instructions, or test program. They could not put questions to NPP operators or managers, as those individuals were not part of the Soviet expert delegation at the meeting, nor had they participated in preparing the Soviet report.

Unfortunately, the IAEA experts in 1986 departed from the important principle «trust but verify». As a result, several years later the conclusions of the INSAG-1 report required substantial revision.

It should be noted that the INSAG-1 report proposed a set of measures that for years served as the basis for extensive research worldwide, whose results led to significant enhancement of NPP safety around the world and to the development of the regulatory framework for nuclear safety.

4. Independent investigation

In 1988–1990, Soviet Union Gosatomenergonadzor conducted its own independent investigation of the causes and circumstances of the accident at Chornobyl NPP Unit 4 and published a report, concluding that the scientific and technical cause of the accident was the unsatisfactory quality of the RBMK-1000 design. The report confirmed that the operators had indeed committed an error: they violated the minimum operating reactivity margin (ORM) established by the technical specifications.

The report demonstrated, however, that the RBMK-1000 Chief Designer had never defined the ORM as a parameter important to nuclear safety, neither in the design nor in the technical specifications. The design provided no emergency protection based on this parameter, nor any instruments by which the operator could monitor its value in real time. The monitoring system could supply the operator with information on this parameter only at intervals of approximately 15 minutes; the operator therefore did not know what the ORM was in the period immediately before the accident. Most importantly, the operators were unaware that, under certain operating conditions, the reactor emergency protection system could transform into an instrument for driving power excursion. It is possible that the Chief Designer himself did not know or understand this.

The report of Soviet Union Gosatomenergonadzor noted that the Chief Designer had committed more than ten gross violations of the nuclear safety requirements established by applicable regulations in the RBMK-1000 design. The report also demonstrated that the RBMK-1000 deficiencies had been known to the Chief Designer long before the accident. In particular, the positive reactivity excursion upon insertion of control rods into the reactor core (graphite tip effect) was recorded during the initial startup of Ignalina NPP Unit 1 and Chornobyl NPP Unit 4 in December 1983. The Scientific Supervisor of the RBMK-1000 project at the Kurchatov Institute of Atomic Energy drew attention of the leadership at the USSR Ministry of Medium Machine Building and the Chief Designer to this extremely hazardous safety effect, and proposed measures that could have prevented the catastrophe. The RBMK-1000 Chief Designer, however, remained unperturbed: «we are dealing with a known phenomenon», and the measures proposed by the Scientific Supervisor were not implemented.

The report of Soviet Union Gosatomenergonadzor concluded that the cause of the Chornobyl disaster was the reactor concept chosen by the RBMK-1000 Chief Designer, under which the neutronic and thermohydraulic characteristics of the reactor core produced a dynamically unstable controlled system with positive feedback. The reactor’s instability was further aggravated by extraordinary design errors in the control and protection system. The report specifically emphasized that the RBMK-1000 designers had withheld information on the reactor’s hazardous properties from the operating personnel.

The report noted that the system of legal relations in the nuclear power sector of the USSR had not been regulated by law. The country had not established an effective, fully developed system of nuclear regulation, supported by independent, qualified expert review vested with authority and accountable for its conclusions. The RBMK-1000 design had such serious inconsistencies with nuclear safety requirements that authorization for its operation became possible only within extremely poor safety culture at all levels of the country’s management hierarchy.

5. Revision of the IAEA experts’ position

The report of Soviet Union Gosatomenergonadzor on the causes and circumstances of the Chornobyl NPP accident was submitted to the IAEA in early 1991, prompting INSAG members to return to examination of the accident’s causes and circumstances. In 1993, the INSAG-7 report was published, but became known only to a limited circle of professionals. By 1993, the topic of Chornobyl had been largely displaced by the flood of information surrounding the collapse of the USSR.

The INSAG-7 report stated that new information had identified a range of problems that contributed to the accident, including:

• incompliance of the RBMK-1000 with the safety standards in force at the time of its design;
• inadequate safety analysis;
• lack of independent safety assessment;
• unsatisfactory quality of the technical specifications for operation;
• absent exchange of important safety information between the operators and designers;
• insufficient understanding by personnel of the reactor’s safety aspects, and incomplete compliance with the formal requirements of the technical specifications.

INSAG-7 particularly emphasized the ineffective nuclear regulation in the USSR and poor safety culture at the national and local levels.

The conclusions of the INSAG-7 report substantially changed the spirit and content of assessments of what had occurred in April 1986. INSAG-7 demonstrated that an accident of such universal scale could not be the result of a single person’s error: it was the product of a system. The report was a victory of truth over distorted information. Specific aspects of the INSAG-7 report may still be subject to refinement, but no work has appeared that refutes its conclusions in more than 30 years since its publication.

6. How we came to the Chornobyl disaster

The Chornobyl accident was preceded by a long history. In the 1960s, the USSR faced an acute need to rapidly expand electricity generation. A decision was made to export a significant portion of the country’s oil and gas production and use the resulting foreign currency to purchase needed technologies, equipment, and food. The task of increasing electricity output was assigned to a large extent to nuclear power.

However, not all available nuclear power technologies were supported at the time by the capacity of the USSR’s machine-building industry. In particular, there was insufficient capacity for manufacturing large reactor pressure vessels and steam generators for NPPs with VVER reactors in the quantities required by the electricity development program. The solution was to draw on the extensive experience accumulated in the design and operation of graphite-moderated uranium reactors (PGURs) that had been used for the production of weapon-grade plutonium. The construction of this reactor type required no specialized industry for the fabrication of large pressure vessel equipment. The reactors could be assembled from transportable components directly at the construction site.

The design specifications for the new channel-type graphite-moderated uranium reactor were approved on 15 April 1966 by the USSR Minister of Medium Machine Building, Yefym Slavsky. By early June 1967, the Scientific and Technical Council of the USSR Ministry of Medium Machine Building had approved the technical design of a reactor with an electrical output of 1,000 MW(e), designated RBMK-1000.

A superficial comparison of the general descriptions of the RBMK-1000 and PGUR reactors might suggest that the two are similar or closely related nuclear facilities. This view, however, is fundamentally incorrect. The new reactor involved different materials, different fuel, a different core configuration, and different operating objectives and states. This required detailed analysis of the neutronic and thermohydraulic characteristics of the new reactor before design work began. Special research facilities were needed, along with new computer codes, access of researchers and designers to powerful computing equipment, and the construction of low-power prototypes.

Nevertheless, the decision was made to develop a reactor of one-million-kilowatt capacity in the absence of the necessary and sufficient computational and experimental data and without the construction of a low-power prototype. The decision was taken by managers, scientists, and engineers of the highest qualification, the very people who had implemented the Soviet atomic project under extraordinarily difficult conditions. The decision was made possible by boundless overconfidence, a belief in their own absolute infallibility bred by earlier successes. It was facilitated by the absence of legislation defining authority and responsibility for nuclear activities in the country, above all for nuclear safety, and by the absence of independent safety review. All subsequent problems in the development and operation of RBMK-1000, which ultimately led to the Chornobyl disaster, trace their origins to that decision made long ago.

The potential problems of RBMK-1000 as a highly unstable controlled system, together with its hazardous characteristics, had already been identified at the design stage. After the commissioning of the lead RBMK-1000 unit, its negative features repeatedly manifested themselves in operation and gave rise to accidents and numerous failures. The Chief Designer of the reactor, however, adopted a position of concealing nuclear safety problems both from the authorities above and from the personnel operating RBMK-1000: «…The defining characteristic of the RBMK-1000 reactor is its dynamic instability, driven by a substantial positive void coefficient of reactivity, which in turn results from the poorly chosen graphite lattice pitch. It was at the Leningrad NPP, at the lead RBMK-1000 unit, that the positive void effect and the dynamic instability it produces first manifested themselves, giving rise to a serious nuclear accident. This incident clearly and unmistakably demonstrated the fundamental property of RBMK-1000 as a controlled system: its dynamic instability. The final power surge was not recorded by any instruments and was identified only by the ingress of moisture into the graphite stack. The fact of this accident and its circumstances were concealed not only from the public but also from experts, above all, from personnel of other nuclear power plants with RBMK reactors».

It should be added that it was precisely the RBMK Chief Designer who blocked the information exchange system «…on the grounds that information on damage and accidents could not be transferred to another department…»;consequently, for example,«…many nuclear power experts learned with surprise about the events at the Leningrad NPP only after the Chornobyl accident».

Years have passed, but even today it is difficult to give a definitive answer to the question of whether the Chief Designer understood the consequences of the errors made in the RBMK-1000 design. And if he did understand, why he did not take exhaustive measures to eliminate them? Safety analyses that would have allowed the identification of potentially catastrophic consequences even of design-basis accidents and the introduction of restrictions on certain operating states were apparently never conducted. Moreover, no measures were taken to provide specialized training for operators to act in situations that could trigger an accident.

The accident, affecting the interests of many countries around the world by its scale, shook  the myth about the quality of Soviet NPPs. The task thus was to present the causes of the accident in a way that revealed as little as possible of the true state of affairs and leave the safety of Soviet nuclear power as a whole beyond question. Thus the slogan emerged: the personnel are to blame for everything.

Conclusion

The politicization of nuclear science and engineering in the USSR, the image of its exclusivity and infallibility cultivated over the years, and the absence of an independent nuclear regulatory body are evident causes of the Chornobyl disaster. The political prestige of the state was dominant and suppressed the primary condition for the use of nuclear energy: safety assurance.

Severe accidents have occurred in other countries as well, in very different socioeconomic systems. Assessing the influence of political and socioeconomic conditions on the path to catastrophe is a matter for political scientists, sociologists, and economists. The «first violin», however, is always played by the individual: their character and qualifications, their attitude toward their work, their ethics, and their personal commitment to safety. The individual is the author of successes and equally the author of failures. Yesterday’s successes and yesterday’s achievements offer no guarantee of success tomorrow. Continuous effort is required to evaluate one’s own actions and decisions. Continuous learning and experience exchange are essential, including exchange of information on equipment failures in operation.

The human factor is the sum total of the actions of everyone involved, both those who design equipment and those who operate it. The path to an accident can be very long and may begin long before the operator’s hand reaches the control switches. Complacency and overconfidence, belief in the infallibility of one’s actions, and disregard for safety are unacceptable, for those who design equipment and for those who operate it. This is one of the most important lessons of Chornobyl.

The primary responsibility for safety always rests with the operator. Therefore, the daily duty of those who operate equipment is the continuous identification of its weak points and imperfections, their elimination, and the search for ways to improve and enhance safety. The operator’s position on this must be uncompromising: SAFETY IS BEYOND COMPROMISE. Every doubt must be investigated and resolved. This is the task both of the individual operator and of the operator as an organization.

The history of the Chornobyl catastrophe has shown that the truth can be concealed for a long time, but it cannot be hidden forever. The closed nature (secrecy) of documents and activities played a disproportionately large role in our long road to April: this is evident. Secrecy and falsehood always go hand in hand. Falsehood requires secrecy, and secrecy breeds falsehood.

The lesson of the Chornobyl disaster is universal: any complex facility becomes dangerous when safety culture yields to the drive for self-justification. Chornobyl is not only about atomic energy. It is about society, authority, science, and the individual.

G.A. Kopchinsky and N.A. Steinberg