Sequence of Events – Chernobyl Accident Appendix 1
During the course of a safety system test being carried out just before a routine maintenance outage, Chernobyl 4 was destroyed as a result of a power transient on 26 April 1986.
The accident at Chernobyl was the product of a lack of safety culture. The RBMK reactor design was poor from the point of view of safety and unforgiving for the operators, both of which provoked a dangerous operating state. The operators were not informed of this and were not aware that the test performed could have brought the reactor into an explosive condition. In addition, they did not comply with operational proceduresa. The combination of these factors provoked a nuclear accident of maximum severity in which the reactor was totally destroyed within a few seconds.
A full description of the accident, its environmental and health effects, as well as lessons learned, can be found in the information paper on the Chernobyl Accident.
The accident
The unit 4 reactor was to be shut down for routine maintenance on 25 April 1986. It was decided to take advantage of this shutdown to determine whether, in the event of a loss of station power, the slowing turbine could provide enough electrical power to operate the main core cooling water circulating pumps, until the diesel emergency power supply became operative. The aim of this test was to determine whether cooling of the core could continue to be ensured in the event of a loss of power. (Adequate coolant circulation following completion of the test was ensured by arranging power supplies to four of the eight pumps from station service power; the other four pumps were supplied by unit service power.)
This type of test had been run the previous year, but the power delivered from the running down turbine fell off too rapidly, so it was decided to repeat the test using the new voltage regulators that had been developed. Unfortunately, this test, which was considered essentially to concern the non-nuclear part of the power plant, was carried out without a proper exchange of information and coordination between the team in charge of the test and the personnel in charge of the safety of the nuclear reactor. Therefore, inadequate safety precautions were included in the test programme and the operating personnel were not alerted to the nuclear safety implications of the electrical test and its potential danger.
The planned programme called for shutting off the reactor's emergency core cooling system (ECCS), which provides water for cooling the core in an emergency. Although subsequent events were not greatly affected by this, the exclusion of this system for the whole duration of the test reflected a lax attitude towards the implementation of safety procedures.
As the shutdown proceeded, the reactor was operating at about half power when the electrical load dispatcher refused to allow further shutdown, as the power was needed for the grid. In accordance with the planned test programme, about an hour later the ECCS was switched off while the reactor continued to operate at half power. It was not until about 23:00 on 25 April that the grid controller agreed to a further reduction in power.
For this test, the reactor should have been stabilised at about 700-1000 MWt prior to shutdown, but possibly due to operational error the power fell to about 30 MWtb at 00:28 on 26 April. Efforts to increase the power to the level originally planned for the test were frustrated by a combination of xenon poisoningc, reduced coolant void and graphite cooldown. Many of the control rods were withdrawn to compensate for these effects, resulting in a violation of the minimum operating reactivity margind (ORM, see Positive void coefficient section in the information page on RBMK Reactors) by 01:00 – although the operators may not have known this. At 01:03, the reactor was stabilised at about 200 MWt and it was decided that the test would be carried out at this power level.
Calculations performed after the accident showed that the ORM at 01:22:30 was equal to eight manual control rods. The minimum permissible ORM stipulated in the operating procedures was 15 rods. The test commenced at 01:23:04; the turbine stop valves were closed and the four pumps powered by the slowing turbine started to run down. The slower flowrate, together with the entry to the core of slightly warmer feedwater, may have caused boiling (void formation) at the bottom of the core. This, along with xenon burnout, could have resulted in a runaway increase in power. An alternative view is that the power excursion was triggered by the insertion of the control rodse after the scram button was pressed (at 01:23:40)f.
At 01:23:43, the power excursion rate emergency protection system signals came on and power exceeded 530 MWt and continued to rise. Fuel elements ruptured, leading to increased steam generation, which in turn further increased power owing to the large positive void coefficient. Damage to even three or four fuel assemblies would have been enough to lead to the destruction of the reactor. The rupture of several fuel channels increased the pressure in the reactor to the extent that the 1000 t reactor support plate became detached, consequently jamming the control rods, which were only halfway down by that time. As the channel pipes began to rupture, mass steam generation occurred as a result of depressurisation of the reactor cooling circuit. A note in the operating log of the Chief Reactor Control Engineer reads: "01:24: Severe shocks; the RCPS rods stopped moving before they reached the lower limit stop switches; power switch of clutch mechanisms is off."
Two explosions were reported, the first being the initial steam explosion, followed two or three seconds later by a second explosion, possibly from the build-up of hydrogen due to zirconium-steam reactions. Fuel, moderator, and structural materials were ejected, starting a number of fires, and the destroyed core was exposed to the atmosphere. One worker, whose body was never recovered, was killed in the explosions, and a second worker died in hospital a few hours later as a result of injuries received in the explosions.
Some media had reported a seismic origin of the accident, however the scientific credibility of the paper at the origin of this rumour has been discarded.
Consequences
The plume of smoke, radioactive fission products and debris from the core and the building rose up to about 1 km into the air. The heavier debris in the plume was deposited close to the site, but lighter components, including fission products and virtually all of the noble gas inventory were blown by the prevailing wind to the northwest of the plant.
Fires started in what remained of the unit 4 building, giving rise to clouds of steam and dust, and fires also broke out on the adjacent turbine hall roof (bitumen, a flammable material, had been used in its construction). A first group of 14 firemen arrived on the scene of the accident at 01:28. Over 100 fire-fighters from the site and called in from Pripyat were needed, and it was this group that received the highest radiation exposures. Reinforcements were brought in until about 04:00, when 250 firemen were available and 69 firemen participated in fire control activities. The INSAG-1 report4 states: "The fires on the roofs of units 3 and 4 were localized at 02:10 and 02:20 respectively, and the fire was quenched at 05:00." Unit 3, which had continued to operate, was shut down at this time, and units 1 and 2 were shut down in the morning of 27 April.
INSAG-1 continues: "The main challenges were to prevent the fire from spreading to unit 3, to localize the fire on the roof of the common machine hall of units 3 and 4, to protect the undamaged parts of unit 4 (the control room, inside the machine room, the main circulating pump compartments, the cable trays), and to protect the flammable materials stored on-site, such as diesel oil, stored gas and chemicals.
"The fire-fighters were called upon to extinguish burning ejected graphite blocks and segments. The basic techniques used, successfully, were isolation and water quenching of the graphite blocksg [...] Water was used to extinguish the fires on roofs, cable rooms and on other surfaces, and to put out fires on graphiteg and other material and structural debris. The foam sprays were mainly applied in rooms and areas containing flammable materials such as diesel oil, chemicals, cables, etc."
Initially, attempts to introduce water into the reactor core were unsuccessful. Water fed in by the emergency feedwater pumps injected at a rate of 200-300 tonnes per hour went to other parts of the damaged primary circuit. When it was realised that this water flowed in the direction of units 1 and 2, water injection was stopped after half a day. Steam and white smoke from the reactor well were observed on the first day of the accident, but no steam was seen on the second day.
On 28 April, a massive accident management operation began. This involved dropping large amounts of different materials, each one designed to combat a different feature of the fire and the radioactive release. The first measures taken to control fire and the radionuclides releases consisted of dumping neutron-absorbing compounds and fire-control material into the crater that resulted from the destruction of the reactor. The total amount of materials dumped on the reactor was about 5000 t including about 40t of boron carbide, 2400 t of lead, 1800 t of sand and clay, and 800 t of dolomite. About 1800 helicopter flights were carried out to dump materials onto the reactor.
During the first flights, the helicopter remained stationary over the reactor while dumping materials. As the dose rates received by the helicopter pilots during this procedure were too high, it was decided that the materials should be dumped while the helicopters travelled over the reactor. This procedure caused additional destruction of the standing structures and spread the contamination. Boron carbide was dumped in large quantities from helicopters to act as a neutron absorber and prevent any renewed chain reaction. Dolomite was also added to act as heat sink and a source of carbon dioxide to smother the fire. Lead was included as a radiation absorber, as well as sand and clay which it was hoped would prevent the release of particulates. While it was later discovered that many of these compounds were not actually dropped on the target, they may have acted as thermal insulators and precipitated an increase in the temperature of the damaged core leading to a further release of radionuclides a week later.
A system was installed by 5 May to feed cold nitrogen to the reactor space, to provide cooling and to blanket against oxygen. By 6 May the core temperature had fallen and there was sharp reduction in the rate of radionuclide release. In addition, work began on a massive reinforced concrete slab with a built-in cooling system beneath the reactor. This involved digging a tunnel from underneath unit 3. About 400 people worked on this tunnel which was completed in 15 days, allowing the installation of the concrete slab. This slab would not only be of use to cool the core if necessary, it would also act as a barrier to prevent penetration of melted radioactive material into the groundwater.
In addition to the two workers that had died from the explosions on the day of the accident, by the end of July, six firemen and a further 22 plant staff (including one person that was at the site on business) had died of acute radiation poisoning as a result of the accident.
Timeline
The timeline which follows has been compiled following a review of a large number of reports and it represents what is considered the most likely sequence of events, but there remain some uncertainties.
| April 25 | |
| 01:06 | The scheduled shutdown of the reactor started. Gradual lowering of the power level began. |
| 03:47 | Lowering of reactor power halted at 1600 MW (thermal). |
| 14:00 | The emergency core cooling system (ECCS) was isolated (part of the test procedure) to prevent it from interrupting the test later. The fact that the ECCS was isolated did not contribute to the accident; however, had it been available it might have reduced the impact slightly. The power was due to be lowered further; however, the controller of the electricity grid in Kiev requested the reactor operator to keep supplying electricity to enable demand to be met. Consequently, the reactor power level was maintained at 1600 MWt and the experiment was delayed. Without this delay, the test would have been conducted during the day shift. |
| 23:10 | Power reduction recommenced. |
| 24:00 | Shift change. |
| April 26 | |
| 00:05 | Power level had been decreased to 720 MWt and continued to be reduced. Although INSAG-1 stated that operation below 700 MWt was forbidden, sustained operation of the reactor below this level was not proscribed. |
| 00:28 | With the power level at about 500 MWt, control was transferred from the local to the automatic regulating system. The operator might have failed to give the 'hold power at required level' signal or the regulating system failed to respond to this signal. This led to an unexpected fall in power, which rapidly dropped to 30 MWt. |
| 00:43:27 | Turbogenerator trip signal blocked in accordance with operational and test procedures. INSAG-1 incorrectly reported this event occurring at 01:23:04 and stated: "This trip would have saved the reactor." However, it is more likely that disabling this trip only delayed the onset of the accident by 39 seconds. |
| 01:00 | The reactor power had risen to 200 MWt and stabilised. Although the operators may not have known it, the required operating reactivity margin (ORM) of 15 rods had been violated. The decision was made to carry out the turbogenerator rundown tests at a power level of about 200 MWt. |
| 01:03 | A standby main circulation pump was switched into the left hand cooling circuit in order to increase the water flow to the core (part of the test procedure). |
| 01:07 | An additional cooling pump was switched into the right hand cooling circuit (part of the test procedure). Operation of additional pumps removed heat from the core more quickly leading to decreased reactivity, necessitating further absorber rod removal to prevent power levels falling. The pumps delivered excessive flow to the point where they exceeded their allowed limits. Increased core flow led to problems with the level in the steam drum. |
| 01:19 (approx.) | The steam drum level was still near the emergency level. To compensate, the operator increased feedwater flow. This raised the drum level, but further reduced reactivity to the system. The automatic control rods went up to the upper tie plate to compensate but further withdrawal of manual rods was required to maintain the reactivity balance. System pressure began to fall and, to stabilise pressure, the steam turbine bypass valve was shut off. Since the operators were having trouble with the pressure and level control, they deactivated the automatic trip systems to the steam drum around this time. |
| 01:22:30 | Calculations performed after the accident found that the ORM at this point proved to be equal to eight control rods. Operating policy required that a minimum ORM of 15 control rods be inserted in the reactor at all times. |
| 01:23 (approx.) | Reactor parameters stabilised. The unit shift supervisors considered that preparations for the tests had been completed and, having switched on the oscilloscope, gave the order to close the emergency stop valves. |
| April 26: the test | |
| 01:23:04 | Turbine feed valves closed to start turbine coasting. This was the beginning of the actual test. According to Annex I of INSAG-7, for the following approximately 30 seconds of rundown of the four coolant pumps, "the parameters of the unit were controlled, remained within the limits expected for the operating conditions concerned, and did not require any intervention on the part of the personnel." |
| 01:23:40 | The emergency button (AZ-5) was pressed by the operator. Control rods started to enter the core, increasing the reactivity at the bottom of the core. |
| 01:23:43 | Power excursion rate emergency protection system signals on; power exceeded 530 MWt. |
| 01:23:46 | Disconnection of the first pair of main circulating pumps (MCPs) being 'run down', followed immediately by disconnection of the second pair. |
| 01:23:47 | Sharp reduction in the flow rates of the MCPs not involved in the rundown test and unreliable readings in the MCPs involved in the test; sharp increase of pressure in the steam separator drums; sharp increase in the water level in the steam separator drums. |
| 01:23:48 | Restoration of flow rates of MCPs not involved in the rundown test to values close to the initial ones; restoration of flow rates to 15% below the initial rate for the MCPs on the left side which were being run down; restoration of flow rates to 10% below the initial rate for one of the other MCPs involved in the test and unreliable readings for the other one; further increase of pressure in the steam separator drums and of water level in the steam separator drums; triggering of fast acting systems for dumping of steam to condensers. |
| 01:23:49 | Emergency protection signal 'Pressure increase in reactor space (rupture of a fuel channel)'; 'No voltage - 48 V' signal (no power supply to the servodrive mechanisms of the EPS); 'Failure of the actuators of automatic power controllers Nos 1 and 2' signals. |
| 01:24 | From a note in the chief reactor control engineer's operating log: "01:24: Severe shocks; the RCPS rods stopped moving before they reached the lower limit stop switches; power switch of clutch mechanisms is off." |
The following Figure is taken from INSAG-1, Summary Report on the Post-Accident Review Meeting on the Chernobyl Accident (International Atomic Energy Agency, September 1986) and shows the timeline of reactor parameters in the simulation of the Chernobyl accident. Click on the image for a larger version.
Further Information
Notes
a. Much of the account in this Appendix is based on the International Atomic Energy Agency's INSAG-7 report (see Reference 1 below), which maintains that the operating rules were violated by the operators. However, there remains considerable uncertainty over whether or not they did comply with procedures, since the operating procedures themselves were ambiguous. The plant's Deputy Chief Engineer at that time, Anatoly Diatlov, acknowledged that he took the decision to run the test at a lower power level than he had originally planned, but argued that the lower power level was permitted by the regulations2. [Back]
b. The drop in power occurred at 00:28 on 26 April during transfer from local to global power control. The INSAG-7 report (see Reference 1 below) states: "The INSAG-1 report describes the precipitous fall in power to 30 MW(th) as being due to an operator error. Recent reports suggest that there was no operator error as such; the SCSSINP Commission report (Annex I, Sections 1-4.6, 1-4.7) refers to an unknown cause and inability to control the power, and A.S. Dyatlov, former Deputy Chief Engineer for Operations at the Chernobyl plant, in a private communication refers to the system not working properly." [Back]
c. Xenon poisoning was a significant contributor to the Chernobyl accident. Xenon-135 is produced in the reactor by the decay of the fission product iodine-135 (I-135). As I-135 has a half-life of 6.7 hours, Xe-135 will continue to build up after a reactor has been shut down. (Xe-135 itself has a half-life of 9.2 hours, so will eventually decay.) Xe-135 is a very strong neutron absorber and is 'burned' in the process of absorbing neutrons. During normal operation, the production of Xe-135 is balanced by the reaction rate. When the power of the Chernobyl 4 reactor dropped at 00:28 on 26 April, Xe-135 would have built up making it difficult to raise the reactor power. Attempts to raise the reactor power at this point led to so many control rods being withdrawn that the emergency protection system was brought to a state where termination of the nuclear reaction could not be guaranteed. [Back]
d. The operating reactivity margin (ORM) is simply the number of equivalent control rods remaining in the core. According to the INSAG-7 report (see Reference 1 below): "The definition is not precise, and the importance of the quantity for the safety of the plant seems to have been poorly understood by the operators [...] The magnitude of the ORM was not conveniently available to the operator, nor was it incorporated into the reactor's protection system." [Back]
e. It is possible that the design of the RBMK emergency protection system control rods was responsible for triggering the power surge that initiated the accident. A lower graphite 'displacer' is attached to the ends of the boron carbide absorber rods to prevent coolant water from entering the space vacated as the rod is withdrawn, thereby adding to the reactivity worth of the rod. As a fully withdrawn rod is inserted, an area at the bottom of the core that initially contains water (neutron absorbing) is replaced by the graphite displacer, adding to the reactivity in this region. According to the INSAG-7 report (see Reference 1 below): "The dimensions of rod and displacer were such that when the rod was fully extracted the displacer sat centrally within the fuelled region of the core with 1.25 m of water at either end. On receipt of a scram signal causing a fully withdrawn rod to fall, the displacement of water from the lower part of the channel as the rod moved downwards from its upper limit stop position caused a local insertion of positive reactivity in the lower part of the core. The magnitude of this 'positive scram' effect depended on the spatial distribution of the power density and the operating regime of the reactor." This effect had been identified at the Ignalina plant in 1983 and restrictions on the complete withdrawal of control and safety rods were intended to be imposed. However, "such restrictions were never imposed and apparently the matter was forgotten." See also see Post accident changes to the RBMK section in the information page on RBMK Reactors.
The Report by a Commission to the USSR State Committee for the Supervision of Safety in Industry and Nuclear Power (SCSSINP), Annex I of INSAG-7, states: "The event which initiated the accident was the pressing of the EPS-5 [scram] button when the RBMK-1000 reactor was operating at low power with a greater than permissible number of manual control rods withdrawn from the reactor." [Back]
f. It has not been established why the scram button (EPS-5, also referred to as AZ-5) was pressed at 1:23:40. Annex I of the INSAG-7 report (see Reference 1 below), Report by a Commission to the USSR State Committee for the Supervision of Safety in Industry and Nuclear Power (SCSSINP), states: "Neither the reactor power nor the other parameters (pressure and water level in the steam separator drums, coolant and feedwater flow rates, etc.) required any intervention by the personnel or by the engineered safety features from the beginning of the tests until the EPS-5 button was pressed." The report adds: "The Commission was unable to establish why the button was pressed." However, according to Anatoly Diatlov, the plant's Deputy Chief Engineer at that time: "There was actually one reason for dropping the protection rods: a wish to shut down the reactor when work was finished"3. [Back]
g. Most reports refer to a graphite fire. However, it is highly unlikely that the graphite itself burned. According to the General Atomics website: "It is often incorrectly assumed that the combustion behaviour of graphite is similar to that of charcoal and coal. Numerous tests and calculations have shown that it is virtually impossible to burn high-purity, nuclear-grade graphites." On Chernobyl, the same source states: "Graphite played little or no role in the progression or consequences of the accident. The red glow observed during the Chernobyl accident was the expected color of luminescence for graphite at 700°C and not a large-scale graphite fire, as some have incorrectly assumed."
While INSAG-1 states that the fires were extinguished at 05:00 on the day of the accident, many accounts report that the 'graphite fire' burned for nine days before being extinguished. [Back]
References
1. INSAG-7, The Chernobyl Accident: Updating of INSAG-1, A report by the International Nuclear Safety Advisory Group, International Atomic Energy Agency, Safety Series No. 75-INSAG-7, 1992, (ISBN: 9201046928) [Back]
2. Anatoly Diatlov, Why INSAG has still got it wrong, Nuclear Engineering International (September 1995, republished April 2006) [Back]
3. Ibid. [Back]
4. Summary Report on the Post-Accident Review Meeting on the Chernobyl Accident, Report by the International Nuclear Safety Advisory Group, Safety Series No. 75-INSAG-1, International Atomic Energy Agency, 1986, (ISBN: 9201231865) [Back]