To the South-east of the plant, an artificial lake of some 22 km2, situated beside the river Pripyat, a tributary of the Dniepr, was constructed to provide cooling water for the reactors.

This area of Ukraine is described as Belarussian-type woodland with a low population density. About 3 km away from the reactor, in Pripyat, there were 49,000 inhabitants. The town of Chernobyl, which had a population of 12,500, is about 15 km to the South-east of the complex. Within a 30-km radius of the power plant, the total population was between 115,000 and 135,000.

The RBMK-1000 reactor

The RBMK-1000 (Figure 2) is a Soviet designed and built graphite moderated pressure tube type reactor, using slightly enriched (2 per cent uranium-235) uranium dioxide fuel. It is a boiling light water reactor, with

direct steam feed to the turbines, without an intervening heat-exchanger. Water pumped to the bottom of the fuel channels boils as it progresses up the pressure tubes, producing steam which feeds two 500-MW(e) [megawatt electrical] turbines. The water acts as a coolant and also provides the steam used to drive the turbines. The vertical pressure tubes contain the zirconium-alloy clad uranium-dioxide fuel around which the cooling water flows. A specially designed refuelling machine allows fuel bundles to be changed without shutting down the reactor.

The moderator, whose function is to slow down neutrons to make them more efficient in producing fission in the fuel, is constructed of graphite. A mixture of nitrogen and helium is circulated between the graphite blocks largely to prevent oxidation of the graphite and to improve the transmission of the heat produced by neutron interactions in the graphite, from the moderator to the fuel channel. The core itself is about 7 m high and about 12 m in diameter. There are four main coolant circulating pumps, one of which is always on standby. The reactivity or power of the reactor is controlled by raising or lowering 211 control rods, which, when lowered, absorb neutrons and reduce the fission rate. The power output of this reactor is 3,200 MW(t) [megawatt thermal] or 1,000 MW(e), although there is a larger version producing 1,500 MW(e). Various safety systems, such as an emergency core cooling system and the requirement for an absolute minimal insertion of 30 control rods, were incorporated into the reactor design and operation.

The most important characteristic of the RBMK reactor is that it possesses a "positive void coefficient". This means that if the power increases or the flow of water decreases, there is increased steam production in the fuel channels, so that the neutrons that would have been absorbed by the denser water will now produce increased fission in the fuel. However, as the power increases, so does the temperature of the fuel, and this has the effect of reducing the neutron flux (negative fuel coefficient). The net effect of these two opposing characteristics varies with the power level. At the high power level of normal operation, the temperature effect predominates, so that power excursions leading to excessive overheating of the fuel do not occur. However, at a lower power output of less than 20 per cent of the maximum, the positive void coefficient effect is dominant and the reactor becomes unstable and prone to sudden power surges. This was a major factor in the development of the accident.

Events leading to the accident (IA86, IA86a)

The Unit 4 reactor was to be shutdown for routine maintenance on 25 April 1986. It was decided to take advantage of this shutdown to determine whether, in the event of a loss of station power, the slowing turbine could provide enough electrical power to operate the emergency equipment and the core cooling water circulating pumps, until the diesel emergency power supply became operative. The aim of this test was to determine whether cooling of the core could continue to be ensured in the event of a loss of power.

This type of test had been run during a previous shut-down period, but the results had been inconclusive, so it was decided to repeat it. Unfortunately, this test, which was considered essentially to concern the non-nuclear part of the power plant, was carried out without a proper exchange of information and co-ordination between the team in charge of the test and the personnel in charge of the operation and safety of the nuclear reactor. Therefore, inadequate safety precautions were included in the test programme and the operating personnel were not alerted to the nuclear safety implications of the electrical test and its potential danger.

The planned programme called for shutting off the reactor's emergency core cooling system (ECCS), which provides water for cooling the core in an emergency. Although subsequent events were not greatly affected by this, the exclusion of this system for the whole duration of the test reflected a lax attitude towards the implementation of safety procedures.

As the shutdown proceeded, the reactor was operating at about half power when the electrical load dispatcher refused to allow further shutdown, as the power was needed for the grid. In accordance with the planned test programme, about an hour later the ECCS was switched off while the reactor continued to operate at half power. It was not until about 23:00 hr on 25 April that the grid controller agreed to a further reduction in power.

For this test, the reactor should have been stabilised at about 1,000 MW(t) prior to shut down, but due to operational error the power fell to about 30 MW(t), where the positive void coefficient became dominant. The operators then tried to raise the power to 700-1,000 MW(t) by switching off the automatic regulators and freeing all the control rods manually. It was only at about 01:00 hr on 26 April that the reactor was stabilised at about 200 MW(t).

Although there was a standard operating order that a minimum of
30 control rods was necessary to retain reactor control, in the test only 6-8 control rods were actually used. Many of the control rods were withdrawn to compensate for the build up of xenon which acted as an absorber of neutrons and reduced power. This meant that if there were a power surge, about
20 seconds would be required to lower the control rods and shut the reactor down. In spite of this, it was decided to continue the test programme.

There was an increase in coolant flow and a resulting drop in steam pressure. The automatic trip which would have shut down the reactor when the steam pressure was low, had been circumvented. In order to maintain power the operators had to withdraw nearly all the remaining control rods. The reactor became very unstable and the operators had to make adjustments every few seconds trying to maintain constant power.

At about this time, the operators reduced the flow of feedwater, presumably to maintain the steam pressure. Simultaneously, the pumps that were powered by the slowing turbine were providing less cooling water to the reactor. The loss of cooling water exaggerated the unstable condition of the reactor by increasing steam production in the cooling channels (positive void coefficient), and the operators could not prevent an overwhelming power surge, estimated to be
100 times the nominal power output.

The sudden increase in heat production ruptured part of the fuel and small hot fuel particles, reacting with water, caused a steam explosion, which destroyed the reactor core. A second explosion added to the destruction two to three seconds later. While it is not known for certain what caused the explosions, it is postulated that the first was a steam/hot fuel explosion, and that hydrogen may have played a role in the second.

The accident

The accident occurred at 01:23 hr on Saturday, 26 April 1986, when the two explosions destroyed the core of Unit 4 and the roof of the reactor building.

In the IAEA Post-Accident Assessment Meeting in August 1986 (IA86), much was made of the operators' responsibility for the accident, and not much emphasis was placed on the design faults of the reactor. Later assessments (IA86a) suggest that the event was due to a combination of the two, with a little more emphasis on the design deficiencies and a little less on the operator actions.

The two explosions sent a shower of hot and highly radioactive debris and graphite into the air and exposed the destroyed core to the atmosphere. The plume of smoke, radioactive fission products and debris from the core and the building rose up to about 1 km into the air. The heavier debris in the plume was deposited close to the site, but lighter components, including fission products and virtually all of the noble gas inventory were blown by the prevailing wind to the North-west of the plant.

Fires started in what remained of the Unit 4 building, giving rise to clouds of steam and dust, and fires also broke out on the adjacent turbine hall roof and in various stores of diesel fuel and inflammable materials. Over 100 fire-fighters from the site and called in from Pripyat were needed, and it was this group that received the highest radiation exposures and suffered the greatest losses in personnel. These fires were put out by 05:00 hr of the same day, but by then the graphite fire had started. Many firemen added to their considerable doses by staying on call on site. The intense graphite fire was responsible for the dispersion of radionuclides and fission fragments high into the atmosphere. The emissions continued for about twenty days , but were much lower after the tenth day when the graphite fire was finally extinguished.

The graphite fire

While the conventional fires at the site posed no special firefighting problems, very high radiation doses were incurred by the firemen. However, the graphite moderator fire was a special problem. Very little national or international expertise on fighting graphite fires existed, and there was a very real fear that any attempt to put it out might well result in further dispersion of radionuclides, perhaps by steam production, or it might even provoke a criticality excursion in the nuclear fuel.

A decision was made to layer the graphite fire with large amounts of different materials, each one designed to combat a different feature of the fire and the radioactive release. Boron carbide was dumped in large quantities from helicopters to act as a neutron absorber and prevent any renewed chain reaction. Dolomite was also added to act as heat sink and a source of carbon dioxide to smother the fire. Lead was included as a radiation absorber, as well as sand and clay which it was hoped would prevent the release of particulates. While it was later discovered that many of these compounds were not actually dropped on the target, they may have acted as thermal insulators and precipitated an increase in the temperature of the damaged core leading to a further release of radionuclides a week later.

By May 9, the graphite fire had been extinguished, and work began on a massive reinforced concrete slab with a built-in cooling system beneath the reactor. This involved digging a tunnel from underneath Unit 3. About four hundred people worked on this tunnel which was completed in 15 days, allowing the installation of the concrete slab. This slab would not only be of use to cool the core if necessary, it would also act as a barrier to prevent penetration of melted radioactive material into the groundwater.

In summary, the Chernobyl accident was the product of a lack of "safety culture". The reactor design was poor from the point of view of safety and unforgiving for the operators, both of which provoked a dangerous operating state. The operators were not informed of this and were not aware that the test performed could have brought the reactor into explosive conditions. In addition, they did not comply with established operational procedures. The combination of these factors provoked a nuclear accident of maximum severity in which the reactor was totally destroyed within a few seconds.