Bench Degree·NUCLEAR POWERchapter

Chapter 16: Chernobyl and Fukushima

The other two, and the two everybody has heard of. A design flaw the operators were never told about, in a reactor that should never have had one. And a wall 5.7 m (19 ft) high because somebody chose that number, when the plant down the coast chose 14.8 m (49 ft) and survived.

These are the two accidents that decided what the public believes nuclear power to be, and neither of them is the story it is remembered as. One was a reactor with a property no Western power reactor has, standing in an industrial hall that was not a containment building, run by people who had never been told what the emergency stop button would do for its first four seconds. The other was three reactors that rode out a magnitude 9.1 earthquake exactly as designed and were then drowned by a wave nobody had budgeted for.

The scheme both of them defeated is defence in depth: independent barriers, arranged so that no single failure reaches the public. Chapter 15 is recommended first, where Windscale and Three Mile Island each found a different way through it. These two found two more, and Section 3 sets all four out together.

Section 1: Chernobyl, 1986. A Flaw That Was Known and Not Disclosed

The machine. Unit 4, an RBMK-1000: 3,200 MW thermal, 1,000 MW electrical. Graphite moderator, boiling light water coolant in vertical pressure tubes, 2 percent enriched fuel, refuelled while running, and no containment building. The reactor sat in an industrial hall under a shield of removable concrete blocks.

Chapter 10’s table already gave the fatal property. Graphite moderates and water does not. In this lattice the water is a net absorber of neutrons, so boiling it away removes an absorber and raises reactivity. The void coefficient was positive, and at low power it was worth roughly plus four and a half dollars, which by Chapter 8’s definition means the reactor could reach prompt critical on voiding alone.

The second flaw was in the control rods. Each rod had a graphite displacer about 4.5 m (15 ft) long below the absorber section, with a short water column below that. The purpose was to keep water out of the channel when the rod was withdrawn, improving the neutron economy. The consequence was that inserting a fully withdrawn rod pushed graphite into the bottom of the core first, displacing water, which is an absorber, and therefore adding reactivity at the bottom of the core for the first several seconds of a scram.

This was known. It had been observed in a test at the Ignalina plant in 1983. The operators at Chernobyl were not told.

The third flaw was speed. Full rod insertion took 18 to 21 seconds, against about 2 seconds for a Western pressurised water reactor.

And the fourth was instrumentation. The operating reactivity margin, the amount of rod worth that had to remain inserted, was the single most safety-critical parameter in the machine and there was no real-time display of it. It was computed periodically.

The mechanism, in order.

The test being run was an electrical one: whether the main coolant pumps could be carried by the turbine generator coasting down during a loss of station power. It was scheduled for the daytime and delayed about ten hours because the grid dispatcher needed the electricity.

That delay is where Chapter 11 comes in. The reactor had spent hours at reduced power, so xenon-135 had built up. At 00:28 on 26 April, during a transfer between control systems, power fell to around 30 MW thermal, effectively nothing. To recover against the xenon, the operators withdrew nearly all the control rods. The operating reactivity margin fell to the equivalent of about 8 rods against a required minimum of 30.

The reactor was now at about 200 MW thermal, far below the intended test power, with almost nothing inserted, and with all eight main circulation pumps running, which meant high coolant flow, little boiling, and therefore a core poised on that positive void coefficient.

At 01:23:04 the test began and steam was cut from the turbine. The pumps, now driven by a decelerating generator, slowed. Coolant flow fell. Voids formed. Reactivity rose. Power began to climb.

At 01:23:40 the operator pressed AZ-5, the scram. The graphite displacers entered the bottom of the core and added reactivity there.

Power rose by roughly a factor of a hundred in about four seconds. The reactor went prompt critical, which Chapter 8 defined as the condition where the delayed neutrons stop protecting anything. Fuel fragmented and superheated the coolant instantly. Pressure burst the fuel channels, and the upper biological shield, weighing on the order of 1,000 tonnes (2,200,000 lb), was thrown aside. A second explosion followed seconds later, most probably hydrogen from the zirconium-steam and graphite-steam reactions.

With no containment, the core was open to the sky, and the graphite burned for about ten days. Roughly 5,000 tonnes (11,000,000 lb) of sand, boron, dolomite, clay and lead were dropped from helicopters, and the effectiveness of that is genuinely disputed in the technical literature, with some analyses concluding it did little and may have insulated the core and made it hotter.

The release was around 5,300 PBq excluding noble gases, including about 85 PBq of caesium-137 and 1,760 PBq of iodine-131. Only a few percent of the core’s total inventory left, but a very large fraction of the volatile species did: essentially all the noble gases, over half the iodine, and a substantial fraction of the caesium.

The consequences are in Chapter 7 Section 2 and are not repeated here. Two killed on the night, 134 cases of acute radiation syndrome with 28 deaths within months, about 6,000 thyroid cancers among those exposed as children with 15 deaths by 2005, and a large and genuine burden of psychological and social harm. The larger projected figures, in all directions, are model outputs and are labelled as such.

What it taught. That some designs cannot be made acceptable by operating rules, and a positive void coefficient combined with no containment is one of them. That a known design flaw which is not disclosed to operators makes their compliance with procedure irrelevant. The remaining RBMKs were modified: enrichment raised to reduce the void coefficient, fixed absorbers added, scram time shortened, and interlocks fitted to prevent operation below the reactivity margin. And the World Association of Nuclear Operators was founded in 1989 specifically so that operating experience would cross national and political boundaries, which is the institutional lesson rather than the physical one.

IN PLAIN ENGLISH: Chernobyl is usually told as a story about reckless operators, and Three Mile Island as a story about confused ones. Neither is right, and the two are opposites. At Three Mile Island the machine was sound and the operators could not see what it was doing, so they did a sensible thing that happened to be wrong. At Chernobyl the operators were doing something they should not have been doing, and the machine had a property they had never been told about which turned the emergency stop button into an accelerator for four seconds. In the first case, better information would have prevented it. In the second, better behaviour on the night would have delayed it, and only a different reactor would have prevented it.

Section 2: Fukushima Daiichi, 2011. The Reactors Worked and the Wall Was Too Low

The machine. Six boiling water reactors. On 11 March 2011 Units 1, 2 and 3 were operating, Units 4, 5 and 6 were shut down, and Unit 4’s fuel was in its spent fuel pool.

What went right, and it needs saying first because it is routinely omitted. At 14:46 a magnitude 9.1 earthquake struck about 180 km (110 miles) offshore. All three operating reactors scrammed correctly. The seismic design was adequate and the reactors survived the shaking. The external grid connections were destroyed, and twelve of the thirteen emergency diesel generators started and ran. For roughly forty minutes the station was in a well-understood condition with its safety systems working.

Then the tsunami arrived, in two waves about 41 and 50 minutes after the earthquake.

The numbers are the whole accident.

The seawater pumps were destroyed, which removed the ultimate heat sink: the place all the heat had to eventually go. The emergency diesels and their electrical switchgear were in basements and were flooded. Station blackout at 15:37.

And then Chapter 13’s decay heat did the rest, exactly as Chapter 13 said it would.

Unit 1 had an isolation condenser, a passive system that condenses steam and returns the water by gravity, needing no pumps. Its isolation valves were DC-operated and closed on loss of power. Restoring them required entering a dark, flooding building and operating valves the crew had never used in a real event. It was not restored in time. The core uncovered within a few hours, the cladding reached the 1,200 °C (2,190 °F) at which Chapter 10’s zirconium-steam reaction runs away, the fuel melted, and the hydrogen produced accumulated in the upper reactor building. It exploded at 15:36 on 12 March.

Units 2 and 3 had steam-driven reactor core isolation cooling pumps, which use the reactor’s own decay heat to drive a small turbine and need only battery power for their valves. Unit 3’s ran about 20 hours; Unit 2’s ran about 70. Both eventually failed, and both cores melted. Unit 3’s building exploded at 11:01 on 14 March.

Unit 4’s building exploded at 06:14 on 15 March, and it had no fuel in its reactor at all. Hydrogen from Unit 3 had travelled through the standby gas treatment ductwork the two units shared. A shared system created a dependency nobody had modelled, which is the single most transferable engineering lesson of the accident.

Venting made it worse in a specific and avoidable way. As containment pressure exceeded design, it had to be vented. Doing so required manually operating valves in high radiation with no power, and the hardened vent lines discharged into the reactor building rather than directly to the stack. The hydrogen that blew the buildings up was hydrogen that the venting system delivered there.

The release was about 15 PBq of caesium-137, roughly one-sixth of Chernobyl’s, and 120 to 160 PBq of iodine-131.

The consequences, from Chapter 7. The earthquake and tsunami killed about 19,750 people with about 2,550 missing. The reactor accident killed none of them by radiation. About 160,000 people were evacuated and roughly 2,300 deaths in Fukushima prefecture are officially classified as disaster-related, mostly elderly people harmed by the evacuation itself.

And the comparison that settles what kind of event this was. The Onagawa plant was closer to the epicentre and took a comparable tsunami. It shut down safely and sheltered several hundred local residents in its gymnasium for months. Its site was at 14.8 m (49 ft) because an engineer named Yanosuke Hirai insisted on that level in the 1960s against cost pressure, on the basis of a historical tsunami record. Same ocean, same day, different number in a specification.

The Japanese Diet’s independent investigation commission concluded in 2012 that this was a profoundly man-made disaster, and identified the regulatory relationship as a root cause: TEPCO’s own 2008 internal assessment had found tsunami heights above 15 m (49 ft) plausible and had not acted on it.

What it taught. That redundancy is not diversity: three diesel generators in the same basement are, against a flood, one diesel generator. That external events are common-cause events and defeat the independence that defence in depth assumes. That the design basis is a choice and must be revisited against new evidence rather than treated as settled. That shared systems create unmodelled paths. And, from Chapter 7, that evacuation is itself a hazard to be weighed rather than a free precaution.

The industry response was portable rather than fixed: fleets of trucked-in pumps, generators and hoses, stored off site and above flood level, together with hardened vents, hydrogen recombiners and instrumentation for spent fuel pools that had not previously existed.

ON THE BENCH: The Fukushima clock, calculated

Parts: a calculator, and Chapter 13’s decay heat table. Cost: nothing. A calculation. There is no bench experiment for this and there is no point pretending. Time: forty minutes. Method. Unit 1 was a 1,380 MW thermal reactor, shut down at 14:46. Take decay heat as 6.5 percent at shutdown, 1.4 percent at one hour, 0.65 percent at one day. 1. Decay heat at shutdown: about 90 MW. At one hour: about 19 MW. At one day: about 9 MW. 2. Boiling water absorbs 2.26 MJ per kg. So at one hour after shutdown the reactor is boiling 19,000,000 / 2,260,000 kg per second, which is 8.4 kg/s, or about 30 tonnes (66,000 lb) of water every hour. 3. The reactor vessel and its associated inventory hold on the order of a hundred tonnes of water. Divide. You get a few hours before the core is uncovered with no makeup, which is what happened. 4. Now integrate over the first week. Average roughly 0.8 percent of 1,380 MW over that period, which is about 11 MW, times 604,800 seconds, gives about 6.7 TJ. Divide by 2.26 MJ per kg: about 3,000 tonnes (6,600,000 lb) of water, for one reactor, for one week. What you should conclude. The scale of the problem was not a matter of judgement or of nerve. Somebody had to deliver three thousand tonnes of water per reactor per week, into a building with no power, no lighting, no functioning instruments and a radiation field, starting within about four hours. No procedure existed for that because no design basis had required it. And do the same sum for a spent fuel pool. Unit 4’s pool held a full core’s worth of recently discharged fuel with a decay heat of a few megawatts. At 3 MW it boils about 4.8 tonnes (10,600 lb) an hour, and a pool holds a great deal more water than a reactor vessel, so it had days rather than hours. Days is why Unit 4’s fuel survived and the reactors’ did not, and it is the same thermal mass argument as the cast-iron pan in Chapter 13.

Section 3: The Through-Line

Each accident found a different way through defence in depth, and each addition to the scheme came from one of them.

And one pattern runs through all four. In every case the physical mechanism was understood by somebody before the event. Wigner energy release was known. The Davis-Besse relief valve had already stuck. The Ignalina rod test had already been done. TEPCO’s own study had already found 15.7 m (52 ft). Not one of these four accidents required new physics to explain it afterwards, and in every case the failure was in getting a known thing to the people who needed it.

SLOW DOWN. Check Your Understanding: At Three Mile Island about 45 percent of the core melted and the maximum offsite dose was around 1 mSv (100 mrem). At Chernobyl the core was destroyed and a landscape was contaminated for decades. Both are called meltdowns. Name the single physical difference that accounts for most of that gap, then read on, because the obvious answer is only half right.

The obvious answer is the containment building, and it is genuinely most of the story. TMI’s molten fuel stayed inside the vessel, inside a containment designed to hold the pressure of the entire primary inventory flashing to steam. The barrier did the job it was built for, and that is why the accident produced a millirem instead of a catastrophe.

The half that is usually missed is the energetics. Chernobyl was not a melted core in a building. It was a prompt critical power excursion that fragmented the fuel and blew the reactor open in seconds, followed by ten days of burning graphite lofting material into the air. A containment building of the type TMI had would very probably not have survived that, and even if the structure had held, the ten-day fire and the open core geometry are a different physical problem from a puddle of solidified fuel in a vessel head.

So the correct comparison is not “with containment versus without”. It is that TMI could only ever have been a melt, and Chernobyl could be an explosion, and that difference goes back to Chapter 10’s void coefficient rather than to any building. The containment mattered enormously and it was the second line of defence; the first was a lattice geometry that made a prompt critical excursion physically unavailable.

Which is why the word “meltdown” is nearly useless. It describes an outcome for the fuel and says nothing about the energy, the dispersal or the barriers, and those are the three things that decide what happens to anybody outside the fence.

Section 4: Where Public Perception and the Evidence Part Company

Chapter 7 gave the general reasons. Here are the four specific ones.

Three Mile Island is remembered as a near-catastrophe and was a demonstration that containment works. Nearly half a core melted and the public received a millirem. A barrier that succeeds is invisible, and there is no headline for a building that held.

Chernobyl is remembered as what reactors do, and it is what one reactor type did, with a void coefficient no Western power reactor has and without a containment building of a kind every Western power reactor has.

Fukushima is remembered as a radiation disaster and was a tsunami that killed about 19,750 people, alongside a reactor accident that killed nobody by radiation and roughly 2,300 by evacuation. The proportions in public memory are close to inverted.

And Windscale is barely remembered and was the largest release in British history, concealed for thirty years. That is the one that should worry a reader most, because an institution issuing reassurance while withholding the report is exactly what makes accurate reassurance unbelievable later.

Section 5: What to Carry Forward

Four accidents, four different barriers defeated, and the additions to defence in depth trace one to one.

Windscale: no containment, a procedure nobody had modelled, and a filter derided as a waste of money that turned a disaster into an accident.

Three Mile Island: an indicator wired to a command rather than a state, a level gauge accurate about the wrong vessel, and an alarm flood. No physics failed. You have built the gauge and sat through the flood.

Chernobyl: a positive void coefficient, control rods that added reactivity for the first seconds of a scram, an 18-second insertion, no containment, and a known flaw the operators were never told about. It went prompt critical, which is Chapter 8’s one dollar.

Fukushima: the reactors survived the earthquake and shut down correctly, and then decay heat met a flooded switchgear room. The wall was 5.7 m (19 ft) high because someone chose that number; the plant down the coast chose 14.8 m (49 ft) and survived.

Redundancy is not diversity, and one external event turns independent systems into a single system.

And in all four cases the mechanism was known to somebody beforehand. The recurring failure is not physics and not competence. It is getting a known thing to the person who needs it, which is why two of the four produced institutions whose whole job is that transmission.

Next: the question every reader is holding, asked directly.

Bench Degree

Get the degree without the diploma.

Learn the material, not how to pass the exam.