chernobyl – a canadian perspective library/19910101.pdf · 2 chernobyl — a canadian perspective...

Chernobyl –A Canadian Perspective

byDr. V.G. Snell and J.Q. Howieson

AECL CANDU EACL CANDU

Chernobyl –A Canadian Perspective

byDr. V.G. SnellLicensing Manager, SES-10Local Energy Systems

and

J.Q. HowiesonManager, SafetyCANDU 3 Program

Revised August 1991

What This Brochure Is All About...............................................................................................1

1. Chernobyl — The Place and the Plant ................................................................................21.1 The Chernobyl Site ................................................................................................................21.2 The Soviet Program ...............................................................................................................21.3 How a Reactor Works............................................................................................................31.4 How an RBMK Reactor Works ............................................................................................4

1.4.1 Getting the Right Conditions........................................................................................41.4.2 Containing an Accident ................................................................................................5

2. The Accident on April 26, 1986 .............................................................................................82.1 How and Why it Happened...................................................................................................8

2.1.1 A Test for Safety Sets it Off..........................................................................................82.1.2 How the Trap Was Set...................................................................................................82.1.3 The Test Begins ...........................................................................................................112.1.4 The Test Ends Disastrously .........................................................................................11

2.2 Damage to the Plant .............................................................................................................122.2.1 The Same Day .............................................................................................................122.2.2 The Next Ten Days......................................................................................................122.2.3 The Long Term............................................................................................................12

2.3 Effects on People...................................................................................................................142.3.1 Immediate Effects........................................................................................................142.3.2 Longer-Term Effects ...................................................................................................14

3. Why Things Went Wrong — Ideas of Safety...................................................................153.1 A Simple Analogy .................................................................................................................153.2 Nuclear Safety.......................................................................................................................16

4. How CANDU Stacks Up .........................................................................................................174.1 Controlling the Power ..........................................................................................................184.2 Shutting Down the Reactor .................................................................................................194.3 Containing Radioactivity .....................................................................................................214.4 The End Result .....................................................................................................................21

5. Lessons Learned........................................................................................................................21

6. References ...................................................................................................................................22

Contents

1 C H E R N O B Y L — A C A N A D I A N P E R S P E C T I V E

Before April, 1986, if the name ‘Chernobyl’ hadbeen mentioned to a Western scientist, chancesare that he or she would have no idea what itwas. It was nonetheless one of the largest andmost successful nuclear power stations in theSoviet Union, producing about 4000 millionwatts of electrical power, about the same size asthe combined Pickering A and B CANDU sta-tions near Toronto, and enough to fill theelectrical needs of millions of Soviets. TheSoviets said that Chernobyl (pronounced Cher-NO-bill) was considered a model plant,recently-built and trouble-free. On April 26,1986, it was also the location of the largest acci-dent in the history of peaceful nuclear power.When it was over, one reactor had beendestroyed, 31 people had died, the surroundingarea had been badly contaminated by radioactiveparticles, and studies had begun to predict whatmight happen to people in the long-term.

Four months later, on August 25, 1986, hun-dreds of nuclear scientists and engineersconverged on the offices of the InternationalAtomic Energy Agency (IAEA), in Vienna,Austria. For the first time since the Chernobylnuclear power station accident, we were to findout from the Soviets themselves what had reallyhappened. The answers went beyond what mostof us had ever guessed (Reference (1)). Yet tan-talizing holes in the story still remained. Now,thanks to intensive work in Canada, the U.S. and

other Western countries, as well as in the SovietUnion, many of these holes have been filled in,and we believe we know in detail what wentwrong. The Canadian work in discovering themost likely root cause of the accident has beenaccepted by most of the Western world andacknowledged by the Soviet Union.

First, however, we will go back into thenature of the Soviet nuclear program, look criti-cally and fairly at the design of the Chernobylplant, and describe the sequence of events thatnight of April 25-26. Like all accidents, it result-ed from a combination of human error anddesign weakness; like all accidents, it could havebeen stopped at a number of places and wouldnever have been heard of.

This brochure then looks at the CanadianCANDU (CANada Deuterium Uranium) reactorto see how it stacks up in its ability to toleratethe sorts of mistakes that were made atChernobyl. One of the reasons the CANDU ismore tolerant of error is that in Canada we had asevere accident in a research reactor in 1952.Although the accident caused much less damage(since the reactor was very much smaller), somehard lessons were learned and applied in theCanadian power reactors later on.

Finally we’ll look at the lessons that are beinglearned from Chernobyl by both the Soviets andourselves.

What This Brochure Is All About


1.1 The Chernobyl Site

Chernobyl itself is a small town of 12,500 peo-ple in the Ukraine region of the Soviet Union(Fig. 1 (a) & (b)). It is located about 105 kmnorth of Kiev, the major city of the Ukraine with2 1/2 million people. Chernobyl town gave itsname to the nearby Chernobyl nuclear powerstation, 15 km to the north-west, which by 1986had four of the most recent of the Soviet RBMK-type reactors in full operation, and two morebeing built. Three kilometers away from thereactors was the town of Pripyat, with 45,000people. The Pripyat River flows through the areaon its way to the Kiev reservoir.

1.2 The Soviet Program

The initials RBMK are a Russian acronymwhich translates roughly as “reactor cooled bywater and moderated by graphite”. It describesone of the two types of reactors the Soviets havebuilt for power production, the other being simi-

1. Chernobyl — The Place and the Plant

FRANCE

POLAND

HUNGARY

CZECHOSLOVAKIA

GERMANYDR

ITALY

AUSTRIA

UNITED

KINGDOM

BELGIUM

NETHERLANDS

NORWAY

SWEDEN

U N I O N O F S O V I E T

S O C I A L I S T R E P U B L I C S

ROMANIA

YUGOSLAVIA

BULGARIA

FINLAND

Chernobyl

Kiev

LUXEMBOURG

SWITZERLAND

DENMARK

GERMANYFR

✪

��

✪Nuclearplant sitePripyat

Kiev

Chernobyl

D

esna

Riv

erD

niep

rR

iver

Pripyat Rive r

KievReservoir

30 kmEvacuation Zone

Km0 10 20 30

Figure 1(b) Area nearby the Chernobyl reactor site

Figure 1(a) Chernobyl reactor

location


lar to the United States pressure vessel reactor.The RBMK type is the older of the two designs.The Soviets developed it, by themselves, fromearly models which had been first used to gener-ate plutonium for weapons, and to produce heatfor district heating.

The Soviets have a strong and growing nuclear power program. At the time of the acci-dent they generated about 10% of the world’snuclear power from 43 operating reactors, a totalof 27 thousand million watts of electricity. Theyhad under construction another 36 reactors rep-resenting 37 thousand million watts, and hadplanned another 34 reactors or 36 thousand mil-lion watts. Figure 2 shows the split by type ofreactor as of January, 1986. Even then, there wasa big shift in future plants away from theRBMK-type of reactor and toward the pressure-vessel (PWR) type of reactor. This was arecognition, we believe, that the RBMK reactorswere becoming obsolete, and were not economiccompared to modern pressure-vessel and modernpressure-tube concepts.

1.3 How a Reactor Works

Before we describe the RBMK reactor and theaccident, it’s worth reviewing the major parts of

a nuclear generating station. Let’s start by com-paring it with a simple gasoline-poweredportable generator that people use in cottagesand on trips (Figure 3). The motor burns gaso-line, and uses the energy of the hot gasesproduced to move pistons. Since the pressuresfrom the burning gasoline are high, the engineencloses the “reaction” in strong cylinders. Thepistons turn a crankshaft, which in turn spins anelectrical generator. The electricity in turn can beused to run lights, work a refrigerator, etc. Youcontrol the power of the engine by a throttlewhich varies the rate at which gasoline is fedinto the engine.

The basic principles are: using a fuel to heatup a fluid (gas), and then using the energy of thefluid to spin a generator. The same principles areused in a nuclear power reactor — of course thescale is vastly different. The fuel is uranium.Small particles called neutrons split the uraniumatoms; this produces heat, and more neutrons,which keep the reactor going. The heat turnswater to steam, and the energy of the hot steamspins a turbine (it’s more efficient than a piston)which in turn spins an electrical generator. Sincethe hot steam is at high pressure, it must be keptin a strong container. You control the power ofthe reactor by changing the number of neutrons.The power is steady if the number of neutronsproduced exactly matches the number used up. Ifmore are used up than produced, the reactorshuts down; if more are produced than used up,the power increases. There are lots of materialswhich are very good at absorbing neutrons, forexample boron (found in household borax), andthese are used in making reactor “throttles”.Usually they are formed into rods, and by mov-ing these control rods in or out of the reactor,you can move the power down or up.

We mentioned that a strong container is need-ed to hold the uranium and the hot water. In theRBMK reactors, the containers consist of about1600 small (4 inch diameter) pipes, called pres-sure tubes. In the other type of Soviet reactor, thecontainer is a single huge pressure vessel, con-taining all the uranium and hot water in a largepot. Both concepts are used elsewhere —Canada, Korea, Argentina, Japan, the UnitedKingdom, India, Pakistan and Italy all haveexperience with pressure tube reactors of onesort or another, and the U.S., France, Germanyand many other countries have built pressure-vessel reactors.

Operating Construction Planned

27

8 7

43

36 34

RBM

KPW

R

40

Num

ber o

f rea

ctor

s

0

20

Figure 2 The Soviet Reactor Program (10% of the world’s nuclear program)

Source: Japan Atomic Industrial Forum


1.4 How an RBMK Reactor Works

1.4.1 Getting the Right Conditions If you just put blocks of uranium together, andtried to split uranium atoms, you would find thatthe neutrons moved too fast and would miss theuranium atoms too easily. So all of today’s com-mercial nuclear power stations have a way ofslowing the neutrons down, by making thempass through a material called a moderator. InCanadian reactors, this moderator is a specialtype of water, called heavy water (it is 10%heavier than ordinary water); in U.S. pressure-vessel reactors, it is an extra supply of ordinarywater; in the RBMK reactor, it is a solid calledgraphite. It’s the same graphite that you writewith when you use a pencil, except purer — bothreactor graphite and pencil graphite are forms ofcarbon, which is what is burned as briquettes ina charcoal barbecue.

So the heart or core of an RBMK reactor con-sists of a huge container, about as big as aCanadian house, filled with graphite blocks. Theblocks are pierced by about 1660 vertical holes,

in which the pressure tubes and the throttles, orcontrol rods, fit (Figure 4). As neutrons split theuranium atoms, the uranium fuel gets hot. Wateris pumped from the bottom of the pressure tubesover the fuel. It removes the heat from the fuel,turns to steam in the process, and leaves thereactor core at the top. From there it goesthrough pipes and gives up its energy to spin twolarge turbines, in an adjacent building (Figure 5).The turbines in turn spin electrical generators,and the cooled water goes back into the reactoragain. All the reactor itself does is the mundanejob of boiling water.

As in all pressure tube reactors, some (about5%) of the heat produced by the uranium leaksout to the moderator. In the CANDU reactors,where the moderator water is separate from thecooling water, the moderator heat is removed byan independent moderator cooling circuit, con-sisting of special pumps which circulate themoderator water through coolers, and pump itback into the reactor core — like a transmissionoil cooler in a car. The coolers keep the modera-tor temperature at about 70°C, or the same as

Portable GeneratorGas

Throttle

Generator

Uranium Fuel

Reactor Turbine Generator

Piston

Control Rods

Local electricity generation Central electricity generation

Figure 3


from a hot tap. Obviously you can’t do that withsolid graphite. In the RBMK design, the graphiteoperates at a high temperature — about 700°C— and if you could see it, it would be glowingfaintly red-hot. This heat flows slowly from thegraphite back through the pressure tubes, and isfinally taken away by the boiling water. Now theproblem with graphite at high temperature is thatif exposed to air, it will burn slowly, just like thecharcoal briquettes on a barbecue. So it’s veryimportant in the RBMK design to keep air awayfrom the graphite. To do this, the Soviets puttheir entire core in a sealed metal container(Figure 6), and circulate a mixture of inert gases,helium and nitrogen, which do not react with

graphite, inside the container. The container wasbuilt so it could withstand the failure of a pres-sure tube without bursting and letting in air.

1.4.2 Containing an Accident The rest of the structure in Figure 6 is justshielding, to reduce the levels of radiationaround the reactor while it is operating.Shielding is used in all reactors so that peoplecan work in the buildings the reactors are inwithout getting overexposed to radiation. On thesides of the RBMK reactor are shields made ofwater, sand, and concrete; on the bottom is aconcrete shield; and on the top another concreteshield. All the pressure tubes and control rods

Cooling system

Waterpump

Turbine Generator

Steam

Steam separator

Pressure tubeControl rod

Core

Maincirculation

pumpGraphite

Collector

Valves

Water from the emergencycooling system

Turbine Turbine hall

Unit #1 Unit #2Unit #3 Unit #4

(where the accident occurred)

ReactorbuildingCore

Figure 4 Schematic diagram of

the RBMK-1000

Figure 5 Layout of four reactor

units


are attached to this top shield, and it played akey role in the accident.

The reactor itself is placed inside a building.Now in any reactor, if a pipe carrying the waterwhich cools the uranium were to break, severalthings could happen:

a. mildly radioactive steam would escape fromthe pipe and contaminate or damage the plant;

b. since the uranium has lost its cooling water, itwould get too hot, and would be damaged;

c. radioactive material normally safely con-tained inside the uranium could escape to therest of the plant and to the outside.

This is an unacceptable risk both from a pub-lic safety and an economic point of view. Toreduce the chances of escape of radioactivematerial, designers of nuclear reactors normallyprovide several “lines of defence”:

� Exceptionally high-quality piping, plusinspection of the piping in-service to see if it

is deteriorating unexpectedly. This follows theold adage of prevention being better thancure.

� Normal control systems which, if a pipe breakdoes occur, can shut the reactor down and, inmost cases, replace the water that is being lostwithout damage to the fuel. This mitigates anaccident after it has occurred so that bothsafety and economics are respected.

� Special safety systems, which act only in anaccident, and back up the normal control sys-tems. They can shut the reactor down, andreplace water as fast as it is lost from any pipebreak. (The system which replaces lost wateris called an Emergency Core Cooling systemor ECC.) The main function of these specialsafety systems is public and worker safety, sothey are mitigating systems.

� Strong leak-tight buildings surrounding thepipes so even if they do break, and even ifradioactive material is released, the steam and

��

��

��

�

��

��

��

��

��

��

��

��

��

��

��

Steel case

Removable concrete segments of reactor building floor Pressuretube

Upper shield

Steam toseparator

Sand shield

Water shield

Graphitemoderator blocks

Lower shield

Figure 6 Cross sectional view of

reactor vault


the radioactivity are contained by the build-ings. This does not prevent plant damage, butprotects the public by accommodating anaccident. These structures are normally calledcontainment and are a safety system.

The Chernobyl unit 4 reactor had shutdownand emergency core cooling, as we shall discusslater, but had only a partial containment. Thepipes below the reactor core were inside whatthe Soviets called “leak-tight boxes”. Theseboxes were connected to a huge pool of waterunder the whole building — the “bubbler” pond,as the Soviets named it. If one of the pipes in theboxes broke, the steam would be forced into thepond, where it and any radioactive particles itcontained would be trapped in the water, and theleak-tight boxes would hold. But all the steampipes above the core were inside ordinary indus-trial buildings (Figure 7). Thus if one of thesepipes broke, particularly if the break were large,a release of radioactive steam would occur. Theamount of radioactivity released would dependon how effective the other systems — shutdownand emergency cooling — were in preventingdamage to the fuel. At first this seems hard to

understand — why not build containment aroundthe whole reactor and all its piping?

Earlier versions of the RBMK reactors, forexample the 4 units at Leningrad, do not evenhave a partial containment. The Soviet philoso-phy at the time these were built relied onaccident prevention and mitigation, and neithertheir RBMK reactors nor their U.S.-style pres-sure-vessel reactors had containment. Theaccident at the U.S. Three Mile Island plant in1979 caused a thorough review of safety in allcountries, including the USSR. While theSoviets may have already started to add contain-ment to reactors near cities, it is likely that as aresult of Three Mile Island, they confirmed thatcontainment buildings were justified at otherlocations. But the RBMK is a huge reactor —there is a tall fuelling machine at the top thatreplaces the uranium as it is used up, so thebuilding above the reactor is large — about 71meters high. The Soviets felt that to put all thisin a containment is difficult and costly. To putthe bottom pipes in containment is easier, andthis was done. So Chernobyl unit 4 represented acompromise.

��

��

��

��

��

��

��

��

��

��

��

��

��

��

��

��

��

Containment

Pool

Industrialbuilding

Separator

Shieldingbricks

Pump

Figure 7Chernobyl containment


Much of the information on the accidentsequence comes from Soviet official sources(References (1) and (2)). The Soviets have pub-lished reactor design information, in openliterature, providing the key characteristics of theRBMK, and sometimes discussing weaknesseswith exemplary frankness. Can it be checked?Yes. In Canada scientists can and have checkedthe consistency of the Soviet information on theaccident sequence and the design using our ownmathematical reactor models, and confirmed thatthe Soviet information is consistent. We also dis-covered important omissions from the Sovietpresentation in Vienna — they had left someclues, but because there were design weaknesses,they were not highlighted. We have now filled inthe blanks, and AECL’s interpretation of theaccident cause (Reference (6)) is now acceptedby many countries, and has been confirmed asplausible by independent assessments done inthe United States (by the Department of Energy)and in the United Kingdom, and by the SovietUnion (Reference (7)).

2.1 How and Why It Happened

2.1.1 A Test for Safety Sets it Off It is one of history’s ironies that the worst nucle-ar accident in the world began as a test toimprove safety. The events of April 26 started asan experiment to see how long a spinning turbinecould provide electrical power to certain systemsin the plant. The reason for the test? Well, theSoviets, in common with most of the rest of theworld, design their reactors not only to withstandan accident, but also to cope simultaneously witha loss of electric power. This may seem a littlestrange — to run out of power at a generatingstation — but in an accident the reactor is shutdown right away, so can’t generate its ownpower directly. It would normally get powerfrom the electrical supply to the station or fromthe other reactors at the same site. To ensure anextra layer of defence, it is considered that thereis a possibility that these sources have alsofailed. The normal backup is to provide dieselengines at the site to drive emergency genera-tors, just as hospitals do in case of a powerfailure. These diesels usually start up in 30 sec-onds, and for most plants this is a short enoughinterruption to keep important systems going.For the Chernobyl reactor, the Soviets felt thiswas not short enough, and they had to have

almost an uninterrupted supply. Now even withthe reactor shut down, the spinning turbine is soheavy, it takes a while to slow down, and theSoviets decided to tap the energy of the spinningturbine to generate electricity for the few sec-onds before their diesels started. The experimentwas to see how long this electricity would powerthe main pumps which keep the cooling waterflowing over the fuel.

The test had been done before, on unit 3, withno particular ill-effects on the reactor. Howeverthe electrical voltage had fallen off too quickly,so that the test was to be redone on unit 4 withimproved electrical equipment. The idea was toreduce reactor power to less than half its normaloutput, so all the steam could be put into one tur-bine; this remaining turbine was then to bedisconnected, and its spinning energy used torun some of the main pumps for a short while.At the meeting in Vienna the Soviets were atsome pains to point out that the atmosphere wasnot conducive to the operators performing a cau-tious test:

1. The test was scheduled to be done just beforea planned reactor shutdown for routine main-tenance. If the test could not be donesuccessfully this time, then the people wouldhave to wait another year for the next shut-down. Thus they felt under pressure tocomplete the test this time.

2. Chernobyl unit 4 was a model plant - of all theRBMK-1000 type plants, it ran the best. Itsoperators felt they were an elite crew and theyhad become overconfident.

3. The test was perceived as an electrical testonly, and had been done uneventfully before.Thus the operators did not think carefullyenough about the effects on the reactor. Thereis some suggestion that in fact the test wasbeing supervised by representatives of the tur-bine manufacturer instead of the normaloperators.

2.1.2 How the Trap Was Set The accident really began 24 hours earlier, sincethe mistakes made then slowly set the scene thatculminated in the explosion on April 26. Table 1shows a summary of all the things the operatorsdid and how the plant responded; here we describe the key events.

At 1 a.m. on April 25, the reactor was at fullpower, operating normally with steam going to

2. The Accident on April 26, 1986


both turbines. Permission was given to startreducing power for the test, and this was doneslowly, with the reactor reaching 50% powertwelve hours later at 1:05 in the afternoon. Atthis point only one of the two turbines was need-ed to take the steam from the reactor, and thesecond turbine was switched off.

Normally the test would then have proceeded,with the next step being to reduce power stillfurther to about 30%. However the people incharge of distribution of electricity in the USSRrefused to allow this, as apparently the electricitywas needed, so the reactor stayed at 50% powerfor another 9 hours. At 11:10 p.m. on April 25,

Table 1 — Event Sequence

TIME EVENT COMMENTS

April 25 01:00 Reactor at full power. As planned.

Power reduction began.

13:05 Reactor power 50%. As planned.All steam switched to one turbine.

14:00 Reactor power stayed at 50% for 9 hours because of unexpectedelectrical demand.

April 26 00:28 In continuing the power rundown, This caused the core to fill with water &

the operator made an error which caused allowed xenon (a neutron absorber) to the power to drop to 1%, almost build up, making it impossible to reach shutting the reactor off. the planned test power.

01:00-01:20 The operator managed to raise power The RBMK design is unstable with the to 7%. He attempted to control core filled with water — i.e., small changesthe reactor manually, causing in flow or temperature can cause large fluctuations in flow and temperature. power changes, and the capability of the

emergency shutdown is badly weakened.

01:20 The operator blocked automatic reactor He was afraid that a shutdown would shutdown first on low water level, abort the test. Repeat tests were planned,then on the loss of both turbines. if necessary, and he wanted to keep the

reactor running to do these also.

01:23 The operator tripped the remaining turbine to start the test.

01:23:40 Power began to rise. The reduction in flow as the voltage dropped caused a gradual increase in boiling leading to a power rise.

The operator pushed the manual Canadian (and other) calculations show shutdown button. that, because of the shutoff rod design,

this had exactly the opposite effect to what was expected. The power increased rapidly instead of dropping.

01:23:44 The reactor power reached about 100 The pressure in the reactor core blew the times full power, fuel disintegrated, top shield off and broke all the remaining and excess steam pressure broke pressure tubes. the pressure tubes.


the Chernobyl staff got permission to continuewith the power reduction. Unfortunately theoperator made a mistake, and instead of holdingpower at about 30%, he forgot to reset a con-troller and the power fell to about 1% — thereactor was almost shut off. This was too low forthe test. Now in all reactors, a sudden powerreduction causes a quick buildup of a materialcalled xenon in the uranium fuel. Xenon is aradioactive gas, but more important it sucks upneutrons like a sponge, and tends to hasten thereactor down the slope to complete shutdown.As well, the core was at such a low power thatthe water in the pressure tubes was not boiling,as it normally does, but was liquid instead.Liquid water has the same absorbing effect asxenon. To try to offset these two effects, theoperator pulled out almost all the control rods,and managed to struggle back up to about 7%power — still well below the level he was sup-posed to test at, but as high as he could gobecause of the xenon and water.

It was as if you were trying to drive a car withthe accelerator floored and the brakes on — it’sabnormal and unstable.

Indeed it is a very serious error in this reactordesign to try to run with all the control rods out.The main reason is that some of these same rodsare used for emergency shutdown, and if they areall pulled out well above the core, it takes toolong for them to fall back into the high-powerpart of the reactor in an emergency, and the shut-down is very slow. The Soviets said that theirprocedures were very emphatic on that point,and that “not even the Premier of the SovietUnion is authorized to run with less than 30rods!”

Nevertheless, at the time of the accident, therewas the equivalent of only 6 to 8 rods in thecore. At any rate, the operator had struggled upto 7% power by 1 a.m. on April 26, by violatingthe procedure on the control rods. He had otherproblems as well — all stemming from the factthat the plant was never intended to operate atsuch a low power. He had to take over manualcontrol of the flow of water returning from theturbine, as the automatic controllers were notoperating well at the low power. This is a com-plex task to do manually, and he never didsucceed in getting the flow correct. The reactorwas so unstable that it was close to being shutdown by the emergency rods. But since a shut-down would abort the test, the operator disabled

a number of the emergency shutdown signals. After about half an hour of trying to stabilize

the reactor, by 1:22 a.m. the operators felt thatthings were as steady as they were going to be,and decided to start the test. But first they dis-abled one more signal for automatic shutdown.Normally the reactor would shut down automati-cally if the remaining turbine were disconnected,as would occur in the test, but because the staffwanted the chance to repeat the test, they dis-abled this shutdown signal also. The remainingautomatic shutdown signals would go off onabnormal power levels, but would not reactimmediately to the test.

Let us pause briefly to see what the state ofthe reactor was. Most of the shutdown signalshad been disabled. The control/safety rods hadmostly been removed, and the power was abnor-mally low. As well, the core was filled withwater almost at the boiling point, but not quite.We mentioned that liquid water is a goodabsorber of neutrons. So if it boils suddenly(water being replaced with steam), fewer neu-trons get absorbed and the power goes up. Innormal operation, this is not a problem as thereactor is designed to cope with this change. Butat low power, with the core filled completelywith water, sudden boiling would cause a rise inpower at a time when the shutdown systems wereabnormally slow. The Canadian analysis of theaccident by Chan, Dastur, Grant, and Hopwoodof AECL and Chexal of the U.S. Electric PowerResearch Institute (EPRI), (Reference (6)),showed that this effect by itself would be toosmall to start a bad accident, but it would accel-erate a rise in power that had already started.

The Canadian/EPRI analysis in fact points toa more fundamental weakness in the shutdownsystem design. The control rods (which are alsoused for shutdown) travel in vertical tubes, andare cooled by flowing water. Normally the con-trol rod moves in and out of the reactor tocontrol the power — moving in (adding moreneutron absorber) to reduce power and out toincrease it. So as the control rod moved in, itwould replace the water, and as it moved out, itwould be replaced by water. The trouble withthis scheme is that water also absorbs neutrons,so the effect of moving the rod would be small.To enhance its effect, at the bottom end of mostof the rods, there is attached another rod, madeof graphite — called a displacer. Graphite as wehave said does not absorb neutrons very well. So


now when a control rod moves in, it replaces notwater but graphite — so its effect on the numberof neutrons is larger. And similarly when itmoves out (Fig. (8a)).

So far so good. The weakness lay in the waythis scheme worked if the reactor was not oper-ating normally. Just before the accident, most ofthe control rods were pulled out of the reactor, sofar out in fact that even the graphite section wasabove the bottom part of the reactor — the con-trol rod tubes at the bottom contained only water(Fig. (8b)). Even this would not normally matter,because very little power is usually generated atthe bottom. But Canadian simulations and thepattern of damage to the reactor suggest that justbefore the accident, most of the reactor powerwas being generated near the bottom. If the con-trol/shutoff rods were then driven slowly in, thefirst effect would be to replace water (whichabsorbs neutrons) by graphite (which does not)(Fig. (8c)).

In other words, driving in the control/shutoffrods, which was supposed to shut down the reac-tor, would have precisely the opposite effect — itwould cause a fast power increase instead. With this in mind, let us return to the sequenceof events.

2.1.3 The Test Begins At 1:23:04, the turbine was disconnected and itsenergy fed to 4 of the 8 main pumps. As itslowed down, so did the pumps, and the water inthe core, now moving more slowly over the hotfuel, began to boil. Twenty seconds later thepower started rising slowly, then faster, and at1:23:40 an operator pushed the button to drive inthe emergency rods and shut down the reactor.We do not know for sure why he did it — theindividual was one of the early casualties — butlikely he saw either the power begin to rise orthe control rods start to move slowly in to over-come the power rise. The shutdown rods beganto move in slowly. Our analysis (Reference (6))shows that this attempt to shut the reactor downin fact caused a large, fast power rise. It isacknowledged as plausible by a Soviet paper,presented at a public conference in October,1987 (Reference 7)). Within four seconds, thepower had risen to perhaps 100 times full powerand had destroyed the reactor.

2.1.4 The Test Ends Disastrously The power surge put a sudden burst of heat intothe uranium fuel, and it broke up into littlepieces. The heat from these pieces caused a rapidboiling of the cooling water, and a number of

Figure 8 Role of shutdown rods

Control rod

Coolingwater

Control rod tube

c)

a)

Normal

Just beforeaccident

Just after Shutdownbutton was pushed

b)

Graphitedisplacer

Graphite (non-absorber)displaces water (absorber)

and increases power

Reactor


pressure tubes burst under the strain. The steamescaped from the pressure tubes, burst the metalcontainer around the graphite, and lifted the con-crete shield on top of the reactor. This broke allthe remaining pressure tubes.

2.2 Damage to the Plant

2.2.1 The Same Day

The power surge destroyed the top half of thereactor core, the building immediately above thereactor, and some of the walls on either side(Figure 9(b)). The Soviets commented somewhatironically that the leak-tight compartmentsbelow the reactor survived intact.

Burning fragments of fuel and graphite werethrown out in the explosion, and landed on theroof of the adjacent turbine building, causingabout 30 fires on the asphalt roof and elsewhere.The Soviets’ first priority was to put these out,so the damage would not spread to the reactorsoperating nearby. Local firefighters had extin-guished all fires by 5 in the morning, but at aterrible personal cost: many of them were over-exposed to radiation and were among the earlycasualties.

The destruction was not, of course, caused bya nuclear explosion but by steam and perhapschemical explosions, so the damage was con-fined to unit 4. Indeed, unit 3 was keptgenerating electricity for several hours, and theother units for somewhat longer, until they wereall shut down in a controlled manner because ofthe increasing radioactive contamination of thearea.

2.2.2 The Next Ten Days

The next step was to try to cool off the damagedcore. The water pipes had been broken in theexplosion, so an attempt to flood the core withwater didn’t work. The graphite, meanwhile, hadbeen exposed to air by the destruction, and wasbeing heated by the small amount of heat com-ing from the fuel, which although broken up,was still in the reactor and piping compartments.By the second day, the graphite had begun toburn in places, as clearly seen in a film takenfrom a Soviet helicopter. Eventually about 10%of it was consumed. The burning was not alto-gether bad — it caused an air draft through thedamaged core that kept the fuel cool, but thesame air was reacting chemically with the fuel

and causing it to release radioactive particles. Sothe Soviets decided to smother the core, andfrom April 28 to May 2, flew hundreds of heli-copter sorties over the reactor, dropping 5000tons of mainly lead, sand, clay, and limestone —the idea was that these materials would trapradioactive particles before they could escape.

The materials did shield the core, but likeputting a tea cozy over an electric kettle, alsotrapped the heat, so the fuel began to heat upagain. The Soviets solved that by pumpingnitrogen into the bottom of the core. That reallydid the job — cooling off the core and puttingout the graphite fire.

The Soviets were worried about the possibili-ty of the core collapsing into the water poolbelow, causing a burst of steam. So they sentcourageous divers into the pool to open somevalves and empty it. Indeed, recent observationson the remains of the reactor showed that fuelhad melted and flowed out of the core, latersolidifying again as it cooled down. In the end,between 2% and 8% of the significant radioac-tive species of material escaped from the plant,much of it being deposited as dust or particlesclose by, and the rest being carried by wind overthe Ukraine and Europe.

2.2.3 The Long Term

With the situation stabilized, the Soviets’ nextjobs were to remove radioactivity from the siteso the other three units could be restarted, and toshield the damaged reactor more permanently.Remotely-controlled bulldozers were used toscrape off contaminated soil, buildings werewashed down with special chemicals, concretewas poured on the ground to keep down radioac-tive dust, and deep concrete walls were built inthe ground around the site to prevent contami-nated groundwater from spreading. Thedamaged reactor itself has been surrounded by aconcrete “sarcophagus”, as the Soviets called it,which shields the radiation sufficiently thatworking near it is possible. The fuel will contin-ue to generate a small amount of heat for a longtime, so fans blow cooling air through the core,and filters remove radioactive particles from theair on its way out. Figures 9 (a, b, c) show thestate of the buildings before and just after theaccident, and the burial of the damaged reactorsix months later.


a) Units 3 & 4 before the accident

b) Units 3 & 4 after the accident

Unit 4

Unit 4

Unit 4

Unit 3

Unit 3

Unit 3

c) Unit 4 burial

Figure 9 Damage from the

accident


2.3 Effects on People

2.3.1 Immediate Effects The brunt of the accident, in human terms, wasborne by the station staff and the firefighters —no member of the public received lethal doses ofradiation or even became ill from radiation. Twostation staff were killed almost immediately —one was trapped by falling masonry, and theother was badly burned in the fire. Twenty-nineothers died over the next few weeks — manyfrom severe skin damage. The combination ofordinary skin burns from the fire, and radiationdamage to the skin, proved particularly difficultto treat. Bone marrow transplants, which fea-tured so prominently in the early days after theaccident, were reported as counterproductive forsome patients, because the surgery exposed thepatients to increased risk of infection and tocomplications resulting from rejection of thetransplant. In the end the Soviets felt that themost effective treatment was Tender LovingCare — meaning individual nursing, antibiotics,very sterile surroundings, and as little dramaticintervention as possible.

2.3.2 Longer-Term Effects As the scale of the accident became apparent,and the direction of the wind veered toward pop-ulated areas near the plant, the Soviets ordered

first that people in Pripyat and other nearbytowns should stay indoors (to reduce their expo-sure to the radioactive cloud) and then decided toevacuate them. On April 27, 45,000 people fromPripyat were evacuated, followed over the nextfew days by 90,000 people living within 30 kmof the plant.

In order to appreciate the significance of radi-ation effects, we should remember that we live ina natural seal of “background” radiation (fromcosmic rays, soil, food, water and air). From it, ifwe live in Canada or Europe, we get a radiationdose of about 200 units (called millirem) a year.In some places in the world, it is much higher —in Kerala, India, the natural dose is about 1000millirem/year, because of natural radioactivity inthe soil. There are no obvious effects from thisincrease — in that area, poverty, for example,has a much larger effect on life expectancy thanradiation.

For the people evacuated from the 30 kmzone, the radiation dose they received beforeevacuation was, on average, equivalent to 60years’ worth of natural radiation in Europe; afew were as high as 200 years’ worth. The effectfell off quickly with distance, as the radioactivematerial became more and more dilute: in theregional population of 75 million in the Ukraine,the average dose was equivalent to 4 to 16 years’worth of natural radiation, and in most of

(.0001) Maximum in Canada (eating banned food)

(.003) Typical, at the Pickering nuclear plant boundary

(.100) Natural, per year, in Toronto

(.160) Natural, per year, in Banff

0 5

(1) Natural, per year, in Kerala, India

(2) Maximum dose outside USSR from Chernobyl

(40) Maximum exposure to people near the Chernobyl site during accident

(100) Doses to some people on site in Chernobyl. Nausea, no immediate death. One person in every 100 who receives 100 rem may die of cancer years later.

(1000) Rapid death for fire fighters at Chernobyl

0 100 200 300 400 500 600 700 800 900 1000

Enlarged 100 times

REM

10 REM

1 REM = 1000 milliremFigure 10(a)

Examples of radiationdose


Western Europe, the dose to people was less thanone year’s worth (Figure 10 (a)). The extensivecoverage of the accident caused widespread con-cern among people who thought they could havebeen exposed. In addition to the stress on thesepeople, what do we expect to happen to them asa physical effect of the radiation?

We know that radiation can lead to a smallincrease in the normal chance of getting cancermany years after the original exposure — but thetests which show this effect are for doses muchhigher than almost all people received in theaccident. How does one interpret these tests atlower doses? The technique used by almost allscientists is to assume that the effect of a dose ofradiation is proportional to the dose — i.e., ifthe dose is halved, the effect is halved — evendown to very small doses. The effects of smallamounts of radiation are difficult to quantifybecause they are small. Figure 10(b) quoted inReference (3) shows the incidence of cancerdeaths versus background radiation in the vari-ous U.S. states. The states with the highernatural background have the lower rate of cancerfatalities. Does this mean radiation is good foryou in small doses? More likely the effect ofradiation is swamped by other factors.Nevertheless, the predictions of cancer fatalitiesfrom Chernobyl, which we present below, are fordoses in this range — the dose to the averagepopulation of the Ukraine from Chernobyl issimilar to the increase in dose that you get byspending your life in Banff rather than Toronto,because of the increase in natural radiation expo-sure with altitude.

The Soviets’ dose figures suggest that in theevacuated population of 135,000, over the next30-40 years, about 200 people would die of can-cer from the accident — or about 1% of the17,000 people who would die of cancer fromother causes. In the regional population of 75million, the accident would increase the numberof fatal cancers by about a fifth of a per cent.The effects on the rest of Europe will be muchless than this.

At the Vienna meeting, there was consider-able debate over the Soviets’ calculations —many experts felt that their modelling of howradioactive material got into the food chain wasa large overestimate, and the Soviets concededthat the results of their calculations could be tentimes too high. Indeed more recent estimates arelower (Reference (9)). However, all the predictions are small enough that direct observa-tions of the effects are difficult — thus acontinuing follow-up of the health of theexposed people is planned. The follow-up itselfcould affect the results — if people see the doc-tor more often, illnesses which normally goundetected until too late will be caught andcured — a phenomena which was found in thefollow-up of the Hiroshima bomb survivors.

S. DakotaColorado

WyomingN. MexicoUtah

Idaho

Nebraska

Montana

Linear hypothesis

Annu

al m

alig

nant

mor

talit

y ra

te p

er 1

00 0

00 200

180

160

140

120

100 120 140 160 180 200 220 240

Natural background in m rem/year

Figure 10(b)Cancer deaths versusnatural backgroundradiation levels in theU.S. states

3. Why Things Went Wrong — Ideas of Safety

What went wrong? To be sure, the operatorsmade some mistakes. But a mistake should notlead to such disastrous consequences. The prob-lem was that the design was not forgiving ofmistakes. Let’s explore that a bit, by looking at ahousehold tool that almost every Canadian hasused — the power drill.

3.1 A Simple Analogy

Let’s assume, narrowly, that our safety concernwith a power drill is electrocution — we’llignore drilling holes in one’s hand or getting hitby broken metal. To achieve this safety goal, thefirst thing an informed consumer does is buy aquality product — the better the drill is built, theless chance there is that it will short out.Accident prevention is the most effective wayof assuring safety.


But it is not enough. Most of us want to beprotected even if an accident occurs. Modernpower drills are able to protect you from electro-cution by means of a ground plug (whichensures the housing is grounded) or by doubleelectrical insulation — so even if a wire doesshort out, you do not get a shock. This is acci-dent mitigation.

You can go even one step further, and buy aground-fault-interrupter — this plugs into thewall and the drill plugs into it in turn. It worksby measuring the difference in current betweenthe hot and neutral wires, and if there is a differ-ence, concludes the missing current must bepassing through you, and cuts it off (Figure 11).This level of safety assumes the drill has failedand accommodates that failure — accidentaccommodation.

In order for these to work well, they have tobe simple and powerful. Simple in the sensethat they shouldn’t depend on the type of fault inorder to work — e.g., which wire shorts outshouldn’t matter. Powerful in the sense that theyhave to be designed to do the job — a groundfault interrupter has to cut off the current fastenough that you are not injured.

3.2 Nuclear Safety

In a nuclear power plant, although it is muchmore complex, the same basic ideas apply. Infact, we introduced them early on in the contextof a pipe break. The safety goal is to avoid therelease of dangerous amounts of radioactivity.Since almost all the radioactivity is in the fuel,and can only get out if the fuel overheats, theneed is to control the power and keep coolingwater on the fuel.

Again, accident prevention is the mostimportant thing to do, and it is done by strictquality control in manufacture and construction,by inspecting the plant while it’s running, and byusing operating experience to fix up small prob-lems before they become large ones.

If an accident starts, the next step is to arrestit before it damages the plant. In CANDU reac-tors, the normal control systems are powerfulenough to do this for most accidents. They arebacked up by separate systems dedicated only tosafety — shutdown systems to turn off the powerif it starts to go up higher than it should (Figure 12), and emergency core cooling, toreplace cooling water if it should be lost from apipe break. These are the CANDU mitigatingsystems.

The CANDU goes one step further and allowsfor the possibility that fuel is damaged regard-less, and so it has an accommodating system —containment — also a safety system, but whoserole is to contain radioactivity released from thefuel. There is also a one-kilometer ring of landaround the reactor — called the exclusion zone— which allows dilution of any radioactivityreleased in an accident before it can get to wherepeople live (Figure 12).

Let’s now look at Chernobyl, and CANDU, inthis light.

Figure 12 CANDU reactor containment of radioactivity

Shutdown system No. 1

Reactor

Shutdownsystem No. 2

Concretecontainment

Exclusion zone

Figure 11Power drill safety

Doubleinsulation

Ground faultinterrupter

Ground plug


We are going to compare CANDU andChernobyl in three areas:

� control systems

� shutdown systems

� containment systems

to see how the ideas of simplicity and powerwere applied in both cases (Reference (8)).

A thumbnail comparison to the Chernobyldesign is given in Table 2. For a description ofCANDU safety, see Reference (4), and for ageneral description of CANDU, see Reference(5). Like Chernobyl, the CANDU uses pressuretubes to contain the fuel. But that’s where the

similarity ends. In CANDU, the tubes are hori-zontal rather than vertical; the fuel is naturaluranium rather than enriched; the coolant is aspecial form of water, called heavy water, ratherthan ordinary water; the moderator is also heavywater rather than graphite; and the steam fromthe reactor goes not directly to turbines, but toboil ordinary water in a second cooling system.While the differences in design concept areinteresting, what is more important is how safetywas approached. There are differences betweenvarious CANDU reactors — here we use theCANDU 600, as it is in operation both inCanada and in other countries.

FEATURE CHERNOBYL CANDU (typical)

Design

Coolant Ordinary water Heavy water

Steam Cycle Direct (steam & water from Indirect (hot water fromreactor are separated and reactor boils ordinary watersteam goes directly to in a boiler to steam, whichturbines) then goes to the turbine)

Fuel ~2% enriched uranium oxide Natural uranium oxide

Moderator Graphite bricks Heavy water(max. temp. 700°C) (max. temp. ~88°C)

Fuel channels Vertical, pressure-tube, Horizontal, pressure tubeno calandria tube with calandria tube

Safety Systems Containment No upper containment — Concrete building, or

lower containment is concrete multi-unit negative cells surrounding high pressure containment,pressure piping, & connected surrounding all major piping, to water pool, to reduce the with water spray (dousing) to building pressure. reduce the building pressure.

Shutdown One mechanism: Two complete systems: — absorber rods — absorber rods

— liquid injection

10 seconds to be effective 2 seconds to be effective

Effectiveness depends Effectiveness independent on state of plant of state of plant

Emergency High pressure injection High pressure injection Core Cooling driven by gas and pumps, driven by gas or pumps,

then pumped flow then pumped flow

Table 1 — Event Sequence

4. How CANDU Stacks Up


4.1 Controlling the Power

Figure 13 shows the two power control systemsschematically.

Chernobyl is a physically large core — 12 min diameter by 7 m high. It is also large in aphysics sense — that is, one part of the core canbe going up or down in power without the rest ofthe core feeling the effect. In fact, it takes only2% to 10% of the reactor to form a mini-reactorwhich behaves almost independently of the restof it. Thus the control system has to be able tohandle both the bulk power, and the spatialpower, i.e., to ensure that the power is in stepacross the core, and that the mini-reactors areacting together. This difficult job is done by amixture of computers, ordinary control circuits,and people — but the computers in Chernobylare used for monitoring only, and a combinationof ordinary control circuits and people does theday-to-day, hour-to-hour controlling based onthe information the computers present. TheSoviets mistrusted the reliability of direct com-puter control, apparently based on some badearly experience they had.

In case the mini-reactor concept seems aca-demic to you, we are fairly certain that in theaccident the reactor really behaved as two inde-pendent reactors — one at the top and one at thebottom. We believe that the shutoff rods proba-bly succeeded in shutting down the “top” reactorbut never reached the “bottom” one in time — infact they raised its power.

CANDU is a smaller core physically — lessthan half the size (6 m diameter by 6 m high) ofChernobyl. It is also a more tightly-coupledcore: specifically, it takes at least 65% of thecore to form a mini-reactor, so if there is a high-er power in one region of the core than another,the regions are large and easy to detect. Routinecontrol is through two independent computers,one always operating and the other on standby.The operators tell the computers what powerthey would like, and the computers process allthe power measurements, and operate all thecontrol rods, to achieve that. They also provideinformation to the operators on the state of theplant. The CANDU designers and owners feltthat although the CANDU can be controlledmanually, the computers were faster in response

Detectors

ComputerInformationto operator

Informationto operator

Detectors

Control rods/Liquid zones

Control rods

Some analogueautomaticcontrol

Manualcontrol

Controlpanel

Figure 13Controlling the power

Routine CANDU control Routine Chernobyl control


to off-normal conditions and less likely to makemistakes, than a human. Our experience hasborne that out — if both computers do fail, thatstation is designed so that it will shut downimmediately, and in practice double computerfailures account for an insignificant fraction ofthe downtime of the station.

In short, Chernobyl, which is more difficult tocontrol, relies much more on operators for thatcontrol. This is one reason why the Soviets wereso critical of their operators for making mistakesin the events leading up to the accident —Chernobyl is more unforgiving of such mistakes.

4.2 Shutting Down the Reactor

Perhaps no area is more dramatically differentthan emergency shutdown of the two reactors. InChernobyl, emergency shutdown relies on 24rods, held in the upper parts of the core, anddriven in, in an emergency (Figure 14). TheSoviets are reluctant to shut down these reactorscompletely, probably because of the length oftime it takes to restart them, so emergencies areclassified into five groups. For four of these

groups, the reactor is not shut down completely,but the power is reduced until the abnormal con-dition can be controlled. For the fifth group, thereactor is shut down slowly — the power goesfrom 100% to 20% in about 10 seconds.

In fact the shutdown rods are part of the con-trol system, rather than being a separateemergency system. This means there is a risk ofa fault in the control room also disabling emer-gency shutdown. Even more important, theshutdown effectiveness depends on the reac-tor being operated properly. There must be aleast 30 (other) control rods in the core for theemergency shutdown to work properly, and thereactor should not normally be run at low power.If these requirements are violated by the opera-tors, as they were in the accident, thenemergency shutdown can be slowed down con-siderably or work exactly opposite to the way itis supposed to.

In CANDU 600 (Figure 14), the closestequivalent to the Chernobyl emergency shut-down is something we call stepback. This iswhat the control system does in an abnormalcondition — it drops 4 control rods partially or

CANDU shutdown Chernobyl shutdown

Computer

AZ-5 rods (24)

Detectors

Detectors(48)

28 SDS #1 rods

SDS #2detectors (23)

30 control rods must be infor shutdown effectiveness

SDS #1detectors

(34)

Stepbackrods(4)

6 SDS #2 pipes Power after shutdown

CANDUChernobyl

100% 100%

10% 10%10sec 10sec

P PFigure 14

Shutting down thereactor


fully into the core, and can shut the reactor downfor most, but not all accidents. In addition, thereare two, independent shutdown systems. Theseare there only for safety reasons — they play nopart in the day-to-day control of the plant, and infact each system has its own power detectors,logic, and shutdown mechanism. Each system iscapable of shutting down the reactor for all acci-dents. And they are fast — either can take thepower from 100% to 10% in less than 2 seconds.They are shown schematically in the figure —the first system consists of 28 rods, which areshot by heavy springs down into the moderator,and the second consists of 6 pipes with over 200nozzles which squirt a liquid neutron absorber, athigh pressure (about 75 times tap-water pres-sure) into the moderator.

Why such a dramatic difference for CANDU?Perhaps the simplest reason is that Canada had asevere accident in a research reactor in ChalkRiver in 1952. The reactor (NRX — an experi-mental model from which the CANDUeventually evolved) was much smaller, therewere no injuries, and the damage was not nearlyas severe (in fact the core was replaced and thereactor operated continually until 1987 and stillruns periodically in a back-up role to anotherresearch reactor, NRU). The causes of the acci-dent were operator errors in incapacitating theshutdown rods, followed by a rise in power theycould not react to. The operators did manuallyfire another shutdown mechanism — quicklydraining the heavy-water moderator — althoughtoo late to prevent damage to the reactor core.

The biggest effect was on the safety philosophyof CANDU. We learned some hard lessons thenand made sure the same mistakes were notrepeated in the Canadian power reactors. Thelessons were: � keep the control and shutdown systems

independent

� keep the mechanical design simple and powerful

� ensure the shutdown systems can be testedon-power to meet stringent reliability targets.

Canada has had a unique emphasis on shut-down capability since then. Indeed the Pickering‘A’ units put into operation in the early 1970s(near Toronto, Ontario) have two separate shut-down mechanisms (shutoff rods, and quicklydraining the heavy water moderator). The shut-down is fully independent of the control and,unlike Chernobyl, capable under any accidentconditions of shutting the reactor down. Thelogic of each shutdown mechanism is not as sep-arate as in later CANDU designs. Offsetting this,the measured reliability of shutdown inPickering ‘A’ is much better than called for inthe original design requirements, and shutdownis not impaired even if a number of the rods (~6)do not work.

We mentioned that, in the Chernobyl design,increased boiling in the core increases the power(this is called a positive void coefficient). Thesame is true of CANDU, although the effect ismuch smaller. Other reactors (such as U.S. watercooled reactors) have the opposite effect — the

600 MW CANDU Chernobyl

Shieldingonly

Complete containmentenclosure

No uppercontainment

Industrialbuilding

Figure 15Containment


power goes down as the boiling increases. Is thatsafer? Not necessarily — it means that there isjust a different accident where the power goesup. For example, in a Boiling-Water Reactor(one of the two main types of U.S. reactors), ifthe steam valves on the boilers close by mistake,the reactor starts behaving like a pressure cookerwith the valve closed — the cooling water to thefuel heats up, the pressure rises and compressesthe water, and since compression is the oppositeeffect to boiling, the power goes up. So U.S.reactors must have shutdown systems to be ableto handle this. The general rule is quite simple:the shutdown systems must be powerful enoughto overcome all sources of a power increase soas to shut the reactor down in an emergency. Thelarger the effect of boiling (whether positive ornegative), the harder this is to do — it’s better tohave a small coefficient than a large one.

4.3 Containing Radioactivity

We have already mentioned that Chernobyl had apartial containment. The accident bypassed thispartial containment, with the releases all goingout through the burst-open top of the reactorcore into the region of the building where therewere no leak-tight boxes.

The CANDU 600 design (Figure 15) sur-rounds all major cooling piping with a concretebuilding designed to take the pressure of all thesteam released in an accident. The pressure inthe building is controlled by a spray of watercoming from a huge (500,000 gallon) tank in theroof of the building — the equivalent of thewater pool in Chernobyl. There is a rather subtleadvantage of enclosing all this water in a build-ing. The atmosphere in the building after anaccident will be like a rain forest during a tropi-cal storm, and the water will dissolve almost allthe radioactive iodine and cesium released. Theiodine and cesium, so trapped, will not escapeeven if the containment leaks. This chemicalreaction did not occur in Chernobyl because thehot fuel and graphite were exposed to air, andthere was no containment on top of the reactor.

4.4 The End Result

Chernobyl need not have been an unsafe design.However it had sensitive characteristics thatrequired a sophisticated control and emergencyshutdown design to keep the chance of an acci-dent sufficiently small. As we have seen, its

safety depended very heavily on operators stay-ing within certain limits. If the operators wentoutside these limits, the safety systems could beineffective in an accident, and in a very realsense, the operators would be operating blind. Ina CANDU, the capability of the safety systems isindependent of the operating state; as well, wehave more backup systems, especially for shut-down. In that sense, CANDU is a much moreforgiving design.

5. Lessons Learned The world will continue to study Chernobyl foryears to come. Each country with a nuclearpower program has scrutinized the accident tosee what lessons apply to its design and opera-tion. In the meantime, the Soviets have drawncertain conclusions for their own program(Reference (7)).

1. They recognize how important their operatorsare. On the positive side, they are installingimproved displays of information in the controlroom; improving operator training; improvingprocedures; and making it much more difficult todisable safety systems. On the negative side, theimportance of procedures will be reinforced —violating one will be a criminal offense, and thedesigners and operators of Chernobyl Unit 4have already been tried and sentenced.

2. On the hardware side, in the short term theSoviets first mechanically prevented control rodsfrom being withdrawn too far in the RBMKreactors. This caused a misshapen power distri-bution so the reactors had to be run at reducedpower. They are now redesigning the rods so thatthe graphite cannot be lifted above the bottom ofthe core even if control rods are fully withdrawn.They also required more rods to be inserted — infact, the plants will now shut down automaticallyif the operator tries to pull out too many rods.The motors of the shutoff rods have beenchanged to speed up shutdown — from 20 sec-onds to 10 (compared to 2 seconds in CANDU).A new fast shutdown design is being developed.Finally the composition of the fuel is beingchanged (more enrichment). These changesreduce the size of the positive void coefficient,and increase the effectiveness of the emergencyshutdown.


In Canada, we have shown that these prob-lems have already been addressed. In particular,we checked, again, to see if there was any possi-ble operating state in which the shutdownsystems could be ineffective; and electrical utili-ties also reviewed the operational aspects of theirnuclear power plants.

6. References (1) USSR State Committee on the Utilization of

Atomic Energy, The Accident at theChernobyl Nuclear Power Plant and ItsConsequences, presented at the InternationalAtomic Energy Agency Post-AccidentReview Meeting, August 25-29, 1986;Vienna.

(2) A. Dastur, R. Osborne, D. Pendergast, D.Primeau, V. Snell and D. Torgerson, A QuickLook at the Post-Accident Review Meeting(PARM), Atomic Energy of Canada LimitedPublication AECL-9327, September, 1986.

(3) Frigerio, N.A., Eckerman, K.F. and Stowe,R.S., Argonne Radiological Impact Program(ARIP): Part I, Carcinogenic Hazard fromLow-level, Low-rate Radiation, ArgonneNational Lab. Publication ANC/ES-26,September, 1973. Also see J. Jovanovich,World Energy Choices: MalthusianCatastrophes, Climactic Changes orNuclear Power, University of ManitobaDepartment of Physics preprint, February,1986.

(4) V.G. Snell, Safety of CANDU NuclearPower Stations, Atomic Energy of CanadaLimited Publication AECL-6329, January,1985.

(5) CANDU Nuclear Generating StationTechnical Summary, Atomic Energy ofCanada Limited Publication 901212PA,AECL CANDU, Mississauga.

(6) P.S.W. Chan, A.R. Dastur, S.D. Grant, J.M.Hopwood, and B. Chexal, The ChernobylAccident: Multidimensional Simulations toIdentify the Role of Design and OperationalFeatures of the RBMK-1000, paper present-ed to the ENS/ANS Topical Meeting onProbabilistic Risk Assessment, Zurich,Switzerland; August 30 – September 4,1987.

(7) V.G. Asmolov et al., The Accident at theChernobyl Nuclear Power Plant: One YearAfter, translation of principal Soviet paperpresented by N.N. Ponomarev-Stepnoj to theInternational Atomic Energy AgencyInternational Conference on Nuclear PowerPlant Performance and Safety, Vienna;September 28 – October 2, 1987.

(8) For a detailed technical evaluation, see: J.Q.Howieson and V.G. Snell, Chernobyl – ACanadian Technical Perspective, NuclearJournal of Canada, Vol. 1, No. 3; September,1987. A technical executive summary of thisis in: V.G. Snell and J.Q. Howieson,Chernobyl – A Canadian TechnicalPerspective – Executive Summary, AtomicEnergy of Canada Limited publicationAECL-9334S, January, 1987.

(9) International Advisory Committee report tothe International Atomic Energy Agency,The International Chernobyl Report – AnOverview, June 1991.

chernobyl – a canadian perspective library/19910101.pdf · 2 chernobyl — a canadian perspective...

Documents