The History of Reactor Safety: Chernobyl

Nuclear safety has been an important concern of reactor designers since the first reactors were designed. The earliest reactor designers realized that some reactors designs were safer than others. Safety flaws were known to exist in the reactors built in the Hanford, Washington complex. For that reason the complex was situated in a relatively remote lightly inhabited area.

The safety problem with the Hanford reactor stemmed from the use of water cooling in a graphite reactor. If the reactor heated up to much, the water inside the reactor could could boil within its pipes. Water inside the graphite moderated core, tends to act as a break on the chain reaction. When water is removed from the water cooled graphite reactor the break is released, and the chain reaction speeds up. That adds more heat to the reactor core, and the added heat boils off more water. This process can build up very rapidly until there is a steam explosion that could potentially destroy the reactor core.

Why would anyone ever build such an unsafe reactor? The answer in the case of the United States, was that the Hanford Reactors were built because the American Government believed that it had a military necessity to do so. In 1942, the Germans were known to be developing nuclear technology, and that technology was assumed to have a military purpose. Few of the people who were involved at the time believed that nuclear safety was the most important issue. The danger to national survival that would emerge if Germany was the first to develop a nuclear weapon was the primary concern. Thus the decision was made to build unsafe reactors at Hanford because the reactors would be an important source of weapons grade fissionable Plutonium. The Hanford reactor design was never copied elsewhere in the United States, and when the United States Government around 1950 made the cold war decision to expand its plutonium output, a different, safer reactor design was chosen.

The political leadership of the Soviet Union dictated that nuclear safety was not an issue, When Yuri Andreyev took an examination to become a Soviet nuclear plant operator, he was asked to describe how a reactor could explode. He answered the question by describing three different scenario. The examiner criticized Andreyev 's answer,

"Keep it in your mind, man -- Soviet reactors cannot explode,"

the examiner told him.

With this attitude the Soviet Union chose to copy the Hanford design for plutonium production reactors. Later these military heated coolant water from these reactors was used to produce steam that drove electrical generators. This experiment was considered successful, and the Soviet leadership chose to develop a new class of power generating civilian reactors that was based on the old, unsafe Hanford design, During the 1950's the Soviets began producing a slightly modified Plutonium production reactor, that could also generate steam for electrical generation. These reactors were designed with little regard to the nuclear safety concerns, but they were cheap and easy to manufacture, so the Soviets adopted the design for a single purpose power reactor, the RBMK.

All of the safety problems of the original Hanford design were still present in the RBMK. While thinking about nuclear accident containment had advanced in the West, the Soviets failed to see the point. Western researchers had investigated how radioisotopes could escape into the environment in a nuclear accident, and how that escape could be prevented. Western power reactors reactor designs included a system of multiple barriers to the release of radioactive materials into the environment in case of an accident. The Western nuclear containment system was tested at Three Mile Island when a an error by a reactor operator turned a minor nuclear incident into a core meltdown. The TMI accident was contained without and known illnesses or deaths as a consequence. Some radiation was released in the form of radio active gases, but radio active gasses are also released by burning natural gas in the home. Despite the evidence that the Western containment system prevented radiation related deaths and illness, the Soviets slightly modified RBMK reactor building design to improve containment, but this modification still left RBMK containment far short of Western standards.

In addition to its known safety problems, the RBMK design included a serious hidden safety flaw. Sonja Schmid, in a study of Soviet nuclear safety practices notes,

Soviet design choices display a similar circular pattern: while the “Sovietness” of the graphite-water reactor (the “Chernobyl’ type” reactor) was invoked to legitimize its development, mass production and implementation, the reactor design itself then served as proof of Soviet technological prowess.

In addition to the already noted RBMK safety flaws, there was a defect in the design of its control rods. There was a graphite extension of the control rod, that entered the reactor prior to the neutron absorbing metal that formed the main body of the control rod. The control rod channels were normally filled with water, which as I have already noted acted as a break on the chain reaction. The presence of more graphite actually accelerated the chain reaction, as did the displacement of water in the control channels. As a result, as the control rods entered the reactor, there was a massive spike in core reactivity. Power output rose quickly to an estimated 30 Billion thermal watts, ten times what the RBMK was designed to handle. As this process unfolded, the heat of the reactor core increased dramatically, fuel elements and full channels began to rupture and pressure built up in the coolant water tubes As steam began to escape the rupturing tubes, steam pressure inside the reactor case increased, until the case explosively ruptured. A two thousand ton plate that covered the top of the reactor was blown off by the force of the explosion, opening the upper surface of the reactor to the sky. Three seconds later, an even more violent explosion occurred ripped the core apart, flinging chunks of burning radioactive matter high into the air.

Under ordinary circumstances graphite does not burn, but the graphite in the Chernobyl was heated white hot, and the mass of superheated graphite was exposed to an airflow, that ignited it. Then all of the Soviet nuclear mistakes, all of the Soviet arrogance that vainly assumed that nothing bad could happen to Soviet reactors came home with horrific force.

The Chernobyl reactor disaster was not simply a result of poor reactor design, but it was the result of an ideological system that believed that Soviet reactors could not fail. Mistakes made by the Chernobyl operators played a very large role in the accident. Those mistakes were the result of a test requirement imposed on the reactor staff, by the authoritarian Soviet system. Reactor safety issues were simply ignored in the performance of the test, and the reactor staff drove the reactor to and past its breaking point. It is unlikely that there would have been a Chernobyl, had there not been a Soviet Union.

A Primer on Nuclear Safety: 2.2 Defense in Depth

A Primer on Nuclear Safety:
2.2 Defense in Depth
Controlling Nuclear Reactions in Light Water Reactors

The Enrico Fermi was the first nuclear scientist to find a solution for controlling chain reactions in a nuclear reactor. Fermi said that his Chicago Pile was "a crude pile of black bricks and wooden timbers." Of course natural uranium fuel was added. There was, Fermi realized, something else needed in order to make his reactor safe. That was a means of soaking up the neutrons created by the chain reaction in order to control it. The way Fermi chose to control the Chicago Pile was to insert a number of cadmium-coated control rods into the reactor. Inserting the rods would slow the chain reaction and eventually stop it. In fact history reports that the chain reaction in Fremi's first pile was initiated by lifting control rods that were initially embedded in the pile.

Fermi and his associates were none to confident in the mechanical reliability of the control rods. Thus a back up system was devised for an emergency shut down of the reactor in case the control rods failed to operated properly during a shut down. A history of the Chicago Pile experiment states:

Since this demonstration was new and different from anything ever done before, complete reliance was not placed on mechanically operated control rods. Therefore, a “liquid-control squad,” composed of Harold Lichtenberger, W. Nyer, and A. C. Graves, stood on a platform above the pile. They were prepared to flood the pile with cadmium-salt solution in case of mechanical failure of the control rods.

In many respects the Fermi's CP-1 was the evolutionary ancestor of the Light Water Reactor, and the control scheme for Light Water Reactors is basically the same as for the CP-1 although a few twists have been added.   The control rods now use Hafnium rather than cadmium for neutron absorption.  And rather than flooding the core with a Cadmium salt solution, boron in the form of boric acid is injected directly into the cooling water. Because the dilution of the boric acid in the cooling water can be easily altered, the use of boron is by no means limited to reactor shutdown. By altering the boric acid content of cooling water reactor operators can actually control the chain reaction, thus providing a simple but effective throttle for a chain reaction.

It is possible to completely shut dow a LWR by increasing the boron content of the coolant water, or by a high concentration of boric acid in the emergency coolant water. However reactor shut downs and start ups are normally controlled by the control rods. Control rods can also be used to control chain reactions in parts of the reactor, and the play a major role in counteracting Xenon poisoning.

Xenon-135 is a nobel gas that is produced in the fusion process. It is highly radioactive, but in addition it has a very powerful neutron absorbing property. Because of this property, even a relatively small amount of Xenon, produced during a chain reaction has the capacity to slow down and even stop the chain reaction. Hence reactor controls must posses a means of balancing reactor power output as the amount of Xenon in the reactor increases due to Xenon production by nuclear fission.

Controlling reactor power in the face of Xenon poisoning is not simple. Xenon builds up with the fission process, and decreases as it undergoes nuclear decay. There can be a lag between the positioning of a control rod and its effect on the power level and heat generation of a reactor. Running a light water reactor at low power increases difficulties related to Xenon poisoning. Xenon may not be evenly spread through the core. Thus hot and cool spots may develop in the core. since coolant flow is based on average power output, coolant flow to reactor hot spots may not be sufficient, and as fuel pellets begin to overheat, and their cladding begin to overheat, their integrity may begin to break down.

Control rods played a far more critical role in the Chernobyl accident than would be possible in a light water reactor accident. In the Chernobyl RBMK reactors the control rods were divided into three segments. The upper and lower segments were made of graphite, while the middle segment was made of graphite a nuclear moderator, while the middle segment was made of a of a material that served as a neutron poison. As the control rod is lifted coolant water fills the bottom of the control rod channel. Under normal operations the control rod is lifted to the position in which its lower graphite segment fills the channel inside the reactor core. But because a highly dangerous test was being conducted on the Chernobyl reactor, the lower graphite segments of control rods were also partially withdrawn from the reactor. Thus more water entered the reactor core through the control rods channels. As I have already observed coolant water served as a break on the chain reaction within the Chernobyl reactor. As we observed poor management of the Chernobyl reactor during a test lead to the boiling of the coolant water inside the reactor and the voids created by the steam bubbles began to removed the break placed on the chain reaction by the presence of coolant water in the core. As the overly withdrawn control rods began to descend into the core of the Chernobyl reactor they first displaced water that had served as a break on the chain reaction, and replace it with graphite, a moderator that greatly increased the chain reaction.

The insertion of the graphite tips of the control rods into the core of the Chernobyl RBMK was sort of like attempting to hit the breaks of car that is running out of control, and hitting the accelerator instead. The power level of the Chernobyl reactor went off the charts, and as reactor heat increased dramatically the remaining coolant water in the reactor core flashed to steam. There was a large steam explosion, which as we have seen destroyed the top of the reactor and the surrounding radiation shield.

A similar accident could not occur in a light water reactor because (a) water in the control rod channels moderates rather than slows the nuclear reaction, (b) the water in the control rod channels is immediately displaced by a neutron poisoning material in the control rod, and (c) voids created by heat related bubbles in the reactor coolant work in concert with the control rods rather than against them.

Control rod insertion during an accident can be accomplished by gravity rather than mechanical means. Control rods can be attached to the lifting mechanism by electro-magnets. The termination of power output during an accident would automatically produce control rod insertion and shut down. The shutdown can also be triggered by operator control.

There are redundancies in the control rod system and of course reactor operators always have the options of shutting the reactor down by adding more boric acid to the coolant water. The loss of reactor coolant does cause a termination of the chain reaction, because the water serves as a moderator for the chain reaction in Light Water Reactors. At the same time the loss of coolant water is highly undesirable, because coolant water is required to remove the residual heat from fission product decay from the reactor core.

The control system of Light Water Reactors thus provides for operational redundancies and safety backups. Emergency shutdowns can be accomplished by passive safety features that use the law of nature to insure that a chain reaction stops as soon as the reactor ceases to produce electrical power. Different control systems insure that operators have more than one emergency shutdown system available. Finally automatically operating passive shut down systems, insure that the reactor will automatically shut down before serious safety problems emerge, thus interrupting chains of events that could lead to serious reactor accidents.

A Primer on Nuclear Safety: 2.1 Defense in Depth

A Primer on Nuclear Safety:
2.1.1 Defense in Depth
Light Water Reactors - Physical Barriers

The Defense in Depth philosophy is applied to the release of radioactive materials from inside the core of light water reactors. Helen Caldicott, the ceaseless critic of nuclear power notes

Nuclear power creates massive quantities of radioactive isotopes, which are classified as nuclear waste. Among these materials are strontium 90, . . cesium 137 . . . plutonium, . . . lutonium has a radioactive life of half a million years. It enters the body through the lung, where it is known to cause cancer. It mimics iron in the body. Hence it migrates to the bone, where it can induce bone cancer or leukemia, or to the liver, causing liver cancer; and it crosses the placenta into the embryo, where, like the drug thalidomide, it can cause gross birth deformities. Finally, it has a predilection for the testicles, thus inducing genetic mutations in humans and other animals that are passed from generation to generation for the rest of time. Meanwhile, the plutonium itself lives on to enter testicle after testicle, lung after lung, liver after liver for the rest of time as well. Children are 10 to 20 times more susceptible to the carcinogenic effects of radiation than are adults.

That it is possible for such radioactive materials to escape in massive amounts from some reactors is certain given the Chernobyl accident. Even though massive amounts of radioactive materials that escaped during the Chernobyl incident did not lead to the sort of human disaster Dr. Caldicott imagined large scale releases of bioactive readio active materials from reactors is highly undesirable.   

During the 1950's and 60's nuclear chemists at Oak Ridge National Laboratory did extensive theoretical, field and Laboratory research on routs to radioisotope release from reactors.   This research was of major importance to nuclear safety because by identifying routs for radioisotope escape, the researchers alerted reactor designers to those escape routes and the possible means of mitigating events that could potentially lead to radioisotope escape.  

Nuclear safety researchers were by no means satisfied with their acomplishments. In 1967 my father, C.J. Barton, Sr. wrote

In order to promote confidence in such large reduction factors, continued research into the efficiency of removal for al l the various forms of the released fission products will be required.

During the 1960's researchers at ORNL. Battelle Northwest, and Phillips-Idaho conducted sophisticated containment and reactor accident research with facilities that were designed to simulate nuclear accidents. Again the findings of this research were fundamental to reactor safety design. As I have pointed out elsewhere in this blog, the continuation of nuclear safety research at AEC facilities became during the late 1960'sane early 1970's became a major matter of political controversy.

Even though the politically inspired attack on nuclear safety research was never completely rectified by the American political establishment, enough progress had been made to allow for great improvements in Light Water Reactor safety.

Physical Barriers increase Light Water Reactor safety

Defense in Depth against the release of radioisotopes required a series of physical barriers that inhibited the movement of radioisotopes from the nuclear fuel pellets, into the environment. In order to illustrate the defense in depth of civilian light water reactors, a brief comparison to the Soviet RBMK reactor is in order. The failure of the safety features of one of the RBMK at Chernobyl lead to the release of large amounts of radioisotopes from the reactor core. The RBMK reactor like Western Light Water Reactors featured ceramic uranium fuel elements made of uranium dioxide baked at high heat. In Western reactors the fuel pellets are clad with Zirconium a sturdy metal that resists the reactors heat and radiation.
The Uranium Oxide fuel is itself the first barrier in the defense in depth, and it is a one of the strongest barriers in the whole defense. Fission products are basically locked in to the rock like fuel pellet. As George Parker and my father were to observe that the release of fission products from Light Water Reactor fuel was cause by a variety of mechanisms that were all triggered by overheating. Thus the first barrier could be breached by reactor over heating.

The Zirconium cladding adds protection against fission product escape. Zirconium has a high melting temperature, although not as high as uranium oxide. Like uranium oxide, zirconium and zirconium alloys are dependent on reactor cooling to prevent to maintain integrity as a barrier to fission product escape. A further consequence of the failure of Zirconium cladding would be that it would subject uranium oxide fuel to mechanisms that promote fission product loss.

A Zirconium tubes in which the fuel pellets rest in the reactor core constitute a third barrier to fission product release, however in practice if reactor core heat is sufficiently high to cause the failure of Zirconium cladding, it will also cause the failure of zirconium tubes. The outer structure of the reactor provides a further barrier to fission product release. In LWRs the pressure vessel is a major barrier to solid fission product release, although radioactive gases can work their way around the barrier in major reactor accidents. The RBMK does not have a pressure vessel, which is perhaps the most significant reason for the massive release of radioisotopes in the Chernobyl accident. The Chernobyl RBMK appears to have included an outer structure designed to maintain the RBMK core in a helium environment in order to prevent graphite burning. This containment structure failed during the Chernobyl incident, and the resulting graphite fire contributed greatly to the fission product release during the Chernobyl incident.

The next barrier to fission product release is the reactor outer radiation shield. Although this shield is seldom mentioned in discussions of defenses in depth, it does provide a barrier to the release of solid and molten fission particles whose movement is limited by the forces of gravity. Thus in the event of a core melt down which penetrated the pressure vessel, the radiation shield would offer considerable containment of the molten fission particles. Because of its massive nature, the radiation barrier would also mitigate a steam explosion powerful enough to rupture the wall of the pressure vessel. The sideways and downward pressure of the steam explosion would be baffled by the massive radiation shield while gravity would contribute to containing the movement of non-gaseous fission products within the outer containment structure. The Chernobyl reactor was surrounded by a radiation containment structure which failed because the of a powerful steam explosion. The cause of the blast was a combination of design flaws that caused a dramatic rise power levels in the reactor when an operator attempted to shut the reactor down.

The destruction of the radiation shield of the Chernobyl reactor removed the last level of containment for that reactor, while another level of containment, represented by the outer containment dome, would have still survived a Chernobyl like explosion. The failure of the Chernobyl radiation shield and the subsequent graphite fire lead the the massive release of radioisotopes from the burning Chernobyl reactor. Thus the critical features that lead to the radioisotope release from the Chernobyl radiation release were not present and two outer barriers to the release of solid radioactive materials, the massive 8" thick steel pressure vessel, and the even more massive outer dome of the reactor were not features of the Chernobyl reactor design. Other unique features of the RBMK reactor design including the use of a graphite moderator, and numerous design flaws that created safety problems contributed to the accident.

Anti-nuclear critics of nuclear safety often point to the Chernobyl accident as evidence of the fundamental safety flaws of all reactors, without noting the significant differences in safety features between RBMK reactors and LWRs. In fact during the Three Mile Island accident the outer safety barriers, the pressure vessel, the radiation shield, and the containment dome all remained in tact. There were no verified cases of radiation related health problems as a result of the Three Mile Island accident, and subsequent research failed to identify any increase in the number of cancer cases that could be associated with the accident. Thus the defense in depth deployed at the Three Mile Island Reactor was successful.

A Note on Radioactive Gases

The radioactive material released as a consequence of the Three Mile Accident were primarily nobel gases. The nobel gases and other radioactive gases are fission bi-products that are present in the uranium oxide fuel pellets, Normally they would remained trapped in the uranium oxide pellets, but if the reactor core heats enough to melt down, the zirconium cladding will rupture or melt, and the melting of the uranium oxide pellets will release the nobel gases. The gases escape from the reactor core through the cooling system. The gases are quickly dispersed by the atmosphere. While nuclear critics rase the issue of radioactive gases as an issue in justifying their opposition to nuclear power, nuclear critics often display a strange inconsistency. Radon, a radioactive gas is also released by coal burning coal fired power plants. In addition natural gas contains radon. More radioactive gas is released into the environment by the use of fossil than by nuclear power plants, yet nuclear critics rarely raise their voices in concern about radioactive gasses released by the use of fossil fuels. In fact, many supposedly pro-environmental, anti-nuclear organizations, accept funds from foundations with ties to fossil fuel produces, sometimes with stipulations that the funds will be used to promote fossil fuel use. Needless to say, these organizations never raise talk about the association of radon gas with fossil fuel use.

I will in a later post discuss a methods of preventing or at least limiting the release of radioactive gases associated with the development of the LFTR.