ML20210P706

Report on the Accident at the Chernobyl Nuclear Power Station

ML20210P706
Person / Time
Site:	Pilgrim
Issue date:	01/31/1987
From:	ELECTRIC POWER RESEARCH INSTITUTE, ENERGY, DEPT. OF, ENVIRONMENTAL PROTECTION AGENCY, Federal Emergency Management Agency, INSTITUTE OF NUCLEAR POWER OPERATIONS, NRC
To:
References
CON-#487-5069 2.206, NUREG-1250, NUDOCS 8702170005
Download: ML20210P706 (214)

Text

a

• we- c.p+ ~y ,

~

. +w

.. , 7

• s a

,g3p yvi .y., ,

.}%, q' 4;)7- .

[* , , ,

%wp. +p; .,,

N

9 4

• ) **v 'I

• 4s, ,% .

s r.n, x,

,4 z

, ,.s - A f*,. -g 3.*

g <,n } i-

,; , . 4 t , ,7,*;.,

+g, u, /,~n , %a-) .og% > -

i;ya x-

-Q. % r:

~

.4j: ..

% - FQ, . ,y s h

q, .9,Ba .

C n$..

~

\-'

.~

~-r y -

4 *

) {

,, 4P .w .-

(? j g 16 's s ev +

j

- n cy _ x p n: ; ..

,2, <

( p; m3g;x,g A.w.

14g 4

.. 0 , %. a -

u \,<

e s - +A.

,Is\"jg ~

[ /**,*g .hp kl " b g\ C'

.y .-

• - 4* . . af

^' g' , Xi

,J t .

s +

y 9l $ h * ' ' '

.,-* ' ~ ,

s .

n.n.  %.h s ( ,

4 fi)* ;' .

?;

. g' o N, .A "DQ.v.s W, e ,

j d' #

• • I- )

e\

RA3 ;g pr q

<: . m 6 <

,;.= -

s ,

..5 D*f .A . . . -

v 's  ; ,%c , ;j A

n. - f g. %gi _, ph j %f . '[ "

j.j L -~ *

.js pm.+ n , a g

gd, n c 3 gw .4, k , #~ {O~

p,g.g.[b %3 . 'y (..

,4 6* ' ,N

' h* }

, . - .n %v3 -

r 4g e_. 1 l

F ; u. .

' 42

., *eg

. '. I*Jf j g,&W t

k

'g

%f~,5 ,,#'

c. 's

,k K .

I+

c.  : 3 , .

j

.y . -

1.

• # Y,

/ -

s k)i a s

,. , - "' llym.s 3 %y , y v.

g, a.,

%\

^

,_ , a +

4 N 4 , ,,%

J, N-

~

i - w;..

u_

u -

\

75 .

l N ,, .

A s

n r,

c-

.W, . .-- .

c7. ., .

,.  ?, s.

o. .

S,s ~~-C1 ; . J 4

_ _ _____ _ ___ _ _ _ ____T1 . ** _

rs .. 1 L

1 f-l r

^

Available as NUREG-1250 for $10.00 from the Superintendent of Documents U.S. Government Printing Office

. P.O. Box 37082

. Washington, DC 20013-7082 and.

National Technical Information Service U.S. Department of Commerce Springfield, VA 22161

. COVER PHOTO:

Landsat Thematic Mapper image of Chernobyl nuclear plant provided by Earth Observation Satellite Company

. - White circle indicates plant site and fire area.

f -- Landsat Thematic Mapper image was translated April 29,1986.

Report on the Accident at the Chernobyl Nuclear Power Station

/)

I!!6ETMN '

COMMISSION Prepared by:

Department of Energy Electric Power Research Institute i Environmental Protection Agency Federal Emergency Management Agency Institute of Nuclear Power Operations Nuclear Regulatory Commission NUREG-1250 l

l

_ _ , , , ,,--,i--.--,- - - - - - -

ABSTRACT This report presents the compilation of information obtained by various organ-izations regarding the accident (and the consequences of the accident) that occurred at Unit 4 of the nuclear power station at Chernobyl in the USSR on April 26, 1986. Each organization has independently accepted responsibility.

for one or more chapters. The various authors are identified in a footnote to each chapter. Chapter 1 provides an overview of the report. Very briefly the other chapters cover: Chapter 2, the design of the Chernobyl nuclear station Unit 4; Chapter 3, safety analyses for Unit 4; Chapter 4, the accident scenario; Chapter 5, the role of the operator; Chapter 6, an assessment of the radioactive release,' dispersion, and transport; Chapter 7, the activities associated with emergency actions; and Chapter 8, information on the health and environmental consequences from the accident. These subjects cover the major aspects of the accident.that have the potential to present new information and lessons for the nuclear industry in general.

The task of evaluating the information obtained in these various areas and the assessment of the potential implications has been left to each organization to pursue according to the relevance of the subject to their organization. Those findings will be issued separately by the cognizant organizations. The basic purpose of this report is to provide the information upon which such assessments can be made.

i l

l iii l 4 , , . _ . - - - - - - -e- -----w-e w- w-= w ~ , ~ ^ "

' *^w ~ Y ' ' ' #

• ' ' ' " " " ' ~ " ' ~ ' " " ' ~ ~ ~ ' ' ' ' ' ' ' ' ' '

CONTENTS i P* B.'

Abstract.............................................................. iii

.Ac knowledgments....................................................... ix Chapter 1 0verview......................................................... 1-1 2 Plant Design..................................................... 2-1 2.1 Reactor, Fuel, and Fueling Machine.......................... 2-7 2.2- Fluid and Heat Transport Systems............................ 2-18 2.3 ' Reactor Physics............................................. 2-24 2.4 Instrumentation and Control................................. 2-27 2.5 Electrical Power System..................................... 2-36

-2.6 Safety Systems.............................................. 2-37 2.7 Reactor Operations.......................................... 2-49 2.8 References.................................................. 2-51 3 Safety Analysis.................................................. 3-1 3.1 Introduction................................................ 3-1 3.2 Soviet Safety Analysis of the Chernobyl Unit 4 Reactor...... 3-3 3.3 Independent Safety Review................................... 3-27 3.4 References.................................................. 3-53 4 Ac cide nt S c enc r i o . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1 4.1 0verview.................................................... 4-1 4.2 Events Leading to the Accident.............................. 4-2 4.3 Events During and After the Accident........................ 4-9 4.4 References.................................................. 4-12 5 Role of Operating Personnel...................................... 5-1 5.1 Operator Actions and Plant Activities Before the Accident. . . 5-2 5.2 Immediate and Short-Term Operator Actions. . . . . . . . . . . . . . . . . . . 5-3 5.3 Summa ry of Key Operational Events and Errors . . . . . . . . . . . . . . . . 5-6 5.4 Operator Actions Following the Accident..................... 5-9 5.5 References.................................................. 5-10 6 Radionuclide Release and Atmospheric Dispersion and Transport.... 6-1 6.1 Radionuclide Release........................................ 6-1 6.2 Atmospheric Dispersion and Transport........................ 6-8 v

+

CONTENTS (Continued)

' Chapter Page 6.3 Consistency of Soviet Estimates of Radionuclide Release With Observed Data From Other Countries..................... 6-10 6.4 References.................................................. 6-12 7 Emergency Preparedness and Response.............................. 7-1 7.1 Emergency P1ans............................................. 7-1 7.2.. Emergency Organization and Facilities....................... 7-6 7.3 Alert and Notification System............................... 7-7 7.4 Protective Actions Taken.................................... 7-8

-7.5 Radiological Monitoring and Exposure Control................ 7-10

- 7.6- Medical Treatment........................................... 7-14 7.7 Soviet Guidance on Acceptable Levels of Public Radiation Exposure.......................................... 7-16 7.8 Decontamination............................................. 7-18 7.9 Site Recovery............................................... 7-19 7.10 Relocation and Reentry (Off Site)........................... 7-21 7.11 Public Education and Information Programs................... 7-21 7.12 Training Program............................................ 7-22 7.13 Summary..................................................... 7-24 i

~7.14 References.................................................. 7-27 8 Health and Environmental Consequences............................ '8-1 8.1 Pathways of Human Exposure.................................. 8-1 8-4 l 8.2 Health Effects..............................................

8.3 Radiological Effects on the Soviet Union.................... 8-6 8.4 Radiological Effects'on Europe Outside the Soviet Union..... 8-11 8.5 Radiological Effects on the United States................... 8-14 l 8.6 Global Effects on. Agriculture _and Food...................... 8-14 8.7 Ecological Effects.......................................... 8-16 8.8 References.................................................. 8 Figure 'Page 2.1 . Cross-sectional view of RBMK-1000................................ 2-9 2.2: Fuel channe1..................................................... 2-10 2.3 Zirconium-to-stainless steel transition j oint. . . . . . . . . . . . . . . . . . . . 2-10 2.4 Assembly of graphite rings on presssre tube and graphite block cooling.......................................................... 2-11 2.5 Cross-sectional view of reactor cavity........................... 2-12 2.6 Cross-sectional view of reactor building elevation, Chernobyl Units 3 and 4.................................................... 2-14 2.7 Layout of main building of Chernobyl Units 3 and 4............... 2-15 2.8 Schematic drawing of the 36-rod fuel element..................... 2-17 2.9 . Cross-sectional view of the fueling machine...................... 2-19 2.10 Grab hook of refueling machine................................... 2-20 vi

CONTENTS (Continued)

Figure Page 2.11 Normal'and emergency cooling systems of the Chernobyl Unit 4 reactor.......................................................... 2-21 .

2.12 Schematic drawing of control rod cooling system.................. 2-23 2.13 Gas circuit system............................................... 2-24 2.14 Effect of reactor operation on the coolant void, fuel temperature, and moderator terperature reactivity coefficients... 2-27 2.15 Control rod design............................................... .2-31 2.16 Schematic drawing of fully withdrawn and fully inserted control rods..................................................... 2-32 12.17 Functional diagram of a control rod drive mechanism.............. 2-35 2.18 Schematic drawing of the reactor emergency cooling system........ 2-38 2.19 Schematic drawing of the system for discharging steam from the main safety valves into the pressure suppression pool of 4

the accident localization system................................. 2-41 2.20 System to protect the . reactor vault from excess pressure. . . . . . . . . 2-43 2.21 Schematic diagram of the accident localization system............ 2-45 2.22 Evolution of reactor-parameters during startup................... 2-50 3.1 Nuclear safety regulatory bodies and documents in the USSR........ 3-6 4.1 Chronology of the accident at the Chernobyl Nuclear Power Station.......................................................... 4-3 4.2 Key reactor parameters for the last five minutes before the

-accident......................................................... 4-6 4.3 Chernobyl data evaluation of power vs. time during core destruction phase..............................................*. 4-10 4.4 Photographs of the residues from model fuel pins (SPXM rods) after tests in the CDC (capsule driver core) simulating power excursions from reactivity insertion accidents................... 4-11 5.1 Schematic diagram of the RBMK-1000............................... 5-2 l

6.1 Daily radionuclide release into the atmosphere from the damaged unit..................................................... 6-3 1

Table Page

'2.1 Development of Soviet graphite-moderated, water-cooled reactors......................................................... 2-2 2.2 Chernobyl Unit 4 design parameters............................... 2-4 2.3 Fuel assembly design parameters for Chernobyl Unit 4............. 2-18 2.4 Calculated reactivity coefficients for RBMK...................... 2-26 2.5 Types of control rods............................................ 2-29 2.6 Control rod specifications....................................... 2-32 4.1 Chronology of the accident at the Chernobyl Nuclear Power Station.......................................................... 4-13 vii I

CONTENTS (Continued)

Table Page 5.1 Operator violations of procedures................................ 5-8 6.1 Core inventories and total releases at the time of the Chernobyl accident............................................... 6-2 6.2 Daily release of radioactive substances into the atmosphere from the damaged unit............................................ 6-4 6.3 Radionuclide composition of release from the damaged unit of -

Chernobyl Nuclear Power Station.................................. 6-6 6.4 Estimates of percent of core inventory released based on measurements outside the Soviet Union............................ 6-12 7.1 Agricultural products in which the permitted radioactive contamination was found to be exceeded........................... 7-13 7.2- Levels of I-131 in milk, May 1986................................ 7-13 7.3 Criteria for making decisions for protection of the population... 7-17  ;

2 8.1 Radionuclide contributions to external dose based on =$

spectrometric measurements in southern Finland on May 6 and 7, 1986................................................ 8-2 8.2 Radionuclide deposition in two U.S. areas........................ 8-3 8.3 Maximum radiation levels found in Europe following the accident, by country............................................. 8-12 8.4 Maximum individual doses to groups in the United States due to exposures or intakes in the first year after the -

accident......................................................... 8-15 3_

9 i

1 I=

h 4

2 a

)

9 viii j J

0

~

E l, ACKNOWLEDGMENTS

^

The following individuals'have contributed substantially in the production of this report: From the U.S. Department of Energy - S. Rosen, E. Purvis, D. McPherson, F. Tooper and their contractors, notably Pacific Northwest Laboratories (J.-McNeece and L. Dodd); from the Environmental Protection Agency S. Nyers, D. Janes, J.,Puskin, C.. Nelson, and N. Nelson; from the Elec-tric Power Research Institute - G. Vine; from the Federal Emergency Management Agency - M. Sanders and V. Adler; from the Institute of Nuclear Power Genera-tion - W. Conway and S. Visner, and from the Nuclear Regulatory Commission -

B. Sheron, C. Allen, F. Congel, and S. Archarya.

The Nuclear Regulatory Commission provided a' coordinating function with regard to the production of the report. C. Allen from the NRC acted as the project manager for coordinating the production of the report. The Nuclear Regulatory Commission also provided substantial editorial (M. Harwell and staff), graphics (J. Thot-Thompson ~and staff), typing (L. McKenzie and word processing staff),

and printing (M. Baggett and staff) services supporting the publication of.this

, report.

Y z.

1. 1 I

t 1

ix

.- . . _ , - - _ _ . . - . - , . . _ - , , _ - . . , - . . - - _ , , . ._,_,.-.-.--..,,_,,r-- . . ~ . _ , , , , . , 2..,._., . - . .

c , -

W CHAPTER 1 OVERVIEW In response to the Chernobyl Nuclear . Power Station accident in April 1986, a group comprised of representatives from the Federal Government and the nuclear power industry met-to compile factual data and information relevant to under-standing that accident. Specific organizations, as noted below, prepared de-

- scriptions of the accident. The individual inputs are herein compiled and represent, therefore, the views of the responsible organization.

The effost drew heavily on three sources during the preparation of its report.

.The first source is a report prepared in the Soviet Union (USSR, 1986) that was presented to the International Atomic Energy Agency (IAEA) at a meeting held August 25-29, 1986, in Vienna, Austria (IAEA Experts' Meeting). The second major source of information came from discussions with Soviet representatives attending the IAEA Experts' Meeting in August 1986. The third major source is

- a report prepared by theLInternational Nuclear Safety Advisory Group (INSAG, 1986) for the Director General of IAEA (Post-Accident Review Meeting, August 30-September 5, 1986).

The focus of this report is limited to the factors bearing directly on the accident at Chernobyl. It does not extend to all aspects of the design and operation of the Chernobyl plant. As such, the report includes information on the relevant areas of plant design, plant safety analysis, the accident scenario, the role of operating personnel, radioactive releases, emergency response, and health and environmental consequences.

Chapter 2 was prepared by the U.S. Department of Energy (DOE). It describes the unique design of the Soviet high-power, graphite-moderated boiling-water-cooled reactor at the Chernobyl Nuclear Power Station. This uniquely Soviet design evolved from early demonstration and plutonium production reactors.

General' characteristics of the RBMK and its predecessors include the use of graphite as a neutron moderator and light water as the coolant. Pressure tubes, contained in vertical channels in the graphite, either contain low-enriched uranium oxide fuel or are used as locations for control rods and instrumentation.

The use of boiling water as a coolant in a pressure-tube, graphite-moderated reactor distinguishes the RBMK design from any other reactor design. Other distinguishing features of the RBMK design include:

on-line refueling

- single uranium enrichment level

- separation of core cooling into independent halves use of computerized control systems separate flow control for each pressure tube positive void reactivity coefficients under most operating conditions slow scram system 1-1

. w steam suppression system

+

programmed power setbacks (rather than scrams) for various abnormal conditions

~-

! low coolant-to-fuel ratio accident localization systems Chapter 3, prepared by the Electric' Power Research Institute (EPRI), is directed at a-safety analysis of Chernobyl_ Unit 4, one of 14 operating RBMK-1000 reactor plants. Significant differences exist in RBMK-1000. designs, as they have

. evolved from the early I.eningrad design (first-generation RBMK,' eight total

, units) to the more modern Smolensk design (second-generation RMBK, six total i units, including Chernobyl Units 3 and 4). This evolution of the RBMK design is often difficult to discern in Soviet literature, and details of the plant-specific differences among_the 14 plants'are not available. However, descrip-tive material of second-generation RBMK-1000 reactors is more complete,

~

especially as a result of information in the Soviet report on the accident l (USSR,1986). The safety analysis in this chapter sometimes presents a compos- _!

~ite, or generic analysis of second-generation RBMK-1000 reactors. Where known l differences exist between first- and second-generation reactors, a brief dis- ,

cussion is included of the effects of those differences on the RBMK safety '

analysis, but an analysis of the older design is not included in this report.

Since many of the design features unique to the second generation do not appear to have been backfitted into the first generation,'the reader is cautioned

. against assuming that safety capabilities discussed here apply-to the eight older RBMK-1000 reactors.

Chapter 4 was prepared _by the U.S. Nuclear Regulatory Commission (NRC). It presents the events leading to the accident at Chernobyl Unit 4 on April 26, 1986. The events are detailed in narrative form and are summarized in Table 4.1. The accident chronology includes relevant information on several aspects of the plant design characteristics and operation and includes the operator and procedural errors that contributed to the accident. These factors were important in the sequence of events that ultimately resulted in an uncon-trolled power excursion that destroyed the reactor and breached the integrity 4

of the. reactor building. The focus in the chapter is on the respcase of the system to the various events. Information used in reconstructing the sequence of events was obtained from review of summary reports on the Chernobyl accident prepared by the USSR State Committee on the Utiliz<. tion of Atomic Energy (USSR, 1986) and the International Nuclear Safety Advisory Group (INSAG, 1986).

l Chapter 5, prepared by the Institute for Nuclear Power Operations (INPO), ex-plores the role of operating personnel at Chernobyl Unit 4. During the per-formance of a turbine generator test on April 26, 1986, Chernobyl Unit 4 experienced a core-damaging accident. A severe excursion was accompanied by a I

pressure surge and fire that destroyed the reactor and breached the surrounding building. The test procedures had not been adequately reviewed from a safety standpoint. Management control of the performance of the test was not main- ,

tained; the test procedure was not followed; safety systems were bypassed; and l' control rods were misoperated. Operators lost control of the reactor during the performance of the test. Chapter 5 focuses on the operator actions during the event and on the breakdowns in management / administrative controls. ,

Chapter 6 was prepared by the U.S. Nuclear Regulatory Commission (NRC). It has as its first topic the magnitudes and timing characteristics of release of radio- 1 nuclides from the Chernobyl Unit 4 plant. Its second topic is the atmospheric 1-2

dispersion and transport of the released radionuclides resulting in environ-mental contamination within and outside of the Soviet geographic boundary.

Radionuclide release and atmospheric dispersion and transport from Chernobyl as described in Chapter 6 are derived from the information contained primarily in the two reports cited (INSAG, 1986; USSR, 1986). The last section of Chapter 6 offers a short discussion on consistency of the estimates of the radionuclide release provided in the Soviet report with the observed data from regions out-side the Soviet boundary.

Chapter 7, prepared by the Federal Emergency Management Agency (FEMA), docu-ments the available offsite and onsite emergency plans and preparedness meas-ures that were in place for the Chernobyl nuclear facility. It also describes the Soviet response to the accident, and relates it, where feasible, to the preaccident emergency planning and preparedness activities. Where known, emergency response organizations are identified and their roles are described.

The alert and notification system used by the Soviets is examined. The pro-tective actions taken by the Soviets are also described, including evacuation, sheltering, use of radioprotective drugs, and medical arrangements. Finally, Soviet information pertinent to decontamination, relocation, and re-entry is '.

documented.

Chapter 8 was prepared by the Environmental Protection Agency (EPA). It exam-

, ines the radiological health and environmental consequences associated with the Chernobyl accident. Radiation doses and their reported or calculated health effects are discussed for populations at the site, within 30 km (18.6 mi) of the site, in the balance of the European Soviet Union, in other European coun-tries, and in the United States. Because of limitations in the exposure data, however, most of these estimates must be regarded as tentative.

Data for the Soviet Union were drawn chiefly from the Soviet report to the IAEA (USSR, 1986). Estimates for other European countries were based largely on information reported by the World Health Organization (WHO, 1986a and 1986b) and individual European governmental agencies. For the United States, measure-ments made by or reported to EPA were employed.

References INSAG, 1986 International Nuclear Safety Advisory Group, " Summary Report on the Post-Accident Review Meeting on the Chernobyl Accident,"

August 30-September 5, 1986, GLC(SPL.I)/3, IAEA, Vienna, September 24, 1986.

USSR, 1986 USSR State Committee on the Utilization of Atomic Energy, "The Accident at the Chernobyl Nuclear Power Plant and Its Consequen-ces," I formation compiled for the IAEA Experts' Meeting, August 25-29, 1986, Vienna, 1986.

! WHO, 1986a World Health Organization, Regional Office for Europe, " Summary Review of Measurement Results Relevant for Dose Assessment,"

Update Revision No. 7, Copenhagen, June 12, 1986.

1 1-3 l

WHO, 1986b World Health Organization, Regional Office for Europe, " Summary Report of Working Group on Assessment of Radiation Dose Commit-ment in Europe Due to the Chernobyl Accident," Bilthoven, June 25-27, 1986, Copenhagen, September 8, 1986.

l 1-4

CHAPTER.2 PLANT DESIGN The Soviet high-power, pressure-tube reactor (Soviet designation: RBMK) is a

= graphite-moderated, boiling-water-cooled reactor. This unique design, which has been constructed'only in the Soviet Union, evolved from early demonstration and plutonium production reactors. General characteristics of the RBMK and its predecessors include the use of graphite as a neutron moderator and light water as the coolant. Pressure tubes, contained in vertical channels in the graphite, either contain low-enriched uranium oxide fuel or are used as locations for control rods and instrumentation.

The use of boiling water as a coolant in a-pressure-tube, graphite-moderated reactor distinguishes the RBMK design from any other reactor design. Other dis-tinguishing features of the RBMK design include on-line refueling-single uranium enrichment level separation of core cooling into independent halves use of computerized control systems separate flow control for each pressure tube positive void reactivity coefficients under most operating conditions slow scram system steam suppression system programmed power setbacks (rather than scrams) for various abnormal conditions low coolant-to-fuel ratio accident localization systems These features are described in detail later in this chapter.

The Soviet nuclear program has included research and development on several types of reactors. This work has-led to the construction and operation of various prototypes. In the mid-1960s, the Soviets decided to develop two types of power reactors: the VVERs (pressurized-water reactors) and the RBMKs (boiling-water reactors).

The evolution of the general design parameters related to Soviet graphite-moderated, water-cooled reactors is presented in Table 2.1 (Semenov, 1983; Klimov, 1975). The units at the Siberian Atomic Power Station were built as dual purpose reactors (Klimov, 1975) to produce both plutonium and electricity.

The Beloyarsk reactors are demonutration plants and are unique because they superheat the steam in the reactor core.

S. Rosen, E. Purvis, D. McPherson, and F. Tooper of the U.S. Department of Energy (DOE) and DOE contractors, notably Pacific Northwest Laboratories (J. McNeece and L. Dodd) eqmpiled this chapter.

2-1 o .

P Table 2.1 Development of Soviet graphite-moderated, water-cooled reactors RBMKs Item Obninsk SAPS

• Beloyarsk-1 Beloyarsk-2 Chernobyl-4 Ignalina-1 Year of operation 1954 1958 1964 1967 1983 1984 Electrical capacity (MWe) 5 >100 100 200 1000 1500 Thermal capacity (MWt) 30 -

286 530 3140 4800 Number of fuel channels (equilibrium loading) 998 -

998 998 1661 1661 Number of steam superheat channels 0 0 268 266 0 0 Steam pressure at turbine 7

m (atm) 12 -

87 87 65 65 Steam temperature (*C) 270 -

500 500 280 280 Total uranium loading (tonne) 0.55 -

67 48 189 189 Average enrichment (%) 5.0 -

1.8 3.0 2.0 2.0 Burnup (MWD /kg) - -

4.0 14.6 22.3 21.6 Specific power (kW/kg) 54.6 4.3 11.3 16.7 25.4 -

Fuel cladding material Stainless Aluminum Stainless Stainless Zirconium Zirconium steel steel steel 1% niobium 1% niobium

• Siberian Atomic Power Station - Six identical units using double coolant circuits with steam generators.

The first'RBMK.was a 1000-MWe plant brought on line in 1973 at the Leningrad Atomic Power Station. The.Chernobyl. Unit 4 reactor is considered a second-

. generation plant because the design includes a number of safety features not present in Leningrad Unit 1.

-At'the time of the accident, 14 RBMK-1000 reactors were in operation'in addi-tion to a 1500-NWe RBMK plant operating at Ignalina (Table.2.1). The RBMK-1500 design differs little.from the RBMK-1000 design. The cores are essentially identical. Plans exist to build even larger plants with electrical capacities-as large as 2400 MWe, The Soviets had several reasons for pursuing the RBMK design. These reasons included (Semenov,.1983) an extensive engineering experience base with graphite-moderated, boiling-water-cooled reactors existing manufacturing plants could fabricate major components the reactor size not limited by considerations related to fabrication, transportation, or installation of components a serious-loss-of-coolant accident larger than that considered as design basis thought to be virtually impossible because of the use of numerous pressure tubes rather than a single pressure vessel very efficient fuel use use of online refueling could achieve a very high plant capacity factor The Soviets considered the RBMK to be their " national" reactor and showed con-siderable pride in the development of the design. A number of design issues were identified by the Soviets and addressed in newer designs. Economies of scale, control, and safety were three such issues:

Economies of scale: The economics were recognized to improve substantially by going to larger designs. As a result, one 1500-MWe RBMK is currently operating and several more are under construction. Plans exist for plants as large as 2400 MWe.

Control: The RBMK-1000 was recognized to have stability problems and was difficult to control, particularly at low power levels. The approach to resolving these problems was to place increased reliance on automatic con-trol systems and adopt a slightly higher fuel enrichment and slightly lower graphite moderator density in order to decrease the positive void coefficient.

Safety: The Soviets re-evaluated the safety systems of their reactors.

As a result, later RBMK designs, including Chernobyl Unit 4, incorporated improvements in emergency core cooling systems and steam suppression pools.

A summary of the key design parameters of the Chernobyl Unit 4 reactor is given in Table 2.2 (USSR, 1986).

2-3

-_JN ^

Table 2.2 Chernobyl Unit 4 design parameters

~~ Item . Description General Design Characteristics Reactor type Vertical pressure tube, boiling water, graphite moderated Refueling On-line Design power generation. 3200 MWt Total reactor coolant flowrate 37,600 tonnes /hr'(23,026 lba/sec)

Core Description Core dimensions (active zone): 1

-Height 7.0 m (23.0 ft)

Diameter 11.8 m (38.7 ft)

J Volume 765.0 m8 (20,655 ft3 )

Total number of fuel channels 1661 Lattice spacing 25 cm x 25 cm (9.8 in. x 9.8 in.)

Moderator material Graphite Maximum allowable measured 750*C (1382'F) temperature Material density 1.65 g/cm3 (103 lb/ft8)

Reflector dimensions:

Top and bottom 0.5 m (1.64 ft)

Sides 0.88 m (2.89 ft) s Graphite core weight 1700 tonnes (3.74 x lo Ib)

Fuel Description i

Design Two 18-rod elements connected in series i

Uranium material UO2 Cladding material Zr-1% Nb Enrichment 2.0 wt% U-235 2-4 l

-_ m _ C

i Table 2.2 (Continued) i Item Description  ;

Fuel Description (Continued)

. Fuel assembly pellet region length 6.9 m (22.6 ft)

Maximum cladding temperature 323'C (613'F)

Maximum fuel temperature 2100'C (3812*F)

Total uranium weight 190 tonnes (418,500 lba)

Maximum fuel exposure 20.0 MWD /kg Water Recirculation System

' System material Austenitic stainless steel Independent flow loops 2 Steam drums 4 total, 2 per loop Pumps 8 total, 6 normally operating Pump dynamic head 1.96 MPa (284 psi)

~

Net positive suction head 0.6 MPa (87 psi)

Main pump suction and discharge 90 cm (35.4 in.)

header diameters Ma!.n pump capacity 5500 to 12,000 m8 /hr (24,200 to 52,800 gpm)

Dimensions of individual pressure 5.7 x 0.35 cm (2.2 x 0.14 in.)

tube inlet piping (OD x wall)

Dimensions of individual pressure 7.6 x 0.4 cm (3.0 x 0.16 in.)

tube outlet piping (OD x wall)

Fuel Channel Number 1661 Pressure tube diameter (OD) 8.8 cm (3.46 in.)

Pressure tube wall thickness 0.4 cm (0.158 in.)

Material Zr-2.5% Nb Connection Diffusion welded Zr to stainless steel joint in core zone 2-5 a ~ _ . _ _ _

1 Table 2.2 (Continued)-

Item-  : Description _ _ _

Fuel Ch'annels (Continued)

. Individual channel flow control Manually adjusted regulating valve Inlet temperature 270*C (518'F)

Outlet temperature (avg.) 284*C (543'F)  ;

I Operating pressure 6.8 MPa (986 psig)

Quality 14.5% (average steam), 20.1% (maximum)

Average tube power 1890 kWt Axial peak / avg.. power ratio' 1.40 Radial peak / avg. power ratio 1.48 Steam Secondary System Steam collector Primary system steam drum separators Number of collectors 4 total, 2 per loop I

Collector (ID x length) 2.6 x 30.984 m (8.5 x 101.7 ft)

Steam flow rate (total) 5800 MT/hr (3552 lbe/sec)

. Power generation 1000 MWe (two 500-MWe turbine generators)

Heat rejection without turbine Water reservoir (condenser) generators Feedwater inlet temperature to steam 165'c (329*F) separators Control Shutdown and Safety Shutdown System Type B4C segments encased in aluminum, lowered and retrieved from above by a belt cable and motorized drum Number of control shutdown assemblies 211 Neutron absorption material BC 4

l Control rod spacing 500 mm x 500 mm (19.7 in. x 19.7 in.)

2-6

__ _ . .. re--

Table 2.2 (Continued)

Ites Description l Control Shutdown and Safety Shutdown System (Continued)

Control rod travel 6.25 m (20.5 ft) except auto. control rod - 4.5 m (14.8 ft) and axial control rod - 7.0 m (23 ft)

Cooling method Separate water cooling system with downward flow3 in individual channels of 4.3 to 5.4 m /hr (151 to 190 fta/hr)

Control rod fuel insertion time 20 seconds 90% reactivity insertion time -10 seconds Overpressure Control System Type Partial steam suppression of releases from the reactor cavity, inlet piping and pumps Enclosure Reactor core inlet and piping system Function Condense steam from piping break or steam separator relief valves Design pressure Enclosure areas designed for either 0.45 MPa (65 psig) or 0.18 MPa (26 psig)

Operation Steam-water from pipe break or steam separator relief valves directed to standing water in bubbler pond below reactor. Water spray above bubbler pond helps condensation process.

2.1 Reactor, Fuel, and Fueling Machine 2.1.1 Highlights Chernobyl Unit 4 is a 1000-MWe, vertical pressure tube, boiling-water reactor that uses online refueling. The core and reflector are in a cylindrical graphite stack with a diameter of 13.56 m and a height of 8 m. The reactor is penetrated by about 2000 channels that provide locations for fuel, control rods, and instrumentation. The fuel is 2% enriched uranium oxide clad with zirconium containing 1% niobium (Zr-1%'Nb). Fuel elements are constructed in 18-element clusters connected to a central support tube. There are two subassembly clusters approximately 3.5 m (11.5 ft) long in each fueled pressure tube. The 2-7 a

1 .

t fueling machine is a massive piece of equipment that operates over the reactor operating floor and is designed to load fuel while the reactor is at full power.

I . 2.1.2 Reactor (Dollezhal, 1980b; USSR, 1986)

Chernobyl Unit 4 is a'1000-MWe, vertical pressure-tube, boiling-water reactor

. that uses online refueling. The plant contains two independent primary recir-culation coolant loops that serve separate halves of the reactor. Figure 2.1 shows a schematic cross-section of the Leningrad first generation RBMK-1000, which is representative of Chernobyl. Unit 4. .Each loop has four primary recirculation pumps (with three functioning under normal operating conditions)

- and two steam separators.

, The primary coolant from these pumps discharges to a common header to which 22 group distribution headers are connected. Supply lines for individual pressure tubes originate at these headers. Each supply line contains a manually operated flow-regulating valve and flow meter. The coolant is directed up the 1661 fuel channels past the fuel assemblies (see Figure 2.2). The inlet water' reaches the saturation temperature at about one-third of the length of the fuel element. J Nucleate boiling occurs over the remainder of the fuel length.

The pressure tubes in the core are made'of zirconium containing 2.5% niobium.

The Zr-2.5% Nb is diffusion welded to stainless steel piping by heating it to 600*C under a vacuum (see Figure 2.3). The joints are constructed separately and joined to the tube assembly before installation. The top and bottom tran-sition joints are located immediately above and below the graphite reflector.

l A permissible rate of heating and cooling of 10 to 15'C per hour has been established on the basis of thermal and strength tests.

{

i Chernobyl Unit 4 has 211 control and shutdown rods. The rods are functionally divided into manual control rods, automatic control rods, emergency power reduc-tion or scram rods, shortened absorbing rods, and compensating rods.

The 1700-tonne graphite moderator is stacked in the shape of a vertical cylinder j 11.8 m (38.7 ft) in diameter and 7 m (23 ft) high. Each column is composed of 25 cm x 25 cm (9.8 in. x 9.8 in.) graphite blocks. The main blocks are 60 cm (23.6 in.)'high, and shortened blocks are installed in the 50-cm (19.7-in.)

i top and bottom reflectors for a total graphite stack height of 8.0 m (26.2 ft).

The outer side reflector is 0.88 m (2.89 ft) thick, making a total stack diameter of 13.6 m (44.5 ft). The side reflector graphite columns are pinned with cooled steel tubes to enhance rigidity and provide reflector cooling. The moderator and reflector columns are capped on both top and bottom with a thermal shield. The top caps are steel blocks 250 mm (9.84 in.) thick and the bottom i

caps are also steel but 200 mm (7.87 in.) thick.

A gas mixture, nominally 80% helium and 20% nitrogen, is fed into a chamber i below the reactor where it is distributed across the bottom face of the reactor.

The gas mixture flows between the graphite columns, providing a heat-conducting medium for transmitting the graphite heat to the coolant channels. The space between the tubes in the channels is fitted with graphite rings, which are fitted alternately to the tube and graphite channel opening (see Figure 2.4).

During reactor startup operations a pure nitrogen cover is used. The graphite temperature can reach 750*C (1382*F) under these conditions. The gas mixture is monitored for moisture to detect leakage from the tubes.

2-8 e

w -

l N, I.

\ 1 Reactor Core

's 2 Steam-to-water pipes y 4,' ' ~' s " 3 Drum separator

's 4 Main circulation pumps (MCP)

. IC <

'-s 5 Group dispensing headers (GDH) '

I' 3: g l N' 6 Water pipelines ,

L. -

l 7 Upper biological shield I

' h A 8 Unloading-loading machine (ULM) b  ; ,

- ps 9 Lower biological shield

- i. ,

..f.

s N', x  ;

, q E

b d'N '

l

\

' 0 g g y % {. l \ l

},

%g,, .~ ,

I ,

k:, ,

E o

{ '

f 2

.;IJ t ' l7o , ]g d , ,  :

[ ,

. N l  !

i. l ,

y ,, g {y 3 l If!

n 4

s l q-

2+ >

e:': As i ' '

1 l 9 '

l 4 lI  ;

,l IO ,

~

6 g-

. W(:'__-

-r i

\va &

Figure 2.1 Cross-sectional view of RBMK-1000

Zircon um .

to Stainless Steel s Tr ansition Weldment f

~L, i ', /

m dh l,i l i mh, 7 >

n". "i .

f ,._ Steel I -

y(%s'i du l g;  :  !

g i .

c  : 1 Bellows '

k p fy puoi f[ '

(: ~ Diffusion Weld j h  ; if 5 Assembly 5 s y

• t i

[$ I b ,! .i l

(

['I N i ,.. ...

N

!!K -

N.

N -  : . . . .  :

4 Weideo g ;y ]4 -

iM: ll N5 Zirconium o "Tendnt" Seam  ; g j 8'" '"*

Weld .. $I ,

L g

Upper , . .  !! ! "

Biological Shield t-V' i

-. 33 M i' 5[ m 4 Q 's ' Pressure Tube.

fl E .1 Zr-2 5% Nb

+

l-l h - h iological B

LO**'

Shield Figure 2.3 Zirconium-to-stainless Figure 2.2 Fuel channel steel transition joint

4 Centerkne

'/ / I Graphite

/ /

g,g 'd f- 350*(662*F)

Graphite 750*C -

320*(608'F)

(1382*F) Man.  !

+- 310' (590*F)

/

j

/ -

Coolant

/ 284'c

/ (543'F) ?

/ Pressure Tube i

-+ ^

' 0 4 cm (016 in i

/ 8 8 cm(3 46 m )

i

! '/ t

/ -

91 cm(3 58 an )

/

l -

11.1 cm (4 37 m ) '.

/

114 cm(4 49 n)

[:

l Figure 2.4 Assembly of graphite

! rings on pressure tube and l graphite block cooling l

2.1.2.1 Reactor Core, Reactor Cavity and Vessel (Dollezhal, 1980a, b; Dubrovsky, 1981; Dollezhal, 1977; USSR, 1986)

A cross-section of the reactor core, cavit;y, and vessel is shown in Figure 2.5.

The reactor is located in a cavity 21.6 m wide x 21.6 m long x 25.5 m deep

' (71 ft x 71 ft x 84 ft). The reactor's graphite core is located in a sealed cylindrical vessel formed by a 14.5-m diameter (47.6-ft) x 9.75-m high (32-ft) steel shell. This shell is bounded at the top and bottom by upper and lower biological shields. The shell, together with the-top and bottom biological shields, forms the closed reactor space.

The 16-am (0.63-in.) thick reactor vessel serves mainly as a gas barrier and structural restraint for the graphite. 'The reactor vessel contains the circu-lating helium-nitrogen atmosphere for the graphite moderator at a pressure of about 0.0015 MPa (0.22 psig). The space outside the reactor vessel is filled i with nitrogen at a pressure of 0.0017 MPa (0.25 psig), which is greater than the pressure in the reactor vessel.

2-11

4.

Rernovable Floor

.. ..j y --

.19', MfiW's 4 tl" dWH.+. n';? 2 Upper

+Y. ,MimCFN,f n -r e,p Wh -w....o,,.. H g -

,. - Biotogical

%TUm ;1((i ,_k%m M G/M- l-

~

m l[ Shield C3 i* [;> - l l' I il el ll  ! y .A .'

Welded d -

Q } ][( { ,

[,I '

"] ] ., W"" ,

Steel ',} .*,-. ;.

% fj j (

m y qn

,gggy gun inn

{

Hl i Hl

.[ gg g- -d,y -

h ..o f Graphite =

Shielding f f .' H Blocks E*? N  !

lh [ < Reactor Vessel Reactor

} -y,q g g y -

[. / ,;I Nitrogen Vault / Filled Space

. . 7-t c Ci / 'A K c .U *;*

-

• C c .

S *

. Annular Sand - - . y c _

, . .. Water Tank

...e l= .

.; c.,

g ._

... .. ~ . B o o ical Shield

%[dcIOU.M E-[*. l,I 5.- c'  : n ('(([ fl **.;/... *o

~ ** y j'UQl bi bb '

p. .j l

=

l

'.h n i

!i !

h  !

l l ii'll \\$ l' 12 Reactor Support

• c- l; h O l T*lt[l W ')4 's i

• % / u#s} , I ,..

t

i

=

% _J '

. :.. . .:; :[ . . ,. ;. .f:. . ?.  : ?,h.s.%. . %.:o : .

@. . :o= [ ( 7. .: . . . .

... * - 9 . e. .. . * ^

• * . .s -

.-'5 : , '].:a . .e. .n .... ^ ;o.

r ' a~~#  : e :'. -o'. = ' m l;.':,

.:,; _ n . -

• y-~ ~Mw~~ ~ ~^~

Pressure Boundary of Closed Reactor Space Figure 2.5 Cross-sectional view of reactor cavity ,

^

2.1.2.2 Upper and Lower Shields and Reactor Support (Dubrovsky,1981; Dollezhal, 1977; Dollezhal, 1980b; USSR, 1986) 7 6

The upper biological shield is a cylindrical shell about 17 m (56 ft) in dia-meter and 3 m (10 ft) thick. It consists of two circular plates welded to a cylindrical outer shell. Additional strength is provided by vertical stiffen-ing ribs. Openings for the pressure tubes consist of welded cylindrical tube -

ducts. The space between the ducts is filled with6serpentine aggregrate. The entire assembly, which weighs 1000 tonnes (2.2x10 lb), rests on rollers to accommodate thermal expansion. In addition to providing for biological shield-ing, it also supports the weight of the fuel channels, control rod drive '

channels, the upper reactor outlet piping, and the removable floor covering. .

The lower biological shield is 14.5 m (48 ft) in diameter and 2 m (6.5 ft) j thick. It is similar in construction to the upper biological shield. This 2-12 >

V J

shield. transmits the load of the graphite and lower piping to the main. reactor

- support immediately under it.

~

The main reactor support is made of two steel plates with stiffening ribs 5.3'm (17_ ft). high placed perpendicular to each other (cruciform shape). This sup-port transmits the weight of the lower shield and the reactor to the building foundation.

2.1.2.3 Upper Floor Slab (Dubrovsky, 1981; Dollezhal, 1980b;' USSR, 1986) a The floor of the reactor hall is constructed of removable sections that allow access to the fuel channels, instrumentation leads, and control rod drives.

' 'The floor serves as both a radiological shield and a thermal barrier .The re- .

movable sections are made of _ steel structures filled with iron-barium-serpentine concrete and rest on the channel ducts of the upper biological shield. Air is ,

extracted from the reactor-hall through gaps in the floor to provide for cooling

, and to prevent the possibility of radioactive steam entering the reactor building.

4 2.1.2.4 Side Biological Shield (Dubrovsky, 1981; Dollezhal, 1980b; USSR, ,-

1986) l A double-walled vessel,16.6 m (54 ft) inside diameter (ID) x 19.0 m (62 ft) outside diameter (OD), surrounds the reactor vessel inside the reactor cavity.

l The vessel consists of 16 water-filled compartments and provides shielding in .c j the lateral direction. The vessel walls are 30 mm (1.2 in.) thick. The space between the water-filled shield and the walls of the reactor cavity is filled with sand. The space between the water-filled shield and the reactor vassel is filled with nitrogen.

2.1.2.5 Reactor Cavity Walls (Dubrovsky, 1981; USSR, 1986) j The reactor cavity walls are made of reinforced concrete 2 m (6.5 ft) thick.

2.1.3 Reactor Hall (Dubrovsky, 1981; Konviz, 1981; Dollezhal, 1980c, e; Usik, '

1984; USSR, 1986)

A cross-section of the building for Units 3 and 4 is shown in Figure 2.6. A plan view of Units 3 and 4 is shown in Figure 2.7.

! The reactor hall-(the area above the upper shielding cover of the reactor) is a '

large open workspace containing the refueling machine and an upper, high-bay area with a 50-tonne-capacity overhead traveling crane. The refueling machine, which weighs about 350 tonnes, is mounted on a traveling bridge. The inside b dimensions of the reactor hall are about 24 m wide x 80 m long x 35 m high (79 ft x 262 ft x 115 ft). The lower bay is constructed of reinforced concrete and has walls about 1.5 m (5 ft) thick. The massive walls and columns support the fueling machine and provide shielding for the steam separators located 4

adjacent to the reactor hall. A spent fuel storage pool is located in each

!: reactor hall. The high-bay portion of the reactor hall is of steel frame

! construction using precast concrete panel sheathing for the walls. The reactor hall roof, atop the high bay, is supported by steel trusses about 6 m (20 ft) deep. The mass of a preassembled roof block is 50 tonnes. The reactor has four roof blocks, and each block is 20 m x 24 m x 6 m (66 ft x 79 ft x 20 ft).

, 2-13

3

• T

\ 0-Boundary of 'p Closed Reactor { ' {13 ,f O.18 MPa (26 psig)

Pressure Boundary Space ,,

\ .. . 22 23 d-- & 2 ' c ),. /

~j' ',

"-_ " " * * 'V O.25 MPa (36 psig)

,i,1 ,ii,1 Pressure Boundary 22 - g .

r-- 12 .

12 i' '

if 39 9 u -

T

\

• ,,,7 2 35 6

' -A '6 g,' H Lll Q

- ^

- a 2! !W

>- w r @ g g s 4--

f. - .

-3 m,i m o el 5 d j , 3 . i

\ '

1 2s 3 N' - -

1_

8 ' neemas a- - ' N'- , CM NM lI d~- '

W '

.- M E ld .

l l lllll .i od

,1 + + + + + + + + + H +r.Os+ ++++ Mi t t + t + t t t t t t t t tt t Ht + t H H H. 24 0 [rlJ -- -

> 't %_ a '

h/9 i

y

. n;n

• M dg W f 9 i \ v 11 .

- -- - ' 11 2 " '

8--~' is4 'M g 3 ,- _

g 18 ' '

ll, igo -- ,i l

[ \h ,5 d 3" ~

w 1 T'Ri- h 1 'T 0.'l 6,a \ c

~

m

,; iin y,g 2 - i t-3p n j _ _L_ . _ .

j s

i n-noi a n n iur 1mr mvr -- % m- nic,,,

gi. i__,

i n m a

M , :1 Riiikilii# .iji. M TF

, t'b.3 ~

l ' ,' . ~.

'. fv.  ?.

..es..

'nv,wav m mec-m wmmmn%-...

.$1.

l }

~

O

-wrwn.w>;*

g S** va5mwxv w.wm w0sexywwn uww+wvv5:ww Num l_ 23 000 l 2a000 13.000 _ l 4.000 72 000 i l- 1 1 - First-stage condensate pump.2 - 125/20-t overhead travelimg crane. 3 - separator-steam superheater; 4 - K-500-05/3000 steam turtune. 5 Condenser; 6 - Additional cooler.

7 - Low pressure heater. 8 - Demerator. 9 - 50/10-t overhead travelimg crane.10 - Mam circulatmg pump.11 - Electnc motor of mam circulatmg pump; 12 Drum separator.

13 50/10-t remotely controlled overhead travelling crane,14 - Refueling mechanism; 15 - RBMK-1000 reactor; 16 Accident containment wavles.17 - Bubbler pond.

18 - P.pe aisle.19 Modular control board. 20 Location beneath control board room. 21 - House switchgear locations; 22 - Enhaust ventilation plant locations. 23 Plenum ventilation plant locations Figure 2.6 Cross-sectional view of reactor building elevation, Chernobyl Units 3 and 4

Nall ifGCh soi

~

Reactor No.4 O 'D owy 'O' ~6660 ? J hr im o t/2.J M i

/n,,cio, no.3 or en 'US

/g N _Il f , ,,U-f , , .

bh.2

~

a. . l -

'. D Rail lisch arts T* j gz3 "8 g k , S ,; h y,,,,,, g,,, gy f pf;

'oooo0050 nt n 050 Doooo 1 l'_ _ / ^ ^^

/ \Q

....... Y.16?4 E. . ^ N N ~ ~ ~ ~ ~ ~ t' di ' ' ' ' ' ^

^

^

b lf +00 l cocoa lll}.h.','5 .,,,,$

j

~

+1Z0

'~ $0 [_

Eal l jl

} _ __ -CT h'7M2

"'M .

TM.] $ h Tuhof

-7 a -TM/-

IIlil!illililll!!IITill " " " *** _ _

108DW \ 96 000 1 96000 l 102UUU Section lY ktlion /// / & ction // &cteon /

Ratt trach axis Figure 2.7 Layout of main building of Chernobyl Units 3 and 4 Source: Dubrovsky, 1981, p. 95.

2.1.4 Reactor Building and Turbine Generator Hall (Dubrovsky,1981; Konviz, 1981; USSR, 1986)

The overall dimensions of the reactor building, not including the turbine generator hall and connecting mounting frame, are about 72 m wide x 160 m long x 50 m high (236 ft x 525 ft x 164 ft) (see Figure 2.6). The distance from ground elevation to the top of the high bay is 71 m (233 ft). The reactors are separated by a wall and shared ventilation systems. A ventilation stack is mounted between the two units directly above the general ventilation equipment.

The largecontrol room. rooms of Chernobyl Units 3 and 4 are separately located in a single, The reactor building is generally constructed of te nfo :ed concrete, most of which is precast, but thick walls [over 70 cm '2. ti tre built by the 5

" precast cast in situ" method using2 prefabricats . reu.(nced foro panels.

[More than 200,000 m2 (2 million ft ) of building surface on each power unit has a special protective covering stated to be polyethylene, presumably for ease of surface decontamination.]*

A turbine generator hall, about 51 m wide x 400 m long x 30 m high (167 ft x 1312 ft x 98 ft), adjoins the reactor building. The space between the turbine

• Square brackets denote information believed to be true but not found in Soviet literature.

2-15

generator hall and the reactor building is occupied by an intermediate building.

The upper floors are occupied by de-aerators and a pipe aisle, and the lower floors are occupied by a central control board, unit control boards, house switchgear, storage batteries, cable shelves, and other electrical equipment.

2.1.5 Fuel Assembly Design (Dollezhal, 1981; USSR, 1986)

The fuel assembly consists of two circular 18-rod clusters, connected by a cen-tral rod. Each cluster is 3.644 m (11.96 ft) long and consists of an inner ring of.6 rods and an outer ring of 12 rods, held by 9 stainless steel spacer grids and 2 end plates. The fuel rods are composed of cladding tubes (Zr-1% Nb) containing sintered uranium oxide pellets. The central rod is made of Zr-2.5%

Nb. A schematic drawing of the assembly is shown in Figure 2.8. Details on the design are given in Table 2.3.

2.1.6 Fueling Machine (Dollezhal, 1980c, e; USSR, 1986)

The refueling system includes a 100-tonne crane that spans the reactor area; a carriage that operates along the crane rails; and the refueling machine, which is held by the carriage (Figure 2.9). The whole assembly weighs about 350 tonnes (770,000 lb). The refueling machine can be positioned over any of the 1661 fuel channels and over the fuel storage area. The refueling machine is designed to refuel five fuel channels during a 24-hour period while at full power.

The refueling system is designed to refuel at least 10 channels every 24-hour period while the reactor is shut down. Refueling at full power permits replace-ment of defective fuel elements and normal refueling without interrupting power generation. The refueling machine can be used to move irradiated fuel assem-blies from storage to the reactor or from one reactor position to another.

While centered over a fuel channel, the refueling machine lowers a cylinder that contains a seal, which fits over the outside of the fuel channel nozzle.

The cylinder, which is part of the pressure vessel, is filled with water from an on-board water tank. The system is pressurized, at which time the nozzle cap is ready for removal. A grab hook, located inside the pressurized cylinder (Figure 2.10), is lowered onto the top of the nozzle plug. The jaws of the grab hook are remotely closed around the enlarged nozzle plug extension. An actuating device, which is engaged with lugs on the outside of the plug, is then rotated. This rotation unseals the nozzle plug gasket and releases the ball-locking device that keeps the nozzle plug in place. The pressure in the pressurized refueling machine cylinder is higher than the pressure in the internal loop; thus, preventing the nozzle plug from being ejected. The nozzle plug, the shield plug, the suspension rod, and the fuel assembly are lifted into the pressurized cylinder of the refueling machine and retained within a cartridge holder. The cartridge is rotated to permit insertion of a gauge (used to check the fuel channel diameter). The fresh fuel assembly, with attached nozzle and shield plug, is then lowered into the fuel channel.

i During this entire refueling operation, water is pumped at a controlled rate from the pressurized cylinder into the fuel channel to cool the discharged fuel elements. After the fresh fuel is in place, the nozzle plug locking device is again engaged, sealing the plug gasket. The refueling machine seals are then depressurized and the cylinder is retracted. A biological shield plug is moved 2-16 1

" t l ille l s  !

lJQ

. It 00 ul B{ . .

]B 1

' 7 l EP l i _ __ ,

4d '1

~

l iD

'= '

2 ' ' ' '

N  !

3 130

.... l.il E i i __f B

!O 1& s q{

{

i i

- ( .

6' ' ' ' ' '

1- Suspension I '

2 - Pin y 3 - Adapter TT 4 - Shank IE h;]T L 5 - Fuel Element

. :  :, 6 - Carrier Rod

, , 8/ j ' l

7. sieeve 9

i 8 - End Cap 7 9 - Nuts Note that the fuel length in each subassembly is 3.43 m (11.2 ft), with a 20-mm (0.79-in.) gap between the subassemblies. The upper and lower assemblies have their rod plenums at the upper and lower ends, respectively.

Figure 2.8 Schematic drawing of the 36-rod fuel element (18 rods in each of two subassemblies)

Source: Do'11ezhal, 1981.

2-17

=. -

t:

t.

i Table 2.3 Fuel assembly design parameters for Chernobyl Unit 4 )

Parameter Value 2 j Subassemblies per assembly , '

Number of rods per subassembly 18 Assembly outer diameter 9 mm (3.1 in.)

Length of assembly fuel region 6.9 m (23.0 ft)

Length of active ' fuel per rod 3.43 m (11.25 ft)

Plenum length 17.5 cm (6.9 in.)

Cladding tube outer diameter 13.6 mm (0.5 in.)

Cladding radial wall thickness 0.9 mm (0.035 in.)

Cladding material Zr-1% Nb Fuel material UO2 Fuel enrichment 2.0 wt % U-235 Fuel pellet diameter 11.5 mm (0.45 in.)

Fuel pellet length 15.0 mm (0.59 in.)

Minimum pellet density 10.4 g/cc (0.376 lb/in.3)

Pellet end Dished Fuel cladding gap 0.18 to 0.38 mm (0.007 to 0.015 in.)

Fill gas composition He Fill gas pressure 0.1 MPa (14.7 psi)

Water-to-fuel volume ratio 1.23 into position below the refueling machine, and the discharged fuel element is transported to the spent fuel storage pool.

2.2 Fluid and Heat Transport Systems 2.2.1 Highlights Three principal' fluid and heat transfer systems are used in the Chernobyl Unit 4 reactor: (1) the primary cooling system, which cools the core and produces power; (2) the control rod cooling system, which provides cooling to the con-trol rods and the reflectors; and (3) the reactor gas circuit, which enhances heat transfer from the graphite moderator to the pressure tubes.

2.2.2 Primary Cooling System (Sedov,1979; Novosel'skii,1984; Dubrovsky,1981; Dollezhal, 1981; Voronin, 1980; Kulikov, 1984; USSR, 1986)

The Chernobyl Unit 4 reactor contains two independent primary coolant loops, each of which cools half of the reactor. A schematic drawing of the cooling system is shown in Figure 2.11. Each loop has four primary coolant pumps, three of which are normally in use the fourth acts as a backup. Each pump has a capacity of 5500 to 12,000 mS/hr (about 24,200 to 52,800 gpm) and a dynamic head of 1.96 MPa (284 psi). The discharge line from each pump also has a check valve, to prevent backflow should the pump fail, and a flow-regulating valve.

The pumps are fitted with heavy flywheels to provide a 120-second rundown time in case of a loss of electrical power to the pump, and to provide interim cool-ing until natural circulation can be established. Natural circulation is ex-pected to be established 30 to 35 seconds after the main pumps are deenergized.

2-18 L

sus en /

3

_gj _ 5 h I / 6 T:g --

h / -

7

_& __Jb8 r . . )

/*

J E l l l 18 l

I .-

l 10 i ;

.::(

16 $

15 a --.

j. ---

7, 14 r_.

11 13 bK -

12 w

LEGEND: 1-Cartridge; 2-Support Equipment; 3-Upper Pressure Vessel Section; 4-Grab Drive; 5-Grab Actuating Chains; 6-Framework; 7-Chain Winding Mechanism; 8-Cartridge Rotation Drive; 9-Middle Pressure Vessel Section; 10-Shutoff Device; 11-Manual Tube Location Device; 12-Television Tube Location Device; 13-Movable .

Lower Shielding; 14-Lower Pressure Vessel Section; 15-Special Hook; 16-Sealing '

l Drive; 17-Shielding; 18-Crane; 19-Carriage.

Figure 2.9 Cross-sectional view of the fueling machine 2-19 1

l , _ .___ -

I e a a

]

Gear Rack

\

N _Q a

kN -

/ "'"i*"*

,A ,

'h

f. , . ',v /j,,:h/ ** "*

• Drive Mechanism ---

h

- l' -

hW )

L .

l $

c Housing / ',

e Jews

/ =6 N I

Figure 2.10 Grab hook of refueling machine l' Each of these pumps has shutoff valves to isolate the pump. Two normally open bypass valves and a check valve between the inlet and the outlet of the pump permit natural circulation through the reactor after shutdown of the four in-

! stalled pumps.

The coolant from the pumps flows to a common header and then to twenty-two j 32.5-cm (12.8-in.) diameter distributor headers on each half of the reactor.

l The individual supply pipes of 5.7-cm (2.24-in.) diameter, and 0.35-cm

' (0.14-in.) wall thickness to the pressure tubes are connected to these dis-tributor headers. Each supply pipe contains a manually operated flow-regulating valve and flow meter. Pressure tube coolant flow, and thereby steam quality, is set by adjusting these flow-control valves on the basis of calcu-lated channel power, calculated power distribution, and measured inlet temper-ature. The coolant is directed from the supply pipes up through the fuel channels. The full core coolant. flow at 100% power is 37,600 tonnes per hour.

The inlet water, initially at 270*C (518'F), is heated to the average satura-tion temperature, 284*C (543*F).

i i

2-20 l

t

ea Level Regulator To Turbogeneratof -

\ / -Pressure Regulator f v Deaerator s-

'h Reactor Pump Turbogenerator Condenser Pump Storage i i Und of Em Condensate Pump Pressurized Collector v," v Flow Limitars  :

Main Circulating Pump q'g-+From Suppression Pool Distributing Group g Tan {

Pumps of Self-Contained  !

ERCS Collector Fast-Action Emergency Reactor Cooling Valve of ERCS System (ERCS) i Dc >< '

N Figure 2.11 Normal and emergency cooling systems of the Chernobyl Unit 4 reactor At approximately 2.3 m (7.55 ft) into the active core, bulk nucleate boiling occurs, and this process continues along the remainder of the channel. The average exit steam quality of the core is 14.5%, and the maximum exit steam quality is 20.1%.

The steam-water mixtures from the various fueled pressure tubes are individually carried by pipes of 7.6-cm (3.0-in.) diameter and 0.4-cm (0.16-in.) wall thick-ness to four horizontal drum-type separators, 2.6 m (8.53 ft) in internal diameter and 31.0 m (101.8 ft) in length. Two separators serve each loop.

Steam exits from the top of each separator into two 426-mm (16.77-in.) diameter steam headers. Between the separator outlets and the main turbine or steam dusp inlets, these two headers join to form a single 630-mm (24.8-in.) diame-ter header, which passes from the reactor building into the turbine gallery.

There are four 630-mm (24.8-in.) headers. These headers are cross-connected to headers that can feed either the steam dump or one or both of the 500-MWe turbine generator sets.

The pipe section located before the turbine main steam valves contains various steam discharge devices: eight main safety valves with a throughput of 725 tonnes (1.5 million Ibm) of steam per hour, four turbine condenser fast-acting d

steam dump stations with a capacity of 725 tonnes (1.5 million Ibm) of steam per hour (two per turbine plant), and six service-load fast-acting steam dump stations.

2-21

Steam at 6.46 MPa (937 psia), 280*C (536*F), and 0.1% or less relative humidity is fed from the main steam header into the first stage of the four-stage high-pressure turbine. Some high-pressure steam is bled off upstream of the turbine inlet valve, as well as from inter-stage taps in the high-pressure turbine, and sent to the heating side of the reheater /superheaters, the jet pumps for the main condenser air ejectors, and the main turbine shaft seal system.

After exiting the high pressure turbine, the steam passes through one of the two separator / reheaters and is dried and superheated to 0.4 MPa (58 psia) and 263 C (473 F) before entering one of the four 4-stage low pressure turbines.

Inter-stage steam is bled from various taps in the low pressure turbines to service condensate reheaters and auxiliary thermal loads.

After leaving the low-pressure turbine, the steam enters one of the four sec-tions of the main condenser where it condenses at 0.04 MPa (5.8 psia). From the condensers, the water is pumped back to the main steam separators (using four electric high pressure feedpumps) via a condensate polisher (for purification and water chemistry control), a series of reheaters, and a de-aerator with an attached explosive gas recombiner. The feedwater enters the steam separators at 6.964 MPa (1010 psia) and 165*C (329*F). It is mixed with 284*C (543*F) saturated water to provide recirculation water at 270*C (518 F).

Twelve downcomer pipes are attached to the bottom of each steam separator.

These pipes connect with a common header that feeds the suction of the primary coolant pumps. This header, and the pump discharge header described earlier, are 90 cm (35.4 in.) in internal diameter.

Under certain (unspecified, but presumably low-power) conditions, steam from the reactor can bypass the main turbines and be discharged to the main condensers via a steam dumping system. This system consists of a series of reducers, which pass the high-pressure steam into one of two bubble tanks where it is cooled before being sent to the main condenser.

2.2.3 Control Rod Cooling System (USSR, 1986; Dollezhal, 1981)

A system separate from the primary cooling system is provided to cool the con-trol rods of the Chernobyl Unit 4 reactor (Figure 2.12). The system also pro-vides cooling to the reflector regions of the core.

Approximately 1100 m 3 /hr (4850 gpm) of cooling water from a supply reservoir (known as the emergency storage tank) at 40*C (104 F) flows under gravity to the control rod cooling channels (and reflector cooling passages) at the top of the reactor. The coolant in the control rod channels flows downward through the core. The flowrate in each of these channels is approximately 4 m3 /hr (18 gpm), and orifices at the bottom prevent the rapid loss of water even if the supply is terminated. The volume of the supply reservoir is governed by the condition that it should supply the rated flow for 6 minutes after the supply water from the lower circulation tank is interrupted. After flowing through the control rod pressure tubes, the water (65*C, 149*F) is cooled and returned to the circulation tank. Water is pumped from the circulation tank back up to the supply reservoir. Part of the water in the reservoir is sent through a purification system consisting of mechanical filters and ion exchange beds.

I l

2-22

n o a o Compressed Air Feed p .,,7 I supply neservo.,

Control ^1

{

l a b L'

~'

i Channehs h __ Z -

0 Brpass Cleaning

{ j  :

un;i l

. 1' l

Il s '

N neacio, Fa7ure oeiection compresseo To siowoown f f f Channel Aer Feed #'*

I (

F- -

q $3 Heat Exchangers l [ l Fdurs

{3 g g

g E-

[*n'"

circuianon rank

- ===- "*"

'- - + '-

= - ---

" coohng service water Figure 2.12 Schematic drawing of control rod cooling system 2.2.4 Reactor Gas Circuit (USSR, 1986; Voronin, 1980)

The reactor gas circuit (see Figure 2.13) circulates a nominal mixture of 80%

helium and 20% nitrogen gas through spaces in the graphite moderator at a rate of about 200 to 400 normal 3m /hr (7062 to 14,125 normal3 ft /hr). This action improves the heat transfer from the graphite prevents oxidation of the graphite permits channel-by-channel monitoring of the pressure tubes' integrity during operation The gas mixture is fed into a channel below the reactor and distributed across the bottom face of the reactor. The mixture then flows between the graphite columns, providing a heat conduction medium for transmitting the heat generated in the graphite to the process channels. Monitors are provided at the top of each channel to sense the relative humidity and temperature of the exiting gas.

These data are used to detect any leaks that may be present in the various pressure tubes.

The gas scrubbing system consists of a set of contact catalyzers, scrubbing and dewatering units, and cryogenic cooling system units. In the contact catalyzer, hydrogenation with H 2 takes place at a temperature of N160*C, with the forma-tion of water vapor and combustion of C0 to CO2 and the release of heat. The reaction takes place in an oxygen atmosphere in the presence of a platinum 2-23

Release Through the Activity Reduction System

+

HeNa hen 2 N2 Fuel Channel Integrity l l I Monitoring System Nitrogen-Intensified Helium Extraction . Scrubbing hen 2 System

"*' System

- hen 2 _

Na 3,, , , , , . ... Fuel Channel Integrity

[_-J -

Monitoring System Drum a Nitrogen Supply e- e' hen 2 y To the Pressure-Active Ventilation ss e se< I n -

hen 2 --> fo"ol ha ber

[; t-U. . _ . . -.' M- Na -

_ _ ]1=  %

Active e -'. d  ?

~

• Ventilation

3. q i s V" -

Na

@<3.3.

?

+.1

____-?, " Active Drainage

. N2 s'- Pipework N2 w A 47 a

f.  % Supply of Nitrogen to the

'/

Metal Structures of the Reactor Q/j// W //////////////A

'/

hen 2 Figure 2.13 Gas circuit system catalyzer. After passing through the contact catalyzer, the gas passes through a refrigerator and dehumidifier and then on into the scrubbing and dewatering unit, which is equipped with zeolite and mechanical filters. Adsorption takes place and CO 2 , H3 , C2, and water vapor impurities are scrubbed from the helium-nitrogen gas, which then passes to the cryogenic cooling unit. Any impurities remaining in the gas are removed in this unit by a cold trap at a temperature of -185'C.

During startup, pure nitrogen cover gas is used. The graphite temperature is allowed to increase up to a maximum measured value of 750*C (1382*F) during this time.

2.3 Reactor Physics 2.3.1 Highlights The unique design features of the reactor core, from a reactor physics perspec-tive, are its graphite moderator, large size, and large core load of enriched 2-24

-uranium fuel. The graphite moderator plays a significant role in defining the characteristics of the reactivity feedback coefficients. The large core size causes it to be loosely coupled, and the large fuel load causes it to contain many critical masses. These special design features produce unique neutronics characteristics and complex reactivity control requirements.

2.3.2 Reactivity Coefficients (Dollezhal, 1980a; USSR, 1986; Romanenko, 1982; Virgil'ev, 1979)

Reactivity feedback-coefficients are associated with the temperatures and densi-ties of the reactor core materials. The five primary coefficients that deter-mine the neutronics behavior of the reactor during both normal. operation and accident conditions are coolant density, graphite temperature, coolant tempera-ture,. fuel density, and fuel temperature. The magnitude and sign of these coefficients are dependent on the core loading of neutron absorbers (control-rods, supplemental absorbers and unfueled, water-filled channels) and the isotopic content of the fuel. Because the loading of absorbers in the core and

, the isotopic content of the fuel change.with time, the reactivity coefficients change with time.

Reported values for the coefficients as a function of core configuration for 1.8% U-235 fuel and for the 2% U-235 fuel for Chernobyl Unit 4 are given in Table 2.4. Of the five, the effects of fuel density and coolant temperature are minor because the ranges of possible density and temperature changes are

small. The remaining three coefficients, however, significantly affect the

, reactivity state of the core. Each of these three is discussed in detail.

2.3.2.1 Coolant Void Coefficient The coolant void coefficient is positive under most operating conditions. This is due to the large graphite-to-fuel ratio, which produces a well thermalized neutron spectrum with no water in the fuel channel. The magnitude and sign of this coefficient are strong functions of void fraction, control rod positions, fuel enrichment, fuel exposure, and supplemental absorber loading. Since these ,

factors vary considerably over the reactor volume, there is a large variation in void coefficient. As shown in Table 2.4, the coolant void reactivity coeffi-cient is positive in most operating conditions, and it becomes more positive as the reactor continues to operate. Figure 2.14 shows that the void coeffi-cient becomes constant at approximately 1000 effective-full-power days.

[ 2.3.2.2 Graphite Temperature Coefficient The graphite temperature coefficient is positive. Increasing the graphite moderator temperature hardens the energy spectrum of the thermalized neutrons.

The net reactivity effect is a combination of decreased neutron absorption in i the water coolant (positive), increased neutron absorption by U-238 (negative),

and increased fission reactions in the plutonium isotopes (positive). The 1 latter effect continues to increase as the fuel undergoes burnup; thus, the reactivity effect associated with increasing graphite temperature becomes more l

positive as the reactor continues to operate (Table 2.4). Figure 2.14 shows that the graphite temperature coefficient becomes constant at approximately

1000 effective-full-power days.

4 5

4 2-25

- -4

%i 2 %

Table 2.4 . Calculated reactivity coefficients for RBMK

-State of core-

' Item 1.8% U-235 2.0% U-235 Exposure (NWD/kg) 0 5 10- 10.3 y

Reactivity per $-(p)' 'O.0065 0.005 0.0042 0.0048 Number of ~ equivalent ?

rod worths 30 20 20 :H)

Number of aupplemental. 236- 118 0 1 absorbers Coolant void (ap/aa)*. -1.0x10 2 +0.15x10 2 +0.92x10 2 +0.02x10 2 Graphite temperature 0 +3.2x10 5 +5.4x10 s +6.0x10 s l

.(p/*C)

' Water temperature- -5.1x10 s +0.42x10.s +5x10 5 -

(p/ac)

Fuel temperature -1.0x10 5 -1.0x10.s -1.1x10 5 -1.2x10 s (p/*C)

Fuel density +1.44x10 2 -0.22x10 2 -1.3x10 2 _

(p/gm/cm3 )

• a = % void.

2.3.2.3 Fuel Temperature Coefficient The fuel temperature coefficient is the only coefficient that is negative. As shown in Figure 2.14, the fuel temperature coefficient becomes less negative as

, the reactor operates, and it becomes constant at approximately 700 effective-

full power days.

i 2.3.3 Reactivity Control Requirements The reactivity control system is designed to compensate for any reactivity changes. The number and spacing of the control rods are used to control spatial l-variations in the power. The total reactivity worth is sufficient to hold the I

reactor suberitical under all conditions.

! During startup of the Leningrad Unit 1 RBMK reactor, local power oscillations j

occurred with a frequency of approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. In an effort to reduce the tendency toward local power variations, the later RBMK reactors were l

designed with a fuel enrichment of 2% U-235 and a reduced graphite density. An increased reliance on automated control was also initiated to assist in reduc-ing power oscillations.

2-26 l-L

-4 -

1 E

3j #. 2 -- -

0 7 2

1 p s -

.E re .2 N 4 -

j@ g20 2 $ "o- 2 -

-0.5 -

E o '

j j ; .1.0 m=

$=S #5 e i . I Figure 2.14 Effect of reactor operation on the coolant void, fuel temperature, and 0 1000 2000 moderator temperature reactivity t, effective days coefficients The large enriched uranium fuel load creates many critical masses in the core.

The reactivity control system is designed to hold the core subcritical under all conditions. The control rod system alone is not sufficient to hold the core suberitical for the initial fuel loading. During the initial loading, one supplemental absorber rod is loaded for every six uranium-fueled channels. As the reactor operates and the initial reactivity is burned out, the supplemental absorbers are replaced with uranium fuel. The positive reactivity coefficients add to the difficulty of maintaining the reactor suberitical during accident conditions.

As discussed earlier in this section, the values of the reactivity feedback coefficients are dependent on the core loading of absorbers and the isotopic composition of the fuel. The magnitude of some of the coefficients varies considerably. From the information in Figure 2.14, the coolant void, graphite temperature, and fuel temperature coefficients are at their maximum values at a reactor average fuel exposure-of 10 MWD /kg. (The average fuel exposure at

'Chernobyl Unit 4 at the time of the accident was approximately 10.3 MWD /kg.)

Because of the control rod configuration at the time of the accident (virtually all rods fully withdrawn), the void coefficient was 1.5 times its normal value.

The delayed neutron fraction and the prompt neutron lifetime determine the dynamic behavior of the reactor in response to changes in reactivity. For an RBMK lattice with an exposure of 10.3 MWD /kg, these values are 0.0048 and 0.77 msec, respectively.

2.4 Ir.strumentation and control 2.4.1 Highlights The reactor is highly instrumented and relies upon extensive computerized control for operation. Control rods are grouped as follows: manual, automatic 2-27

. . - . . ~ ,_. . __ -.

j regulation, scram, and short absorbing rods. In addition, auxiliary absorbing rods are used during a multi-year period while the reactor is achieving an equilibrium exposure level.

2.4.2 Core Instrumentation and Control Rod Systems (USSR, 1986)

Reactor instrumentation collects and processes data needed to control reactor power. At least six sensor systems are used in the Chernobyl Unit 4 reactor:

- Beta-emission sensors are located in 12 fuel channels in the central part of the core at seven different heights to measure the axial distribution of neutron flux.

Additional beta-emission sensors are installed in 130 fuel channels to measure the radial flux distribution.

- Fission chambers, used te measure neutron flux when the reactor is started, are arranged in four channels, located symmetrically around the core in the radial reflector.

- Thermocouples are installed at 3 different heights in 17 vertical channels to monitor graphite temperature.

- Gamma-spectrometer probes that measure the activity of the steam / water mixture in the drain pipes at the separator inlet (near drum separator in Figure 2.11) are used to monitor leaks in fuel-element cladding.

- The relative humidity and temperature of a helium-nitrogen mixture, which is pumped through the gap between the tube and the graphite, is used to monitor leaks in pressure tubes.

2.4.3 The Monitoring and Control System (Dollezhal, 1980d; USSR, 1986)

The monitoring and control system is composed of two basic subsystems: the control and protection system, and the reactor process monitoring system. The latter contains the centralized monitoring system (Soviet designation: Skala).

2.4.3.1 The Control and Protection System The control and protection system (Soviet designation: SUZ) regulates both the power and the power distribution in the reactor. It also provides automatic emergency protection if the power level exceeds set limits (see Section 2.7).

The control and protection system provides

- control of the power level (based on the neutron-flux) of the reactor and its period under all operating regimes from 8x10 12 to 1.2 times full power

- startup of the reactor from the shutdown state to the required power level

- automatic regulating of the reactor power at the required level and changes in that level 2-28

manual (from the operator's control desk) regulating of the power density distribution throughout the core and regulating of the reactivity to com-pensate for burnup, reflection, and other effects automatic stabilization of the radial-azimuthal power density distribution in the reactor preventive protection, i.e., rapid controlled reduction of the reactor power to safe levels (protection level 1 is 50% of full power, protection level 2 is 60% of full power)

• emergency protection when the parameters of the reactor or generating unit change as a result of an accident (protection level 5)

Overall power control can be divided into three groups: manual, automatic, and emergency. Local power control can be divided into two groups, automatic and emergency. Each group is described briefly. Overall power control is provided by 211 control rods (earlier reactors had 179). The rods are functionally divided into manual control rods (Soviet designation: RR), two sets of auto-matic control rods (Soviet designation: AR and LAR), emergency power reduction or scram rods (Soviet designation: AZ), and shortened absorber rods (Soviet designation: USP). In addition, numerous supplemental absorber rods in the core are used to hold down the initial excess reactivity. These additional absorber rods are gradually replaced with fuel during burnup. The number and function of these various types of rods are listed in Table 2.5.

Table 2.5 Types of control rods Name Symbol Number Function Manual control RR 139 Operator controlled - a portion is used to shape power and a portion is reserved.

Local automatic regulation LAR 12 Maintain power shape by using signals from four lateral ionization chambers.

Automatic power regulation AR 12 Maintain total reactor power.

Three sets of four ganged rods.

Scram AZ 24 Scram rods - normally withdrawn from core.

Short absorbing USP 24 Used to control axial power shape - manually controlled, and enter from bottom of reactor.

Auxiliary absorbers DP 240 Replaced by fuel during burnup.

Compound of boron steel (2%

boron).

2-29

The absorbing material of the rods is boron carbide fabricated in a sleeve design (see Figure 2.15 and Table 2.6). The boron carbide is enclosed in a sealed annular element formed from an aluminum alloy. The RR, AR, and AZ rods are assembled from six absorbing sections. The USP rods are assembled from three absorbing sections. All rods are lowered into the core from the top, except the USP rods, which are raised from the bottom.

With the exception of the AR rods, all'the rods have sections to displace water and, thus, enhance the effectiveness of the control rods. The displacer sections are cylindrical and are formed of aluminum alloy with sealed end caps.

The five displacer sections are filled with sleeves and cylindrical graphite blocks. When a control rod is fully withdrawn, the displacer is located symmetrically with respect to the core so that the 1-m rod channel sections on either end are filled with water (see Figure 2.16).

These 1-m (3.2-ft) water-filled sections are strong neutron absorbers. During the initial insertion of fully withdrawn control rods (scram), the water in the bottom section is replaced by the weakly absorbing graphite displacer.

The result is a local, positive reactivity increase in the bottom meter of the core. The magnitude of the reactivity increase is dependent on the number of rods fully withdrawn.

Manual control is provided by manual control (RR) rods. These rods are divided into four groups. One group is located in the periphery of the core, and the remaining three are located centrally in the core. The central rods are divided into three regular, intermixed lattices. Control of excess reactivity is accom-plished by the RR rods in one of these central groups and by the peripheral rods, which are moved up or down to equalize the current in the peripheral ionization chambers. The rods of each central group are moved sequentially to maintain the position within 10.5 m (20 in.) of each other. The rods of the two other central groups are at the extreme upper or lower positions depending upon the reactivity reserve.

The overall power control system consists of three identical sets of automatic regulators. Each set consists of four ionization chambers placed around the reactor. Information from these chambers is used in synchronizing the movement of the four automatic regulating rods. The use of ionization chambers of different sensitivity enables these sets to work in either the low-power range, from 0.5% to 10% of full power, or in working power range, from 5% to 100% of full power. In the low power range there is one automatic regulator (3AR); in the working power range there are two (IAR and 2AR). One of the working-range regulators is switched on; the second is in " hot" standby. The second regulator is automatically switched on if the first regulator malfunctions.

An emergency signal is generated if the set limit of a chamber is exceeded and the signal is recorded on at least two measuring channels of different groups.

If an emergency signal is generated, the emergency control rods are lowered.

This action protects the reactor as a whole from power excursions, and it also protects the reactor from peripheral local power excursions.

The power density distribution in the reactor is stabilized by the local automatic regulating system and by the local emergency protection system. The former is designed on the principle of independent power regulation in 12 local l

2-30

Belt 3E Idl l

EA  ?

Aluminum Alloy \.  !

f. RR, AR & AZ Rods

-'i_I_&--

6 B.C Sections B.C 7 USP Rods'

\Ji j 3 Sections i

m '

h Void for Coolant Passage b b (Nsh 25LM Graphite

. ]'

esi 1s::i:Ms RR, AZ and USP* Rods 6 Sections -

b' 'I AR Rod has no z- -i displacer s

Aluminum Alloy -

.w0 t.

l T

• USP rods have their displacers on the top and the B 4C absorber on the bottom.

Figure 2.15 Control rod design 2-31

Table 2.6 Control rod specifications i

Component Composition and dimension Control material Boron carbide (B 4C)

Cladding material Aluminum (A1) alloy i

Control length /section 98.4 cm (38.7 in.)

Total length /section 102.4 cm (40.3 in.) ,

Displacer length /section 100 cm (39.4 in.)

Outer B4C diameter 6.5 cm (2.6 in.) 1 Inner B 4C diameter 5.75 cm (2.3 in.) i Outer cladding diameter 7.0 cm (2.8 in.)

Outer cladding thickness 0.2 cm (0.08 in.)

Inner cladding diameter 5.0 cm (2.0 in.)

Inner cladding thickness 0.2 cm (0.08 in.)

k

..y Boron Carbide 3 I

Poison \

5 h 200 mm Top of Core i _L I 1 m' ' - H2O

~~ "

fH2O 3 R 4

• Graphite Boron Carbide 7m 5m h Displacer  : # Poison 0, +

?' .,

l 6 s

__ A $

1m -H0 +H0 Bottom 5 of Core {

' I Grephite

• ~ Displacer

/

Fully Fully l Withdrawn Inserted Figure 2.16 Schematic drawing of fully withdrawn and fully inserted control rods 2-32 L

i l

zones of the reactor by means of 12 regulating rods. The local automatic regu-lating system rods are controlled by two detectors positioned in the core around the local automatic regulating rods at a distance of 0.63 mm from the rods.

The local automatic regulating system is switched into the automatic mode in the power range after the required power density distribution has been achieved. In transitional regimes, the local automatic regulating system has considerable advantages, because it not only measures and regulates the overall power, but it also smoothes out power distortions caused by local perturbations in the equipment.

The local automatic regulating system is the primary system used to automati-cally regulate overall power in the power range from 10% to 100% of full power.

The automatic regulating system for overall power is used for standby and is automatically switched on when the local automatic regulating system malfunctions.

The insertion /withdrawl speed of the automatic control rods is limited to 0.2 m/see so that movement does not exceed the limits established by the Nuclear Safety Regulations for the rate of addition of positive reactivity when 12 rods of the local system are moved at the same time (0.7 p,gg/sec). A built-in limi-tation prevents the continuous withdrawal of the automatic regulatory rods for more than 8 seconds.

Wen a power-overshoot alarm signal appears in one of the channels of the Incal emergency protection zone, the withdrawal of the local automatic regulating rods is automatically blocked. Een emergency power overshoot signals appear in both channels of the local emergency protection zone, two local emergency protection rods are lowered into this zone of the core until at least one of the emergency signals disappears. In this case, the overall power of the reactor is reduced by automatically lowering the power transducer settings at their operational rate change.

The withdrawal of more than 8 to 10 of the manual regulating and emergency pro-tection system or shortened absorber rods upon any malfunction is prevented by a " power blocking" circuit. This circuit automatically determines the number of rods that may be withdrawn. If this number is greater than 8 to 10, the circuit is automatically disconnected from the servo drive power supply source and no additional rods can be withdrawn from the core. Three power blocking channels process the signals by a two-out-of-three logic.

2.4.3.2 Reactor Process Monitoring System The Chernobyl Unit 4 type RBMK reactor process monitoring system provides the operator with information ti. visual and documentary form on the values of the parameters that define the reactor's operating regime and the conditon of its structural elements (e.g., process channels, control channels, reflector cooling, graphite stack, and metal structure).

The following systems relate to the process monitoring system:

2-33

J I

i i

a a' channel-by-channel coolant flowrate monitoring in the process and control channels.

+ temperature monitoring.of the graphite stack and the metal structure ,

channel. integrity monitoring from the temperature and humidity of the surrounding gas

)

]

physical power density monitoring system

+ fuel cladding failure detection

+ Skala centra 1' monitoring system Information from the reactor process monitoring system is collected and pro-cessed by the Skala central monitoring system and by individual instruments or independent systems (channel failure detection, physical power monitoring sys-tem, fuel cladding failure detection) for some of the more important parameters.

The Chernobyl Unit 4 type RBMK reactors have the following numbers of monitoring points:

+ fuel channel flowrate measurement - 1661 points

+ control channel flowrate measurement - 227 points temperature measurement of-the metal structure and biological shielding -

381 points 1 - measurement of the graphite stack and plates - 46 points

+ radial and vertical power measurement - 214 points gas temperature measurement - 2044 points

- measurement of coolant activity - 1661 points The results of computer calculations are given in the form of cartegrams of the

!. reactor. A cartogram is a computer printout organized to be geometrically sini-

lar to the layout of channels in the reactor. The cartogram lists the parameters for each channel (e.g., the type of cell charge, the rod position) and also identifies the hottest regions.

t 2.4.4 Description of the Rod Drive Mechanism (Plyutinskiy, 1983) l The rod drive mechanism is used to raise, lower, and monitor the position of i the control rods (Figure 2.17). The mechanism has a de motor with a built-in l

electromagnetic brake that stops rotation of the shaft when voltage is applied.

[

The motor transmits rotation through a geared transmission link to a drum. A belt-cable wound around the drum supports the control rod.

Rotation is monitored by a selsyn sensor. Cams driven by a screw move when the rod moves. Limit switches activated by the cams indicate when the control rod has reached its extreme upper or lower position.

In the absence of motion commands, the circuits of the armature and the excita-tion winding of the electric motor are de-energized; voltage is applied to the l electromagnetic brake; and the drum, which holds the belt-cable and rod, remains motionless. When a command to extract the rod is transmitted, voltage 2-34 L

s l

l i

l

, 4  !

F "

, .-i i Litij[1 62

[./ c.a ' 9Y\ .

I* .i I _ _

l-c

.. -: = - -a

,h

~

.9 3

3 O

Figure 2.17 Functional diagram of a control rod drive mechanism is removed from the brake, the drum is released, and the electric motor raises the rod. Motion continues until either a stop signal is given or the upper limit switch is activated.

Rods are inserted into the core in one of three ways:

(1) When a signal to lower.the rod.is received, the electromagnetic coupling is de-energized and, because of the weight of the rod, the drive initiates a lowering movement, working in a self-exciting dynamic braking mode.

(2) The drives can also initiate a lowering movement mode when voltage is applied to the excitation winding. The brake is de-energized and, be-cause of the weight of the rod, the drive initiates a lowering movement in dynamic braking mode with a weak current.

(3) It is also possible to use the motor to initiate the lowering of the rod, thus reducing the transition time. In this case, full voltage is applied to the armature circuit and to the excitation winding, and power is cut off from the electromagnetic brake. The drive initiates a lowering move-ment in the motor mode. Then power is cut off from the armature winding but not from the excitation winding. The rod continues to fall, but its motion is slowed by the presence of electrical current in the excitation winding of the motor.

The safety system has five different levels of response to reduce the power level. These levels of response are discussed in Section 2.6.

2-35

- . - - ~. . . - . -. . .. . _ _ . -

2.5 Electrical Power System 2.5.1 Highlights The electrical systems used at Chernobyl Unit 4 included normal working supplies and reserve supplies for power. _ Two types of emergency power sources (batteries and automatic diesel generators) were available immediately in the event the primary sources failed.

The~ equipment is grouped into one of three categories depending on allowable power-interruption times: fractions of a second, fractions of a minute, and extended.

~2.5.2 Categories of Electrical Equipment (Plyutinskiy,1983; USSR,1986)

Many mechanisms and devices within the reactor operating system require electric power for normal operation. These include feedwater pumps, motors of electric drives, various control valves, and numerous monitoring and control systems.

All electrically driven equipment within the plant is categorized into one of three " dependability categories":

2.5.2.1 Category 1 Equipment in this group cannot tolerate an interruption in power supply or can tolerate only very brief interruptions of between fractions of a second and several seconds. A power supply is absolutely essential for this group after a scram. The power users in this group and in the Category 2 group are sub-divided into " safety-related process systems users" and "whole-unit users" for which a power supply is absolutely essential, even when the plant's in-house power supply has been totally shut off.

Category 1 safety system users include the isolating mechanism for the accident localization (containment) system and hydrogen removal system, the fast-acting valves and gate valves on emergency core-cooling system lines and monitoring, protection and automatic control devices of safety systems. Whole-unit users include the Skala central monitoring system, the control and protection system, the dosimetric monitoring systems of the reactor, the turbine and generator, and the fast-acting pressure-reducing mechanism. The emergency power for these systems comes from storage batteries with static transformers to provide 0.4-kV.

f 2.5.2.2 Category 2 Equipment in this category can tolerate interruptions in the power supply from tens of seconds to tens of minutes. A power supply for this equipment is abso-

lutely essential after a scram. Safety systems that use Category 2 equipment include mechanisms of the emergency core cooling system and the accident local-ization (containment) system. Whole-unit users are mechanisms of the auxiliary turbine generator systems, certain auxiliary reactor systems'(intermediate cir-cuit, cooling systems of the fuel cooling pond, blowdown and cooling system, etc.). The backup power source for this category of equip.aent is provided by a diesel generator.

l 2-36 l

2.5.2.3 Category 3 All other equipment that is not Category 1 or Category 2 is considered Category 3.

Use of flywheels on main recirculation pumps allows these pumps to be classified as Category 3. Category I and Category 2 equipment are powered by different power sources. Such sources possibly include internal transformers powered by the power supply system; special internal power generators turned by the main gen-erator shaft; the main turbine generators, which are disconnected from the power supply system when mishaps occur; diesel generators, which are started up auto-matica11y and are capable of providing power within 15 seconds of a mishap occurring in the power supply system; storage batteries; and medium power gen-erators at nearby hydroelectric power plants (or thermal electric power plants) that are not connected to the power system but are operating only to supply the internal networks of the given nuclear power plant. The following power supply networks are used to supply internal plant electrical loads:

a 6-kV, 50-Hz network supplying main circulating pumps and other large electric motors, and 6/0.4-kV step-down transformers a 380/220-V, 50-Hz network supplying electric motors of up to 20 kW, and welding and lighting systems a 6-kV and 380/220-V, 50-Hz Category 2 dependable power supply network a 380/220-V, 50-Hz Category 1 dependable power supply network a 380/220-V, 50-Hz Category I network providing power to the control computer system 2.5.3 The Diesel Generator Station (USSR, 1986)

Three diesel generators provide backup power to Chernobyl Unit 4 These genera-tors, each with a capacity of 5500 kW, were used as an independent power supply for the 6-kV emergency power supply sections. The startup time of the diesel generator was 15 seconds. The diesel generators start up automatically but take up the load in stages upon receipt of an accident signal. The time for each stage to be taken up is 5 seconds. The diesel generators were located in separate compartments, each with its own supply of fuel, oil, and air and its own electrical connections. Diesel generators were used to supply power to the most important equipment during the entire time of a complete voltage loss from all sources except storage batteries.

2.6 Safety Systems (USSR, 1986) 2.6.1 Highlights The Chernobyl Unit 4 type RBriK reactor safety systems provide for emergency core cooling main coolant loop overpressure protection reactor space overpressure protection

• mitigation of radioactive releases steam pressure suppression a

hydrogen gas removal i

l 2-37

In addition, protection against abnormal operating conditions is provided for by automatic power reductions and full reactor shutdown by insertion of control rods.

2.6.2 Reactor Emergency Core Cooling System The emergency core cooling system (ECCS), shown in Figure 2.18, is designed to provide cooling of the reactor in the event of accidents resulting in damage to the core inlet cooling system.

The ECCS is brought into operation by the opening of a fast-acting electric gate valve. Power is supplied by storage batteries.

The nitrogen from the ECCS tanks is prevented from reaching the reacter through the automatic closing of two gate valves.

The ECCS was designed to satisfy the following main requirements:

(1) It must supply water to the damaged and undamaged halves of the reactor in quantities that will prevent melting, massive overheating, and cladding failure of the fuel elements.

(2) The ECCS must operate automatically on receipt of the " maximum design-basis accident signal" (a break in the main coolant pump discharge piping). The Clean ndensate p g,,, ,g ,,,,,,,,,

ECCS Vessels ECCS Pumps for Coohng the n' y gy [, ,j i Undamaged Half -

y

' T --

of the Reactor -

l Suction , , ,

O ,.s Header -

y; Main -> <

Reactor Circulation - .

l l l - -

1@ i i , ,

[ ll  ;, ,,

f F] , , .

~

ECCS Pumps for , _

[ "3 , j Coohng the Damaged l.

l Half of Reactor ---

l Pressure Header h d

! Heat Exchangers -

i / ,

1 /

l L- A -. L. f Coohng Service <iiM Pressure #

Suppression g R R.

Water Pool I De Aerator j

___o._.

Feed Pump l Figure 2.18 Schematic drawing of the reactor emergency cooling system i

2-38 L

basis for distinguishing between the damaged and undamaged halves of the cooling system are (a) an increase in pressure in compartments containing primary coolant piping (indication of pipeline rupture)

(b) coincidence with either of the following two signals (showing selec-tion of the damaged half):

drop in water level in the steam separators of the damaged half of the reactor

+

decrease in the pressure differential between the main circula-tion pump pressure header and the steam separators of the damaged half of the reactor (3) The speed of operation of the ECCS must ensure that water is supplied to the damaged half of the reactor within 3.5 seconds.

(4) There must not be an unacceptable reduction in water supply to the reactor channels as a result of a pipeline rupture.

(5) The system must perform its safety functions in the event of any failure independent of the source event, in any active or passive element having moving mechanical parts.

(6) The system must comprise a number of independent channels (subsystems) and must function with the required effectiveness in the event a failure occurs independently of the source event, in any one channel (subsystem) of this system.

(7) In the event of drainage of the ECCS vessels, nitrogen from the vessels must not be allowed to reach the reactor.

(8) The ECCS must operate as intended in the event of a maximum design-basis accident coinciding with a loss of internal power from the power unit.

In order to comply with the above essential requirements, the ECCS comprises three independent channels (subsystems), each of which ensures not less than 50% of the required output. Each channel (subsystem) includes a fast-acting section and a section providing prolonged afterheat removal. The fast-acting section supplies water to the damaged half of the reactor during the initial stage of the accident. The afterheat removal section comes into operation after the fast-acting section has ceased to operate. The fast-acting section of two ECCS channels consists of a system of tanks filled with water and nitro-gen at a pressure of 10.0 MPa (1450 psi), connected by pipelines and headers to the distributing group headers of the primary coolant system.

Each of the two fast-acting sections consists of six tanks of 25 m8 (880 ft3) volume each. The total initial volume of water is approximately 80 3m (2800 ft3 ),

and of nitrogen, approximately 70 m3 (2500 ft3 ). Each section supplies not less than 50% of the required quantity of water to the damaged half of the

reactor over a period of not less than 100 seconds. The period of operation depends on the magnitude of the coolant leak.

2-39 l

- - , , - - . _ , - - . _ , . . . - - - - , . , , - . , . - , - , . - . . , . , . . , , , - - - . . . - , . - - . - - - - - . - - . - --.-,n..,,. , , , , , , , , , - - - - - - - - - , - . . , .

The fast-acting section of the third ECCS channel supplies water from the electric feed pump, which ensures a supply of not less than 50% of the required amount of water to the damaged half of the reactor. In the event a maximum design-basis accident coincides with a loss of internal power, the supply of water from the electric feed pump is assured for a period of 45 to 50 seconds while the pump runs down in tandem with the turbine generator.

The prolonged afterheat removal section provides cooling to both the damaged and undamaged parts of the reactor. It comes into operation no later than the moment at which the fast-acting section of the ECCS ceases to operate.

The long-term afterheat removal section of each of the three ECCS channels consists of cooling pumps of the damaged half of the reactor, and the cooling pumps of the undamaged half of the reactor.

The pumps for the damaged half of the reactor of each of the three ECCS chan-nels consists of two pumps connected in parallel. These pumps ensure a supply of water at a rate of approximately 500 tonnes /hr (300 lbm/sec), that is, not less than 50% of the required rate for the damaged half in the event of a maxi-mum design-basis accident. The water is drawn by the pumps from the pressure suppression pool of the accident localization system, is cooled by the service water in the heat exchanger mounted on the common intake line of the two pumps, and reaches the ECCS headers through the discharge lines. Flow restrictors are installed on the discharge lines of the pumps and are designed to ensure the steady functioning of the pumps in emergency situations characterized by a sharp drop in pressure of the reactor's coolant circuit resulting from a rup-tured pipe.

Each of the ECCS channels contains one pump and supplies water at a rate of approximately 250 tonnes /hr (150 lbm/sec), that is, not less than 50% of the flow required for the undamaged half in a maximum design-basis accident. Water is drawn from the tanks containing clean condensate and flows to the headers of the cylinder section behind the quick-opening gate valve. The flow restrictors in the discharge lines of the pumps perform the same functions as do those in the damaged half of the reactor, l

j 2.6.3 Main Coolant System Overpressure Protection

} This system is designed to ensure that the permissible pressure level is not exceeded. This is done by providing a path for steam into the pressure sup-pression pool. The system includes relief valves and a system of pipes and headers that conduct the steam into the pressure suppression pool of the acci-dent localization system.

The system was designed with the objective of satisfying the following main requirements:

• pressure in the main cooling system not to be exceeded by more than 15%

of the working pressure

• be operational when the pressure in the coolant circuit reaches the l minimum operating value

+ to close the main safety valves l

2-40

r

+

to work under conditions of cyclic dynamic loads upon operation of the main safety valves '

to introduce steam into the water of the pressure. suppression pool at-

~

speeds that are close to that of sound,-even when one main safety valve-is in operation-(this is necessary for shock-free steam condensation)

'A schematic drawing of the system for discharging steam from the main safety 4

valves into the pressure suppression pool of the accident localization system is shown in Figure 2.19.  ;

The system consists of eight main safety valves with a total output of

+

5800 tonnes /hr .(3500 lbs/sec), under nominal circuit pressure, i.e. , an output which is equal to the nominal steam output of the reactor installation. Con-trol of each main safety valve (with an output of 725 tonnes /hr (440 lbe/sec))

-is by a directly acting pulse valve (lever gravity type), equipped with an electromagnetic drive unit for opening and closing. Steam from the main safety '

valves is discharged underwater into the pressure suppression pool through submersible nozzles, each with an exit diameter of 40 mm (1.6 in.) (approxi-mately 1200 nozzles in all).

w l

+-

f a 2 j  : , Fresh Steam to i

Fresh Steam from g  : Turbogenerators Separators  :

u.m S.#ety v.ive ---- E M

• O b N b # y

_. I to.it,gne ,I compartment h.

l l . .. . . _._

Header 800

,r _

l........r....

8

' w 3 LWD I.I,'Als1,T,T,TT,

.111,111,11ll111

,, ,, ,..... IH.I Ill

. ... - 'T,I,T,IV4 16 4. 1111111111111111111:t,,,, y,,,

....r. .. .. .

....... .... .. mmm . . .. . . ..... ......... ............ .

+-!- Pressure Suppression Pool

?4 H!!!!!!!!!"X6  !!!!!!""!I' !!!!!!!!!! m n w + n!!!!!!!!!!i!f _t,,,,,,,,

n ................. . . . .. .... ... ....

Figure 2.19 Schematic drawing of the system for discharging steam from the main safety valves into the pressure suppression pool of the accident localization system 2-41

q, y

4 .+ .

Ai'

L When an overpressure condition is' detected, the systems are intended'to operate g .in the following sequence

.

76 kgf/ce 2 1081 psi) 1 main safety valve operates

-77 kgf/cm 2 (1095 psi) 2 main safety valves operate 78 kgf/cm 2 (1109 psi), 1 main safety valve operates 81 kgf/cm 2 (1152

( psi) 4 main safety valves operate Staff-working in the unit control room and in the' reactor control room can have the, pap 6bility to manually open the main safety valves.

2.6.4 Reactor Vault Overpressure Protection This' system ensures that the permissible pressure in the reactor vault is not exceeded in an accident involving the rupture of-a single fuel channel. (The  !

. system is not designed to handle multiple ruptures.) Protection is achieved by

' drawing the steam and-gas mixture from the~ reactor space into the steam and gas discharge compartment of the pressure suppression pool and subsequently into the pressure suppression pool itself (sce Figure 2.20).

SY IThe hates is designed to satisfy the following requirements:

prevents the excess pressure in the reactor vault from exceeding 1.8 kgf/cm

~, '

[- (abs) (25.6 psia) in the event of a double-ended break of one fuel channel i[,

s

" (e.g., failure of one transition joint) l 1.', .

, - prevents water from the steam and gas discharge compartment of the pres-sure suppression pool from entering the reactor vault in the event of a

" -r  ;

design-basis accident ensures that the reactor vault is reliably isolated from the atmosphere

( ,

The reactor vault is connected to the steam and gas discharge compartment of the pressure suppression pool by a set of pipes. (This is a special compartment of

~

the pressure suppression pool systems having a water depth approximately 1 m (3.25 ft) greater than the rest of the pool.) Two sets of four 300-mm (11.8-in.) exit pipes (four at the top and four at the bottom of the reactor space) connect to two 600-ass (23.6-in.) pipes that go to the steam and gas

- discharge compartment. The ends of the 600-mm pipes are 2 m (6.5 ft) below the surface of the water. That is, under normal operating conditions, the

! , reactor space is separated from the atmosphere by a 2-m seal.

In the event of a rise in pressure in the reactor vault to 1.2 kgf/cm2 (abs)

> (17.6 psia), the seal opens and the steam and gas mixture enters the pressure suppression pool through the steam discharge pipes. When the pressure in the above-water part of the compartment reaches 1.1 kgf/cm2 (abs) (15.6 psia), the

. check valves open and the steam and gas mixture enters the steam distribution corridor. The steam and gas mixture then enters the water of the pressure suppression pool by means of the steam discharge pipes. The gas from the i reactor space, bubbling through the layer of water in the compartment / pressure suppression pool, is cooled and maintained in the compartments of the accident E localization zone. After a necessary holding and cleaning period, the gas is

( ' discharged into the atmosphere by the hydrogen disposal system.

[

i 2-42 I

L

/" ' ' 600 mm Pipe

/ /

e- 300 mm Pepe

/ , -

/ /

f Upper Biological

/ f Shield 7

/ ~ ~

/

/ /

/ , Reactor Space f f f f f f,/ /

PSP = Pressure

, / Suppression

/

[ Lower Biological '

/

/ s Shield s

/

/ -

Compartment /

Enclosing Main /

Coolant Pump Inlet I and Outlet Headers [

' (f / / // / // //////// /// / / / /// /// /// // ///// /1 t Steam Discharge Escape Valve (x 2)' Steam Pipes * * * * " "'

j - Discharge Corndor 7 p,p,,

2z2y,r/ s - , s _: _ , - - - - - - - / - / N_

/ -

lr ,,rr - - - - - - - - - - - - .

/

Upper / 4 / ~

PSP / > Upper PSP e

/

<//// / s s i T

,, s i s s i / s r s i se r s s i s / / /

\

psp f_ /

/

Lower PSP )

/ -

/

/ l 7 /

/

/1 1 1 1 1 7 1 1 1 1 1 1 1 in.1 1 1 as 1 1 // 1 1 ,1 1 1 1 1 1 1 1 1 1 1 1 . /1 1 1 1 1 1 1 1 1 2 Steam and Gas Discharge Compartments Figure 2.20 System to protect the reactor vault from excess pressure The reactor vault overpressure system is not designed to accommodate multiple pressure tube failures. Multiple failures will cause overpressurization of the reactor space. If the pressure exceeds 0.3 MPa (44 psi), the upper biological shield will lift up. Since the fuel channels are welded to the upper shield, its upward movement will lead to massive tube failures. Drthermore, since the control rod channels are also connected to the upper shield, the control rods will be lifted out of the core.

2.6.5 Accident Localization System The accident. local.ization system is designed to mitigate radioactive releases during accidents involving failure of certain piping of the reactor cooling

system. Piping within localization zones includes primary pump suction headers primary pump outlet pressure headers 2-43

- the group distribution headers

- - the coolant supply pipes between the group distribution headers and the fuel channel inlets-Piping not within localization zones includes f - fuel channels (they are enclosed in the sealed reactor vault)

- sections of the fuel channels above the upper biological shield not enclosed within the sealed reactor space

- steam-water crossover pipes from the fuel channel outlets to the steam separators

- ~ steam separators

- steamlines fros'the steam separators to the turbines

- downconers from the steam separators to the pump inlet headers The accident localization system consists of a set of s'ealed compartments and

~

rooms interconnected by valves and piping. The main system components are

- two compartments with a design pressure of 0.25 MPa (36 psig) each enclos-4 ing four main cooling pump inlet and outlet headers

- .the steam distribution corridor, with a design pressure of-0.25 MPa (36 psig)

- the pressure suppression pools, with a design pressure of 0.25 MPa (36.psig)

- the portion of the building with a design pressure of 0.08 MPa (12 psig) enclosing the group distribution headers and the fuel channel inlet piping i

A schematic diagras'of.the accident localization system is shown in Figure 2.21. ,

l The various compartments and rooms of the accident. localization system are con-nected by three types of valves:

l.

- check valves'(Figure 2.21, ites 9), installed in.the openings of the cover separating the inlet piping and the steam distribution corridor

- release valves (Figure 2.21, item 10), installed in the openings of the '

cover separating the air space above the pressure suppression pool and the two primary pump compartments

- panels of check valves (Figure 2.21, item 11), installed in the partitions i

separating the steam distribution ccrridor and the two primary pump I

compartments The two primary pump compartments and the steam distribution corridor are con-nected to the pressure suppression pool by steam outlet channels (Figure 2.21, item 17).

2-44 ,

- - - ~ - . . . - - . -. . _ - . , _ y -.. . .._ -.. . - -,m ,.-- - - . - - ,

I 10 3 4 12 s 0

1 17 12 2 6

/ 11 9 16 5 u i

/

,, ,r

. J I L I v

_L Y + "

' _L

+ Y .

W Ct] i [ a j i 2 E ip EE-aEEE = = = = = = = = = = - ME: sas_==_=2 E_:g EE 1i5 % =5\=_=E&n2 5E5= t =-=,= =ti 5m=1i, z=_=s- iE.=_= .-.=5.=-i s = =

w W- 17

\t 13 18 14 15 8 7

Figure 2.21 Schematic diagram of the accident localization system In emergency situations the system functions in the following manner. If a failure occurs in the primary pump inlet or outlet header, the resulting steam formation leads to a pressure rise in the affected compartment. The check valves between the compartment and the steam distribution corridor (Figure 2.21, item 11) open at a pressure differential exceeds 2 kPa (0.29 psi). When the pressure reaches a value sufficient for displacing the liquid column from a steam outlet channel, the steam and air mixture begins to flow into both elevations of the pressure suppression pool. By bubbling inrough the water, the steam condenses and the air is collected in the space above the water.

When the pressure in the air space exceeds 5 kPa (0.73 psi), the release valves between the air space and the other primary pump compartment open and part of the air flows into that. compartment. Thus, its volume is used to reduce the pressure in the compartment sustaining the pipe break. During the course of this accident, the check valves (Figure 2.21, item 9) remain closed.

If a failure occurs in the group distribution headers or in the supply pipes be-tween the group distributica headers and the fuel channel inlets, the resulting pressure rise opens the check valves leading into the steam distribution corri-dor. From the corridor, via the steam discharge channels, the steam-air mixture goes into the water volume of the pressure suppression pool's central region.

When the pressure in the air space above the water exceeds 5 kPa (0.73 psi) the release valves connecting the air space with the two primary pump compartments 2-45

open. In this situation, the volumes of both primary pump compartments are used

', to reduce _ pressure in the rooms containing the ruptured piping.

To prevent the spread of radioactive material outside the regions of the localization system, the walls, floors, and ceilings are equippped with special d seal penetrations at the places where they.are traversed by pipes or electrical cable. In addition, a cutoff and sealing valve system ensures isolation of the

' localization zones by cutting off the communication lines between the sealed and non-sealed locations.

2.6.6 Pressure Suppression System The-purpose of this system is to condense steam formed'

- during an accident involving failure of some sections of the primary coolant system

- during the actuation of the main safety valves

- during leaks through the main safety valves under normal operating conditions.

The system is a dual-elevation, reinforced concrete tank with a metal lining (see Figures 2.19, 2.20, and 2.21). The space in each elevation is divided by longitudinal partitions into four corridors and by traverse partitions into three sections: two lateral (under the primary pump compartments) and one cen-tral (under the steam distribution corridor). The longitudinal and transverse walls have openings for water and air. The lower elevation is filled with water.

The depth of the water layer is 1.2 m (3.9 ft). The total volume of water in the two elevations is 3200 m3 (113,000 ft 3), and the volume of the air space is 3700 m 3 (131,000 ft3 ).

Steam goes into the water volume through the steam discharge channels. The num-ber, diameter, and spacing of the steam distribution pipes and their depth under water are determined from tests on a large-scale model. These pipes i

ensure full condensation of the steam in the water volume.

The accident localization system also includes a system for heat removal and a j system for hydrogen removal.

i Heat'from-the sealed locations of the accident localization system is removed by a sprinkler cooling system, and by surface-type condensers located in the

! steam distribution corridor.

2.6.7 Hydrogen Removal System l

=The hydrogen removal system creates a negative pressure in the accident locali-zation zones, then measures the concentration of hydrogen and removes the hydro-l- gen upon its occurrence. The hydrogen removal system consists of an electric i

l heater, a contactor, a condenser, a moisture separator, and a gas blower.

1 Under normal operating conditions the gas-air mixture passes through the elec-tric heater, contactor (in the presence of hydrogen), condenser and moisture 2-46

separator, and, by means of the gas blower, through the filtration plant, and is discharged into the atmosphere.

2.6.8 Emergency Shutdowns The reactor is protected against. emergencies by the automatic insertion core of all absorber rods (except for the shortened rods).

Twenty-four SUZ rods uniformly distributed throughout the reactor are selected for the. emergency protection mode from the total number of manual regulating and emergency protection rods. When the reactor is started up, the 24 emergency protection rods are the first.to be raised to the upper-limit switches. The withdrawal of any other rods is automatically prevented until the emergency system rods have been raised.

The reliability of the emergency protection system and the reliable functioning of the manual control system is achieved by having six independent groups of 30 to 36 control rods each distributed uniformly over the reactor. Each rod is moved by its own servo drive under the control of its individual power and logic block. The failure of one or even several servo drives or control blocks is not serious, since there are 187 rods. Since each SUZ rod is surrounded in the reactor by rods of different groups, the failed rod is always surrounded by neighboring rods in working order.

i The design of the SUZ drive mechansism ensures automatic insertion of all SUZ rods (except the shortened rods) into the core in a power failure. The relia-bility of the protection system is ensured by functional redundancy (redundant monitoring channels) for each parameter and equipment redundancy (redundant channels for logical processing of the signals).

In view of the large contribution of nuclear power plants with RBMK reactors to the general power grid, it is necessary to reduce to a minimum the outages of such plants. A differential approach to emergency situations in the reactor and generating unit has, therefore, been adopted in organizing the emergency protection system. Depending on the nature of the emergency, there are a number of different categories (regimes) for emergency protection.

emergency protection with complete shutdown of the reactor (AZ-5) emergency protection acting until the emergency situation has passed (partial AZ-5) preventive controlled reduction of reactor power at an increased speed to safe levels (AZ-1, AZ-2, and AZ-3)

The safe power levels for various emergency situations and the speed of preven-tive power reduction are determined by calculation and confirmed experimentally.

The highest level of emergency protection is AZ-5, which is achieved by insert-ing all the SUZ rods (except the shortened absorber rods) into the core up to '

the lower cut-off switches,. This regime is entered in the following situations:

i -

a power overshoot of 10% of full power a reduction in the period to 10 seconds 2-47

~

a drop or excess in the level in the drum separators a drop in-the feedwater throughput

- a pressure excess in the drum separators

- a pressure excess in the accident localization compartments, drum separators, or lower water lines.

- a pressure excess in the reactor cavity

- a fall in the level in the SUZ coolant tank.

- a reduction in water flow through the SUZ channels

- - trip of two turbine generators or of the only operating turbine generator

- trip of three of the four operating main circulation pumps in any pump room

- voltage loss in the plant auxiliary power supply system or indication of one of the protection level regimes (AZ-3, AZ-2, or AZ-1) without its being carried out, or order from the command units (AZ-5 button, declutch-ing key) at the control desks and at a number of other locations in the plant The In the event of an emergency power overshoot, a partial AZ-5 is ordered.

resulting rod insertion stops when the original cause of the emergencyThis has dis-appeared (when the power has been reduced to the appropriate level).

makes it'possible to keep the unit in a power regime if the power overshoot signals have been caused by power distortions and the emergency The situation same is can be removed by rapid partial reduction of the reactor power.

true in transitional operating regimes and in the case of significant local perturbations. The partial AZ-5 regime can only operate for a short ' time, for if the SUZ rods are lowered to a significant extent into the core during a partial AZ-5 event, the reactor will be completely shut down just as in an AZ-5 regime.

The AZ-3 regime (reduction to 20% of full power) is ordered when there is an emergency load rejection

- by two turbine generators, or

- by the only operating one The AZ-2 regime (reduction to 50% of full power) is ordered when there is

- an outage of one of two turbine generators, or

- an emergency load rejection of one of two tarbine generators

'The AZ-1 regime (reduction to 60% of full power) is ordered when

- One of the three operating main circulation pumps in any pump room is switched off.

- The water flow in the primary circuit falls.

- The feedwater flow falls.

- The water level in the drum separators falls.

3 J.

- The group closure key for the throttle regulating valves is actuated.

In AZ-1, AZ-2, and AZ-3 regimes the reactor power is automatically reduced at a rate of 2% of full power per second to levels of 60%, 50%, and 20% of full The l

l- power, respectively, by the online automatic power regulating system.

emergency rate (speed) of power reduction and reactor operation stabilization 1

2-48

at a safe power level after its reduction are obtained by automatic switching \

.into the automatic regulating regime of the supplementary SUZ rods.  !

2.7 Reactor Operations (USSR, 1986) 2.7.1 Highlights

' Normal operating modes consist of startup and shutdown and full power operation.

Startup and shutdown must be performed in a prescribed sequence to limit thermal stresses in the metal components of the reactor. During full power operation, plant operating conditions are maintained within specified boundaries to ensure reactor safety.

i 2.7.2 Reactor Startup and Shutdown '

RBMK reactors are started up with the main circulation pumps in operation at a -

" sliding" pressure and at a steam separator water level selected by the operator within a given range. The required cavitation margin of the main circulation pump is ensured by reducing the pump output using the throttle-regulating valves installed at the pump discharge. The cooling water flowrate in all the fuel. channels of the core is monitored continuously. Initial heating of the reactor is carried out at a " sliding" pressure in the steam separators,-i.e.,

, the pressure is not constant but increases as the temperature rises.

During startup and initial heating of the reactor, the main coolant loop is fed by the emergency. feed pumps. Reactor power during startup and initial heating is maintained at an average level of 2 to 3% of nominal capacity. The thermal power of individual fuel channels during this process can be as much as 6%

of nominal because of the non-uniformity of power density distribution in the core.

Reactor power ascension and initial heating of the cooling loop can take place with one, two, or three of the main circulation pumps operating on each side of 3

the reactor. At this pump capacity it is possible to monitor the water flowrate through each fuel channel and at the same time ensure an adequate pump cavita-

tion margin. At a reactor power of 2 to 3% of nominal, the cooling loop is heated to a temperature of about 200*C (392'F). Thermal stresses in the metal ,

structures of the reactor limit the heatup rate to 10'C (18*F) per hour.

At a pressure of 2 to 4 kgf/cm2 (28 to 56 psi) the de-aerators begin to heat up. A vacuum begins to build up in the condensers of the turbine being started i

at a separator pressure of about 15 kgf/cm2(213 psi). Once the vacuum has been created, the turbine starts up and begins to build up speed. The turbine generator is normally synchronized and 2 connected to the grid when the pressure l

in the separators is about 50 kgf/cm (711 psi). Further increase in the parameters, up to rated values, takes place in parallel with the buildup of electric load.

t Figure 2. 22 gives an example of the evolution of the main reactor parameters from the time the reactor reaches the minimum power level that can be monitored 1

until the turbine generator is synchronized and connected to the grid.

The main circulation pumps remain in operation during scheduled shutdown and cooling of the reactor. Before the onset of shutdown cooling, the reactor

2-49 i

N b B

• u lh a E o a: 2i F-f 60 - 300 250 -

40 - 200 - 200 -

~

1 2

\

20 -100 - 150 -

L. '3 r-= ,

" I I I I I 0 0 ~100 4 1 -

6 1

8 10 12 14 16 18 20 0 2 Time, h LEGEND: 1 - water temperature (T) in reactor circulation loops; 2 - pressure (P) in separators; 3 - thermal power (N) of reactor.

Figure 2.22 Evolution of reactor parameters during startup L power is reduced to the after-heat level and the unit turbine generators are l disconnected from the grid and shut off. When reactor power is reduced to the 20% level, the capacity of the main circulation pumps in service is reduced to 6000 to 7000 m 8 /hr (27,000 to 31,000 gpm). The coolant loop is cooled down to a temperature of 120 to 130'C (248 to 266'F) by gradually lowering coolant loop l

l pressure by discharging steam in a controlled manner from the steam separators l

to the turbine condensers or to the process condenser. To achieve a greater i degree of cooling, a special shutdown cooling system composed of pumps and heat exchangers is used.

i Thermal stresses in the metal structures of the reactor limit the cooling and heating rates. During shutdown cooling, the rate of temperature reduction in the coolant loop is determined principally by the rate of controlled steam dis-charge from the separators. Therefore, it is not difficult to keep the cooling rate at the prescribed level under these conditions.

2-50

2.7.3 Operation'at Power

~

Up to a power level of 500 MWt, coolant is circulated through the reactor by the main circulation pumps operating at 6000 to 7000 m3 /hr (27,000 to 31,000 gpm). ' At a power of 500 MWt, . the throttle-regulating valve is opened and the 8

. capacity of the main circulation pump increases to 8000 m /hr (35,000 gpa). At power levels above 500 MWt, the reactor operates at a constant main circulation ,

l pump capacity. When the power level exceeds 60% of rated power, no fewer than I three main circulation pumps should be operating on each side of the reactor.

The hydraulic distribution of an RBMK reactor core is such that, when rated r capacity is reached, the throttle-regulating valves are fully open and the 3

total flow through the reactor is 48,000 m /hr (212,000 gpm).

2.8 References Cherkashov, 1981 'Cherkashov, Y. M., et al., " Mathematical and Experimental Study of Emergency Cooling of RBMK-1500 Reactor in Case of Maximum Credible Accident," Atomnye Ehlektricheskie Stantsii, i

Vol. 4, July 1981.

Cherkashov, 1984 Cherkashov, Y. M., " Safety Design of the RBMK-1000 Reactor,"

IAEA-SM-268/84', Operational Safety of Nuclear Power Plants, Proceedings of an IAEA symposium in Marseilles, May 2-6, 1983, IAEA,-Vienna, 1984.

Dollezhal, 1977 Dollezhal,- N. A., et al., " Design of the RBMK-1000 Reactor,"

Paper presented at Risley under the SCUAE/UKAEA' Agreement 1

for Exchanges of Information on Pressure Tube Reactors,

Atomnaya Energiya, February 1977.

, Dollezhal, 1980a Dollezhal, N. A., and I. Y. Yemel'yanov, " Physical Characteristics of the Core," Chapter 2 of Channel-Type Nuclear Energy Reactor, Atomizdat, Moscow, March 1980.

Dollezhal, 1980b Dollezhal, N. A., and I. Y. Yemel'yanov, " Design of a Reactor Plant," Chapter 3 of Channel-Type Nuclear Energy Reactor, Atomizdat, Moscow, March 1980.

! Dollezhal, 1980c Dollezhal, N. A., and I. Y. Yemel'yanov, "The Recharging.

Machine," Chapter 5 of Channel-Type Nuclear Energy Reactor, Atomizdat, Moscow, March 1980.

Dollezhal, 1980d Dollezhal, N. A., and I. Y. Yemel'yanov, " Control Devices," Chapter 6 of Channel-Type Nuclear Energy Reactor, pp. 119-123, 131-138, Atomizdat, Moscow, March 1980.

Dollezhal, 1980e Dollezhal, N. A., and I. Y. Yemel'yanov, "The Recharging Machine," Chapter 10 of Channel-Type Nuclear Energy Reactor, L Atomizdat, Moscow, March 1980.

i

{ Dollezhal, 1981 Dollezhal, N. A., " Graphite-Water Steam-Generating Reactor

! h the USSR," Nuclear Energy 20(5):385-390, 1981.

1 f

i 2-51

Dubrovsky, 1981 Dubrovsky, V. (ed.), " Construction of Nuclear Power Plants,"

Mir Publishers, Moscow, 1981.

Egiazarov, 1977 Egiazarov, M. B., and A. N. Kuz' min, "Startup and Familiar-ization With an RBMK-1000 Reactor Power Plant (Experimental Investigation of Core Physics and Physical Startup of an RBMK Reactor)." Paper presented at seminar at Risley, under the SCUAE/UKAEA Agreement for Exchanges of Informa-tion on Pressure Tube Reactors, [Atonnaya Energiya],

February 1977 (EPRI Ref. No.77-021).

Isayev, 1984 Isayev, N. V., et al., " Unloading Additional Absorbers From the RBMK-1000 Core," Atomnaya Energiya 56(5):280-282, 1984.

Klimov, 1975 Klimov, A., Nuclear Physics and Nuclear Reactors, Mir Publishers, Moscow, 1975.

Konviz, 1981 Konviz, V. S., " Work Continues on Construction Chernobyl'skaya AES," Moscow Energeticheskoye Stroitel'sno 4:2-6, 1981.

Konviz, 1984 Konviz, V. S., and L. V. Golubkov, "Chernobyl'skaya AES Third-Phase Construction Begins," Moscow Energeticheskoye Stroitel'sno, 1984.

Kulikov, 1984 Kulikov, E. V., " State of the Art and Development Prospects for Nuclear Power Stations Containing RBMK Reactors,"

Atomnaya Energiya 56(6):359-365, 1984.

Levin, 1983 Levin, Y. M., and Kremen', M. G., " Particulars of Startup, Adjustment on Third Generating Unit of Chernobyl AES,"

Russian 6:50-54, 1983.

Markov, 1984 Markov, Y. P., et al., " Emergency Localization System at Third Unit of Chernobyl AES," Moscow Energeticheskoye Stroitel'sno 1:61-63, January 1984.

MCCE, 1986 Motor Columbus Consulting Engineers, " Accident at the Chernobyl Plant," Unpublished analysis, Columbus, Ohio, 1986.

Novosel'skii, 1984 Novosel'skii, O. Y., V. B. Karasev, et al., " Tests on Improved Steam Separators in the Third Unit at the Chernobyl Nuclear Power Station," Atomnaya Energiya 57(12):382-385, March 1984.

Plyutinskiy, 1983 Plyutinskiy, V. I., and V. I. Pogorelov, " Automatic Control and Safety of the Thermal Power Generation Components of Nuclear Power Plants," Energoatomizdat, 1983.

Pushkarev, 1979 Pushkarev, V. I., et al., " Ways of Altering the Coeffi-cients of Reactivity in RBMK Reactors," Atomnaya Energiya 46(6):386-389, 1979.

2-52

ec - -

E Romanenko, 1982 -Romanenko, V. S., and A. V. Krayushkin, " Physical Charac-teristics of an RBMK Reactor in the-Transitional Period,"

Atonnaya Energiya 53(6)

367-373, 1982.

Sedov, 1979 Sedov, V. M., et al., " Corrosion Products in Main Tech-

,nological Systems of Atomic Power Plants With an RBMK-1000 Reactor During Operations," Atonnaya Energiya 46(1):23-28, 1979.

Semenov, 1983 Semenov, B. A., " Nuclear Power in the Soviet Union," IAEA Bulletin 25:(2), June 1983.

UEik, 1984 Usik, A. M., et al., " Progress Report: Chernoby1'skaya AES' 4th Power Block," Moscow Energeticheskoye Stroitel'sno 12:8-11, 1984.

USSR, 1986 USSR State Committee on the Utilization of Atomic Energy, "The Accident at Chernobyl Nuclear Power Plant and Its Con-sequences," Information compiled for the IAEA Experts' Meet-ing, August 25-29, 1986, Vienna, 1986.

Virgil'ev, 1979 Virgil'ev, Y. S., " Thermal Expansion of Structural Graphite and the,Effect of Neutron Irradiation," Atomnaya Energiya 47(5):305-308, 1979.

Voronin,-1980 Voronin, L. M., " Nuclear Electric Power Plants," Atomnaya-Energiya, July 1980.

Yemel'yanov, 1981 Yemel'yanov, I. Y., " Design Measures To Ensure Operability of' Nuclear Electric Plants With RBMK Reactors Under Emer-gency Conditions," Atonnaya Energiya 50(4):251-254, 1981.

Yemel'yanov, 1984 Yemel'yanov, I. Y., et al., " Study of Operating Conditions of Power-Generating Unit With RBMK Reactor With False Turning on of Reactor's Emergency Cooling System," Soviet Power Engineering 3:10-13, March 1984.

2-53

CHAPTER 3 SAFETY ANALYSIS This chapter presents a summary of Soviet safety analysis of the RBMK-1000 reactor, as well as an independent review of RBMK-1000 safety. The base line

~for this chapter is the Chernobyl Unit 4 generation of RBMK reactors. Sec-tion 3.1 summarizes the descriptive material contained in Soviet literature.

i Section 3.2 explains how the RBMK-1000 reactor responds to-a variety of-credible

' challenges, to the degree adequate detailed technical information on the plant

'is available. As such, the independent review section should be viewed as an extension of Chapter 2 (" Plant Design"): explaining how the RBMK-1000 reactor responds as a system to_ transients and accidents. Many interim reports by

Western countries since the accident have attempted to analyze RBMK reactor a

safety. _Such Western reports are referenced when used, but Soviet source docu-ments are used whenever possible.

L The Soviet report on the accident.at Chernobyl (USSR, 1986), and earlier Soviet

, literature, contain extensive information'about RBMK reactors. Most of that information is descriptive, and not analytic. Hence, there exists a rather complete body of knowledge from which to assemble Chapter 2 (" Plant Design");

there is less information about Soviet safety analysis. The available informa-tion on Soviet safety analysis is very general in nature, is not plant specific or site specific, and presents the qualitative results of generic analysis, usually'not quantitative details.

Chernobyl Unit 4 was one of 14 operating RBMK-1000 reactor plants. Significant differences exist in RBMK-1000 designs, as they have evolved from the early Lenin-grad design (first generation RBMK, 8 total units),to the more modern Smolensk design (second generation, 6 total units, including Chernobyl Units 3 and 4).

. This evolution of the RBMK design is often difficult to discern in Soviet liter-

' .ature, and many details of the plant-specific differences among the 14 plants are not clear. The descriptive material of the RBMK-1000 second generation, is much more extensive than inforn:ation abcut the current status of first-generation RBMK-1000 reactors. Soviet literature does not. discuss whether the design fea-tures unique to the second-generation RBMK have been backfitted into the first generation. Therefore, safety capabilities discussed here may or may not apply to the 8 older RBMK-1000 reactors. Also, since the single operational RBMK-1500 unit (Ignalinsk Unit 1) operates with less safety margin to " boiling crisis"

[ critical . heat flux limits] than RBMK-1000 reactors, a similar caution applies to assuming-this discussion can be applied to the RBMK-1500 reactor.

3.1 Introduction 3.1.1 Purpose of This Chapter Chapter 2 described the Chernobyl Unit 4 reactor plant design, and Chapter 4 explains what happened at Chernobyl in April and May 1986. This chapter will G. Vine of the Electric Power Research Institute (EPRI) compiled this chapter.

3-1

help explain why it happened, by giving the reader an understanding of plant response to frequently occurring transients and credible accidents. Many of the transients discussed in this chapter actually did occur during the Chernobyl accident. Reviewing them individually helps provide a better understanding of what happened in the complex Chernobyl accident.

In addition, some Western countries may choose to develop " lessons learned from Chernobyl" for their own countries and own nuclear power industry. A safety review of Soviet reactors is an important part of this process. For example, an accident such as the one at Chernobyl could raise questions about the original safety analysis and the design basis of the plant. Even if the accident was due partly to operator error or management breakdown, it is prudent to review the plant safety analysis to assure ourselves that a contributing design over-sight does not exist that could have a parallel in our own safety analysis.

A broad investigation of Chernobyl reactor safety is necessary for this purpose.

Finally, 13 RBMK reactors remain in operation, many with fewer safety features than Chernobyl Unit 4 had. Several of these reactors are sited close to inter-national borders. A factual review of the safety of the RBMK design can help answer questions about Soviet corrective actions.

This chapter does not pass judgment on the design or operation of the Chernobyl reactor. This chapter is intended to be factual and constructive, and is based on published information from the Soviet Union wherever possible. A major i source of information is the Soviet report on the accident at Chernobyl (USSR, 1986). An independent safety review of Chernobyl based on Western approaches is included to help us understand the design performance from a more familiar perspective. A comparison of the relative merits of U.S. and Soviet reactors is not the objective of this report.

3.1.2 Summary of the Safety Review Chernobyl Unit 4 is one of the newer RBMK-1000 reactors, and as such has bene-fitted from the evolutionary improvements in RBMK reactor safety since the original Leningrad design. As a second-generation RBMK reactor, Chernobyl Unit 4 had an accident localization system (ALS) underneath the reactor, de-signed to condense steam and prevent the release of radioactivity from large ,

pipe breaks in lower reactor recirculation piping. Such breaks are considered by the Soviets to be the " maximum credible accident." The reactor protection system and the emergency core cooling system include features to shut down the reactor, cool the core, and prevent fuel damage in such an event.

No other " maximum credible accidents" are defined in Soviet literature, but a number of transients are studied, such as loss of feedwater, turbine trip, and recirculation pump trip. The Soviets attempt to keep the reactor critical at reduced power during many such transients. The reactor protection system pro-vides automatic power reductions to 60%, 50%, and 20% power for selected tran-sients in order to avoid full plant shutdowns.

Since the emergency core cooling system and accident localization system are designed for a single maximum credible accident, other credible accidents are not discussed in Soviet safety analysis, presumably because they are considered to be of sufficiently low probability to justify disregarding them in the i 3-2

design basis. Examples of credible accidents with potentially serious conse-

-quences not discussed in Soviet literature. include: ruptures of reactor exit-piping, main steam piping, and main feedwater piping; rapid reactivity excur-

, sions; and some accidents initiating in the core region itself, such as a blocked flow channel or multiple channel ruptures (see Section 3.3 for further discussion). Many of these accident sequences not addressed by Soviet safety analysis were part of.the Chernobyl accident. An important result of the.deci-sion to consider only pipe breaks below the reactor as credible is that there is no containment surrounding reactor outlet piping above the reactor (see Figure 2.6).

3.2 Soviet Safety Analysis of the Chernobyl Unit 4 Reactor This section will summarize the bulk of information available on the Soviets' own assessment of their RBMK reactors, with emphasis on the second generation i RBMK design and Chernobyl Unit 4. The sources of Soviet safety analyses are primarily the Soviet report on the accident at the Chernobyl nuclear power plant (USSR, 1986), Soviet technical papers on their RBMK-1000 reactor, and a few Soviet textbooks available in the West.

A review of these Soviet documents indicates that some fundamental differences exist between Soviet and Western approaches to safety analysis. Some of these differences include:

(1) The Soviets place heavy reliance on system testing to verify that safety criteria are met. For example, the Soviets have conducted extensive in-plant experimentation, and have recently developed one or more scaled test i facilities that can duplicate RBMK-1000 functions without the use of nu-i clear fuel. The Soviets state their analytic capabilities are good, but

' their capacity for computer-assisted analysis may be more limited than in Western countries. Soviet technical literature contains less pretest pre-dictive modeling and less post-test code validation than is in U.S. tech-nical literature. The Soviets' empirical approach to safety analysis may be adequate for studying routine operaticas and the ability to cope with i

routine transients. It is likely, however, that their approach has placed

, limitations on their ability to predict plant performance in abnormal regimes beyond those which can be treated by extrapolation of test results.

(2) Requirements for complete documentation of all safety analysis calculations typical of the Western licensing process are not as extensive in the Soviet Union. Also, Soviet safety criteria generally emphasize overall safety objectives, without specifying the detailed criteria or methods to be used.

(3) Available Soviet safety analysis of the VVER (PWR) design is more complete than available RBMK analysis. Soviet VVER safety requirements are gener-ally more stringent than RBMK safety requirements. The VVER is the Soviet

export design, whereas the RBMK is not exported outside the USSR. Hence l VVER designs tend to be more compatible with Western safety criteria; and

, Soviet safety analyses of the VVER often rely on Western studies. This l

Western influence on the VVER has led to some recent Soviet applications of VVER safety approaches to the RBMK.

3-3

I I

(4) Soviet safety analysis tends to place greater emphasis on prevention and early mitigation of selected design-basis accidents than it does on the consequences and mitigation of severe accidents beyond the design basis of the plant. As a result, comparatively little analysis appears in Soviet literature on issues such as the prevention and mitigation of reactivity excursions, or coping with the stored chemical energy in the RBMK (graphite, zirconium, H2 generation in an accident, etc.)

3.2.1 Soviet Design Philosophy g (This section is based on information in 1981-1983 Soviet literature.)

The following requirements form the basis of safety for Soviet nu-clear installations (Cherkashov, 1984):

a. the plant must be designed and built in such a way that the _

probability of accidents is kept to a minimum; qEm

b. at any time, even during an accident, no radioactive substances or radiation from them should enter the serviced areas of the E nuclear power station or the surrounding environment; g 7

c. the personnel servicing the nuclear plant must possess adequate i knowledge and experience of operation. [

4 The overall safety of nuclear power plants in the Soviet Union in- 2 2

cludes a wide spectrum of measures, the most important of which are (Cherkashov, 1984; Sidorenko, 1981): g G

a. securing high quality manufacture and installation of components; b, checking of components at all stages; -j

=i development and realization of effective technical safety mea- E c.

sures to prevent accidents, to compensate fer possible malfunc-tions, and to decrease the consequences of possible accidents; g 2

a

d. development and realization of ways of localizing radioactivity released in case of an accident; i

e. realization of technical and organizational measures to ensure  !

safety at all stages of construction and operation of nuclear 3 j

power plants; a

f. regulation of technical and organizational aspects in securing j safety; and u E

g. introduction of a system of state safety control and regulation.

Soviet Nuclear Safety Regulation 'l 3.2.2 i.

(This section is based on information in Soviet literature published in 1983 9 (Semenov, 1983).

.i i

2 3-4 2

.. ~ , . _ . . ._

a l

+

i I

, I The regulation of safety by official documents is o'ne of the main

~

tools for. ensuring.the_ safety of nuclear power plants in the USSR.

. - The state supervision of ' nuclear power plant' safety. [as it was .

structured = prior to'the accident] was accomplished by:

The State Committee onLSupervision of Safe.0perations in Indus-try and. Mining, under supervision of the~ Council'of Ministers of the USSR,(Gosgortekhnadzor of theiUSSR), which supervised com- *

. pliance with Regulations and. standards of engineering' safety in

design, construction, and operation of nuclear power plants; i-

• The State Nuclear Safety Inspection (Gosatonnadzor of the USSR), -

which supervised. compliance with rules and standards of nuclear .i safety in design, construction, and operation of. nuclear power plants; I - The State Sanitary Inspection of the USSR, under the Ministry of Public Health, which supervised compliance with rules and stan-dards of radiation safety in design, construction, and operation of nuclear power plants.

I The established system of three supervisory bodies largely determined the structure of the whole complex of regulatory documents on nuclear power plant safety.

A regulatory document on nuclear power plant safety in the USSR, " General Regu-

'lations To Ensure the Safety of Nuclear Power Plants in Design,, Construction and Operation," was introduced in 1973. In 1982, the " General Regulations" were revised. The new document is titled " General Safety Regulations of Nu-

clear Power Plants During Design, Construction, and Operation" (GSR, 1983).

This document covers all types of comnercial reactors operating or under con-struction'in the USSR. In.this approach, requirements are presented in a

general way, without concrete details. In most cases the General Regulations 4

only prescribe tasks which have to be solved to ensure safety (what must be

done); they do not determine the solutions (how it should be done).

Other regulatory documents (codes, guides, rules, procedures) develop further and specify more concretely the " General Regulations," estab-lishing the basis for activities of designers and corresponding

! supervisory bodies. One of the main documents in the field of engi-neering safety is " Regulations for Design and Safe Operation of Com-ponents for Nuclear Power Plants, Test and Research Reactors, and Installations."

l-l The basic document in Gosatonnadzor's activity, " Nuclear Safety Regu-l 'lations for Nuclear Power Plants," was introduced in 1975. It regu-lates nuclear safety, governing not only criticality problems in reactor operation, but also refueling, transportation and storage of fuel assemblies. It contains the main technical and organizational requirements to ensure nuclear safety in the design, construction, and operation of nuclear power plants, and the training requirements for personnel associated with reactor operation.

3-5

In the field of radiation safety, the basic document by which the health and inspection protection bodies are guided is " Radiation Safety Standards" (RSS-76). These standards were worked out on the.

basis of recommendations of the International Commission on Radiolog-ical Protection (ICRP) and establish the system of dose-limits and principles of their application. The " Health Regulations for Design and Operation of Nuclear Power Plants," issued in 1978, further de-velop and specify the basic RSS-76 document to include siting, moni-toring, and inspection problems.

The system of regulatory documents on nuclear power plant safety is complemented by the system of state standards developed and estab-lished by the State Committee on Standards (Gosstandart of the USSR).

The system of standards extends the system of regulatory documents by ensuring nuclear plant safety.through establishing requirements for many components, materials, processes, etc.

Figure 3.1 is taken from Semenov's study (1983).

State Nuclear State Engineering Safety inspection Ministry of Public Health Safety inspection State Sanitary inspection e

I I

i i I t  !  ! '

!  ! l I I General Safety Regulations j l

s  !

! N Radiation Safety Design and Operation  !

Nuclear Safety Rufes Standards Rules  ;

j i

Figure 3.1 Nuclear safety regulatory bodies and documents in the USSR Source: Semenov, 1983 3-6

3.2.3 RBMK-1000 Compliance With General Safety Regulations The 1982 " General Safety Regulations" (GSR, 1983),, discussed in the previous subsection,-establish a broad set of compulsory regulations for all nuclear power plants. The regulations-are more comprehensive than those established in 1973. The provisions for bringing existing nuclear power plants into con-

~

.formity with the _ revised regulations were to be established :ht each specific case by the SovietLregulatory bodies. It. is not known whether Chernobyl, Unit 4 had been brought into conformity with the' revised safety regulations before the accident.

, The regulations (GSR, 1983) discuss some design and regulatory documents that should exist for Chernoby1:

-The-design of the nuclear power plant should contain a special volume

" Technical Substantiation of Construction and Operating Safety of Nuclear Power Plants" (TOB), compiled by the general contractor, chief designer, and scientific director, according to the " standard content of the TOB."

i

The main document that ensures the operating safety of the nuclear power plant is-the technological regulations containing the rules and

^

main procedures for safe operation of the. plant, the general proce-dure for performing operations related to nuclear power plant safety, and also the limits and conditions of safe operation.

, The regulations are worked out by the board of directors of the nu-i clear power plant with participation of the scientific director,

chief designer and general designer, and is confirmed by the operat-t ing organization." [This suggests local regulaticns with no higher approval.]

None of the above documents have been made available to the International Atcmic Energy Agency (IAEA)-to assist in understanding the design and operation of the Chernobyl Unit 4 reactor.

With respect to compliance with the 1982 regulations, it is very difficult to assess the conformity of Chernobyl Unit 4 to those regulations. The available i Soviet literature on the RBMK-1000 design does not provide a complete under-

+

standing of how some of the general requirements are met. Documents that might demonstrate that Chernobyl Unit 4 complied with the general regulations would be of great value to safety engineers in reaching an understanding of the accident. To date, the Soviet Union has not provided these documents to the IAEA.

The evidence from the accident suggests that Chernobyl Unit 4 was not in com-pliance with the following specific requirements in the 1982 regulations:

i j 2.1.4. The systems and devices of nuclear power plants important to l safety should be designed, manufactured, and installed with regard to

[ possible mechanical, thermal, chemical, and miscellaneous effects that arise as a result of planned accidents.

i f

I 3-7

d

~

2.1.9. ~The systems and devices'of nuclear power plants.important to safety should be subject to a periodic check throughout the entire

, service ' life of the nuclear power plant and after repair. The main-

'tenance and checks should not lead to a reduction of the safety level.

2.2.2.._The fast power coefficient of reactivity should usually not

-be positive in any operating modes of the nuclear power plant and in any states of the system for dissipation.of heat-from the coolant of the first circuit. If the fast power coefficient of reactivity in any operating modes is positive, the reactor safety in steady transient, and emergency modes should be ensured and substantiated in the design.

2.3.1. At-least two independent reactivity control systems (two independent members or two independent groups of members), preferably based on different principles should be provided.

, 2.3.2. At'least two of the provided. independent reactivity control systems,should be capable of converting from any normal operating state to the subcritical state independently of each other and should maintain this state at the operating temperature of the coolant and moderator.

Conversion to the suberitical state should occur rapidly enough to prevent damage of the fuel elements-above the permissible limits at any considered initial event.

2.3.3. 'At least one of the provided independent reactivity control systems should ensure conversion from any normal operating state to the suberitical state under any temperature conditions and during transition processes of the considered initial events.

Conversion to the suberitical state should occur rapidly enough to prevent damage of the fuel elements above the permissible limits at any considered initial event according to the principle of single i failure in a given system, including that during failure of the most effective reactivity control member to respond.

. The. total range of variation of reactivity in'the indicated transi-i tion processes can be divided into several temperature and mode ranges, using part of the indicated system for each range (part of the members and some groups of members) with application of the prin-ciple of unit failure for each part of the system.

, 2.3.4. At least one of the provided independent reactivity control 4'

systems should ensure conversion from any normal operating state to a suberitical state and should maintain this state with regard to possible release of reactivity during prolonged shutdown cooling under any normal conditions and those that take into account initial

- events according to the principle of unit failure in the given system j and with failure of the most effective reactivity control member to respond.

{ 2.3.5. The reactivity control system, together with the core charac-i teristics, should ensure the absence or rapid suppression of such 3-8

power fluctuations and energy release distribution, as a result of which the fuel elements may be damaged above the limits for-normal

~

operation during the operating period of the core. {

2.3.6. The reactivity control system, if there is a single disturb-ance in the monitoring and control system, should ensure suppression of positive reactivity related to the control members being brought to reactivity (within the design rates) without damage to the fuel

-elements above the limits for normal operation.

2.3.7. The maximum efficiency of the reactivity control members and the maximum possible rate of increase of reactivity in the case of erroneous actions of personnel or of single disturbance of any device of the nuclear power plant should be limited so that the effect from a subsequent increase of power does rot lead:

to excess maximum permissible pressure in the first circuit; to impermissible deterioration of the efficiency of heat dis-sipation or meltdown of the fuel elements.

2.8.1. Localizing systems should be provided to confine radioactive materials that have escaped from the reactor installation during an accident within the bounds provided by the design.

2.8.2. The first circuit should either be located entirely in con-tainment buildings or, as in the case of planned accidents, localiza-tion of released radioactive materials within the boundaries of containment buildings should be ensured. Directed discharge of radioactive materials into the environment is permissible in indivi-dual cases if it is substantiated in the design that nuclear power plant safety is ensured with this discharge.

2.8.4. Localizing systems should perform their functions during accidental leaks of coolant of the first circuit with regard to the possible mechanical, thermal and chemical effects.

3.3.1. The following should be carried out before permanent opera-tion (startup]:

conformity of the nuclear power plant structures to the design should be checked; 1

starting-adjusting operations should be completed (including tests of individual equipment systems);

complex testing of the nuclear power plant should be completed (including physical and power startups of the reactor).

The procedure for putting the nuclear power plant into operation is carried out in the order established by existing regulations for the corresponding enterprises and according to these " General Regulations."

3-9

3.3.3. Documents that regulate starting-adjusting operations should contain a list of the operations that are potentially hazardous from the viewpoint of safety (for example, operations which may uncontrol-lably convert the core to a supercritical state) and a list of the measures that prevent the occurrence of accidents.

3.2.4 RBMK-1000 Design-Basis Transients.

The 1982 requirements (GSR, 1983) establish the maximum damage to fuel elements for normal operation at 1% of fuel elements with defects of the gas leak type, and 0.1% of fuel elements for which direct contact of the coolant and nuclear fuel occurs. The requirements then specify that An excess of these limits is not permissible upon a single one of the following violations of normal operation:

a. malfunctions of the reactor control and monitoring system;

b. loss of power supply to the main circulating water pumps;

c. switching off of turbogenerators;

d. complete loss of external power supply sources;

e. leaks of the first circuit, filled by standard makeup systems.

The RBhX-1000 design provides for automatic power reduction or shutdown (scram) for some but not all the above violations (see Section 2.6.8). The protection scheme for each of the above design-basis violations of normal operation is discussed below.

One 1983 Soviet report (Cherkashov, 1984) states that The following are considered the most likely transient conditions resulting from failure of equipment:

emergency shutdown of power station turbogenerators malfunction of coolant circulation pumps failures in the feedvater supply system total loss of power of the nuclear power plant The criterion of nuclear power station safety assumed for the above emergency conditions is the absence of dryout on the fuel pin surface. . .

which correlates to the fuel element defect criteria of the general require-ments. Each of the above "most likely transient conditions" is discussed below.

3.2.4.1 Protection for Design-Basis Transients The Soviet protection system for most transients is designed to initiate a power reduction, but not to shut down (or scram) the reactor. One 1981 Soviet textbook (Voronin, 1981) differentiates between transients and accidents as follows:

Under transient conditions, the primary goal is to keep the power l unit in operation at the admissible power level with observation of I all requirements with respect to reliability of heat transfer from  !

3-10

1 I

l the reactor core and safety of the nuclear power plant. Under emer-gency conditions, the primary goal is timely shutdown of the reactor and the power unit in order to exclude damage to the nuclear fuel in )

the reactor and basic equipment and the pipelines of the nuclear  ;

steam generating plant. '

(1) Malfunctions of the Reactor Control and Monitoring' System One of the worst reactor control and monitoring system malfunctions would be a continuous rod withdrawal accident. Such an accident would increase reactor power to an unsafe level. A high reactor power scram on power overshoot of 10% i

, of nominal power is listed in the Soviet report on the accident at Chernobyl (USSR, 1986). However, the ability of the high power scram to respond with adequate speed to a rod withdrawal accident and to prevent fuel damage is not clear. A 1981 Soviet textbook (Dollezhal, 1980) indicates that the number and .

efficiency of scram rods are based on "the maximum possible rapid variation of 4 reactivity." Two conditions were considered: dryout of the fuel channels in a cold reactor late in core life, and collapse of steam in the core and cooling of fuel elements early in core life when the void coefficient of reactivity is negative. However, the rate at which these reactivity variations would occur is less severe than the rate experienced in the Chernobyl accident. Also, the list of most likely transient conditions does not include reactor control and monitoring system malfunctions.

(2) Loss of Power Supply to the Main Circulating Water Pumps Section 2.6.8 lists the following automatic actions in relation to this transient:

AZ-5: Emergency shutdown of the reactor (scram) on shutdown of three or more main circulating pumps in one loop.

AZ-2: Reduction to 50% of rated power because of loss of one of two turbine generators and its associated main circulating pumps (MCPS).

AZ-1: Reduction to 60% of rated power of both the reactor and generator be-cause of shutdown of one of three main circulating pumps in one loop, or when the water throughput is reduced in the primary circuit. The reactor protec-tion system also initiates an automatic trip of one recirculation pump in the

~

opposite loop, so flow through the core will be balanced. This prevents power

! oscillations and thermal transients. One 1983 Soviet report (Cherkashov, 1984:

discussed investigations in which the output of the remaining pumps increased from 8000 m 3 /hr to 11,000 m3/hr on shutdown of one pump and reduction in steam quality.

Shutdown of a coolant circulating pump is listed as one of the most frequent transient conditions.

I Note that loss of two out of three main circulating pumps per loop is not covered by the protection logic. Based on protection logic described in the Soviet study on the Chernobyl accident (USSR, 1986), loss of two out of three MCPS in either loop will not reduce power below 50%. However, " Operation and Maintenance of Nuclear Power Plants" (Voronin,1981) indicates the plant would trip on loss of two out of three pumps per loop. l I

3-11

~

E (3)L Switchina Off Tukbine Generators 1 . . . .. . . .

Section:2.6.8-lists the following automatic actions in relation to..this transient:

AZ-5: Emergency shutdown (scram) on loss of both turbine generators (including loss of on-site ac power)

'AZ-3: Reduction to 20% power, on load rejection by both turbine generators.

AZ-2: Reduction to 50% of rated power on loss of one turbine generator.

Emergency shutdown of power station turbine generators is listed as a~quite frequent transient condition. In the case of a simultaneous load rejection from full power by both turbine generators, power is reduced to 20% to carry e in-house' loads, and it is likely that one or more safety valves will lift.

h (4)l Complete Loss of External Power Supply Sources

) Section 2.6.8 lists no automatic actions :in relation to this transient. It does list " loss of in-house electric power" as a. condition resulting in an emergency shutdown (scram). This use of the term " loss of.in-house electric power" indicates that all plant ac loads are powered normally from turbine generator output. (One Soviet report lists this' transient as an " accident.")

The'following description of a " loss of power to' internal equipment" appeared i in a-1984 Soviet report (Smolin, 1984).

f When the. internal equipment in a nuclear power station is deprived of i current, the main circulation pumps stop along with:the feed pumps,

.while the emergency shutdown equipment operates and the automatic

' shutoff valves ahead of the turbines are closed, which causes the i,

pressure to. increase and the safety valves to open. Then the pres-sure in the loop begins to fall, and the safety valves should close.

t After about 3 min, the emergency feed pumps are switched on It has i been found with a simulation system and checked on the reactor that stable conditions are then set up in the loop by natural circulation, and cooling the core does not cause any complications.

(5) Leaks of the First Circuit, Filled by Standard Makeup Systems Section 2.6.8 lists three conditions relating to recirculation ~ system (Soviet designation: first circuit) leaks which cause an automatic emergency shutdown i (scram):

' .- uncompensated coolant leak greater than 55 kg/sec decrease in steam separator water level outside set limits in either half high pressure in reactor piping spaces (leaktight compartments)

! Each of these three conditions is indicative of a large leak. The regulation ,

on transients is directed at smaller leaks that are within standard makeup i capability (no need for emergency cooling actuation). It appears from Sec-l tion 2.6.8 and from " Operation and Maintenance of Nuclear Power Plants" I (Voronin, 1981) that smaller leaks do not require an immediate plant shutdown unless the leak is in the graphite region, and therefore leaks within makeup 3-12

system capacity will not.cause'an automatic scram. The. operators have the option of reducing power, isolating the. leak if possible, and pursuing online repair of isolable leaks. The rupture of a single channel lower (inlet) line or steam-water (outlet) line would not cause an automatic scram. Section 2.6.8 lists five specific conditions which are indicative of a leak inside the reac-tor vault (e.g. , moisture in graphite, excess pressure in graphite), all of

, which should be monitored by the operator and would-require a manual scram if obse rved.

(6) Partial or Total Loss of Feedwater Although not listed above as a design-basis transient, failures in the feed-I water supply system are listed as a likely transient condition. Other Soviet documents list loss of feedwater as a design-basis transient, possibly because 1 it is an outcome of either a loss of offsite power or a loss of both turbine generators. The normal power supply to the main feedwater pumps is turbine generator output. All five RBMK-1000 feedwater pumps are ac motor driven. In

addition, all main feedwater pumps can be powered by external ac power sources, i as well as by the normal turbine generator output. The Soviet report on Chernobyl (USSR, 1986) states that a drop in feedwater flow causes both a power runback to 60% (AZ-1), and an emergency shutdown, without specifying a feedwater setpoint for either action. Section 2.6.8 states that a loss of 50% or more of feedwater flow causes the emergency shutdown.

One 1983 Soviet report (Cherkashov, 1984) discusses the complications associated with a loss of feedwater flow to the steam separators.

In this situation the emergency safety system is triggered, com-pletely. stopping the fission chain reaction, and the reactor power is reduced to the decay heat removal' level. The turbogenerators

[ turbine generators) are unloaded on receipt of a pressure reduction signal from the separators, with the rate of unloading under these conditions being greater than with normal operation under pressure regulation conditions or with the triggering of protection devices bringing the reactor to a lower power level. The increased rate of unloading the turbogenerators prevents any significant reduction of pressure in the circuit. When the feedwater supply is cut off there is a possibility of supplying water to the separators by means of ee.crgency feedwater pumps with a total output of about 10% nominal.

These pumps are switched on automatically about 10 seconds after the start of the loss of normal feedwater. [If the loss of main feed-water is caused by loss of in-house electrical power, then about 2 to 3 minutes are required to get emergency feedwater pumps loaded on the emergency diesel generators.]

A feature of the transient is that the coolant circulation pumps are switched off after triggering of the emergency safety system. This feature permits a reduction of water level in the separators and l prevents steam from being trapped in the downcomer system. Trapped l steam could lead to cavitation of the coolant circulation pumps and to a deterioration in the conditions for convective circulation in the circuit. After shutdown of the pumps, decay heat is removed from j the reactor by convective circulation of the coolant.

l 3-13 l

U

3.2.4.2 Analysis of Design-Basis Transients As stated.above, mor,t of the design-basis transients are provided for by auto-matic or manual scrans or power reductions. However, no quantitative _ analysis could be found in Soviet literature that documents how automatic actions will keep fuel element temperature within limits. -Specific examples of transients that: appear to be within the RBMK-1000 design basis, but do not appear to be analyzed for safety in the Soviet literature are-4 (1) The leak or' rupture of a single fuel pressure tube in the graphite region is the limiting design-basis event for the RBMK-1000 reactor vault. Detec-tion and manual reactor shutdown are prescribed in procedures, but effects

! of tube rupture on surrounding graphite and the gas pressure boundary are uncertain. The reactor vault pressure boundary might be breached in such an event if operator detection and manual action are delayed.

-(2) The RBMK-1000 reactor should be protected against the leak or rupture of a single pressure tube steam outlet pipe, located below the refueling t

l floor but above the upper biological shield and gas boundary. Although makeup capacity is adequate to handle this event, the escaping steam and i

water are not contained. Such a rupture has not been analyzed in the l available literature for its effects on adjacent outlet pipes, on con- ,

trol rod drive mechanisms subjected to high pressure steam, or on nearby refueling operations in progress.

(3) With a positive void coefficient, and complex systems and procedures for j maintaining adequate heat transfer margin to critical heat flux (CHF) limits in each individual tube, the plant operators face demanding re-sponsibilities. It is not clear what measures exist to assure they are capable of detecting and selecting the proper course of action for each

! of the large spectrum of credible malfunctions in the reactor control and monitoring system.

3.2.5 RBMK-1000 Design-Basis Accident The Soviets employ the concept of " maximum credible accident" (MCA) or maximum permissible accident (MPA) in their approach to designing the RBMK-1000 safety systems. The MPA is defined as the largest credible pipe break in the primary circuit. The size of that largest " credible" break has evolved over the years

,- to the size of the main circulating pump inlet and outlet piping (900-mm L diameter). Early RBMK-1000 designs (first generation) did not consider large

! pipe breaks as credible accidents.

The existence of an emergency core cooling system to cope with pipe breaks was mentioned in 1975 (Konstantinov), and general descriptions of this system appeared in 1977 (Yemel'yanov). However, the emergency core cooling of this period consisted of the high-pressure tanks and pumps only, without a tie-in to a bubbler pond (or steam suppression pool), which did not yet exist as a source of emergency makeup water or as a heat sink for pipe breaks (see Figure 2.1).

l A 1979 Soviet textbook (Dubrovsky) discussed a 300-mm (12-in.) pipe break as the maximum credible accident, although other references shortly thereafter discussed a 900-mm (36-in.)' break. Soviet documents in that same time frame (e.g., Margulova, 1978) discussed " bubblers" and " technological condensers" that were installed in the turbine building to condense main steam safety valve 1

l 3-14 m

discharges only (not steam blowdown from pipe breaks). The first Soviet docu-ments to describe the accident localization system (ALS, the bubbler pond sys-tem installed beneath the reactor building) and its design. basis (the.900-mm-break),. appeared in 1979 (Dubrovsky), four to five years before the first RBMK-1000 reactor went into operation with the ALS installed (see' Figure'2.6 from Dubrovsky, 1979). Therefore, for nearly a decade, the 900-mm pipe break represented a " semi-design basis accident" for operating RBMK-1000 reactors:

It was the basis- for injection capability to protect the reactor fuel from overheating, but it was not the basis for any containment function, which did not yet exist.

Soviet literature during the late 1970s and early 1980s concerning emergency core cooling and accident localization is much more ambiguous about first-generation than second-generation RBMK. reactors. Soviet literature reveals the following about the first-generation RBMK-1000 systems:

(1) High-pressure injection to cool the core in the case of pipe breaks is provided. Soviet references state clearly that second generation RBMK-1000 emergency core cooling systems are designed to handle the largest recirculation pipe break (900-mm or 36-in. diameter), and suggest that first generation injection systems are now equivalent.

(2) " Bubbler" vessels were installed to quench safety valve discharges. These

" bubblers". were small in comparison to the bubbler ponds to be installed later on second generation RBMK-1000 reactors. The older RBMK-1000 plants had two bubblers, each a vessel about 10 ft in diameter and 70 ft long.

They did not have the capacity or the physical connections to condense the steam from large pipe breaks.

(3) Originally, first generation recirculation piping was installed in " strong boxes" designed to withstand up to about 4 atmospheres pressure (about 60 psi). But these strong boxes or vaults had no means of relieving steam pressure from a pipe break to a condensing system (first generation RBMK-1000 reactors do not have a bubbler pond beneath the r-actor). Hence, only small amounts of leakage could be " contained." However, the litera-ture and a comment by academician Legasov in Vienna during the postaccident review meeting seem to indicate that tunnels from these strong boxes to additional " external" bubblers subsequently may have been provided. No Soviet reference could be found that states whether or not such tunnels are backfitted on all first-generation RBMK reactors, or whether such localization systems are capable of handling a 900-mm break. Therefore, older (first generation) RBMK-1000 reactors may still have a limited ability to cope with the largest break size: ECCSs apparently have been upgraded to provide adequate core cooling, but breaks may not be contained and could vent to the atmosphere. Bubbler ponds beneath the reactor could never be backfitted on older generation RBMK-1000 reactors.

(4) Extensive Soviet literature appeared in 1979 (Dubrovsky) that described emergency core cooling systems, bubbler pond design and testing, and the capability of the RBMK-1000 design to handle a 900-mm (36-in.) pipe break.

However, the literature did not differentiate between first- and second-generation RBMK-1000 systems, and could be misinterpreted as implying that all RBMK systems were designed to localize large pipe breaks.

3-15

I The lead plant for the new accident localization system (ALS) design underneath the reactor was Smolensk Unit 1. Descriptions of the ALS featuring Smolensk appeared in 1979 (Dubrovsky), but Smolensk did not go into commercial operation until 1983. In fact, the first RBMK-1000 plant to go into operation with an ALS was Chernobyl Unit 3. Since Chernobyl Unit 3 was ready for startup before -!

Smolensk Unit 1, the first ALS test program was conducted at Chernobyl Unit'3, and was reported in 1984 (Markov). Chernobyl Unit 4 was built with these im-proved large-break loss-of-coolant-accident (large-break LOCA) capabilities, and therefore was designed to handle a 900-mm break.

A 1984 Soviet paper (Cherkashov) described the following testing and analysis of the 900-mm pipe break event:

The design of the safety system is based on the premise that the most serious emergency situations may occur with the fracture of the large pipework of the primary circuit. The RBMK power unit design provides technical means to prevent the discharge of a steam gas mixture into the service areas and particularly beyond the power station boundary.

The fracture of a large pipe ic highly unlikely. Experiments on full-scale models have shown that at a pressure of 8.5-9.0 MPa the fracture of a pipe with a diameter of about 800 mm is possible if the depth of fatigue cracks is approximately 0.75 of the wall thickness and the crack length exceeds 470 mm. Operational monitoring of the state of the metal ensures the exclusion of the sudden fracture of pipework since the critical defect size is large and is reliably revealed during planned shutdowns of the unit. During inspections, the metal is examined and inspected using special methods (ultrasonic defectoscopy, acoustic emission). Despite this, the nuclear power station design provides measures to ensure its safety in the event of the instantaneous transverse rupture of the largest pipe.

3 The leak rate is initially about 6 m /sec in the event of the com-plete instantaneous rupture of a 300-mm-diameter pipe, and 40 m3 /see with the same fracture of a 900-mm-diameter pipe. As a result of the analysis of emergency situations, two independent signals have been l chosen for the actuation of the reactor emergency cooling system:

an increase in pressure in compartments containing circuit pipework, l

and a reduction in level in any separator down to a value exceeding l the departure from the nominal value for transient conditions.

l The most dangerous pipework fracture is in the discharge line of the main coolant circulation pump, since this instantly cuts off the coolant delivery to the channels in the half of the reactor in which the emergency has occurred. It is this hypothetical accident which determines the characteristics of the reactor emergency cooling sys-tem, including its rapid action and maximum output (about 1.1 m3 /sec).

Water from the emergency cooling system enters each group distribu-tion header. Non-return valves are provided in the pressure header at the inlet to the group distribution header to prevent the useless discharge of water through the fracture. The reactor emergency cool-I ing system consists of two subsystems: (1) the basic subsystem with I water tank unit; (2) decay heat removal subsystems with special pumps 3-16 l

E x ,

p v

y Q- .

^

,' and water reserves in tanks. The cooling water is fed from pressure.

tanks (and after their, discharge, with the aid of pumps) to the emer-gency cooling system header of each half of the reactor and from  ;

there through pipework to each group distribution header. High-speed valves on the water supply lines to-the headers open on receipt of the signal that the emergency cooling system has been switched on.

The procedure for switching on the basic subsystem of the emergency cooling system guarantees the decay heat removal from the core in the event _ of a complete or partial large diameter pipe _ break and pre-cludes false trips in the event of emergencies.not related to a cool- 3 ant circuit rupture.

In the initial period of an emergency with a full pipe break in one pressure header there is no coolant flow through one-half of the -

core, the residue of water evaporates and is discharged through the heated part_of the fuel channels [ Soviets estimate complete dryout in one second). This_is followed by a rapid heatup of fuel pin clad-ding. At the moment of restoration of coolant flow from the emer-gency cooling system, the cladding will have heated up to 650-700*C.

Further increase in temperature of the cladding is slowed down and is then completely stopped by the transfer of heat to the steam-water mixture and steam under non-equilibrium conditions.

Maximum cladding temperature is very sensitive to the interruption time of cooling water. A Soviet calculation (Kabanov,1983) of peak cladding tempera-ture with a 5-second interruption was over 1100*C. With only a 3-second -

interruption, peak temperatures can be 200'C lower. (The Soviet criteria for fuel performance following an accident are given in the safety regulations (GSR, 1983) as:

maximum fuel rod temperature, < 1200'C maximum zircaloy-water reaction in the core, < 1%

maximum depletion of fuel cladding thickness,'< 18%)

The investigation of this emergency situation required a series of experiments to study the heat transfer in the fuel channels under conditions of water extraction and repeated supply of coolant. The results of these experiments were then used to calculate the thermal

, conditions of the fuel pins. It was shown that even in such a hypo-thetical situation there was no penetration of water into the fuel pins.

l All equipment and pipework of the recirculation loop of the reactor is located in closely sealed compartments preventing the discharge of a steam-gas mixture from the nuclear power station into the atmos-phere in the event of pipework ruptures, since the steam gas mixture is removed via special tunnels into a localization unit where the steam is condensed. The compartments are designed to withstand an overpressure of 0.4 MPa, which is not exceeded even with a full instantaneous rupture of the largest pipework.

3.2.5.1 Other Design-Basis Accidents Soviet literature discusses other design considerations and less severe events including transients, various equipment failures, and human errors. A few large 3-17

~. - . - . - - _ . - - - - . - _ . - _ - _ - - _ _ - -_- .-- . - . . _

l' pipe breaks in locations other than the main circulation pump discharge are discussed briefly and not analyzed because they are judged less severe (e.g. ,

distribution headers, MCP suction pipes). The only other pipe break discussed in detail in the available Soviet literature is a break in a 53-mm pressure tube inlet line. This small pipe rupture is treated uniquely in the design, because the smaller size of these lines permits a lower pressure confinement area beneath the core that is not subjected to the energy from large breaks in adjacent confinement areas.

No other design-basis or beyond-design-basis accidents are discussed in the Soviet literature that has been reviewed. For example, control rod malfunc-tions are discussed, but reactivity insertion accidents are not defined or analyzed.

Main steamline breaks and main feedline breaks are examples of important pipe breaks that do not appear to be analyzed as design-basis accidents. The de-scription in Chapter 2 of the boundary of the primary piping confinement areas shows that the steam separators and their inlet and outlet piping are not part of the confinement / bubbler pond system. The main steamlines and main feedlines do not appear to be equipped with main steam isolation valves or main feed isolation valves at the steam separator room boundary. These factors seem to indicate that the Soviets do not consider main steamline and main feedline breaks in their design basis. The analysis of these accidents is important for a complete understanding of RBMK-1000 safety for the followir.g reasons:

- They represent credible pipe breaks of large size.

- They would discharge steam outside a confinement area and outside the bubbler pond designed to condense steam from pipe breaks. They would be unisolable breaks allowing radioactive steam to reach spaces that could contain vital equipment.

- They would cause a rapid steam demand and steam pressure decrease that would in turn create rapid and severe voiding in pressure tubes. Not only would this create CHF concerns for fuel assembly heat transfer, but it could initiate a severe power transient because of the positive void coefficient.

- Since emergency shutdown setpoints are established on the basis of recir-culation pipe breaks instead of feedline or steamline pipe breaks, it is not clear which setpoint will initiate a shutdown or power reduction, or how long it will take. Since the void coefficient power excursion would probably react much more rapidly than protective action, the tran-sient could permit an excessive amount of reactivity insertion before power could be reduced.

- Finally, main steamline and main feedline breaks in the steam separator room would not initiate emergency core cooling systems, since initiation criteria would not be met.

(Note that Section 3.3, this chapter, discusses these accident sequences in greater detail.)

3-18

3.2.6 RBMK-1000 Changes With Potential Impact on Safety Soviet literature contains extensive discussion of changes made in the design and operation of the RBMK-1000 reactor since the first unit went into operation  ;

in 1973 at Leningrad. The major changes were made as the design transitioned from the first to the second generation, but other evolutionary changes have also been made over the last decade.

Not all of these changes were made for safety reasons. .-For example, some Lchanges were made to simplify construction or improve the economics of RBMK-1000 operation and maintenance. Some of these changes were made to upgrade the safety of the RBMK design. A review of these safety-related changes'provides additional insight into RBMK-1000 safety problems, Soviet analysis techniques, and the degree to which these problems have been corrected. (More recent Soviet literature before the Chernobyl Unit 4 accident stated that all the RBMK-1000 problems have been resolved.)

3.2.6.1 Reactor Control Problems and Instabilities

'The following discussion of RBMK-1000 problems and solutions identified by the Soviets before the accident at Chernobyl is limited to areas with probable impact on safety. Most of the info. cation comes from 1983 and 1984 Soviet reports (Dollezhal, 1983).

~ Deep depletion of;the nuclear fuel with a low initial enrichment is characteristic of RBMK-type reactors, which is provided for by conti-nuous fuel recharging at the operating facility. Fuel recharging at capacity is constantly accomplished at all RBMK-1000 nuclear power plants with the help of an unloading loading machine. The U-235 con-centration decreases from 18-20 to N3.7 kg/ ton of uranium, and the amount of tissionable plutonium reaches s2.8 kg/ ton of uranium. With such a change in the isotopic composition of the fuel, the neutron-physical characteristics of the cell are significantly altered. If in the steady-state regime of fuel recharging only the local charac-teristics (e.g. , the power) of the channels are altered but the' characteristics of the reactors as a whole remain practically con-stant, then the most important changes in its physical characteri-stics, in particular, the reactivity coefficients (steam, thermal of the graphite, thermal from heating up) occur during the initial period of operation of a reactor loaded with fresh fuel and addi-tional absorbers. The values of these coefficients depend not only on the isotopic composition of the fuel, but also on the presence of absorbers in the active zone.

Experience with the operation of the RBMK-1000 has confirmed the theoretical conclusions that as the fuel is depleted and the absorbers are withdrawn, the reactivity coefficients increase and the stability of the energy distribution decreases. A radial-azimuthal energy dis-tribution, for which the form of the nonsteady deformations is deter-mined by several of the lowest harmonics, turned out to be the least stable. Measures related to stabilization of the energy distribution have been carried out in two directions:

3-19

L r

~an increase in the automation by virtue of the creation of

~

a branched system for regulation of.the reactor; and-

-- a purposeful change in .the ~ composition of the nuclear fuel.

(1) Increased Automation

-Improved automation and control can be grouped into four areas. First,

-A qualitatively new system of-local automatic regulation of the energy _ distribution (LAR) and local emergency protection (LEP) which operates'from intrazonal detectors has been created and introduced into opera-tional practice. The LAR system' fulfills the function of automatic stabilization of the lowest harmonics of the radial-azimuthal energy distribution. Maintaining a specified capacity of, the reactor, this system can, by virtue of auxiliary elements operat-ing in the individual mode, automatically regulate the capacity in individual regions of the active zone. The LEP system accomplishes emergency power reduction in the case of local bursts of power, which can arise due to the failure of LAR elements or for other reasons. A structural peculiarity of.the LAR and LEP consists of the use, for

_ regulation of the capacity and protection of the reactor, of groups of (from 7 to 12) slave mechanisms with a regulating rod uniformly positioned in the active zone and surrounded by two LEP detectors.

and four LAR' detectors. The average correction signal of the LAR detectors is used to control the rods. Triaxial-chambers located in

.the central hermetic sleeves of the HGA serve as the detectors of the

-LAR-LEP system.

'The' Soviets claim "the LAR-LEP system has exhibited high reliability and effec-tiveness,_ based on operating experience."

.Second,. nuclear monitoring of the radial power distribution, which works on the

~

power level of 130 fuel assemblies-uniformly distributed over the core, using in-core detectors. The vertical monitoring system measures the neutron density at seven' points along the length of each of 12 fuel.~ assemblies. The detector 3

signals are passed to a computer in the control complex.

Third, a data processing program which' calculates the power of all fuel assem- 1 blies from the detector signals and .from calculated reactor physics data, the 3

safety margins to maximum-allowable power for the particular flow through each channel, the maximum permissible levels of the detector signals, the void frac-tion, the power generation of each channel, etc.

Fourth, a computer at a center outside the reactor installation, which periodi-cally carries out nuclear and optimization calculations.

(2) Increased Fuel Enrichment Computational investigations have shown that when the initial enrich-ment of the fuel in U-235 is increased, not only do the dynamic pro-r perties of the reactor improve, but its economic indices also in-crease due to an increase in the depletion depth and a decrease in l the specific consumption of nuclear fuel. An important dependence 1

i 3-20 L

~ _ ,

> e v

+

of the variation of the time constant of the'first azimuthal harmonic-of the deformation ~of.the energy distribu' tion'(tot) on the steam reactivity coefficient has been established. The smaller the value

'of the positive steam reactivity' coefficient,-the_ higher the stabil-

.ity of~the energy distribution and thel simpler-the monitoring of the reactor. The'most rational method for decreasing the steam coeffi-cient is an increase of the ratio of the concentration of-U-235 nuclei

-and the moderator nuclei-in the active zone'. A decrease in the steam coefficient due to a1 change to a fuel of 2% enrichment is estimated to be approximately.1.3 p, where B is the' effective fraction ~of delayed neutrons. These [ Soviet): conclusions have served as the basis for the adoption of the solution of increasing the enrichment

of the RBMK-1000 fuel to 2%.

1 (3) Results

, The Soviets believe that The 8-year operation of systems which provide'for the control and regulation of the energy distribution in RBMK-1000 has confirmed the correctness of the engineering solutions'which have been taken as the basis for their. development. The combined and consistent function-ing of the three systems - the monitoring and-protection system

[MPS), which operates off lateral ionization chambers; the system'for physical control of the energy distribution'(SPCED) with respect to

• radius and height of the active zone, which uses p-emission neutron detectors of the cable type; and the Skala system for centralized control (SCC) - has facilitated the reliable control and regulation of the energy distribution in all operating modes of the reactor.

The ' accumulated experience of the assimilation and subsequent opera--

, ' tion of the monitoring and control systems has permitted developing

'o and incorporating measures directed at a further increase in the reliability of their operation. Among these measures one can count the conversien of the logic portion of the MPS to more reliable inte-1 grated circuits, which have permitted' appreciably developing its functional possibilities with a reduction by sev-cal times in the dimensions of the electronic equipment, the replacement of the cable link in the slave mechanisms of the MPS by a belt ling to increase their operational reserve, and the introduction of noncontact thyristor circuits for strong control of the MPS servomechanisms.

t. The service term of the detectors for control of the energy distri-L bution with respect to the radius of the active zone exceeds the

[ operating time of the HGA in which they are mounted. In order to i increase the reliability of operation of the detectors, soldered connections have been replaced by welded ones. The detector assem-blies for control of the energy distribution with respect to the height of the active zone preserve their effectiveness for 4 years.

(4) Testing and Analysis A great deal of attention has been devoted to the perfection of ther-mal automation and emergency protection systems in the interests of increasing the reliability and safety of the operation of RBMK-1000 nuclear power plants. The equations of kinetics, hydrodynamics, and 3-21

i heat transfer, and algorithms of the operation of the equipment and systems for automatic regulation of the parameters of a nuclear power -

. plant are used in a mathematical.model which has been developed for

-the investigation of transition and emergency' conditions. Some Soviet references discuss new computer programs with two-dimensional

~c hannel-by-channel modeling capabilities. Upon comparison of the ~

results of calculations with 3.he data of-the dynamic processes in I- RBMK-1000 operating units, it has been established that the model satisfactorily describes the dynamics of the power unit. Some emer-gency conditions associated mainly with the transition to natural circulation of the coolant have been studied on special_ test stands.

In order -to justify the reliability of'the cooling of the active zone under conditions of natural circulation, three serieslof experiments have been performed under natural conditions on the first and third Leningrad units and the second Kursk unit in steady-state and tran-sitional regimes.

l l 3.2.6.2 Problems With Emergency Core Cooling for Recirculation Pipe Breaks 1

As previously discussed in Section 3.2.5 (this chapter), a rupture of the largest recirculation pipe (900-mm diameter) is considered the maximum credible accident for the RBMK-1000_ reactor. The second generation of RBMK-1000 plants

}

has been designed to handle this event. The Soviets state they have done much

. testing and analysis to verify that their improved emergency cooling injection and bubbler pond pressure suppression will perform as intended.

Improvements in the ECCS design have been made since the initial design. These improvements are summarized below.

(1) The capacity of the ECCS injection and pressure suppression systems was studied. Apparently, the limited steam condensing capacity of the bubbler ponds led to the addition of a surface condenser using a freon-type cool-ing system, directly under the core. This surface condenser and added pool spray systems augmented the thermal capacity of the water in the pools. The ability to cool the bubbler pool water with a system of heat exchangers appears to have been a part of the initial bubbler pool design, although pool cooling capacity may have been increased.

(2) The response of the bubbler pond to simulated pipe break events in various locations was modeled in a test facility and reported in 1984 (Turetskiy).

The response to recirculation pipe breaks was considered adequate. Test results were also presented in the Soviet report on the Chernobyl accident (USSR, 1986).

(3) Soviet documents indicate that the ability to discharge steam from the main steam safety valves to the external bubbler vessels and sub-reactor bubbler ponds was part of the original design for first- and second-generation RBMK reactors, respectively. However, recent reports indicate improvements have been made in the number and modes of operation of these safety valves. Such improvements may have created the need for increased bubbler pond thermal capacity.

Also, a 1984 Soviet report (Smolin) discussed a test that was conducted to simulate a stuck-open safety valve following a simulated loss of ac power.

3-22

This complex test simulated a loss of recirculation flow, loss of feed-water flow, and natural circulation cooldown of.the reactor. These tests demonstrated that depressurization caused by safety-valve actuation'will lead to boiling in the loop and disruption of core cooling when pressure drops below 550-650 psig. Auxiliary feedwater must be initiated or main feedwater restored for adequate core cooling.

-(4) One of the most difficult ECCS problems was the challenge of how to control the power oscillations that result from inadvertent actuation of the ECCS into one-half of the reactor. A 1984 Soviet report (Yemel'yanov)~ detailed a series of calculations that studied the power flash-ups and left-half /-

right-half power imbalances that follow inadvertent ECCS actuation caused by the positive void coefficient. It is important to recognize that Soviet operating philosophy emphasizes maintaining power operation throughout these transients.

Power excursions in excess of 50% above or below the initial 100% power condition were calculated. Power excursions were calculated for void coefficients typical of initial loading (new fuel) and fuel at steady-state overload (maximum burnout). A variety of combinations of automatic control rod responses were modeled. Excerpts from that report are presented below:

There is finite probability of false response of the emergency cooling system (SAOR) with malfunctions in automatic devic'es or with erroneous-actions of the operator. Here the most probable case is the feeding of water from the SAOR into one-half of the reactor. False response of the SAOR results in a sudden change in boiling conditions in the reactor, which via the reactivity steam effect can cause a sudden disturbance of neutron power.

The nature and amount of the reactivity disturbance are deter-mined by the sign and magnitude of the steam reactivity coefficient, a,.

The action of the control and protection systems (SUZs) plays an important role in the progress of this situation. Reactors of the RBMK series are furnished with an automatic power regulation (AR) system which operates on signals from lateral ionization chambers (BIKs). The operation of the AR is aimed at maintain-ing the resultant. signal of four symmetrically placed chambers equal to a specific value and is implemented by the synchronous moving of a set of four rods. When the rods of the working AR reach end cutoff switches, the automatic changeover to the standby AR takes place. Disbalance interlocking of the ARs is provided for the case of failure in the AR (spontaneous with-drawal of the set of four rods of the AR because of a failure in the synchronization system; false appearance of negative dis-balance because of a break in the chamber's circuit). For the purpose of suppressing power flash-ups caused by sudden changes in reactivity with the compensation of which the AR cannot cope, the RBMK is furnished with an emergency power protection (AZM) system. Upon a signal from the AZM, all rods present in the reactor (except the shortened absorber rods) are entered into the reactor. The operation of the AZM ceases when a signal 3-23

4

. arrives, indicating' that the emergency power setpoint has .been.

exceeded.

-In addition to'ARs, RBMK reactors are also furnished with a sys-tem of local. automatic controls (LARs) which simultaneously control the power and. suppress the most rapid distortions of;the form of radial-azimuthal energy release. A 12-channel LAR sys-tem has been provided_and implemented in the design of SUZs for phase 2-(second-generation) reactors. .This LAR version was also

.modeled. Disbalance' interlocking has been implemented in each-LAR channel in all LAR versions. A local emergency protection

< (LAZ) system has been implemented within the framework of the.

LARs in addition to an AZM.

False turning on the SAOR as the result of a change in the rate of flow and enthalpy of the heat transfer medium initially re-suits in a sudden drop in the steam content in the core. Then, following an' increase in the supply of water from the SAOR vessels (for 4 to 5 seconds, maximum), "deexcitation" of this system begins, the supply of water from the SAOR is reduced, and in 32 seconds it'is completely stopped.

Cases of the feeding of water from the SAOR into one-half of the reactor were considered.

Maintenance of power is accomplished either by the AR system or the LARLAZ system,.and the emergency power protection system takes part in suppressing power flash-ups.

Because of a delay in the circulation loop for the first 30 to 35 sec, the enthalpy in the inlet does not depend on the behavior of the pressure ~and the operation of the regulator for the water i level in separator drums.

With a negative reactivity effect with regard to s*eam content, turning on of the SAOR is accompanied by the addition of posi-tive reactivity and involves a power flash-up. If a < 0, then, on the other hand, the first reaction to turning on ,of the SAOR is a power dip. The automatic power regulation system tries to

compensate the reactivity disturbance and to maintain the power at a specific level. Following the flash-up, the drop in the rate of flow from the SAOR requires from the power regulation system a sharp response in the opposite direction.

Thus, with a,< 0 the leading edge of the SAOR discharge pulse is potentially dangerous, and with a, < 0 the discharge drop following the first flash-up leads to a power surge. It was established in the process of calculations that potentially dangerous situations arise in the triggaring of the SAOR. This

' situation is caused by the response of the AR system, and negative reactivity disturbances which are asymmetric with respect to the halves of the reactor.

The Soviet analysis was conducted for the following conditions:

3-24

4 (1) AR system only, without taking into account the operation of the AZM and disbalance interlocking (2) LAR-LAZ system only, without taking into account,the operation of the AZM and disbalance interlocking (3) AR system with the assistance of the AZM (scram system), but without '

, _disbalance interlocking.

f (4) LAR-LAZ system with the assistance of the AZM (scram system), but without disbalance interlocking In the first two conditions,' power flash-ups were as high as 140-150% power from an-initial 100% power condition. In the second two conditions, the scram system helped suppress the flash-ups, but only operated until power was restored below

.the triggering setpoint. Other rods (AR or LAR-LAZ) were ' adjusted to maintain full power conditions while the AZM system was operating.

- Other tests were run which included disbalance interlocking. This interlocking

^ caused a full reactor shutdown in 30-40 seconds because of the power imbalance.

.The interlock prevents AR and LAR-LAZ rods from being pulled out to compensate

for the partial insertion of scram rods.

The study concluded that the transients were acceptable. The option of main-taining power -(primarily with the LAR-LAZ system) was judged the best option i for maintaining full power operation during inadvertent ECCS initiations.

3.2.6.3 Materials Problems i

Early problems were reported with the transition weld between zirconium pres-i sure tubes and the stainless steel inlet and outlet piping. Welding technology was improved, and those transition welds are now designed to withstand limited temperature transients (up to 15*C per hour).

4 The reliability of fuel-assembly construction has been increased. Based on the results of the startup adjustment operations, experimental investigations, and 1-operating experience, some changes in the construction of the individual reactor subassemblies and the equipment of the circulation loop have been introduced.

j

' A 1981 Soviet report (Sidorenko, 1981) discussed improvements in quality con-trol:

At the present time engineering standards requirements are being worked out for all pieces of equipment which are important for safety. A component of this problem is the development of scienti-fically substantiated intervals between inspections for each class of t equipment. Another problem is that of developing methods of conti-

[' nuous or quasi-continuous monitoring of equipment (acoustic and i

neutron noise, stress waves, etc.). The development and introduction of such methods to'the full extent will make it possible to go over to a qualitatively new level of monitoring during operation and may possibly lead to a review of equipment failure taken into account in atomic power plant projects today.

3-25

~_ . _ _ - _ _ _ _ _ _ _ _ _ _ __ _ _ _ . _ _ _ _ _ _ _ . . _ _ , _ _ _ _ . _ _ _ _ . _ _ _ _

3.2.6.4 Steam Separator Problems A 1984 Soviet report (Novosel'skii) discussed the change in steam separator diameter from 2.3 m to 2.6 m (N7.5 ft to 8.5 ft). This change provided addi-tional operating margin between high levels (that could result in moisture carryover to the turbines) and low levels (that could allow cavitation of re-circulation pumps on loss of feedwater on pipe breaks). Increasing the steam separator diameter permitted more time to respond to transient conditions and provided additional system inventory during various transients and accidents.

Also, the pipelines of the steam-water communications were being redesigned, the steam pipes in the space of the separator rooms were being rearranged, and optimal shimming of the steam-discharge fittings of the separators had been introduced for equalization of the steam loads and elimination of misalignments of the levels lengthwise and between adjacent separators.

Finally, improvements were made in the automatic control system for maintaining steam separator pressure and level. The structure of the regulation system as well as hardware was improved.

3.2.7 Soviet Use of Probabilistic Analysis Techniques The following information is taken from a 1983 Soviet report (Sidorenko):

In the early period of the development of the Soviet atomic power industry, the formulation of safety requirements was characterized by purely intuitive and engineering approaches. At the present time the quantitative-probabilistic approach is increasingly becoming the basis. The studies being developed and expanded in the Soviet Union on quantitative probabilistic analysis are directed primarily toward these goals. The elaboration of additional safety requirements for atomic heating plants has been based in great measure on the quantitative-probabilistic approach.

For reliable application of quantitative probabilistic analysis of safety in the design stage, it is necessary to have the pertinent statistical data. Such data can be obtained in sufficient number for most natural phenomena. However, statistical data about the relia-bility of specific equipment used in the atomic industry are limited at this time. This, in the main, is responsible for the determinis-tic approach in the design / construction / operation stage. Certain elements of the quantitative probabilistic approach, however, do exist here and they are laid out in the standards-technical documents.

As a rule, the parameters of the natural phenomena taken into account in the design are chosen on the basis of a quantitative-probabilistic analysis. For example, the design for the construction of an atomic power plant makes provision for an earthquake with an average recurrence period of up to 100 years, and the maximum design earth-quake is assumed to have parameters which, according to the calcu-lations, have a probability of 10 4 yr 1 The choice of the design values for the wind, snow, and other loads when taking the meteor-ology into account is also based on statistical data. (Some reports 3-26

attribute greater protection against natural phenomena such as earth-quake to.the VVER (PWR)' design than to the REMK design.)

There are direct indications for the~use of the quantitative-probabilistic approach during designing of power plant equipment and systems. Thus, the " General Regulations" envisage a' quantitative analysis of_the reliability of the systems, which leads to a search

~for'the most. reliable schemes, quantitative analysis of the proba-bility.of damage to the equipment, and realization of various failure situations considered in the design stage. Special procedures have

' been developed for 'these purposes. In addition to the postulated failures, the atomic power plant design may not take account of fail-

~

ures of systems'(elements) whose reliability is fairly high according to estimates.

As statistical data are accumulated and the pertinent methods are l' approved, the domain of application of the quantitative probabilistic approach in the process of APP designing and monitoring on the part of the supervisory organs will grow.

3.3 Independent Safety Review l This section presents an independent safety review of various transients on the RBMK-1000 reactor plant. It reviews a broad range of credible accident ini-tiators, utilizing a consistent format. The organization of the transients and accident initiators considered in this section is patterned generally after

~ Western approaches.

Computer models of the RBMK-1000 have been developed. Quantitative analysis has been performed for the sequences of greatest relevance to the accident. Through the use of analytic modeling techniques, valuable insight was developed concern-ing the specific behavior of RBMK-1000 reactors during a Chernobyl-type accident sequence, and about the characteristics of RBMK-type reactors. One set of anal-yses was performed using computer codes and models that have been developed under DOE and NRC research programs for analysis of LWRs and fast reactors. Safety analysis packages integrating neutronics with thermal-hydraulic and structural response were used by a team from Argonne National Laboratory, Brookhaven Na-tional Laboratory, Oak Ridge National Laboratory, and Pacific Northwest Labora-tory. These analyses succeeded in modeling the behavior of the accident. These results are reported separately in DOE-NE-0076, " Report of the U.S. Department of Energy's Team Analyses of the Chernobyl-4 AES Accident Sequences." Another set of Chernobyl analyses is in progress at EPRI.

Most of the information contained in this section comes directly from Soviet re-ports or can be inferred from information provided by the Soviets. For example, an RBMK transient that involves an increase in core voiding will result in a power increase by virtue of the positive void coefficient. Conclusions are avoided when the outcome of a particular transient is not obvious based on first principles, or the conclusion is speculative. Quantitative results are not presented because models, design details, and plant data on RBMK reactors are insufficient to permit quantitative analysis of transient response. Success criteria also are qualitative: Sequences that are expected to approach signif-icant fuel damage, and sequences with the potential to overstress, bypass, or cause significant damage to the partial containment and/or pressure suppression i

systems are considered unacceptable.

3-27

i-

?

-Most sequences are considered from an initial. normal full-power (100%) condi- ,

-tion.- In addition, any sequence for which the outcome might be significantly different or potentially more severe in a low power condition is considered at i' :both full power (100%) and low power (typically 10-20%). The degree of average fuel burnup or." core life" assumed for most of these analyses is equivalent to that for Chernobyl Unit 4 at the time of the accident (about two effective full-

~

. power years, or about 10 GwD/t burnup).

Transient and accident sequences are categorized by their initiating cause via

.the process variable whose change may have a deleterious effect on the nuclear fuel. Each postulated initiating incident is assigned to one of the following seven categories:

(1) Transients involving increases in heat removal. This category of over-cooling events includes, among other things, increased steam flow tran-sients. Increased steam flow causes increased voiding in the channels l '

and thus increases reactivity and power, which could threaten fuel cladding from overheating.

(2) Transients involving decreases in heat removal. This category of under-4 cooling events is primarily composed of loss-of-heat-sink events. These

[ events lead to increased temperatures and pressures, and typically reduce channel voids, thus adding negative reactivity. However, these events present a threat to fuel integrity if heat removal cannot be restored.

)

(3) Transients involving' increases in reactor flow rate. This category in-cludes transients involving increases in recirculation flow rate, including credible reactor inlet temperature changes (and resulting reactivity changes) as a result of_the increased recirculation flow. These events j typically involve an initial improvement in power-to-flow ratio, and thus less voiding.

(4) Transients involving decreases in reactor flow rate. This category in-eludes transients involving decreases in recirculation flow rate, primarily due to losses of main circulating pumps (MCPS). These events typically in-l volve an initial degradation in power-to-flow ratio and thus fuel element heatup and increased voiding.

(5) Transients involving reactivity and power distribution anomalies. This category of events includes a variety of control rod withdrawal events, control failures, reactivity imbalances, etc. This category is primarily a result of errors in the positioning of control' rods or fuel, and I includes errors in on-line refueling.

(6) Transients involving increases in coolant inventory. This category in-cludes events that might increase total coolant inventory to the point l

that excessive steam separator water levels occurred, which could threaten the turbine generators with turbine blade damage from water entrainment in the steam system. Since the RBMK is a boiling water reactor, these events will generally not result in increased system pressure.

l (7) Transients involving decreases in RCS inventory. This category includes all events that decrease coolant inventory (i.e., loss of steam separator level), other than excessive steam demand events. This category primarily 3-28

consists of a range of credible loss-of-coolant accidents from small to large breaks.

The transients covered in this section are listed below, grouped in accordance with the above categorization scheme:

-(l) Increases in Heat Removal Main steamline break (from full power and low power)*

Stuck-open safety relief valve (for multiple stuck open SRVs**)

Excessive steam demands from full and low power (steam pressure regulator failed open or rapid turbine generator loading; turbine bypass failed open)**

Loss of feedwater heaters or other reductions in feedwater temperature Inadvertent initiation of decay heat removal (2) Decreases in Heat Removal Single turbine generator trip; partial load rejections Simultaneous trip of both turbine generators Turbine generator trip (s) without bypass Loss of feedwater Loss of offsite power Station blackout (loss of all offsite and onsite ac power)**

Losc of decay heat removal (3) Increases in Reactor Flowrate Startup of an idle main circulating pump (MCP)

MCP startup with idle coolant pump branches at abnormal temperature (4) Decreases in Reactor Flowrate Single MCP trip from full power Loss of all forced MCP flow from full power, low power MCP throttle valve flow control failure (failed shut)

MCP seizure **

MCP shaft break **

Complete loss of flow in one channel (flow blockage, inlet isolation valve shutoff)*

(5) Reactivity and Power Distribution Anomalies Continuous rod withdrawal accident - single rod (full power and low power)

I

• These transients are not discussed in the Soviet literature and are judged to be beyond the design capabilities of the plant or beyond the design capabil-ities of the plant or beyond the ability of operators to control.

• • These transients appear to present a difficult challenge to the plant. Prompt operator action (within a few minutes) is necessary.

3-29

t

- Continuous rod withdrawal accident - rod banks (full power and low power)*

- Miscellaneous control rod withdrawal errors and misoperation**

- Refueling errors including improper fuel placement (e.g., improper enrichment)**

- Rod drop out bottom of reactor (short absorber rods only)* or **

- Loss of inventory in control rod cooling system (6) Increases in RCS Inventory Inadvertent ECCS actuation **

Excessive feedwater flow (7) Decreases in RCS Inventory

- Large-break LOCA of recirculation pipe (MCP outlet)

- Large-break LOCA of group distribution header

- Large-break LOCA of steam separator downcomer or MCP suction header

- Main feedwater pipe break **

Small break in channel inlet line (* or ** for certain break size)

- Small break in channel outlet line or refueling connection

• or **

• Pressure tube ruptures inside reactor vault (graphite region)* or **

3.3.1 Other RBMK-1000 Safety Reviews This particular approach to safety review is not the only acceptable approach.

Other organizations in the United States and overseas have used different for-mats for RBMK-1000 safety review. The U.S. Department of Energy's team analysis of the accident sequence provided that team with the opportunity to develop an understanding of RBMK safety characteristics. The U.S. nuclear industry has developed a position paper on the Chernobyl accident that summarizes some of the more important design characteristics of the RBMK reactor. The IAEA and NEA also have conducted safety reviews of the accident and reported their results.

3.3.2 Recurring Elements of RBKK-1000 Safety Analysis A number of reactor core phenomena, potential failure modes, and other elements of RBMK-1000 safety analysis recur frequently in the individual transient anal-yses. These elements are summarized in this section to avoid repetition in indi-vidual transient analysis sections.

3.3.2.1 Graphite In the RBMK-1000 design, the graphite moderator heat is removed by conduction heat transfer to the fuel channels during normal operation. The heat generated

• These transients are not discussed in the Soviet literature and are judged to be beyond the design capabilities of the plant or beyond the design capabil-ities of the plant or beyond the ability of operators to control.

• • These transients appear to present a difficult challenge to the plant. Prompt operator action (within a few minutes) is necessary.

3-30

. ~ .- - - . . - . . - - . . .

in the graphite during normal full power operation due to neutron moderation is approximately 5.5% of the core power, or 176 MWt. The graphite normally oper-ates at a temperature in the range of 600-650*C, with a maximum temperature of 750*C. Thus, following an accident, in addition to decay heat, there is a sig-nificant quantity of stored heat in the graphite which must be removed. Even when an event commences from low power, stored heat in the graphite is still high, despite the lower neutron flux in the graphite. At low power, primary flow is reduced to maintain proper steam quality, so heat removal from graphite to coolant in the pressure tubes is reduced accordingly. Also, at low power i the helium-nitrogen cover gas is changed to a nitrogen-only cover gas with much poorer heat transfer properties.

The graphite moderator has the potential for graphite-steam reactions and graphite-air (oddation) reactions. The graphite-steam reaction is a high-temperature endothermic reaction that produces hydrogen and carbon monoxide

(" coal gas" or " rater gas"). The high-temperature graphite-air oxidation reaction is highly exothermic, but requires very high temperatures and large amounts of oxygen to get started. Provisions are made in the RBMK design for exclusion of air from the graphite by means of the helium-nitrogen cover gas in the reactor vault area. The cover gas is monitored for water and steam during normal operation. The presence of excessive moisture in the cover gas during normal operation can result in depletion of the graphite beyond the design basis, thus increasing the thermal conductivity gap resistance for heat transfer from the graphite to the fuel channel coolant. No provisions are evident in the design of the RBMK-1000 reactor to mitigate the potential con-4 sequences of flammable gas production as a result of an accident involving graphite reactions.

The dimensional stability of the graphite in the presence of high neutron fluences is an important design issue. A British review of the RBMK reactor 1

(NNC, 1976) reported that dimensional changes on the order of 12% may occur during reactor operation with high quality graphite. Lower quality graphite would be expected to experience greater dimensional changes. The dimensional changes are important to safety because the ability to transfer the heat generated in the graphite to the fuel channel coolant must not be degraded by

! alignment problems. Changes in the dimensions of the graphite may result in increased gaps in the graphite interfaces which represent a barrier to con-ductive heat transfer. This barrier would cause localized increases in graphite temperature which may lead to a greater rate of depletion of the graphite during normal operation; this could result in even greater conductive heat transfer l resistances. These higher temperatures can contribute to greater rates of hydrogen and carbon monoxide production following an accident which admits steam to the graphite in the reactor vault.

The close-packed design of the graphite pile and the pressure-retaining ability of the reactor vault create problems in the event of one or more pressure tube ruptures. The reactor vault has very little free volume, a small-capacity gas treatment system and limited relief capacity. Therefore, in accidents which

release large volumes of gas or steam into the graphite region under pressure, l there is a potential for graphite blocks to be damaged, for the graphite pile

to be " blown apart," and for the pressure boundary to fail.

3-31 l

{

O 3.3.2.2 Zircalloy Reactions In the RBHK-1000 design, the fuel rod cladding and the channel tubes employ zirconium-niobium alloys ("zircalloy"). These metals, when exposed to steam or water at high temperatures, undergo an exothermic reaction and produce hydrogen and metal oxides. This reaction's rate is an exponential function of tempera-ture, and begins at approximately 1150 C. Following a loss-of-core-cooling event it is anticipated that zircalloy-water reactions would originate in the zircalloy fuel rod cladding because of the heatup of the cladding by the decay heat from the fuel pellets. Zircalloy-water reactions in the fuel channel pressure boundary could then occur because of the heatup of the fuel channel material by radiation heat transfer from the fuel rods (5 mm away), or by hav-ing fuel rods slump against the pressure tube. The zircalloy-water reaction would be limited by the availability of both water and zirconium. The water inventory in the core can be depleted before all the zirconium reacts. This situation (limiting total hydrogen production by starving the reaction of water) may have occurred in the Chernobyl accident.

3.3.2.3 Zirconium-Niobium Pressure Tube Strength The pressure tubes inside the reactor vault area are constructed of 97.5%

zirconium and 2.5% niobium. In the event of a loss-of-core cooling event, the pressure tube temperature would begin to increase immediately from the steam-water saturation temperature of approximately 285*C to the graphite operating temperature of 600-650 C. Additionally, radiation heat from the nearby fuel rods as they also begin a heatup transient would raise the temperature of the zirconium pressure tubes to even higher temperatures. The passage of super-heated steam through the pressure tube during this time period would have a slight cooling effect on the pressure tube inner surface.

Zirconium-niobium alloys have little strength above 750*C. In the event of a loss of cooling, it is expected that the pressure tubes would fail within the graphite vault area because of the combination of normal pressures (70 bars) and elevated temperatures. The loss of cooling to several pressure tubes would result in the rapid overpressurization of the reactor vault since the vault rupture discs are designed to accommodate the rupture of only one pressure tube in the reactor. The overpressurization and rupture of the vault due to steam addition would result in the admission of air to the graphite. If temperatures are sufficiently high, an exothermic air-graphite oxidation reaction could result.

Thus loss of cooling to several fuel channels could result in a severe accident condition if core cooling is not re-established within a very short time period.

As mentioned in Section 3.2.6.3, various Soviet reports have discussed the dif-ficulty in creating a strong transition weld between stainless steel and zirc-alloy. A transition diffusion weld is used at the top and bottom of the fueled portion of each pressure tube inside the reactor vault. The weld is designed to handle temperature changes up to 15*C per hour. Many metallurgical experts consider this weld to be the weakest point in the RBHK primary system. The Soviets discussed problems with this weld in the 1970s, but later reported the problem solved.

3-32

l 1

3.3.3 Transients Involving Increases in' Heat Removal This category of overcooling events includes, among other things, increased steam flow transients. Increased steam flow causes increased voiding in the channels and thus increases reactivity and power, which could threaten fuel cladding be-cause of overheating.

'3.3.3.1 Main Steamline Break This accident is not discussed in any Soviet literature. The rupture of.a main steamline in an RBMK-1000 reactor would be an unisolable loss-of-coolant acci--

f. dent that bypasses the suppression pool. The rapid steam demand would result .

in voiding in one-half of the core. This voiding would cause a power surge and l

fuel heatup transient in the affected half of the reactor, driven by the posi-tive void coefficient. The pressure drop would cause bulk boiling in the primary loop, necessitating the loss of forced circulation. The pressure drop also would interrupt natural circulation flow and exacerbate core cooling problem (see Turetskiy, 1984).

Since.the' steam separators are not in one of the accident localization system (ALS) strong boxes, there would be no ALS pressurization signal to actuate the

' ECC systems (the ECC logic must see simultaneous loss of steam separator level and ALS pressurization in order to open the ECC injection valves). The failure

to' inject colder ECC water at this point would allow the channel voiding to con-

" tinue and the neutron power to continue to rise from positive void reactivity.

Without protective action, this uncontrolled reactivity excursion would continue i

until very high fuel temperatures added sufficient negative reactivity from the fuel reactivity coefficient to stop the power rise. Extensive CHF violations I would be likely. It is possible that manual or automatic start of emergency feedwater would occur, but this provides 10% of full feed flow, not enough to control the power excursion or handle the inventory makeup demands of a main steamline break.

j The steam ~ released from a main steamline break in either steam separator room i would fill the space above the upper biological shield, and below the shield blocks' covering the pressure tube refueling connections. Steam would escape to the refueling floor via the gaps between the shield blocks. The steam would ,

1 impinge on control rod drive mechanisms and could damage the control rod drive

! motors sufficiently to prevent operation. If steam blowdown is rapid, some

shield blocks could be ejected off the floor.

Since emergency shutdown setpoints are established on the basis of recircula-tion pipe breaks instead of steamline pipe breaks, it is not clear which set-point will initiate a reactor shutdown or power reduction, or how long it will take. Since the loss of coolant is in the form of steam instead of water, the

. rate of water level drop in the affected steam separator (s) would be slower than in the case of a recirculation pipe break. Without detailed information on scram setpoints, it is difficult to predict the means of scram. It appears that if the event starts from high power, the scram would occur on high neutron flux. However, if the event started at low power, the low steam separator water level setpoint might be reached before the high neutron flux setpoint.

A main steamline break from low power appears to be worse than an equivalent accident at high power for four reasons. First, the magnitude of the positive 3-33

void coefficient is much larger at low power, which leads to a more severe reactivity excursion. Second, at low power, the transient proceeds for a longer period of time before automatic protective action would begin to reverse the positive reactivity excursion. Third, recirculation flow is reduced by turning off selected MCPS and throttling MCP flow to maintain the desired channel exit steam quality. The RBMK design does not appear to be equipped with the capa-bility to increase recirculation flow quickly in response to rapid steam demand or power increases. Steamline breaks at low power would create a severe power-to-flow mismatch that would permit extensive fuel overheating before automatic protective action. At high power, an automatic scram would be initiated before severe poverto-flow mismatch would occur. Fourth, nuclear instrumentation has limitations in accuracy and response time at low power, again permitting the event to progress rapidly before instrumentation detects a problem.

A review of the Soviet literature indicates that the RBMK-1000 plant is not equipped with main steam isolation valves or main steam check valves. This means that a main steamline break is unisolable; and that because of cross-connections between steam separators and apparent steamline cross-connections to both turbine generators, a single main steamline break will probably lead to the blowdown of all four steam separators. It is possible that some steamline break locations (e.g., in the turbine hall) are isolable, or at least can be partially isolated so that all four steam separators do not blow down. However, blowdown of only the steam separators on one side of the reactor, with no auto-matic protective action, would lead to severe power excursions and left-half /

right-half power oscillations. The available Soviet reports provide very limited information on the RBMK main steam system design, valve placement, and normal lineups.

Indications available in the control room include a loss of steam separator level, an initial decrease in steam pressure and outlet feeder tube temperature, and an increase in steam quality and neutron flux. Immediate actions would be required by the operator, who must manually scram the reactor if an automatic scram does not occur, and initiate EFW and ECC injection. This accident could result in a rapid power excursion and rapid fuel heatup before a scram would occur.

Since the break flow and ECC flow would be directed to the steam separator area, the turbine hall, or connecting pipe rooms, none of which are connected to the suppression pool, long-term recirculation cooling of the core with suppression pool water would not be possible. This appears to be a safety issue not addressed by the design of the plant.

3.3.3.2 Stuck-Open Safety Relief Valve A stuck-open safety relief valve (SRV) is an unisolable steam discharge similar in some respects to a small steamline break. The plant response would be simi-lar to that discussed above for a steamline break, with a few important excep-tions. First, severity would probably be less because the size of the safety valve opening is less than the size of a main steamline break. Second, SRVs discharge to the suppression pool, so the questions of pressure suppression, offsite release, and availability of water for long-term cooling are not issues.

Third, most stuck-open SRV sequences would be initiated by other events (e.g.,

load rejection) that cause a reactor scram. Thus, the transient resulting from 3-34

}

a stuck-open SRV is bounded by a main steamline break transient, and prompt protective action is more likely.

A stuck-open steam safety valve is a condition that could occur after turbine trip or load rejection events from high power.' These events would require steam pressure relief via turbine bypass or SRVs. This SRV failure is analyzed and presented in Soviet literature (Turetskiy,1984) and is seen to inn a poten-

tial problem area, according to the Soviets.

A stuck-open relief valve would result in loss of inventory, increased channel voiding and reactivity, and eventual depressurization of the main circulating system. The event may not result in the actuation of the ECCS (discharge rate may be insufficient to actuate both low steam separator level and containment pressurization setpoints simultaneously). The likely initiating event (load rejection) would result in the tripping of the MCPS, main feedwater pumps (NFWPs), and the reactor. During the early phase of the 3-minute interval until emergency diesels can supply power to the emergency feedwater pumps, core cooling is assisted by pump coastdown of the MCPS and natural circulation. The effectiveness of cooling by natural circulation is affected by the rate of depressurization of the circulating loop. The Soviets have investigated this on a test loop and found that for relief rates greater than 0.2 MPa/ min, effec-

-tive cooling cannot be assured without restoring feedwater flow.

This event requires rapid operator response, but should be a benign event for the case of one stuck-open relief valve if feedwater is not lost; more than one stuck-open SRV could result in inadequate core cooling (see Turetskiy, 1984).

3.3.3.3 Excessive Steam Demands From Full Power and Low Power This event is very similar to the main steamline break accident and could be initiated if the steam pressure regulator failed open, if a turbine generator loaded rapidly, or if the turbine bypass valve failed open. Rapid depressuri-zation and channel voiding would result, causing a power excursion due to the positive void coefficient. A plant response as severe as the main steamline break would occur if the path for steam blowdown is large enough. However, some of these blowdown paths can be isolated, so this transient might be terminated earlier than the equivalent steamline break.

This event raises the same concerns for failure to achieve timely automatic protective action that were discussed for the main steamline break. Extensive CHF violations would be likely because of protective action delays, power-to-flow mismatch, and voiding. The potential exists for a significant power transient with no immediate scram, escalating into a serious transient that could result in significant fuel overheating. Prompt operator action is essen-tial in terminating this event, by atopping the steam blowdown if possible and by initiating a scram, EFW, and ECC injection. It is possible that even with prompt operator action, core damage could occur in this sequence.

As in the case of the main steamline break, this event would have more severe consequences if initiated from conditions of low power or low power-to-flow ratio.

3-35

_-______.__- ___ _ __._ _ - _ _ . ~___

l f

3.3 3.4 Loss of Feedwater Heaters or Other Reductions in Feedwater Temperature This overcooling transient is much less severe than those discussed above.

Reduced subcooling of MCP inlet may necessitate a power reduction, but fuel damage from this sequence is very unlikely.

3.3.3.5 Inadvertent Initiation of Decay Heat Removal (DHR)

This overcooling event is one that might occur if the RBMK-1000 design is vul-nerable to the inadvertent initiation of the shutdown decay heat removal system while the plant is operating at power. Not enough is known about DHR system design and operations to address this potential vulnerability.

3.3.4 Transients Involving Decreases in Heat Removal This category of undercooling events consists primarily of loss-of-heat-sink events. These events lead to increased temperatures and pressures, and typically will reduce channel voids, thus adding negative reactivity. However, these events present a threat to fuel integrity if heat removal cannot be restored.

3.3.4.1 Single Turbine Generator Trip, Partial Load Rejections The trip of one turbine generator results in the following automatic actions by the plant:

- decrease in plant power level to 50% at a rate of 4% per second

+ opening of steam dump or turbine bypass valves to relieve excess steam due to slow rod insertion and decay heat

- continued feedwater flow and main circulating pump flow to reactor Since onsite ac loads are normally powered by turbine generator output, it is likely that a loss of one turbine generator would cause a loss of about one-half of all onsite ac loads. (However, a single turbine trip may not cause the loss of sufficient numbers of MCPS (two or more in one loop) or MFWPs (loss of 50%

or more of feedwater flow) to cause an emergency shutdown. This indicates that some MCPS and MFWPs (at least one MFWP and one MCP per loop) might be powered from off site.

A normal trip of one turbine generator would require the regulation of the remaining feedwater flow and main circulation pump flow in order to reestablish the proper power-to-flow ratio, and thus maintain proper steam quality in the reactor outlet piping and adequate steam flow to the other turbine. Since the four steam separators appear to feed both turbines, the circulating flow to the reactor must be decreased quickly to a level supporting a 50% power level. It is not apparent from the Soviet literature how this is accomplished. One MCP supports 40% power, and two MCPS support 80% power. Therefore, if the turbine trip caused the loss of one MCP in each loop, flow would decrease to roughly 80%. The remaining MCP flow from two MCPS in each loop would have to be throt-tied rapidly to 50% flow to match the new 50% power level. Without this de-crease in recirculation flow rate, voids would collapse, and steam quality would fall, resulting in a decrease in steam production. This condition would 3-36

A

. add negative reactivity and further decrease voids. Thus,'the tripping of one turbine could result in a trip _of the second because.of low steam flow.

This event. is a design-basis transient for the RBMK reactor, and should not be a safety problem if systems respond as designed.

. 3'.3.4.2 Simultaneous Trip of Both-Turbine Generators, Full Load Rejection >

Load rejection is defined as the dropping of the plant external load by.the' unit turbine generators.

Tripping both turbine generators results in the following automatic actions by the. plant:

reactor trip (under most conditions) ,

+ start of emergency diesel generators (probable)

As discussed above in Section 3.3.4.1, onsite ac loads are normally powered by turbine generator output. Therefore, a trip of both turbine generators would cause a temporary loss of all onsite ac loads, and should initiate the start of all emergency diesel generators, so that emergency ac loads, such as emergency feedwater pumps, can be operated (after 3 minutes). It is likely that a trip of both turbine generators would cause a loss of all MCPS and a loss of all feedwater.

The AZ-3 automatic power reduction setpoint discussed in Section 2.6.8 (reduc-tion to 20% of rated power instead of emergency shutdown " scram") occurs when-two turbine generators drop off the grid and internal power is left on, i.e. ,

load rejection.

The loss of both turbine generators will result in a large reduction in steam flow, a steam pressure increase, and steam void collapse. Steam dumps, turbine bypass valves, and safety relief valves (SRVs) will open to relieve pressure.

Turbine bypass may not be available in this event, since it is likely that-the main condenser would be lost following a loss of all onsite power. The SRVs would relieve to the suppression pool at a very high rate. This event probably defines the maximum SRV relief capacity. Although the RBMK reactor may not have a large turbine bypass capacity, the Soviet report on the Chernobyl acci- ,

dent (USSR, 1986) states the RBMK-1000 reactor is provided with adequate SRV '

capacity'to handle a full load rejection. It is also likely that this event was considered in the design of suppression pool cooling systems.

If all MCPS were lost, natural circulation would be established during the MCP coastdown period, in about 30 seconds. Sufficient cooling of the core can be accomplished by natural circulation and inventory addition by emergency feed-water actuation.

System pressure would remain at or slightly above normal operating conditions throughout the initial portion of the transient (until emergency feedwater flow is' established) but steam separator levels would fall during this time period as inventory loss through the steam dump and SRVs would not be replaced. The level in the steam separators probably would not be depleted in the first 3 minutes before emergency feedwater injection.

3-37

This event is a design-basis transient for the RMBK reactor, and should not be a safety problem if systems respond as designed.

3.3.4.3 Turbine Generator Trip (s) Without Bypass This event is similar to the single or simultaneous turbine trips discussed above. The RBMK combined safety relief valve capacity appears to be large enough to handle a full load rejection if turbine bypass fails to operate.

3.3.4.4 Loss of Feedwater The loss-of-feedwater event is a design-basis transient in which either a partial loss of normal feedwater or a complete loss of normal feedwater is postulated. For the case of a loss of one out of four main feedwater pumps (MFWPs), conflicting information exists in Soviet literature on the existence of automatic protection. Some Soviet references suggest that following the loss of one MFWP, the decreased flow to the steam separators is sensed, and the turbine power output and reactor power is automatically decreased to either 50%

or 60% of normal full power. If this automatic power reduction is not provided, then the loss of a single MFWP (if unnoticed) probably would lead to an auto-metic shutdown (scram) on low water level in one or more steam separators.

For the case of a loss of 50% or more of main feedwater flow, the main circulat-ing pumps (MCPS) are automatically tripped in the affected loop. This trip is required in order to avoid cavitation of the MCP suction due to loss of sub-cooled feedwater. Pump cavitation could damage the MCPS, and might interfere with the establishment of natural circulation for long-term cooling of the reactor, if MCP discharge loop seals fill with steam or gases out of solution.

The loss of 50% feedwater flow also results in a reactor scram signal and the initiation of the emergency feedwater system to provide feedwater flow to the affected steam separators. Long-term cooling of the reactor is via natural circulation. Natural circulation is aided by the bypass line around the main circulating pumps.

For the case of a complete loss of normal feedwater flow, the automatic plant response is very similar to the " loss of 50% of feedwater flow" case. The initiation of reactor scram and MCP trip, and the startup of the emergency feedwater pumps is performed automatically. Following the scram, steam pres-sure will be relieved via safety valves to the suppression pool. Feedwater must be supplied to provide adequate core cooling. If a safety valve sticks open, the depressurization can interrupt natural circulation cooling of the core.

This event is listed in many Soviet reports as a design-basis transient. The event appears to be capable of being mitigated by the automatic actuation of emergency systems, but would require immediate operator action, if a safety valve stuck open or auxiliary feedwater did not start.

3.3.4.5 Loss of Offsite Power This event is very similar to a simultaneous turbine trip or full-load-rejection event. Onsite ac power ldads are normally powered from the turbine generator output, instead of from a transformer powered from the grid. The loss of off-site power would not normally cause the loss of onsite loads directly, but j 3-38

t could initiate a load rejection which could in turn drop all onsite loads as a result of the turbine trips.

If turbine generators can handle a load rejection transient without dropping onsite ac loads, then reactor power is' reduced automatically to 20%. If.onsite power is lost (turbine generators trip), the reactor would scram automatically.

All main circulating pumps, all feedwater pumps, and condenser vacuum would be lost. .The emergency diesel generators will start and supply power to the emergency feedwater pumps within about 3 minutes. Natural circulation will be 4 established following the MCP coastdown period of about 30 seconds. System 4

pressure will increase because of the decreased heat removal, causing turbine i

- bypass actuation. Safety relief valves (SRVs) will actuate if initial power i- level evreeds bypass capacity. SRVs relieve steam to the suppression pool, where it will be condensed and remain available for continued long-term cooling.

As previously discussed in Sections 3.3.4.1 and 3.3.4.2. it is possible that some onsite ac loads may be powered from off site via an auxiliary transformer.

If so, the most likely loads would be one MCP from each loop, and at least one MFWP. In this situation, one might define " loss of offsite power" (LOSP) dif-i ferently, considering LOSP to be only the loss of offsite power to onsite loads (via an auxiliary transformer). With that definition, a LOSP would not cause a load rejection or turbine trip, but instead would cause the loss of the suggested one MCP per loop, and one or two MFWPs. In this case, the plant response would be similar to a single turbine trip, with a power reduction to 60% or as low as

50% power.

The event appears to be addressed by the automatic actuation of emergency sys-l tems and does not require immediate operator action.

4 3.3.4.6 Station Blackout

• The loss of all station ac power results in immediate plant behavior similar to that for the loss of offsite ac power. However in thic event, the electri-cally driven emergency feedwater pumps and ECC pumps are not available because 1

of the failure of the diesel generator units. With no makeup water to the >

primary system, inventory will be lost via SRVs. Natural circulation will con-l tinue at least until the primary circuit reaches bulk boiling. Adequate core l cooling via degraded natural circulation may continue as long as there is ade-quate water in the steam separators. The time to exhaust the steam separator

- water inventory is a function of initial power level, and assumed values of RBMK decay heat and graphite sensible heat. After steam separators are empty, i

natural circulation cooling of the core is lost. However, assuming electrical l power still has not been restored, decay heat removal can continue for another short period of time in a " percolating" mode. Boiling continues as long as water exists in the core region. Water in the steam separator downconers at an equivalent elevation will flow into the core region via recirculation piping in ,

a " manometer mode". When system water inventory is depleted to a level near the midpoint of the core, steam cooling of the upper core region will no longer be adequate, and the reactor fuel elements would begin to dry out and undergo r heatup. Fuel temperatures exceeding the fuel design temperature under accident i conditions of 1200*C can be expected.

4

• Loss of all offsite and onsite ac power.

j 3-39

. - - - , -..----.---------ne--n- ~ ~.n -~ . ~ - - - - - - - - - - - , - - - - - - - - - - - - - - - , - - . , . ~ . - - ,.. --,%-,. --

An important safety concern is the possibility of a return to criticality be-cause of core boiloff and the positive moderator characteristics of the reactor.

One Soviet textbook (Dollezhal, 1980) indicates in general terms that adequate control rod shutdown margin exists in a completely voided core.

The RBMK plant is not equipped with any steam-driven feedwater pumps or injec-tion pumps to prevent this sequence from leading to fuel damage when water inventory is depleted.

This event is capable of causing core damage if ac power cannot be restored from either onsite or offsite sources.

3.3.4.7 Loss of Decay Heat Removal (DHR)

This event could cause fuel damage if long-term shutdown decay heat removal systems are lost for a sufficient period of time. Few details are known about RBMK long-term DHR systems, and this postulated event represents different initial plant conditions than those in effect at the time of the accident.

3.3.5 Transients Involving Increases in Reactor Flow Rate This category includes transients involving increases in recirculation flow rate, including credible reactor inlet temperature changes (and resulting reac-tivity changes) as a result of the increased recirculation flow. These events typically involve an initial improvement in power-to-flow ratio, and thus less voiding.

3.3.5.1 Startup of an Idle Main Circulating Pump (MCP)

This event will increase total core flow and reduce channel voids, adding some negative reactivity. An idle pump would typically be started up to support higher power demands. The pump start would then be followed by increased demand for steam flow, which would restore normal channel voids and exit steam quality to its previous value.

Controlling large swings in void fraction and exit steam quality following MCP startup appears to be done by throttling MCP flow to maintain a consistent power-to-flow ratio. For example, operators might have procedures (or even pump i starting interlocks) that require the discharge throttle valve on each MCP to be shut before pump start. The throttle valve could then be opened at a suffi-ciently slow rate to balance the flev increase with increased steam demand, thus avoiding swings in reactivity. From the Soviet literature, we have no indication that this procedure is followed, and no indication that the MCP throttle valve is designed for this use. On the other hand, we have no indi-cation that MCP startup has created any operational problems.

This transient is part of the normal anticipated operating requirements of the plant on ascension to full power, and should not be a safety problem if systems respond as designed.

3.3.5.2 MCP Startup With Idle Coolant Pump Branches at Abnormal Temperature l Even if an idle pump branch were allowed to cool down slightly, it is unlikely l that any core reactivity problems would result from pump start because the RBMK l

l 3-40

reactor does not have a large negative temperature coefficient that could create a reactivity excursion from injecting colder water into the core. In-jecting hotter water into the core would increase voids and~ add reactivity, but this situation is considered very improbable, especially since it is unlikely that large temperature increases could originate outside the core of a boiling water reactor.

It appears the largest temperature excursion from idle coolant could occur if an individual pump branch could be isolated and cooled down for maintenance while the reactor remains in operation. If that cold pump branch were uniso-lated and restarted suddenly without rewarming, a sudden slug of cold water would be injected into the reactor. This event would cause a large negative reactivity insertion, and could initiate power oscillations similar to an inadvertent safety injection, as described in Section 3.2.6.2. It also would cause a severe thermal transient on the temperature-sensitive transition welds at the bottom of the zirconium pressure tubes.

3.3.6 Transients Involving Decreases in Reactor Flow Rate This category includes transients involving decreases in recirculation flow rate, primarily due to losses of main circulating pumps (MCPS). These events typically involve an initial degradation in power-to-flow ratio and thus fuel element heatup and increased voiding.

3.3.6.1 Single MCP Trip From Full Power This event is a design-basis transient for the RBMK-1000 reactor and initiates an automatic power runback to 60% and a trip of a single pump in the opposite loop. This event is handled by the automatic actuation of safety systems, and does not appear to require any immediate operator action.

3.3.6.2 Loss of All Forced MCP Flow From Full Power, Low Power This event would progress much the same as a turbine trip or loss of offsite power. It is unlikely that a total loss of flow would occur for reasons other than loss of offsite power, load rejection, or turbine trip. A total loss of forced MCP flow would result in an emergency shutdown (scram), and trip of both turbine generators. Core cooling would be provided initially by flow coastdown driven by the MCP flywheels. After about 30 seconds, natural circulation would take over as the primary means of decay heat removal. Turbine bypass valves would open to relieve excess pressure created by the loss of heat sink. At high power, safety relief valves (SRVs) would open to relieve this pressure to the suppression pool.

Failure to scram on total loss of flow would create an immediate boiling crisis because of the serious violation of balanced power-to-flow operation. It is likely that CHF violations would occur in all fuel channels, followed by over-

, heating, rapid voiding, further reactivity increases, and damage to fuel.

Since these effects would occur within seconds on loss of flow, the Soviets t

have focused much attention on this area. Very large MCP flywheels provide 4 good coastdown characteristics. Also, there is a quick-response reactor scram l signal based on sensing the loss of two or more circulating pumps in one loop (instead of requiring the detection of a loss of all MCPS or instead of depend-i ing on other signals such as turbine trip, to initiate the scram).

l l

l 3-41 1

- - _ _ . _ . - , - . . . _ ~ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ . _ _ . . . . , . - _ . . _ . . _ _ _ , - - . _ - - _ . - . . . - . . _ _ _ _ _ _ _ .

Since the automatic protection system will initiate a scram and turbine trip

( on loss of flow,~ this even can be considered to be a design-basis transient be-cause of its close similarity to the simultaneous turbine trip or loss-of-offsite power transient. Therefore, this transient appears to be mitigated by ,

the automatic actuation of safety systems, without immediate operator action.

i 3.3.6.3 MCP Throttle Valve Flow Control Failure (Failed Shut)

The inadvertent closure of one MCP discharge throttle valve would create a partial loss-of-flow event similar to a pump trip. It has the potential to be worse than a pump trip for two reasons. First, if the throttle valves are quick acting, their closure would halt flow rapidly without the advantage of the MCP coastdown. Second, if the loss-of-flow logic to the protection system only senses MCP operation, a throttle valve closure would go unrecognized, creating an adverse power-to-flow mismatch in one-half of the reactor. Excess voids and higher steam quality would be created in that half, adding positive reactivity. Flow from the remaining pumps would increase somewhat. Increased neutron flux would probably be detected, and control rods would be inserted to prevent CHF violations and fuel overheating. Operators would detect the valve i closure by valve position indication, pump flow or discharge pressure indica-

, tion, or excess reactor power or steam quality indications.

The automatic protection system, or alarms and indications to the operator, would result in a power reduction to 60%. Because of the similarity of this

transient to a single MCP trip event, it is likely that this event would not 4

present a safety problem.

3.3.6.4 MCP Seizure This event is similar to pump trip, except that flow coastdown would not occur.

Also, the RBMK loss-of-flow logic may not monitor actual flow rate, so automatic actions are uncertain. The effects of this event, if undetected, are discussed above in Section 3.3.6.3 (pump discharge throttle valve failure). Power should

be reduced to 60% in this event. If detected and responded to rapidly, it would not present a safety problem. If undetected, some fuel damage might occur.

3.3.6.5 MCP Shaft Break i

This event is similar to the MCP seizure discussed above. The same comments about flow coastdown and uncertainty about detection and automatic response l also apply to this event. Power should be reduced to 60% in this event. If detected and responded to rapidly, it would not present a safety problem. If undetected, some fuel damage might occur.

1 3.3.6.6 Complete Loss of Flow in One Channel

• The complete loss of cooling flow in one pressure tube could result from the closing of the manually operated inlet pressure tube regulating valve (which

! can be fully closed).

• Flow blockage, inlet isolation valve shutoff.

3-42

~ _ _ _ ~ _ _ _ - _ . _ _ _ . . - . _ _ - - _ _ _ _ _ _ _ - - - - , _ _ - . . _

1 The immediate impact would be the rapid dryout and heatup of the affected fuel channel'and a local power increase caused by the increased voiding. This power increase could propagate to other' fuel channels in the immediate matrix, I although not to the degree as in the affected channel. ,

Steam binding and counter-current flow limitations would prevent cooling of the

. affected channel from the steam separator. Soviet literature indicates that cooling in the " reverse (bubbling) mode" (planned shutoff of a pressure tube inlet on a shutdown reactor) during maintenance is only allowed after 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> of shutdown. Before this, decay heat levels are too high to permit effective cooling.

^

The incore instrumentation and automatic control systems for control rod posi- '

4 tioning may respond to this event by driving rods into the core in the vicinity of the affected channel in order to maintain the preset power level.

1 The event should be detected by the cladding leak detection system. The opera-tors should initiate a manual scram based on these indications.

Based on an adiabatic heatup at full power conditions, the time interval be-tween termination of flow and fuel cladding damage is measured in seconds. The fuel would reach melting temperatures within 1 minute. This time frame is very

short compared to the time that would be required for detection and possible manual actions to reopen the valve. (Even if the valve were reopened, severe fuel damage is likely to occur because of the sudden quenching.) Also, the severity of this event appears to be beyond the capability of local reactivity control systems to mitigate the local power excursion.

4 It is probable that this event would result in fuel damage in the affected 4 channel.. Extensive fuel melting would probably cause a rupture of the affected pressure tube, and a single pressure-tube LOCA into the graphite region. Adja-t cent tubes could be adversely affected by the heatup and local reactivity excur-sion. Escaping steam and hydrogen from a ruptured tube could damage adjacent

! graphite. Additional pressure-tube ruptures are possible as these effects prop-agate. Multiple tube ruptures are beyond the design capability of the reactor vault and would eventually cause the vault pressure boundary to fail.

This event is beyond the design basis of the plant and would likely cause severe damage to the reactor.

3.3.7 Transients Involving Reactivity and Power Distribution Anomalies This category of events includes a variety of control rod withdrawal events, control failures, reactivity imbalances, etc. This category is primarily dedicated to errors in the positioning of control rods or fuel, and includes errors in on-line refueling.

! 3.3.7.1 Continuous Rod Withdrawal Accident - Single Rod

• This event is not analyzed in the available Soviet literature and is not indi-cated to be a design-basis event. The uncontrolled withdrawal of a single con-trol rod would result in a local power increase in the reactor core. This power ,

l

• Full power and low power. i 3-43

~ ,.~,.--..~,,--,.m--~ mm----..,.+ -+- -- _.-,=,_--.---,.w-_.m .--....~vr-.,,,m--,,

l I

l 1

. increase'would' lead to increased void fraction and steam quality in adjacent fuel channels. Since the core has only 211 full-length control rods for 1661 fuel channels, the withdrawal of one control rod might affect 8 or more fuel channels. Because of the positive void coefficient, the control rod withdrawal would result in further local power increases in the local core region, which probably would result in violating the CHF limit in those affected fuel-channels.

Because of.the_ positive void coefficient, this event is not self-terminating.

The RBMK reactor must rely on the response of slow control rods and the. fuel Doppler reactivity coefficient to mitigate rod withdrawal accidents. The uncon-trolled withdrawal of one control rod would likely result in the insertion of adjacent control rods by the automatic power distribution control system.

Information in Soviet literature on control rod worths and the neutronics coupling of the fuel channels is insufficient to analyze this event. It is postulated that termination of this event would require the complete shutdown of the reactor by.either the automatic systems (e.g., 110% nominal core power reactor trip) or operator action. Some fuel channels could experience dryout i and heatup of the fuel during this event, with the potential for some fuel ele-ment damage. Because of the core's loose neutronic coupling, it is not clear that insertion of adjacent control rods, even if done promptly, can avoid a dangerous situation in the local region surrounding the withdrawn rod.

If the automatic control systems are capable of detecting and mitigating the continuous withdrawal of one control rod, then it is likely that the limiting (worst case) sequences would be ones that initiate from low power. The amount i, I,

of positive reactivity inserted and degree of voiding would be greater by the time the local high power condition was detected, because of poor instrument response at low power.

3.3.7.2 Continuous Rod Withdrawal Accident - Rod Banks

• i This event is not analyzed in available Soviet literature and is not indicated to be a design-basis event. The event is difficult to define, because it appears that large numbers of control rods are not operated in a group or bank mode. The large number of manual control rods (RR and USP) appear to be moved '

individually and sequentially, so a large group withdrawal of RR or USP rods appears unlikely. A withdrawal of the scram rods (AZ) is an unlikely accident, because the scram rods are maintained in a fully withdrawn position during critical operations. The group withdrawal of the 12 or more automatic regulat-ing rods (ARs) appears the most likely, yet these rods may be moved individually instead of in bank during normal operation. It is also possible that multiple withdrawal of AR rods is more likely in groups of 4 rods because of the way the control system is designed. One Soviet report mentioned a possible synchroniz-ing error that could withdraw four rods. '

The effects of a continuous rod withdrawal accident of a bank of rods would be very similar but more severe than the single rod withdrawal accident discussed above (Section 3.3.7.1). The group withdrawal accident would be worse for two reasons. First, much more reactivity would be inserted; and second, it is un-likely that automatic control actions would be effective, since the automatic

• Full power and low power.

3-44

regulating rods that could' compensate for a single rod withdrawal are most J

. likely the rods being withdrawn in a group' withdrawal.

Since. automatic. compensation is unlikely, this event would proceed rapidly until terminated by an automatic scram on high power, or by a manual scram. . It is likely.that CHF violations, fuel cladding overheating,.and fuel damage could

, occur before the power excursion could be terminated. Again, the positive void coefficient would multiply the effects of the reactivity excursion. Also, as discussed above in the single rod withdrawal event, this accident would pro--

bably be worse if initiated at low power.

This event is very dif'ficult to analyze because of its complexity and lack of detailed core infoonation. On the basis of a preliminary review and available Soviet' literature, it appears to be beyond the design basis of the plant, and beyond the capability of operators to control.

3.3.7.3 Miscellaneous Rod Withdrawal Errors and Misoperation During normal reactor operation, the coolant void fraction must be maintained at a specified level by operator action. The operator does this by adjusting the control rod positions and/or regulating the coolant flow to individual fuel channels. The instrumentation system measures the flow rate at the inlet of each pressure tube, and the individual assembly power and steam quality at the outlet of each pressure tube. From the literature, this measurement and calcu-lation cycle occurs on a continual basis with a time interval of 5 to 10 minutes.

Failure of the operator to recognize a CHF violation, or failure of the mea-suring instrumentation to identify approach to critical heat flux boiling in the reactor, can lead to a local power transient. The event results in in-creased voiding in the affected fuel channel with a resultant power increase in that channel. Because of the weak neutronics coupling of the fuel channels, the increased power level in the affected fuel channel would result in an in-crease in power level in adjacent channels. The ' adjacent channels would then experience increased voiding which would further increase the power level of the adjacent channels. This condition would propagate through the core until the nuclear instrumentation detected an unacceptable power increase in a region of the reactor and generated a signal for control rod insertion. Proper con-trol rod positioning (either manual or automatic) is very important to these power excursions, improper rod motion is the most likely initiator of local power transients; and proper control rod positioning is the only practical

means of stopping them. (Adjusting individual channel flow is a slow, compli-l cated operation.)

i Another.important control rod misoperation that can have severe safety conse-quences is the excessive manual withdrawal of control rods. As evidenced by the Chernobyl accident, excessive rod withdrawal can degrade safety for two reasons: First, rods pulled to full height have little initial effect during a scram because they move into a region of little rod worth. Second, rods

! pulled to full height actually insert positive reactivity during the first

( 3 seconds because of the displacement of water out the bottom of the control

( rod channel by graphite rod followers.

l t

(

3-45 L

v

Failure of the nuclear instrumentation system to detect power surges, or failure of the operator to respond with the appropriate control rod adjustments, could result in overheating of the core and possible fuel damage.

~ 3.3.7.4 Refueling Errors Including Improper Fuel Placement

• This category of events includes various errors in loading fuel or absorber rods. Possible errors include:

+ fuel or absorbers loaded into improper locations

- loading fuel of improper enrichment (either too low late in the fuel cycle, or too high early in the cycle)

+ inadequate cooling of fuel rods during fueling operations, resulting in voiding and a power excursion as fuel is inserted

- rapid insertion of new fuel of high enrichment without compensating con-trol rod insertion (Inserting highly enriched fuel with the refueling machine could have the effect of inserting a " booster rod.")

These errors cannot be analyzed with available information.

3.3.7.5 Rod Drop Out of Bottom of Reactor **

This event is a special category of rod withdrawal accidents, involving the downward withdrawal of short absorber rods (USP rods) out of the bottom of the reactor. The slow withdrawal of these rods by control rod drive mechanisms has been discussed in Sections 3.3.7.1 and 3.3.7.2. This special category is for the unique possibility for very rapid reactivity insertions by a rod drop acci-dent involving USP rods. Since these rods are pulled into the reactor from the bottom of the core by rod drive mechanisms mounted above the core, the possi-bility exists for rapid, gravity-assisted, reactivity insertions as a result of control rod drive failures, mechanism disengagement, cable break, etc.

I Because this sequence would insert reactivity'at a faster rate than other rod withdrawal accidents, it has the potential for being a severe transient.

L 3.3.7.6 Loss of Inventory in Control Rod Cooling System i

The cooling system for the control rods (CPS system) is a major contributor to the overall effectiveness of the control rod channels (rods plus cooling water)

_as neutron ba sor b ers, because tne cooling water is itself a significant absorber l

of neutrons. However, the cooling water aluoghelps moderate neutrons and thus j tends to increase the thermal neutr-on flux.

t Because of the dominant absorbing property of the cooling water, a loss-of-

[ coolant accident in the separate, low-pressure, low-temperature control rod j cooling system would add a significant amount of positive reactivity to the l core. One very preliminary estimate is that a total loss of control rod cool-ing would be equivalent to the complete withdrawal of about 10 to 15 control

• E.g. , improper enrichment.

• • Short absortar cods only.

3-46 i

-c - - - - . - - - , , , , -

X l

a rods. Such an accident would not only add a large amount of positive'reactiv-ity, but it would bring into question the ability of the reactor to achieve a shutdown of the neutron chain reaction after a scram.

9 The Chernobyl Unit.4' reactor'has redundant control rod cooling systems with

' backup makeup water available (see USSR,1986). Also, automatic reactor scrams are -initiated by both a drop of level in the CPS coolant expansion tank and a reduction in flow through the CPS channels. Therefore, it appears this acci-

[ dent sequence is handled adequately by automatic protective systems.

3.3.8 Transients' Involving Increases in RCS Inventory This category includes events that might increase total primary circuit inven-tory to the point that excessive steam separator water levels occurred, which

~

could threaten the turbine gererators with turbine blade damage from water entrainment in the' steam system. Since the RBMK reactor is a boiling water i reactor, these' events will generally not result in increased primary pressure.

. 3.3.8.1 Inadvertent ECCS Activation This transient was discussed in detail in Section 3.2.6.2. It creates power oscillations because of the reactivity differences between the affected and unaffected halves of the reactor. Since the volume of high pressure' injection water is limited, it is not anticipated that steam separator overfill would occur. During the tests discussed in the referenced section, the high-level scram setpoint in the steam separators apparently was not exceeded.

3.3.8.2 Excessive Feedwater Flow A feedwater. control malfunction could result in overfeeding the reactor. If the malfunction occurred in only one-half of the reactor (most probable case),

power oscillations, such as in the inadvertent ECCS actuation discussed above, might result. The total volume and flow rate could be greater than an ECCS injection, but the temperature excursion would be less severe.

If this transient continued for a substantial time period, the high-level steam separator scram setpoint would be reached. Presumably, the Soviets selected a high-level setpoint that would protect their turbine generators from moisture carryover.

3.3.9 Transients Involving Decreases in RCS Inventory

=This category includes all events that decrease primary circuit inventory (i.e.,

loss of steam separator level) other than excessive steam demand events. This category consists 'primarily of a range of credible loss-of-coolant accidents from small to large breaks.

3.3.9.1 Large-Break LOCA of Recirculation Pipe (MCP Outlet or Combined Discharge Header)

The rupture of one main coolant pump discharge line would result in the immedi-ate increase in voiding in one-half of the reactor, and the discharge of steam and water to.the high-pressure containment area. This steam would discharge to the suppression pool. The check valves on the group distribution headers would 3-47

1 1

l l

i close, thus preventing break flow back from~the reactor. Reverse water flow from the steam separator (s) would provide immediate cooling of the core. The increase in pressure in the containment area along with the rapidly decreasing level in the steam separator (s) would result in the generation of an ECC signal and a reactor emergency shutdown (scram) signal within a few seconds after the event initiation. The ECCS is designed to sense the affected loop and initiate ECC flow in 3.5 seconds. This extremely short response time is required to avoid violating CHF limits. .The probable control room indications of the event would include a decrease in the temperature measured in the outlet feeder tube due to. reverse flow from the affected steam separator (s) of saturated or slight-ly subcooled water, an increase in pressure in the associated containment com-partment, and a decrease in steam separator level. It appears that the ECC signal also initiates emergency feedwater and trips main circulating pumps (MCPS). Since the break location is separated from the ECC header and group collectors by a check valve, the initiation of the ECC should provide suffi-cient water flow to. fuel assemblies in the affected half of the reactor. The break flow from the ruptured pipe would be directed to the suppression pool, which also serves as a backup water source for the ECCS, Details of the piping restraints for the MCP discharge pipes are not available.

A potential vulnerability in the rupture of one discharge pipe is the possibil-ity that it could propagate to other discharge pipes because of pipe whip and/or jet impingement. This propagation of ruptures could result in an accident beyond the capability of the emergency core cooling systems.

This event is considered the maximum credible accident for the RBMK-1000 plant, and appears to be capable of being mitigated by the automatic actuation of the emergency systems. Although this event does not appear to require immediate operator action, there is some doubt among reactor safety experts that the coincident " loop-selection" logic can sense the affected loop and initiate ade-quate flow in a short enough time period (3.5 seconde) to prevent fuel damage in all situations.

3.3.9.2 Large-Break LOCA of Group Distribution Header The rupture of a 300-mm group distribution header would result in the immediate

-increase in' voiding in its associated 40 fuel channels, and the discharge of  ;

steam and water to_the low-pressure containment area underneath the reactor, which would vent to the suppression pool. Reverse water flow from the steam separator (s) would provide immediate cooling of the core. The increase in l pressure in the low-pressure containment area, along with the rapidly decreas-l ing level in the affected steam separater(s), would result in the generation of l an ECC signal and a reactor emergency shutdown (scram) signal at some short l

time after the event initiation. The probable control room indications of the j event would include a decrease in the temperature measured in 40 outlet feeder c tubes due to reverse flow from the steam separators of saturated or slightly l

subcooled water, an increase in pressure in the associated low pressure con-tainment compartment, and a decrease in steam separator level. The initiation of ECC would provide sufficient water flow to the steam separator (s) for long-term cooling of the fuel assemblies in the affected channels. The break flow from the group distribution header would be directed to the suppression pool, which serves as an alternate water source for the ECCS.

3-48

9 Details of the piping restraints for the group collectors are not available. A potential vulnerability in the rupture of one group distribution header is the possibility .that it could propagate to _other group collectors because of pipe whip and/or jet impingement. This effect could result in an accident beyond the capability of the emergency core cooling systems.

This event appears to be handled by the automatic actuation of the emergency systems without requiring immediate' operator action.

3.3.9.3 Large-Break LOCA of Steam Separator Downconer/MCP Suction Header Inside the Recirculation Pipe Room These two events would exhibit very similar behavior and thus are considered together. The break in'either one downcomer pipe or the MCP suction header would result in the probable failure of the main circulating pumps in the

' affected half of the reactor and the draining of the steam separator (s) in the affected half. Since this event would result in the rapid increase of lower piping room pressure and the rapid decrease in level in the steam separator (s),

ECC and emergency shutdown (scram) signals would be generated. ECC flow would be directedeto the fuel channels, and long-term cooling would be assured due to the break flow being directed to the suppression pool.

If the recirculation downcomer rupture is outside the suppression pool pro-

- tected recirculation pipe room, then it would be similar to a main feedwater pipe break, which is discussed below. This event appears to be handled by the automatic actuation of the emergency systems without requiring immediate opera-tor action.

! 3.3.9.4 Main Feedwater Pipe Break A break in the feedwater line between the feedwater pumps and the steam separa-tor is not a design-basis accident according to the Soviet literature. For various feedwater line breaks, the break location will determine the plant response to the accident. The feedwater lines between the main feedwater pumps and the steam separators have a shutoff / regulating valve and a check valve fol-lowed by a connection for the emergency feedwater system. For break locations between the pump and.the check valve, the resultant transient would look much like a partial loss of feedwater flow (Section 3.3.4.4). For break locations

! downstream of the check valve, the break would result in the loss of feedwater l

flow to the steam separators on one-half of the reactor and the blowdown of the water-inventory in the affected steam separators through the break.

For these latter break locations, the emergency feedwater system could not be used to provide feedwater to the steam separators. The loss of feedwater flow to the main circulating pumps would result in the cavitation of the main cir-culating pumps, and possible damage. The MCPS probably would not trip on a loss-of-feedwater-flow signal, because this signal is measured by feed flow instrumentation which probably would not sense breaks close to the steam separa-tor. The accident would result in the emptying of the steam separators in the affected half of the reactor and the possible loss of inventory from the steam separators in the unaffected half of the reactor due to the connection of the i

steam separators via main steamline cross-connections (see Section 3.3.3.1 on main steamline breaks). This accident would not result in the automatic 3-49

initiation of the emergency core cooling system. ECCS initiation requires simultaneous signals from low steam separator level and from high containment pressure. This high pressure signal would not occur, since the steam separ-ators and main feedwater piping are not located in spaces that blow down to the suppression pool. The reactor emergency shutdown system (scram) would initiate because of the loss of steam separator inventory. If the break is inside either steam separator room, the concerns for damage caused by steam escaping through the gaps in the refueling floor also apply here.

Operator action to initiate the emergency core cooling system, to initiate emer-gency reactor shutdown (scram), and to close the main steam cross-connections would be required to mitigate the accident. In addition, there would be a continual loss of reactor coolant inventory out of the break location. This accident raises a concern for the availability of the makeup cooling water supply that would be required in order to provide long-term cooling to the core. This accident could lead to fuel damage if prompt operator action is not initiated to provide reactor core cooling.

3.3.9.5 Small Break in Channel Inlet Line 1 The rupture of one inlet feeder tube would result in an immediate increase in voiding in the associated fuel channel, and the discharge of steam and water to the low-pressure ALS vault underneath the reactor. The escaping steam would vent to the suppression pool. Reverse water flow from the steam separator would provide some immediate cooling of the affected channel. This reverse flow normally would be as great or greater than normal channel flow, and prob-ably would not increase voids nor add positive reactivity. The above descrip-tion applies to a complete rupture of one inlet feeder tube. Obviously, a small leak in an inlet feeder tube would not cause flow reversal, but would

' diminish coolant flow in the affected channel. Therefore, there exists a unique inlet line break size (smaller than complete rupture, larger than small leak), that would stagnate flow in the affected channel. This break size is the worst-case inlet channel line break, and could damage fuel in the affected channel. This plausible " stagnant-flow scenario" would be similar to a complete j loss of flow in one channel (see Section 3.3.6.6).

The increase.in pressure in the low-pressure ALS vault along with the slowly decreasing level in the steam separator associated with the ruptured channel tube probably would result in'the generation of an ECC signal and a reactor shutdown signal at some undefined time after initiation of the event. Depend-ing on initial power level, the feedwater control system might compensate for decreasing water level. The control room indications of the event would in-l clude a decrease in the temperature measured in the outlet feeder tube due to i

reverse flow from the steam separator (s) of saturated or slightly subcooled water, an increase in pressure in the associated low-pressure compartment and a decrease in steam separator level. The operators should initiate a manual scram in accordance with procedures. If they fail to do so, an automatic scram and ECCS actuation will probably result from continuous loss of coolant. The ini-tiation of the ECCS would provide sufficient water flow to the steam separator for maintaining long-term cooling of the fuel assembly in the ruptured channel.

The break flow from the ruptured channel would be directed to the suppression pool, which serves as an alternate water source for the ECCS.

3-50

l i

Details of the piping restraints for the inlet feeder tubes are not available.

A potential vulnerability in the rupture of one feeder tube is the possibility.

, that it could propagate to other feeder tubes because of pipe whip and/or jet impingement. This situation could eventually result in an accident beyond the capability'of the emergency cooling systems.

1 In general, the rupture of an inlet feeder line appears to be capable of being mitigated by the automatic actuation of the emergency systems and does.not re-quire immediate operator action. It is considered by the Soviets in the design basis of the RBMK-1000 reactor . However, as discussed above, it appears that a certain medium-size inlet line break could lead to flow stagnation and fuel damage. Immediate operator action (scram, ECCS actuation) would be required.

3.3.9.6 Small Break in Channel Outlet Line or Refueling Connection The rupture of one outlet feeder tube would result in the immediate increase in 4

voiding in the associated fuel channel and the discharge of steam and water to the area above the reactor vault. This region is not within any pressure sup-pression system boundaries. Continued water-flow from the main circulating pumps initially would provide adequate cooling of the affected channel. How-ever, because of the positive void coefficient, the increased voiding would cause an immediate power increase in the affected fuel channel. This power increase is likely to cause overheating and propagate to adjacent fuel channels because of the increased neutron fluence. The level in the affected steam sep-arator(s) would decrease slowly because of blowdown through the ruptured fuel channel.

The local power control system should adjust rods in an attempt to control the local power increase. The immediate reaction of the plant operators should be a manual scram or at least a manual insertion of the control rods in the vicin-ity of the break in order to control the power distribution. The probable indications of this break would include a slow level decrease in one or more of the steam separators, high temperature, -humidity and pressure in one or both steam separator rooms, and escaping steam around the shield blocks on the re-fueling floor. The change in outlet steam quality would depend upon the break location in relation to the instrumentation. For a break upstream of the detectors, they would be exposed to saturated or slightly subcooled water flow-( ing from the steam separator. For break locations downstream of the detectors, l a superheated steam indication probably would be registered by the detectors.

Because of the break location, this accident would not automatically initiate the ECCS since no lower vault pressure increase would be detected. Also, an automatic scram of the reactor would not be expected since it is probable that no scram setpoint would be exceeded by this accident. Normal circulating water flow would continue and accident termination would require operator action to scram the reactor and begin a cooldown process. The break location cannot be isolated since there is no valve between the pressure tube and the steam separ-ator. (If valves existed to permit isolation, it is highly unlikely that plant procedures would permit isolation in this situation, since fuel melting and extensive zircalloy-water reactions in the affected tube would result.) Once reactor cooldown is achieved, the affected pressure tube would have to be defueled. Then, closing the feeder tube inlet valve and installing a freeze plug in the outlet feeder tube downstream of the break would isolate the break location.

3-51

Since the break flow is to the area above the reactor vault, it is likely that the coolant eventually would be discharged outside of the plant. The discharge would not be returned to the suppression pool. This raises the question of the adequacy of water supplies for long-term cooling of the core.

Details of the piping restraints for the inlet feeder tubes are not available.

A potential vulnerability in the rupture of one feeder tube is the possibility that it could propagate to other feeder tubes as a result of pipe whip and/or jet-impingement. This situation could eventually result in an accident beyond the capability of the emergency cooling systems.

Another concern is the likelihood that high-temperature, high-velocity steam will impinge on control rod drive motors, drums, and associated power and con-trol cabling. Such damage could preclude rod motion and prevent manual and automatic scrams. Also of concern is the damage that could occur to nuclear.

instrumentation and control rod cooling systems.

This event has the potential for escalating into a very serious event which could result in significant core damage if prompt operator action is not taken to scram the reactor and begin the cooldown process.

3.3.9.7 Pressure Tube Rupture Inside the Reactor Vault (Graphite Region)

A rupture of a pressure tube inside the reactor vault is considered by the Soviet designers to be beyond the design basis of the plant, based on expecta-tion of " leak before break" and the monitoring for pressure tube leakage.

However, the pressure-relief capability of the reactor vault via rupture discs or relief valves is based on the steam-water flow from the rupture of one pres-sure tube.

The rupture of one pressure tube inside the reactor vault would result in the immediate increase in voiding in the associated fuel channel, and the admission of significant quantities of steam and water to the graphite cover gas. Be-cause of the positive moderator coefficient of the water in the fuel channel, an immediate power increase in that fuel channel would be experienced, which is postulated to propagate to adjacent fuel channels because of the increased neutron fluence. The average channel power increase might be less near the break because of a decrease in graphite temperature in the immediate vicinity of the break as the steam and water cools the graphite slightly. The level in ,

the affected steam separator (s) would decrease slowly as a result of blowdown through the ruptured fuel channel. However, the feedwater control system would probably compensate and maintain adequate level.

The rupture of more than one pressure tube is beyond the design basis of the RBMK-1000 reactor. Such an event would exceed the stated relief capacity of the reactor vault and could overpressure it. Excess pressure might deform or rupture the vault, or it might lift the upper biological shield enough to relieve pressure to the upper core exit piping region.

The immediate reaction of the plant operators should be a manual scram or at least a manual insertion of the control rods in the vicinity of the break in order to control the power distribution. The probable control room indications would include an increase in the temperature and humidity of the circulating cover gas, and a slow level decrease in one or more of the steam separators.

3-52

Because of the break location, this accident would not automatically initiate the emergency core cooling system since no lower vault pressure increase would be detected. Also, an automatic scram of the reactor would not be expected, since it is probable that no scram signal would be generated by this accident.

Normal circulating water flow would continue and accident termination would require operator action to scram the reactor and begin a cooldown process. The break location cannot be isolated, since there is no valve between the pressure tube and the steam separator. (If valves existed to permit isolation, it is highly unlikely that plant procedures would permit isolation in this situation, since fuel melting and extensive zircalloy-water reactions in the affected tube would result. Once the reactor had cooled down, the damaged tube would have to be defueled. Then, closing the feeder tube inlet valve and installing a freeze plug in the outlet feeder tube would isolate the break location for repair.

The impact of steam cutting of adjacent tubes in the reactor vault must also be resolved in order to complete the safety analysis. It is well known in fossil-fired electrical generating units that a steam jet from the break location can erode local materials, such as graphite, and accelerate this material which can then cut adjacent tubes.

This event has the potential for escalating into a very serious event which could result in significant core damage if prompt operator action is not taken to scram the reactor and begin the cooldown process.

3.4 References Cherkashov, 1984 Cherkashov, Y. M., " Safety Design of the RMBK-1000 Reactor,"

IAEA-SM-268/84, Operational Safety of Nuclear Power Plants,"

Proceedings of an IAEA symposium in Marseilles, May 2-6, 1983, IAEA, Vienna, 1984.

DOE, 1986 U.S. Department of Energy, " Report on the U.S. Department of Energy's Team Analyses of the Chernobyl-4 Atomic Energy Station Accident Sequence," DOE /NE-0076, November 1986.

Dollezhal, 1980 Dollezhal, N. A., and I. Y. Yemel'yanov, Channel-Type Nuclear Energy Reactor, Atomizdat, Moscow, 1980.

Dollezhal, 1983 Dollezhal, N. A., I. Y. Yemel'yanov, et al., "Some Charac-teristics of and Experience With the Operation of Nuclear l Power Plants With RBMK-1000 High Powered Water-Cooled Chan-nel Reactors (RBMK)," Atomnaya Energiya 54(4), April 1983.

Dubrovsky, 1979 Dubrovsky, V. B., " Construction of Nuclear Power Plants,"

Mir Publishers, Moscow, 1979.

e GSR, 1983 " General Safety Regulations of Nuclear Power Plants During Design, Construction, and Operation (OPB-82)," Atomnaya Energiya 54:(2), 1983.

Kabanov, 1983 Kabanov, L. P. , " Effectiveness of Emergency Cooling of Water-Cooled Power Reactors," Teploenergetika, No. 2, pp. 4-10, February 1983.

3-53 i

, , , , , ~ , . - - . . -. .. .. .. .

-=

^

n i

a Konstantinov, 1975 Konstantinov, L., " Reactor Design Safety Analysis in Re- 5 gard to Internal Hazards for Pressure-Tube Reactors (USSR),"

Report No. AED-CONF-75-769-067, 1975 meeting on nuclear t power plant planning, IAEA, Vienna, 1975. 4 Margulova, 1978 Margulova, T., Nuclear Power Stations, Izdatel'stvo Vysshaya Shkola, Moscow, June 1978 (EPRI Ref. No.78-004). ]

l Markov, 1984 Markov, Y. P., et al., " Emergency Localization System at =

Third Unit of Chernobyl AES," Moscow Energeticheskoye t Stroitel'sno 1:61-63, January 1984. ]

NNC, 1976 National Nuclear Corporation, Ltd., "The Russian Graphite- Y Moderated Channel Tube Reactor," NPC(R)1275, United -

Kingdom, March 1976.  ;

g l Novosel'skii, 1984 Novosel'skii, O. Y., V. B. Karasev, et al., " Tests on Q Improved Steam Separators in the Third Unit at the Cherno- f byl Nuclear Power Station," Atomnaya Energiya 57(12): _a 382-385, March 1984. y a

Semenov, 1983 Semenov, B. A., " Nuclear Power in the Soviet Union," IAEA 3 Bulletin 25(2), June 1983. 1 1

Sidorenko, 1981 Sidorenko, V. A., and O. M. Kovalevich, " Safety Control of g Atomic Energy Sources," Atomnaya Energiya 50, February 1981. g Sidorenko, 1983 Sidorenko, V. A., O. M. Kovalevich, et al., " Standards for j Safety of Atomic Power Plants in the USSR," A omnaya n

Energiya 54(4), April 1983. ]

2 Smolin, 1984 Smolin, V. N., V. I. Esikov, et al., "An Experimental ]

j Study of Emergency Cooling Conditions in RBMK Reactors on 1 Load Disconnenction," Soviet Atomic Energy 57(2):507-512, August 1984, i 7

et al., " Accident Localization System of 5 i Turetskiy, 1984 Turetskiy, L. I.,

Energy Units With RBMK-1000 Reactors," February 1984 (EPRI 1 Ref. No.84-006).

USSR, 1986 USSR State Committee on the Utilization of Atomic Energy:

"The Accident at the Chernobyl Nuclear Power Plant and Its ;i Consequences," Information compiled for the IAEA Experts' -

Meeting, August 25-29, 1986, Vienna, 1986.

Voronin, 1981 Voronin, L. M., Chapter 1 of Operation and Maintenance of  ;

[

Nuclear Power Plants, Energoizdat, Moscow, 1981.

Yemel'yanov, 1977 Yemel'yanov, I. Y., V. P. Vasilevskii, et al., " Safety  ;

' Problems of Nuclear Power Plants With Boiling Water-Cooled Grap.hite Channel Reactors," Atomic Energy (USSR) [ Soviet Atomic Energy] 43(6):458-464, December 1977. j l

n i -

1 3-54

Yemel'yanov, 1984 Yemel'yanov, I. Y., et al., " Study of Operating Conditions of Power-Generating Unit With RBMK Reactor With False Turn-ing on of Reactor's Emergency Cooling System," Moscow Elektricheskiye Stantsii 3:10-13, March 1984.

(

3-55

CHAPTER 4 ACCIDENT SCENARIO This chapter presents the factual information available to the United States on the causes and in-plant consequences of the accident at Chernobyl. A chrono-logical listing of the events is provided in Table 4.1 at the end of this chap-ter; all aspects of the_ accident from the time the reactor was removed from-normal operation until several days after the accident occurred are identified and discussed there in chronologic order.

1 4.1 Overview The accident occurred during a test of the turbine generator system. This test was designed to demonstrate that_following a reactor trip, with the resulting loss of offsite power and isolation of the steam supply to the turbine, the rotat-l ing inertia of the turbine generator would be sufficient to generate enough elec-trical power to energize certain safety systems until the diesel generator system could be started and accept the electrical loads. This test had been performed earlier at similar plants. The specific purpose of this test was to determine if a new generator magnetic field regulator would maintain the voltage output from the generator for a longer period.

In the process of establishing the test conditions for the reactor, the opera-tors brought the plant to an unstable operating condition. However, for a num-ber of reasons, the operators chose to run the_ test from this unstable condition.

To prevent the reactor from automatically shutting down, the operators purposely bypassed several systems important to safety. The role of the operator in this accident is discussed in Chapter 5.

With the safety systems bypassed, the plant was in an unstable and vulnerable condition. The most prominent parameter of this unstable condition was the positive void reactivity coefficient. This coefficient allowed the reactivity to increase as the volume of steam increased in the core. Other significant parameters included the low initial power level, low subcooling, low initial steam void fraction in the core, fuel burnup condition, and control system

, characteristics. The design characteristics of the Chernobyl plant are detailed

!_ in Chapter 2.

The initiation of the test caused the steam volume in the core to increase. Un-der the unique test conditions (for which the plant was not designed), and with the safety systems bypassed, a significant insertion of reactivity resulted. The l resulting power increase produced additional steam voids which added reactivity B. Sheron and C. L. Allen of the U.S. Nuclear Regulatory Commission (NRC) com-piled this chapter.

i 4-1

and further increased the power. Evaluations to date indicate the reactor was brought to a prompt critical condition. Assessment of Soviet (and other) analyses also indicates that the energy deposition in the fuel was sufficient to melt some of the fuel. The analyses te date suggest the following possible sequence of events. The rapid expansion associated with melting, quickly ruptured the fuel cladding and injected fragmented and molten fuel into the coolant channel. The interaction of the coolant with the hot fuel fragments produced steam very rapidly. The high temperatures and rapid production of steam quickly overpressurized the pressure tubes in the core region. The pressure tubes then failed and overpressurized the cavity region around the graphite blocks. Sufficient force was generated to lift the top plate off the reactor and possibly to fail the reactor building and eject core material.*

This postulated sequence of events can be associated with the first " explosion" heard by operators at the plant. A second " explosion" was reported to have occurred approximately 3 seconds after the initial one.

Various speculations on the source of this noise include a second criticality, a hydrogen detonation, or even an echo or reverberation.

In summary, the event was caused by a combination of procedural and management deficiencies, human errors, and unique design characteristics.

4.2 Events Leading to the Accident The events leading to the accident at the fourth unit of the Chernobyl Nuclear Power Station on April 26, 1986 are discussed in this section. The events are detailed in narrative form and are summarized at the end of this chapter in Table 4.1. The accident chronology identifies the violations of operating procedures and principles that placed the reactor in succeedingly unstable configurations. Information used in reconstructing the sequence of events was obtained from review of the report on the Chernobyl accident prepared by the USSR State Committee on the Utilization of Atomic Energy (USSR, 1986) and the International Nuclear Safety Advisory Group summary report on the Chernobyl accident (INSAG, 1986). Figure 4.1 illustrates the chronology of events leading to the accident and is provided to supplement the detailed scenario.

Unit 4 of the Chernobyl station was put into operation in December 1983. The plant was to be shut down for a " medium" repair on April 25, 1986. At that time the active core contained 1659 fuel assemblies (TVS) with an average burn-up of 10.3 MWD /kg. Most of the fuel assemblies (about 75%) were assemblies from the first loading with a burnup of 12-15 MWD /kg (USSR, 1986).

• Precise details of the events during this time may never be known with certainty.

Further information could contribute to our understanding. Such information as geometry, composition, and distribution of materials would help us analyze the nature of the " explosion." Information on the distribution and conditions (strains, fractures, and distortion) of structures and structural materials would help assess the magnitude of the forces involved.

4-2

4 APRIL 25 l APRIL 26 I

e 7 1:00 0 OPERATORS BEGIN 3200 POWER DESCENT I

h l

1

-14:00 POWER DESCENT so DELAYED FOR 9 HOURS 01:19 OPERATORS PULL RODS 5 BY LOAD DlSPATCHER BEYOND AllOWABLELIMITS TO E ECCS DISCONNECTED REACH M MM U 01:19 OPERATORS BLOCK

>9 REACTOR TRIP SIGNALS

.a 1600 / l ON STEAM SEPARA TOR g DISCONNECTED g } LEVEL AND PRESSURE O OPERA TOR

• • DISCONNECTS REACTOR TRIP l ON TIG TRIP 23:10 POWER y>- DESCENT RESUMED l 1

2" 12:28 OPERATORS 1 SWITCH OFF LOCAL l 30 AUTOMA TIC CONTROL OPERA TORS START 2 l ADDITIONAL COOLANT I

PUMPS. FLOWllMITS l VIOL A TED TIME D (not to scatel Figure 4.1 Chronology of the accident at the Chernobyl Nuclear Power Station (not to scale)

Source: Sheron, 1986 The events leading to the accident started at 01:00* on April 25 when station personnel started reducing reactor power, according to test procedures. By 13:05 reactor power had been reduced from 3200 Wt to about 1600 Wt. Turbine generator No. 7, one of the unit's two main turbine generators, was then removed from service. The electrical systems receiving power from the discon-nected generator, including two of four motor-driven feedwater pumps and four of eight main circulating pumps, were switched to the busbar of turbine genera-tor No. 8, the generator to be used in the test. To ensure the reactor core received adequate cooling during the experiment, the remaining feedwater and main circulating pumps were aligned to the station's service transformer (off-site power).

• References to time will use a hybrid military time designation. For example, 0100 becomes 01:00. The purpose is to provide a framework for more detailed time reference (e.g., in seconds such as 01:00:30) where such information is available and relevant.

4-3

At 14:00,.the emergency core cooling system (ECCS) was disconnected to prevent inadvertent actuation during the test (the ECCS is designed to ensure the core remains cooled during postulated loss-of-coolant accidents). At this time, the test was delayed at the request of the load dispatcher, and the reactor plant was left:in service for an additional nine hours. During this time the ECCS was left isolated.in violation of operating procedures. Although the Soviet and INSAG reports state that the ECCS could possibly have limited the consequences of the accident, most U.S. engineers believe that this violation did not have any direct effect on the course of the accident.

.After the load demand was lifted at 23:10, power reduction was resumed in prep-aration for the test (test specifications required the experiment to be per-formed at a reactor power level between 700 and 1000 MWt). In keeping with low-power operating procedures, the local automatic control rod positioning system, which monitors and maintains local power in 12 core zones, was switched off. Ap-

.parently, the backup automatic control rod positioning system, which operates in conjunction with the local power controller and maintains control of average core i power, had not been set to the proper level. Despite operator efforts, reactor

- power subsequently dropped below 30 MWt.

! The operators were able to stabilize reactor power at 200 MWt by 01:00 on

April 26. However, as a result of xenon buildup in the fuel, which is a natural occurrence that introduces large amounts of negative reactivity.during prolonged Iow-power operation after high power operation, the operators had to manually withdraw the control rods beyond safe operating limits to increase power. The unit's effective shutdown margin was reduced to 6 to 8 control rods, well below the minimum reserve margin of 16 equivalent control rods required by the plant

' operating procedures for safe operation of this class of reactors. Reactor power still could not be raised to the level required for the test.

I Despite the serious reduction in the excess shutdown reactivity margin and the inability to meet established test power conditions, the decision was made to proceed with the test. At 01:03 and 01:07 two standby main circulating pumps,

[-

one per recirculation loop, were started and joined with the six pumps already

! running. According to the test plan, four of the eight pumps, two on each recirculation loop, would be involved in the turbine coastdown test and the remaining four pumps were to remain in operation to provide core cooling. As noted earlier, the original test procedure called for the power to be at least 700 MWt. Under these conditions four pumps would provide the necessary cool-ing. However, at a power level of 200 MWt, four pumps were not necessary, and operating at this power level with eight pumps running violated maximum flow limits. With eight pumps running, core flow was greater than desired, rising to 56,000 to 56,000 m3/hr. At some pumps the flow was measured to be 8000 m3 /hr, well in excess of the nominal 7000 m8 /hr.

Because the operators were unable to increase reactor power beyond 200 MWt (as a result of xenon accumulation), they had a very low power-to-flow ratio and low core void fraction. As a result, the core hydraulic resistance was sub-stantially lower than would be expected in the test. Continued operation beyond this point violated operating procedures because of the risk of pump cavitation, vibration, and possible breakdown under these conditions. In l

addition, the increased flow through the core caused a reduction in steam l generation and a drop in steam pressure and liquid level in the steam drum i

4-4

-. - - ~ . . .. _ _ . . - .

L t

separators. Figure 4.2 (INSAG, 1986) shows the key reactor parameters for the last 5 minutes before the accident.*

At 01:19, to prevent an automatic shutdown of the reactor under these varying

, level and pressure conditions, the operators blocked the reactor protection (scram system) signals related to the pressure and liquid level in the steam drum separators. In addition, at this time, the feedwater flow to the steam drum separators was increased (by as much as.four times nominal) to restore the depressed water level. This action lowered the core inlet temperature and further reduced steam production. At any power level, but particularly at low power, a reduction in core voids. (reduced steam generation) produces a nega-tive. reactivity insertion in plants using the.RBMK-1000 design; that is, it causes a reduction in reactivity.' Within 30 seconds, the automatic control rods had fully withdrawn from the core to compensate for the reduction in reactivity. The operators then assisted the automatic control rod system by withdrawing.the manual control rods. The actions of the operators overcompen-sated for the reactivity reduction and the automatic rods began moving back into the core.

'i '

By 01:22, reactor parameters were relatively stable and the decision was made to proceed with the-test. The reactor protection signals associated with the turbine stop valves on both turbines were blocked to prevent the_ automatic shut-down of the reactor when these valves were closed. It was believed that if the reactor was kept in operation, the test could'be repeated quickly should the first attempt prove unsuccessful. The test procedures did not provide for disabling the automatic shutdown logic associated with the isolation of both turbine generators. Feedwater flow was reduced just before the initiation of the test.

At 01:22:30 a computer printout from the fast reactivity evaluation program showed that the available excess reactivity margin had dropped to a level re-quiring the reactor to be shut down immediately. However, this requirement was ignored so that the test could be completed. The axial neutron flux distri-bution was distorted by this time and the majority of the control rods were probably rendered ineffective for power control.

At 01:23:04, the stop valves of turbine generator No. 8 were closed to begin

- the test and the four main circulating pumps on the generator busbar began .to coast down. -The reactor continued to operate at 200 MWt since automatic reactor shutdown had been disabled following the isolation of both turbines.

At the start of the test, the bulk of the reactor coolant system was near satu-l ration temperature as a result of the reduced feedwater flow and the excessive l

circulation flow produced by all eight pumps running during the low power <

condition. In addition, the core was at a very low void fraction. As core

. flow decreased (reflecting the coastdown of the four main circulating pumps) and inlet temperature increased as a result of the earlier reduction in feedwater flow and with power production still at 200 MWt, steam production in  ;

• Note that much of the information in Figure 4.2 is based on the Soviets' compu-ter simulation of the accident, particularly of the last minute before the power excursion.

l 4-5

O @ @

:;;j::: m

@ W @ E @

j

::;;i::;

operataa of a maaud g;;-l:::r g g g:: j regulator group

.............. -- ~\

saag----en!**a \

j

:iij::j (

.............. { ___.. - - - - - -Td"~'

eerg--- at1-*a -

-

:gg  ::g _s (O E S _ _-

~~ ~~~~~~

Y I \

.............. c g

sneg--. Att- t 1

i di rB rp e g _ O -~~~

\ \ '

., ,,,!-...aas- s .-- -qg- -g- - 19 (p g \--_-CO a-s; ees- g ,

o

,m f

i

:: ;;I::I .

o, 4---

-.g-- ,e_ T -

.;;;;;;;;;.t ----. .-- - - - - ,, - - - -----+

---

. \

,g__4 .- ===,-----______-----

.-fp 7 1

os . ,..........,

119 oo its t21

.....,....e,e..

each interval = 10 sec KEY TO THE CURVES ON FIG. 4.2a SX.M. MiB M_A_E SXd E 5 85 3

-- A Neutron power (%) 0 120 - K Flow, MCP (m /s) 2 8

- B Reactivity, sum. (%) -1 5 --- L Flow. Feedwater (kg/s) 0 600

- C Pressure, steam drum (bar) 54 90 --- M Flow, steam (kg/s) 0 600 0 Neutron power (%) 0 48000 --- N Fuel temp. (*C) .

200 2000

- E Rod group AR-1(fraction inserted) --- 0 Steam mass quality (Exit of core, %) 0 6 0 1.2

- G Rod group AR 2 (fraction inserted) 0 1.2 --- P Steam vo(. quality (Core average, void fraction) 0 1.2

- H Rod group AR-3 (fraction inserted) 0 1.2 --- S Levet (steam drum, mm) -1200 0 Figure 4.2a Key reactor parameters for the last five minutes before the accident, 01:19-01:21

n;b:=:iig:::

- e e ge se m

@ D @x W-

~

i;;i:::r!!!::; e a oo ,m.

5 -

se gay in =iig=y

ni

:::;;;::;. =

. . . . .................. ..a

....P i m ..__.. .___7

, , f e ,

I / .

- t /

j.u

i;;

.;

n;;==i;';=:i / V . \ //

n;;:=:n;=; ~

/  %/l ees -~ ggg-.g

_->__e._.

w

/ ,

/

:;;;r O $ I IO E ~R~ d

.. ~^

<* b ,f%4 )$ "o g[

'g

• Q, .. . . . . . . - .... ... ,,

i" :'":j

=r = = = = = ==== =;== === == Ss syyes sitiiriiiiiii;kg==?==

nn su each interval = 10 sec KEY TO THE CURVES ON FIG. 4.2b M M M32

_ m M ts A Neutron power (%) 0 120 - K Flow. MCP (m /s) 3 2 8

- B Reactivity, sum. (%) -1 +5 --- L Flow, Feedwater (kg/s) 0 600

, --- C Pressure, steam drum (bar) 54 90 --- N Flow, steam (kg/s) 0 600 0 Neutron power (%) 0 48000 --- N Fuel temp. ('C) 200 2000

- E Rod group AR-1(fraction inserted) 0 1.2 --- 0 Steam mass quality (Exit of core %) 0 6

- G Rod group AR-2 (fraction inserted) 0 12 --- P Steam vol. quality (Core average, void fraction) 0 1.2

- H Rod group AR-3 (fraction inserted) 0 1.2 --- S Level (steam drum, mm) -1200 0 Figure 4.2b Key reactor parameters for the last five minutes before the accident, 01:21-01:23:30

III's3

• g g jI*:3 g g

$ e e ,/*ne A>

,e

............-* d es J 186l~*!$3**$ G

~< _. ,

g g' g g

.............. q) F i .I,f 8 8 gsag--- ggg- g _

,, f fy e , g ,

.............. f p 1 # # 111! 8 e

• 1"**!!!"! c_--. --. < ' .-_ ..--- -

4y*-+1

-f--F 1--i-- , Y' D qp

.............. ,a , _

e  ! .e  %

=ar!--- it!"I u g>) ~ o e  ;

,j .; T.

~ r --

a

- l { i.f 1

r - - -

f p!. . i

,!t.;p '

\

i n; ::::[i;=::j

/- r  : 1 3 y'

, m n==isi=i. , /  : ,

- N y=

l .............. -r C  ? -, *

• 1#

ssg -* g3g-*g e e) c r

) ,,,,,  ;, g y' l .............. / /

,k  !  ! 8  !

~~

. ...... . . --~~~~I~ > 1

• *

• l"  !! a - ! , , , , , _____. m.. -- --- - ,4- - -- e

, yj .

g mi:==ui"i

• 13

  :::::j::j

<=====a============__z==u==== ===== ==s

=3=p

==....

p-. -N-; = =7g- -----

t 2F30* 12F35* 12F40* 124'45*

> .. ........... a, e

ao o ceat e- at.

From Fiti 4 of tte sevet wertung Paper vet.1 KEY TO THE CURVES ON FIG. 4.2c

$Yd Y t$ti M_AJ $Y,d (E tMK

- A Neutron power (%) 0 120 - K Flow, MCP (m3 /s) 2 8

- B Reactivity, sum. (%) -1 +5 --- L Flow, Feedwater (kg/s) 0 600

- C Pressure, steam drum (bar) 54 90 -- M Flow, steam (kg/s) 0 600

--- 0 Neutron power (%) 0 48000 --- N Fuel temp. (*C) 200 2000

- E Rod group AR-1(fraction inserted) 0 12 --- 0 Steam mass quality (Exit of core, %) 0' 6

- G Rod group AR-2 (fraction inserted) 0 12 --- P Steam vol. quality (Core average, void fraction) 0 12

- H Rod grcup AR-3 (fraction inserted) 0 12 --- S t.evel (steam drum, mm) -1200 0 Figure 4.2c Key reactor parameters for the last five minutes before the accident, 01:23:30-01:24:45 l

- . . . - -~ - ._ . . _ . .. . -- .-

the core began to increase. The RBMK-1000 design responds to the formation of 4

steam in the core region with an increase in power (because of the positive void coefficient).* Without proper control actions this represents a self-propagating condition. It was at this point that the power excursion began.  ;

Shortly after the start of the power increase (at 01:23:40, 36 seconds after the turbine stop valves had closed), the unit shift manager gave the order to scram.the reactor using AZ-5, which is the highest level of emergency shutdown function available. This would allow insertion of all control and shutdown rods into the core. Because of the reduced shutdown margin and the distorted axial neutron flux distribution, the rods would have had to travel well into i

the core before encountering sufficient neutron flux to be effective. Further, because of the use of followers in the control rod design, it is possible that initial, control rod motion could introduce reactivity. (See Chapter.2 for a discussion of control rod design and functions.) After the scram was ini-i tiated, a number of severe shocks were reportedly felt in the control room and l an operator observed that the control rods had failed to fully insert. The control rod drives were then deenergized in the hope that the rods would fall into the core under their own weight.

4.3 Events During and After the Accident Analysis indicates that by 01:23:43 a large positive reactivity insertion had

, occurred and considerable energy was produced in the fuel. At some point the fuel melted, expanded, and failed the cladding. According to the Soviets' 4

evaluation of their computer analysis of the event, fragmented fuel was in-i . jected into the coolant channel and interacted with the surrounding steam-water mixture.** This resulted in a high pressure failure that ruptured fuel chan-nels, sheared the connecting piping to the reactor, and breached the roof of the reactor building. This phase of the accident is generally associated with i

the first " explosion" that was reported. A second " explosion" was reported to -

have occurred approximately 2 to 3 seconds after the first. The high pressure

, failure destroyed much of the reactor, ruptured the water-filled biological

! *Under the unique conditions of the test, the void reactivity coefficient was reported to be a factor of 50% higher than normal.

• • Soviet experts estimate that the energy deposition in the fuel exceeded 300 cal /gm over the course of the accident, and fragmented the fuel and dis-persed it. Figure 4.3 (Sheron, 1986) shows an integral of the Soviet calcu-lation of reactor power versus time during the power bursts. By dividing this integral over the first peak by the mass of fuel in the core, an average energy deposition of 300 cal /gm is obtained. Some fuel will have a larger specific energy.

A number of experiments on fuel performance versus energy deposition have been performed in the United States. Figure 4.4 shows the results from tests in the SPERT CDC of model fuel pins as a function of energy deposition (MacDonald, 1980). Considering such results, the Soviet description of the event seems reasonable. Given the uncertainties in the calculations (particu-larly in the power distribution and the power time history), a more detailed description would be difficult to develop and justify without considerably more information.

4-9

E

_R_

1600000

$ 1600 o

.. 350 Power Calculated [MW] ,7 344oooo E By Soviets ,j g 1200- ,,,,,,,,,,,,............. -1280000 y E 1060 - -1120000 [

f [**~

E 900_ f Integr81 of 5o 760-  ;

i

/!

Power [MW-sec] -960000}'E

-800000 g .g a j Je

[ 600- 1 j

-640000 Q

$ 4s0 Integral of  ;/  ! 4eoooo $ $

g Energy [ cal /gml n.g

,f"% *

,e i -320000 g 300- , ,,,,,,,..

T3 150- / . ' s I -160000 a

t'

~ .-) ~ - - -

y 2 3 4 5 6 7 8 5 01:23:42 Time - seconds 01:23:48 Figure 4.3 Chernobyl data evaluation of power vs. time during core destruction phase (Sheron, 1986)

Source: Soviet analysis provided in Figure 4 of USSR, 1986, shield tanks, and ejected graphite and fuel from the top of the building. The hot fuel and reactor materials were reported to have started approximately 30 fires on the surrounding structures.

Firefighting units from Pripyat and Chernobyl arrived at 02:54. To prevent the fire from spreading to Unit 3, the firefighters concentrated their efforts on the turbine building, which is conuon to both units. By 03:34 the fires in the turbine building were under control. By 05:00 all fires (other than those in the core) were extinguished and Unit 3 was shut down.

The operators attempted to cool the portions of the core remaining in the reac-tor building by injecting water (200 to 300 tonnes /hr) with the auxiliary feed-water pumps at the steam drum separators and the main circulation pump suction headers. Additionally, water from storage tanks was injected into the intact portions of the reactor via the now reconnected ECCS.

( 4-10

Axial peak radial average fuel enthalpy, cal /g UO 2

9

~y N275 N240 N205

~T,

._~ b N145 Figure 4.4 Photographs of the residues from model fuel pins (SPXM rods) after tests in the CDC (capsule driver core) simulating power excursions from reactivity insertion accidents Source: MacDonald, 1980, p. 585.

Units 1 and 2 were not shut down until 01:13 on April 27.

Between April 27 and May 10, 5000 tonnes of boron compounds, dolomite, sand, clay, and lead were dropped by helicopter onto the damaged reactor to ensure that the fuel rubble remained suberitical and to reduce the discharge of radio-active material from the site. Most of the material was dropped between April 28 and May 2.

By May 6, the discharge of radioactive material had dropped to several hundred curies per hour. Nitrogen gas was pumped into a space under the reactor build-ing to cool the fuel remaining in the reactor.

4.4 References INSAG, 1986 International Safety Advisory Group, " Summary Report on the Post-Accident Review Meeting on the Chernobyl Accident,"

August-30-September 5, 1986, GC(SPL.I)/3, IAEA, Vienna, September 24, 1986.

MacDonald, 1980 MacDonald, P. E., et al., " Assessment of Light-Water-Reactor Fuel Damage During a Reactivity-Initiated Accident," Nuclear Safety, Vol. 21, No. 5, September-October 1980.

Sheron, 1986 Sheron, B., "The Accident at Chernobyl," Presentation to CSN1 participants, Paris, September 1986. (Available in the NRC rublic Document Room, 1717 H St. NW, Washington, DC.)

USSR, 1986 USSR State Committee on the Utilization of Atomic Energy, "The Accident at the Chernobyl Nuclear Power Plant and Its Conse-quences," Information compiled for the IAEA Experts' Meeting, August 25-29, 1986, Vienna, 1986.

i

?

! 4-12

Table 4.1 Chronology of the accident at the Chernobyl Nuclear Power Station

• Date/ time Power (NWt) Event Comment April 25 01:00:00 3200 Began power descent to 700-1000 MWt as re- A slow reduction in power was planned-quired for test. to help reduce the effects of xenon buildup. The range for the test power level;(700.to 1000 MWt) was chosen'by:

-the test designers.

! 13:05:00 1600 Turbine generator No. 7 disconnected. Power At this time four pumps were drawing i for auxiliaries (4 main cooling pumps, power from turbine generator No. 8, -

l 2 electrical feedwater pumps, etc.) trans- two from the grid and two'on standby ferred to bus bars of turbine generator but connected to the grid. -As part

No. 8. of test the equipment connected to turbine generator No. 8 will run'down

, with it when steam to it is shut'off.

14:00:00 1600 Emergency core cooling system disconnected ~This was a violation of safety prin-as required by test procedure. ciple;_however, the test required dis-connecting the ECCS to avoid possible ECCS actuation during test (not.actu-l ated by LOCA).

i j Continued power reduction delayed for 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> The hold.in power would reduce the-i on orders of the power grid dispatcher to rate of xenon buildup at the test j meet demand. power level.

1 l 23:10:00 1600 Power reduction resumed.

i 1

1

• As provided in the Soviet report (USSR,1986) and the INSAG Summary Report (INSAG 1986).

i i

e

+- __ _ _________.._ _ . _ _ _ _

Table 4.1-(Continued) 4 Dste/ time Power (MWt) Event Comment April 26 3 00:28:00 Variable Switched off local automatic control as per- Abrupt power reduction would result in

, mitted at low power operation. Because bulk a negative reactivity insertion from pcwer setpoint was inadvertently left preset xenon buildup requiring removal of to a low power level, the reactor power was control rods to maintain criticality.

driven down to below 30 MWt.

01:00:00 200 Power was stabilized-at this level. Attempts. Xenon poisoning built up greater than t

Variable to increase power to the desired 700-1000 MWt that anticipated for-test; as a result ~

l level were unsuccessful because of the low the ORM was 6-8' rods, substantially '

amount of operating reactivity margin (ORM).* below the 16-30 rods required by.

specification.

,, 01:03:00 200 At 01:03:00, one additional main cooling pump Based on the planned test power level 1 to was placed into service, and at 01:03:07 an- (700-1000 MWt),.only 4 main cooling-a- 01:03:07 other main cooling pump was placed into ser- pumps were required for safe operation.

vice. This resulted in a total of 8 pumps Thus, in this configuration, 4 pumps-in service as specified for the test program. would coast down at test initiation The total flow increased in excess of the and 4 pumps would remain running. The i

maximum flow allowed given the (Iow power) Soviets stated that this mode of opera-l operating conditions. The coolant tempera- tion (i.e., low core void, very low ORM, ture approached saturation. Low power-to- power measurement response, and pumps i flow ratio possibly reduced core _ void to 10%- near cavitation) is very unstable. The i

or less. This resulted in a decrease in Soviets were concerned that the pumps

steam pressure and water level in steam may have been operating close to point '

, separators. of cavitation.

Further control rod withdrawal occurred because of reduced void content. This reduced the ORM even more.

• 0perating reactivity margin is a calculated reactivity margin based on power and control rod distribution and.

positions. It is given in terms of number of control rods where 30 is the minimum' allowable. In certain-situations, this may be lowered to an absolute minimum of 16 (USSR, 1986; pp. 8, 28).

l

Table 4.1 (Continued)

Date/ time Power (NWt) Event Comment i April 26 (Continued)

Before 200 The operators blocked the emergency protec- By blocking these protection signals, 01:19:00 tion signals related to low steam pressure operator was able to continue operat-and low water level. ing plant and avoid scram.

01:19:00 200 Operator began manual replenishment of feed- Apparently anxious to establish this water to steam separator. As this colder water level well within the normal water reached the reactor core there was a range, the operator sharply increased sharp drop in the steam fraction of the cool- the feedwater flow above its nominal ant and a corresponding reduction in reactiv- value.

ity and power decrease.

, 01:19:30* 200 The AR (automatic power regulation) rods The Soviet report implied that this-moved upward to compensate for. reduction in maneuver was not permitted.

1 v' power. Some manual rods were removed entirely.

The feedwater flow to the steam separator The feedwater flows into the steam j had increased by a factor of three over the separator at the nozzles of the down-  ;

balanced flow for this power level. comers leading to the primary coolant I pumps. Hence, the core inlet flow temperature responds rapidly to any change in feedwater flow (approxi-mately 20-30 second transmit time).-

• From this point on, much of the information is based on calculations performed by Soviet analysts as described in their report (USSR, 1986).

0

Table 4.1 (Continued) ,

Date/ time Power (MWt) Event Comment April 26 (Continued) 01:19:58 200 Turbine steam bypass valve (steam dump) This was done to raise the steam pres-closed. sure which was too low. However, it continued to drop slowly until the.

start of the test (01:23:04). The valve was probably only partially open, since reactor steam was being used to power the turbine generator.

01:21:50 200 Operator reduced feedwater flow rate sharply This caused' increase of inlet tempera-from a value of four times the balanced flow ture and compounded the events 1 min-rate. ute later.

k 1 01:22:10 200 Core outlet steam quality increased *. There- Core void content increases.

m fore, AR rods began inserting.

01:22:30 200 Feedwater flow stopped decreasing at a value of two-thirds of balanced flow.

Operator noted from Skala printout that the No action was taken.

ORM was about 6 to 8 rods, far below the value where immediate reactor shutdown is required.

A printout of the actual core flux monitor The flux was " practically arched" in outputs and the position of all the regulat- the radial direction and double. peaked ing rods was obtained at this time from the axially with the higher peak in the Skala system.** top section of the core. At this highly unusual power shape, the error in estimating the control rod worths was extremely large, hence the error in estimating the ORM was also large.

• Resulting from approximately 20-second transient time from steam drum to core inlet.

• • Skala system is the program that evaluates (among other things) the operating reactivity margin (USSR, 1986).

Table 4.1 (continued)

Comment Date/ time Power (MWt) Event April 26 (Continued) 01:22:45 200 Feedwater flow rate stabilized.' Pressure began to rise.

01:23:04 200 The signal for reactor shutdown on closure This was in violation of the test

! of both turbine generator steam valves was program and normal operating proce-disabled. Turbine generator No. 7 had been dures. By avoiding reactor shutdown, switched off much earlier. it would be possible to repeat the test using reactor generated steam.

To begin the test the turbine. generator No. 8 turbine stop valve was closed and the turbine generator bypass valve remained closed.

4 Flow rate began to fall as the four main These factors caused an increase in

'8 cooling pumps powered by turbine generator the coolant void fraction (positive l

No. 8 began to run down. Steam pressures reactivity insertion) and a resulting also began to increase due to removal of tur- power increase.

bine generator steam load and the reduction (by operator action) of the feedwater rate Because of the reactor conditions at about 1 minute before. the time of the test, the void frac-tion is believed to have increased many times more sharply than it would have at normal power. This sharp increase in void fraction results in a sharp increase in reactivity.

(Soviets have stated that the normal void reactivity coefficient of 2.0x10 4/% steam volume increased to 3.0x10 4/% steam volume at test conditions.)

01:23:10 200 Pressure increased, some AR rods began with-drawing because of collapsing voids.

t 4

. . .<. ;f;

', ., y

. 'a Table 4.1 (Continued). '

]

1 'Date/ time Power (NWt) Event Comment a i

i April 26 (Continued) l 01:23:21 200 As four pumps coasted down, the flow dropped, void and power increased. To compensate, some AR rods began to drive in.

j 01:23:31 Increasing Reactivity and power increased further be- Control rods were unable to balance i cause of pump coastdown and increasing inlet reactivity additions, i

temperature.

01:23:40 Increasing Unit shift foreman gave order to press emergency scram button.

! , 01:23:43* High The " runaway" period estimated to be much Soviet calculation indicates power

! j.

D*

less than 20 seconds. The Doppler effect at this time to be 530 MWt and rising.

, only partially compensated for the void Calculated fuel temperatures increased -;

i I

reactivity. increase. sha rply.

01:23:44* - Calculations indicate the first power surge Power surge estimated to exceed 100 terminated by Doppler effect and rod inser- times full power..

tion. Coolant flow continued to decrease (due to rundown of 4 main cooling pumps) and the power continued to increase.

Operator heard banging noises and saw rods

~ The first power surge.may have dis-were stopping before they reached bottom and torted the core so that the control

! disengaged the servo drive couplings to allow rods could not be bottomed. The bang-l rods to fall into core. ing noises may have been initial rup-tures of pressure tubes or bursting of '

the reactor cylinder.

• Estimated from Soviet analysis (USSR, 1986).

l

( _

Table.4.1-(Continued)

Date/ time Power (MWt) Event ,.

Comment . -

'~ '

April 26 (Continued) y.,_

01:23:45* - Power rise likely led to fuel fragmentation m causing a large steam spike (rapid pressure q -

increase) which reversed flow to close main _

reactor pump check valves as indicated by ,

recorded data.  %

01:23:46* - Steam drum pressure exceeded " accident' . Pressure rise rate calculated by -

level." ' Soviets.was 8-10 ate /sec. y s - .j , -

'~

01:23:47* - Large increase in coolant flow as channels If initial ruptures occurred ruptured because of pressure spike. [01:23:44],- this flow increase could

, be, consistent with the upper biologi-

,!, ca] shield being lifted by the pent-up

• steam in the reactor cylinder and the resultant severing ofLall pressure tubes and control rod channels.

01:23:48* - High-pressure failure blew top off reactor and destroyed reactor. ,

01:24:00 - Second loud noise approximately 3 seconds From this point on, there is no more after first - hot fragments and sparks information from the control room, and emitted from top of reactor building. Hot observation proceeded from outside the fragments caused about 30 fires. reactor building.

• Estimated from Soviet analysis (USSR, 1986).

3 3

Table 4.1 (Continued)

Date/ time Power (MWt) Event Comment April 26 ,

(Continued) 01:24:00 Shortly after the accident, an attempt was This was unsuccessful. I (Continued) made to reduce the temperature in the reactor cavity and prevent combustion of the graphite Mixture of gases containing hydrogen using emergency and auxiliary feedwater and carbon monoxide capable of thermal pumps. Decision was later made to fill the explosion if mixed with oxygen, were reactor cavity with " heat discharging and created in core region.

filtering materials."

l 02:54:00 - Firefighting units from Pripyat and Chernobyl Three primary fire sites were: l 3 arrive. (1) turbine room above turbine I 4 generator No. 7 l o (2) reactor room l (3) partially destroyed compartments l adjacent to reactor room Firefighting units focused on fighting fire in turbine room to prevent spread to Unit 3.

1 Hand extinguishers and " stationary '

fire cranes" were used to fight fires in the compartments.

( 03:34:00 - Most of the fires on turbine room roof were l out.

I l 03:54:00 - Fires on reactor building roof were out.

05:00:00 - All fires (other than those in the core) were out. Unit 3 shut down.

Table 4.1 (Continued)

Date/ time Power (MWt) Event Comment April 27 01:13:00 -

Units 1 and 2 shut down.

April 27 to May 10 -

Decision was later made to fill the reactor cavity with " heat discharging and filtering materials."

Dropped (by helicopter) 5000 tonnes of boron compounds, dolomite, sand, clay, and lead -

onto damaged reactor.

, May 6 -

Discharge of radioactivity dropped to several g hundred curies per hour.

Nitrogen gas was pumped into space under the Problem of reducing fuel heatup was reactor : building. Temperaturer rose, stopped solved.

and began to drop.

p As insurance against " extremely improbable" Completed by end of June.

failure of the. lower tier of structures, an artificial " heat discharge horizon" was con-structed under the core.

CHAPTER 5 ROLE OF OPERATING PERSONNEL This chapter focuses on the operator actions and the breakdown in management /

administrative controls that contributed in a major way to the accident. Some descriptive material is repeated from Chapter 4, as appropriate to provide perspective on operator actions.

Since the accident at Chernobyl, much has become known about the sequence of events before, during, and after the accident. However, very little has been provided regarding the operators' experience, training, duties, and respon-sibilities.

At the time of the accident,176 shift personnel were on site at the four oper-ating units. It is not clear how duties and responsibilities were divided among these personnel.

Information available indicates that Chernobyl Unit 4 was one of the best of the 14 operating RBMK-1000 units. The training and experience of the operating crew may have focused mainly on steady-state operation since the reactor operated continually as a base-loaded unit with on-line refueling. Evidently very little, if any, training had been conducted on a plant simulator. Only one simulator at another site has been mentioned as possibly serving the training needs of operators of all RBMK units.

The Soviets believe that the previous excellent performance created an attitude in plant personnel that close adherence to procedures was unnecessary.

The Soviets felt that the previous trouble-free operation led to a dominating overconfidence.

The RBMK units had accumulated more than 100 reactor-years of operation.

Chernobyl Unit 4 had been in operation two years. It is not known what events had occurred at RBMK units that may have been precursors to the April 25, 1986 accident or what corrective actions had been taken in the areas of design, operations, or training.

The plant operating procedures are not available. However, the Soviets have described three operating restrictions in particular that bear on the accident.

(1) Procedures prohibited steady-state operation below 700 MWt - 22% of full power. The basis for this restriction was the dominating positive steam void reactivity coefficient and unstable operation at low power. The S. Visner and W. Conway of the Institute of Nuclear Power Operations (INPO) compiled this chapter.

5-1

__^

overall positive reactivity coefficient below this power level would exacerbate a core transient.

(2) The " equivalent of 30 control rods" was always to be maintained as excess reactivity margin. It is the understanding of U.S. engineers that this requirement was a means of specifying an overall rod configuration that l ensured a certain minimum initial negative reactivity rate during a scram.

l Presence of neutron absorbers within the core also decreased the magnitude l of the positive steam void reactivity coefficient.

(3) The discharge flow of any of the main circulation pumps was not to exceed a specified limit to avoid cavitation.

Figure 5.1 is a schematic drawing of the plant intended solely for use in following the operational aspects of the accident.

5.1 Operator Actions and Plant Activities Before the Accident On April 25, 1986, the plant staff was to conduct a special test on Unit 4 just before it was shut down for routine maintenance. The test was bein8 conducted to demonstrate that the turbine generators could continue to power important loads during a station blackout until the diesel generators took over. In the test, the steam supply to one of the turbine generators was to be cut off. The test would determine how long the generator would continue to supply power near rated voltage as it coasted down. Main coolant circulation and feedwater pumps were to provide the main electrical load. This test had been performed at least twice before, but the generator output voltage had dect-ased faster than desired. Changes therefore were made in generator field control, and the test was to be repeated. The International Nuclear Safety Advisory Group (INSAG)

= Generator Steam Drum with Separator Turbme ,

Fc- s asil b cor-ocna,

\ p \

N -

~ ~

ds w

D i-- a Act core \ - -

Feedpump

4c [

_e_ /

E us,W E A W  ;*

s w ua m / ' t -

9 Automate Vane --_ __ _ _ __ N Valve s

,. t / 'x

<f Emergency core coc*ng system s.wy ' Deaeraim Figure 5.1 Schematic diagram of the RBMK-1000 i

5-2

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - _ _ _ _ . _ _ _ - . n

summary report noted that, "The initiative for the test and the provision of the procedures thus lay with electrotechnical rather than nuclear experts" (INSAG, 1986).

The test called for the following actions:

~

(1) . reducing reactor power to between 700 and 1000 MWt - or between 22 and 31%

of full power (2) blocking'the emergency core cooling system (ECCS) to prevent inadvertent actuation during the test (see Figure 5.1) (Presumably, the ECCS would remain blocked only for the expected short duration of the test.)

(3) realigning the main circulation pumps so four were connected to the tur-bine_ generator on which the test would be conducted, and the remaining four main circulation pumps were connected to the station grid (the test would start with all eight pumps operating while in normal operation only t-six pumps operate; two pumps act as installed spares)

(4) shutting off steam to the test turbine generator to initiate the coastdown It is not known if the test procedure mentioned additional test conditions (e.g., power history) or any special precautions to be taken or how to proceed if the plant did not respond as expected.

It is reported that the test, viewed as a simple turbine test, received only

-perfunctory review. The station's technical safety group apparently did not

' review the procedure. The INSAG report noted that, "the procedures were poorly prepared in respect to safety" (INSAG, 1986).

The test was directed by an engineer who had expertise only in the turbine generator / electrical area. His briefing to the operations staff included direc-tions to carry out the test procedure, following station procedures as neces-

.sary. It would appear that the test engineer assumed responsibility and authority during the performance of the test.

r The operators felt a sense of urgency to complete the test. The test would have been delayed for one year if it were not performed at the scheduled time.

The reasons for the sense of urgency or its origin were not satisfactorily explained in the Soviet report.

5.2 Immediate and Short-Term Operator Actions On April 25, 1986, at 01:00, the operators started reducing power (began power descent) in preparation for the coastdown test on turbine generator No. 8.

(For an exact chronology, see Chapter 4.)

Twelve hours later, the reactor power reached 50%, and turbine generator No. 7 was shut down. The reason for the power decrease being so slow may have been to allow the xenon poisoning to equilibrate with the lowering power levels.

The operators then blocked the emergency core cooling system in accordance with the test procedure. Shortly thereafter, the power reduction was stopped for 5-3

nine hours because the load dispatcher requested a continuing supply of power.

The emergency core cooling system remained blocked for this nine-hour period, in violation of operating procedures. The ease of access to, controls for blocking and unblocking this system is not apparent.

The power reduction resumed at 23:10. However, because of an operator error in the process of switching the automatic control systems from spatial power control to global power level control, the power dropped quickly to 30 MWt.

The automatic global power control system had not been properly set. To com-pensate for the loss in reactivity from the collapse of steam bubbles during the power decrease, the operator withdrew control rods.

The power level was stabilized at 200 MWt at 01:00 on April 26. Xenon poison-ing continued to increase. To compensate, the operators withdrew additional rods. Thus more rods were withdrawn than the operating procedures allowed; procedures required maintaining a reactivity margin " equivalent of 30 control rods." The excessive withdrawal of rods placed the emergency protection system in a configuration that reduced the initial shutdown reactivity rate when scram was required. Also, the withdrawal of rods made the void reactivity coeffi-cient more positive.

The operators were unable to increase power to 700-1000 MWt, as called for in the test procedure, because of the small excess reactivity available. Oper-ating at a power level as low as 200 MWt was a violation of plant procedures, which prohibited continuous operation at power levels below 700 MWt. In this power range, small changes in power produced relatively large changes in steam volume and reactivity, making it very difficult for the operators to control power level and steam separator water level.

Two additional main circulation pumps were started in the next 7 minutes, one in each loop; thus all eight pumps were running. This action was in accordance with the test procedure. However, the test procedure called for a much higher power level. At 200 MWt - 6% of full power - very little steam was being pro-duced within the core, so the resistance to flow was low. The coolant flow rate now exceeded the allowed limits which are set to prevent cavitation. The additional flow further reduced the steam content of the coolant in the fuel channels, resulting in lower steam pressure and lower water level in the steam drums. Most importantly, these circumstances also brought the core inlet tem-perature of the coolant very close to saturation.

The operators experienced difficulty in controlling steam drum pressure and water level because at low power the controls were too coarse. (Also, changes in feedwater flow to control water level changed steam voids and reactivity in the core.) To avoid an automatic shutdown, at 01:19 the operators blocked the emergency protection signals for reactor scram that related to steam drum pres-sure and water level.

During this period, reactivity continued to drop because of xenon buildup and decreased voiding, requiring further control rod withdrawal to maintain power at 200 MWt. The operators supplemented the automat.ically actuated control rods by withdrawing manual rods. It is likely that the operators were also busy adjusting the local power distribution in the core.

5-4

-At 01:22:30, the operators noted from the computer printout that the available reactivity margin, related to the number of rods and their position in the core, had dropped well below the level requiring immediate shutdown of the

, reactor, i.e., six to eight " equivalent" rods versus the 30 " equivalent" rods required by operating procedures. Because a scram in this situation could initially add reactivity, special or emergency procedures would have to be followed to shut down the reactor'. Nevertheless, the operators continued with the test.

At 01:23:04, the operators blocked the reactor-scram that would be automati-

. cal:v activated by the shutdown of the second turbine-generator, No. 8. (The~

first turbine generator, No. 7, had been shut down earlier). The test proce-dure did not call for blocking this scram logic. The scram logic was blocked so the test could be repeated if necessary.

1 At the same time, the operators closed the stop valves to turbine generator No. 8, starting the coastdown test. Conditions had now been inadvertently established for a severe transient, as follows:

(1) The reactor was critical but at a very low power level where it was un-1 stable and difficult to control.

(2) Steam void percentage in the core was small, but the water temperature at the core inlet was near saturation, giving the potential for rapid voiding over a substantial region in the core.

-(3) The overall coefficient of reactivity was positive, with the steam (void)

! coefficient predominant.

(4) Control rods were near the top of the reactor in a region of low reac-tivity differential worth (low " bite"). It would take several seconds for the rods to insert appreciable negative reactivity. (Additionally, the rods apparently would insert positive reactivity initially as the graphite rod followers displaced water from the lower region of the core.)

The four circulation pumps powered from turbine generator No. 8 began to coast down, decreasing the water flow to the fuel channels. This allowed more steam to form in the core, increasing reactivity and initiating a power rise. "

The rising power increased the steam voids which in turn further increased power due to the overall positive reactivity coefficient. Thirty-six seconds into the test, a manual scram was initiated on an order from the shift super-visor. Because the control rods were near the top of the core, they could not counter the increasing reactivity. A very severe power excursion took place.

A loud noise (also translated as " loud report," " shock," and " banging") from the reactor was heard, and an operator noted that the control rods had not fully inserted. He then de-energized the control rod drives hoping the rods would drop under their own weight. Two to three seconds later, the operators heard a second loud noise as the reactor was destroyed.

The core reactivity exceeded prompt critical, and the power, by Soviet calcu-lation, reached 100 times rated full power. The energy release lifted the S-5

1000-ton reactor cover plate, severing all the fuel channels; the refueling machine and its crane collapsed onto the reactor.~ Hot segments from the core

~

were ejected from the reactor, and approximately 30 localized fires started, involving roofing materials and other combustibles. The disintegration of the fuel stopped the chain reaction.

Steam and water from the reactor and water f' rom the ruptured shielding tank were released into the reactor hall and compartment below the reactor core.

The graphite in the reactor was ignited, and a. severe fire resulted. Hydrogen and_ carbon monoxide were produced, but the role they played in the accident is not clear.

The rapid destruction of the reactor, the high radiation levels, and high temperatures probably precluded direct information from instrumentation on conditions in the core.

While radiation and temperature levels in the reactor hall became excessively high, the control room remained habitable, at least temporarily. Some of the operators left the control room to investigate what had happened and to assist in controlling fires; they were among the earliest casualties.

Using the auxiliary feedwater pumps, the operators injected water into the reactor at the rate of 200-300 tons per hour (about 1000 gallons per minute) at the steam separators and at the manifold between the separators and the main circulation pumps. This water came from an intact emergency core cooling system tank. The valves and pumps used remained functional, and the necessary controls may have been in the control room.

5.3 Summary of Key Operational Events and Errors The design of the plant placed a heavy dependence on adherence to administra-tive controls and procedures for safe operation. The following major opera-tional events or errors and administrative or management control breakdowns led to the accident:

(1) Overall management control of the test and its integration with plant operations were not clearly established. The test was directed by an j engineer with expertise in the turbine generator / electrical area only.

Plant management did not ensure that normal restrictions on plant opera-

~

tions were observed.

(2) The test procedure did not receive an adequate safety review. It is 7

i reported that there was a possibility that the accident might have been less severe if the ECCS had not been blocked. In any case, it may reflect the attitude of the station staff towards violations of operating proce-l dures. Also, nececsary safety precautions and instructions in the proce-

dure were evidently not adequate; this situation was not corrected in the j review of the test procedure.

(3) The operators felt a sense of urgency to complete the test. The test would have been delayed for a year had it not been performed at that time. The reasons for the sense of urgency were not well explained in the Soviet report but may have been caused by outside or management pressures. Since the evolution occurred over a 24-hour period, more than one operating shift 5-6

vas involved. The test was conducted early in.the morning and just. before

'a Soviet national holiday. These factors may have influenced performance.

(4)- The power ~ reduction- for the test was interrupted for nine hours at the

^

load dispatcher's request. -This' delay changed the initial core conditions

-fros' conditions contemplated in.the test procedures. The delay'in starting the test may also have. increased the pressure on the operating staff to make up for the lost time.

t.

-(5)~ Due to an operator error in improperly setting the control' point on the.

automatic global power controller, the power level dropped rapidly to 30 MWt when'the operators switched the automatic control system from local to global. The reactivity loss from the resulting collapse in steam tubbles and' increasing xenon poisoning' prevented the return to the 700-1000 MWt~

-power level specified in the test procedure.

f (6) The operators did not follow the test procedure:

The test was started at a' low power level that violated both the test

~

i procedure and station operating instructions. (The test was started -

at 6% power instead of 22.to 31% as specified in the test procedure.)

At low power, very little steam was being generated, so the eight

, circulation pumps produced a flow rate above allowable limits. With the high flow rate'and low power level, the water inlet temperature to the core was very close to saturation. Under these conditions, an increase in power caused a much greater increase in steam voids and reactivity than normal.

j t-The reactor scram signal for the trip of the second turbine generator was blocked, which violated station safety procedures and was not called for by the test procedure.

(7) Other safety systems were also defeated:

l Blocking the steam separator pressure and water level scrams allowed j reactor operation despite unstable conditions.

t Control rods were withdrawn well beyond safety limits specified by plant procedures. This was done to compensate for xenon buildup and negative reactivity resulting from void suppression in the core.

This error rendered the emergency protective (scram) system ineffective.

The emergency core cooling system was deactivated for more than nine hours while the plant was operating, contrary to normal procedures.

Had this system been available, according to the INSAG report and the Soviet report, the accident may have been lers severe.

(8) The plant operators and station management did not demonstrate an adequate understanding of the safety implications of their actions. Their willing-ness to conduct the test at a very low power level, with abnormal and unauthorized control rod configuration and core conditions, and with safety features bypassed indicates an insufficient understanding of the reactor and its potential behavior.

5-7

l Table 5.1, adapted in part from the Soviet report, summarizes the major oper-ational violations.

Further detailed information in the areas listed below would be of considerable help in more fully understanding some operational aspects of the accident.

(1) The exact duties, responsibilities, and authority of the station staff members.

(2) The qualifications, training, and experience of the people on shift. The kind of plant simulator training they had. The frequency with which they were retrained. How knowledgeable they were about reactor behavior, in-cluding reactivity effects and transient and accident analysis.

Table 5.1 Operator violations of procedures Violations Consequences (1) Power level below that Large positive void reactivity specified by procedures coefficient Reactor difficult to control Overall power coefficient positive (2) Control rods mispositioned Unauthorized (and probably unanalyzed) configuration Emergency protective system ineffective (3) Operated all eight main Reduced voiding but coolant circulation pumps, with temperature near saturation coolant flow exceeding authorized levels (4) Blocked reactor scram Lost automatic scram protection signal from loss of both at start of test turbine generators (5) Blocked reactor scrams on Lost reactor protection system water level and steam based on thermal parameters pressure in the drum-separator (6) Turned off the emergency Lost possibility of reducing core cooling system severity of accident 5-8

(3) The rigor and consistency of staff adherence to safety requirements in procedures and operating rules, and how these were enforced.

(4) The administrative controls on bypassing or blocking safety systems. How frequently this was done. How easy or difficult it was from an operational standpoint to bypass or block safety systems (i.e., accessibility of these 4

controls).

(5) The exact content of the turbine generator test procedure and any other procedures to which it may have referred.

(6)- Why it was so important to perform the test at the time it was attempted; why it couldn't have.been postponed.

(7) A detailed explanation of what is meant by " operating reactivity margin,"

how it relates to the number of control rods set aside for this purpose, and what the basis for this requirement was. The relationship between

" operating reactivity margin" and the new requirement of 1.2-m insertion of control rods.

4 (8) The procedures operators were required to follow in shutting down the reactor when control rod withdrawal had inadvertently decreased the

" operating reactivity margin" below the level that required the reactor to be shut down.

(9) Events that had occurred in any of the RBMK plants with lessons that had been included in staff training and operating practices at Chernobyl Unit 4.

(10) The operating shift schedules for Chernobyl Unit 4 in the month of April 1986.

5.4 Operator Actions Following the Accident Within one-half hour, firefighters from the local area arrived to supplement the plant's firefighting teams in dealing with the emergency. The major objective was to keep the fire from spreading to Unit 3. Special attention was given to protecting cable rooms and oil tank storage areas.

L At 02:15, plant personnel informed government officials in Moscow of the event at Unit 4, with the preliminary assessment that it was controllable with local resources. Also, at this time, the operators started to inject water into the reactor using the auxiliary feedwater system. The operators recognized that discharging the pressurized accumulators in the ECCS would be inadequate because of broken pipes in the primary system.

An assessment of the damage indicated that the permanently installed radiation-monitoring equipment was inoperable or off scale. The same was true of the power, flow, and temperature instrumentation. Information is not available on any measurements of radiation levels where personnel were fighting the fire.

Potassium iodide (KI) was distributed at 03:00 to personnel at the site.

5-9

An offsite response team headed by A. Abagyan, director of the Nuclear Power Plant Institute, arrived at 05:00, and a team representing the Soviet govern-ment Central Committee arrived at 20:00. A central emergency center was set up, with complete authority to deal with the accident. Information is not available on the transition of control and authority from the local plant management.

By 05:00, the fires on the turbine building roof and near the reactor had been extinguished. Also at this time, Unit 3 was shut down. We don't know why Unit 3 was kept running until then and why it was shut down at that time.

Later in the day, the injection of the auxiliary feedwater was stopped. It was judged ineffective because of broken pipes in the reactor system. There was also concern about flooding and contaminating Units 1, 2, and 3.

Units 1 and 2 were shut down the following morning at 01:13. These units had become contaminated internally because their ventilation systems had remained in service for several hours after the radioactive releases from the damaged Unit 4 began. No explanation is given on why the ventilation systems stayed on or why the units continued to operate for almost 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the accident in Unit 4.

5.5 References INSAG, 1986 International Nuclear Safety Advisory Group, " Summary Report on the Post-Accident Review Meeting on the Chernobyl Accident,"

August 30-September 5,1986, IAEA, GC(SPL.I)/3, Vienna, Septem-ber 24, 1986.

USSR, 1986 USSR State Committee on the Utilization of Atcmic Energy, "The Accident at the Chernobyl Nuclear Power Plant and Its Conse-quences," Information compiled for the IAEA Experts' Meeting, August 25-29, 1986, Vienna, 1986.

5-10

-- - - - - ~ ._ .

CHAPTER 6 -

RADIONUCLIDE RELEASE AND ATMOSPHERIC DISPERSION AND TRANSPORT

-The first topic of this chapter deals with the magnitudes and timing character-

~

istics of release of radionuclides from the Chernobyl Unit 4 plant. Its second topic is the atmospheric dispersion and transport of the released radionuclides resulting in environmental contamination within.and outside of the Soviet geographic boundary.

The Soviet report (USSR,1986) prepared for the International Atomic Energy Agency (IAEA) Experts' Meeting in Vienna, August 25-29, 1986, contains a large body of information on the subjects of this chapter. Further,-the report pre-pared for the IAEA by the International Nuclear Safety Advisory Group (INSAG) at its Post-Accident Review Meeting in Vienna, August 30-September 5,' 1986

.(INSAG, 1986), provides review, annotations, and implications of the information ,

contained in the Soviet report, and additional information and insight provided by the Soviet experts in the August 25-29 Vienna meeting. Preparation of the INSAG report included participation of and inputs from a large number of tech-nical experts, well known in their respective fields, from various countries

including the United States.

.The Chernobyl radionuclide release and atmospheric dispersion and transport de-scribed in the following two sections are derived from the information contained primarily in the two reports just cited and partly in the U.S. interagency draft report that was prepared before the Vienna meetings. The last section contains a short discussion on consistency of the estimates of the radionuclide release provided in the Soviet report with the observed data from regions outside the 1-Soviet boundary.

t 6.1 Radionuclide Release l When the Chernobyl reactor building and core structure were destre,ed, there was a large release of radionuclides from the plant. The phenomena associated with the Chernobyl accident were greatly influenced by design features and materials unique to the RBMK-1000 reactor which differ in many basic respects from those of U.S. commercial power reactors. The Chernobyl data on radionu-clide release are not directly relevant to the predicted releases from the U.S.

reactors because of fundamental differences in release mechanisms and barriers to the release to the atmosphere.

On the basis of radiation measurements and various techuical analyses of samples of environmental media within a 30-km zone around the Chernobyl plant, Soviet experts estimated that a total of about 50 mci of noble gases (approximately 100% of the core inventory) and a total of about 50 mci of other radionuclides F. Congel and S. Acharya of the U.S. Nuclear Regulatory Commission (NRC) com-piled this chapter.

6-1

(approximately 3-4% of the core inventory) were released to the environment

• over a period of 10 days (from April 26 to May 6). Throughout this period, and particularly on the first day, the release was accompanied by large amounts of energy which elevated the radionuclide plume to great heights (see Section 6.2).

About 20 mci of non-noble gas release occurred on the first day of the accident (April 26). The total non-noble gas release was composed of about 10-20% of the cesium, iodine, and tellurium inventories and about 3-6% of the inventories of other radionuclides in the reactor core at the time of the accident.

The core inventory of principal radionuclides at the time of the accident, decay-corrected to May 6, 1986, and the percentage released are shown in Table II of the INSAG report and in Table 6.1. The estimates in these tables are generally consistent with those made by the experts from the United States and United Kingdom before the Vienna meetings.

Table 6.1 Core inventories and total releases at the time of the Chernobyl accident Element Half-life Inventory

• Percentage (days) (mci) released Kr-85 3930 0.89 100 Xe-133 5.27 46 100 I-131 8.05 35 20 Te-132 3.25 8.6 15 Cs-134 750 5.1 10 Cs-137 1.1x10 4 7.8 13 Mo-99 2.8 130 2.3 Zr-95 65.5 119 3.2 Ru-103 39.5 111 2.9 Ru-106 368 54 2.9 Ba-140 12.8 78 5.6 Ce-141 32.5 119 2.3 Ce-144 284 86 2.8 Sr-89 53 54 4.0 Sr-90 1.02x10 4 5.4 4.0 Np-239 2.35 3.4 3 Pu-238 3.15x104 0.027 3 Pu-239 8.9x108 0.023 3

! Pu-240 2.4x10e 0.032 3 Pu-241 4800 4.6 3 Cm-242 164 0.7 3

• Decay corrected to May 6, 1986, and calculated as prescribed by the Soviet experts.

Source: INSAG, 1986, Table II.

• The Soviet estimates of all releases and release rates except for the noble gases have an uncertainty range of ISO %

6-2

The release of radionuclides from Chernobyl did not occur as a single acute event. Rather, only about 25% of the release took place during the first day of the accident; the rest of the release occurred as a protracted process over a 10-day period. Throughout this time, samples of air and ground deposits in the Soviet Union were obtained and measurements of the radioactive plume were made from aircrafts. From these data, the Soviet experts constructed a time-dependent release rate chart shown in Figure 6.1 (see also Table 6.2). (Note:

Figure 6.1 was provided by the Soviet experts during the August 25-29, 1986, ,

Vienna meeting. Table 6.2 is based on Table 4.13 of the Soviet report. Quanti- l ties of radionuclides shown in Figure 6.1 and Table 6.2 are decay-corrected to May 6, 1986; for example, 12 mci shown for April 26 when back-tracked from May 6 to April 26 would result in about 20 mci for the actual non-noble gas release on April 26.) The release shown in Figure 6.1 can be categorized by four stages:

12.0 l

10- -

8.0 7.0 U

E d 5.0

5. -

4.0 4.0 3.4 2.0 x 10'8 2.0 2.0  ;

0 0

112.6 1 2 3 4 5 6 DAYS 7 8 9 0.1

• 10 o,01 14

' recalculated for May 6,1986.

Figure 6.1 Daily radionuclide release into the atmosphere from the damaged unit (not including noble gases)

Source: Soviet experts at the Vienna meeting (USSR, 1986) 6-3

Table 6.2 Daily release of radioactive substances into the atmos-phere from the damaged unit (not including noble gases)*

Days after Quantity released **

Date accident (mci) 4/26 0 12 4/27 1 4.0 4/28 2 3.4 4/29 3 2.6 4/30 4 2.0 5/1 5 2.0 5/2 6 4.0 5/3 7 5.0 5/4 8 7.0 5/5 9 8.0 5/6 10 0.1 5/9 14 0.01 5/23 28 20x10.e

• The error in the release evaluation is 150%. Contributing to it are the dosimetric equipment error, the error in measuring the isotopic composition of air and soil samples, and the error in averaging fallout over a large area.

• • The values are adjusted to May 6, 1986, with allowance for radioactive decay (the release on April 26, 1986, amounted to about 20 mci at the time of release).

Source: USSR, 1986, Table 4.13.

(1) The first stage is the initial burst release on the first day (April 26) of the accident (Day 0 in Figure 6.1) which occurred without warning. In this stage, very energetic mechanical discharge of dispersed radioactive fuel took place as a result of an explosion and fuel fragmentation in the reactor. Volatile radionuclides were vaporized from overheated and prob-ably molten fuel. Composition of radionuclides in this stage of release corresponds approximately to the composition of fission products in the fuel but enriched in nuclides of volatile elements iodine, tellurium, and cesium.

(2) In the second stage, from April 26 to May 2, the release rate decreased to a minimum value of one-sixth the average release rate for the first day.

Soviet experts credit this decrease to measures undertaken to terminate the burning of graphite, and filtration of radionuclides emerging from the core. One of the measures taken was aerial deposition of about 5000 tonnes 6-4

--__=_---_L_-__ - ._.

of a variety of materials (boron carbide - 40 tonnes, dolomite - 800 tonnes, clay / sand - 1800 tonnes, and lead - 2400 tonnes) between April 27 and May 10, mostly between April 28 and May 2. In this phase, the composition of the released radionuclides was approximately the same as their composition in the fuel.

(3) In the third stage, the release was characterized by a rapid increase in the release rate reaching a daily value of about 70% of the first day's release. In the initial part of this stage, the release was primarily of volatile components, and subsequently the composition of radionuclides in the release again resembled their composition in the fuel (on May 6).

Soviet experts associated this increase in the release to (a) heatup of the fuel by residual decay heat which they estimate raised the fuel tem-perature to above 2000*C and (b) possible carbidization of uranium dioxide (UO 2 ), making it easier for fission products to escape. (It is not clear from the Soviet or INSAG reports as to whether the graphite burning was still continuing into this phase.)

(4) The fourth (final) stage, starting on May 6, is characterized by a sudden decrease in the release rate to about 1% of the initial rate, and con-tinuing to decrease thereafter. Soviet experts attribute this to special measures taken - introduction of cold nitrogen on May 4 or 5 into the reactor vault, and the formation of more refractory compounds of fission products as a result of their interaction with the material deposited.

9 Variation in the daily release rate and composition of the radionuclides re-leased from the damaged reactor are shown in Tables 6.2 and 6.3, respectively.

(Table 6.3 is based on Table 4.14 of the Soviet report.)

The distribution of fuel deposited around Chernobyl was as follows:

onsite 0.3-0.5% of the core 0-20 km 1.5-2% of the core beyond 20 km 1-1.5% of the core Samples of UO2 were found to have been oxidized to U30s. It is not clear, how-ever, whether this conversion occurred within the plant or after release to the environment.

Chemical forms of the released radionuclides were said to be quite variable.

Physical sizes of radionuclide particulates were in the range of less than 1 micrometer to tens of micrometers. Air and fallout samples showed the pres-ence of " hot" particles enriched primarily in radionuclides of one element -

such as nothing but cerium or cesium. Spherically shaped hot particles consist-ing of only ruthenium have been detected outside the Soviet Union. Further characterizations of the physical and chemical nature of the radionuclide re-lease and determinations of particle size distribution of aerosols are being undertaken by the Soviet experts.

The magnitude, timing, duration, and energy of the radionuclide release, pecu-liarities in the variations in the rate of release throughout the release period, the sudden drop in release rate at the end of the prolonged release period, and the formation of hot particles consisting of single elements were unusual. The 6-5

i Table 6.3 Radionuclide composition of release from the damaged unit of Chernobyl Nuclear Power Station

• Activity of release (mci)

Core activity release Nuclide** 4/26/86 5/6/86*** up to 5/6/86 (%)

Xe-133 5 45 Possibly up to 100 Kr-85m 0.15 - Possibly up to 100 Kr-85 - 0.5 Possibly up to 100 I-131 4.5 7.3 20 Te-132 4 1.3**** 15 Cs-134 0.15 0.5 10 Cs-137 0.3 1 13 Mo-99 0.45 3 2.3 Zr-95 0.45 3.8 3.2 Ru-103 0.6 3.2 2.9 Ru-106 0.2 1.6 2.9 Ba-140 0.5 4.3 5.6 Ce-141 0.4 2.8 2.3 Ce-144 0.45 2.4 2.8 Sr-89 0.25 2.2 4.0 Sr-90 0.015 0.22 4.0 Np-239 2.7 1.2**** 3.2 Pu-238 0.1x10 3 0.8x10 3 3.0 Pu-239 0.1x10 3 0.7x10 3 3.0 Pu-240 0.2x10 3 1x10 8 3.0 Pu-241 0.02 0.14 3.0 Pu-242 0.3x10 6 2x10 6 3.0 cm-242 3x10 3 2.1x10 2 3.0

• Error of estimate: 150%; explanation in footnotes to Table 6.2

• • The data presented relate to the activity of the main radio-nuclides measured on radiometric analyses.

• • • Total discharge up to May 6, 1986 (sic) - after April 26, 1986 (see the footnote below).

• • • • Data are presented as provided by the Soviets. The integral release must, however, be a monotonically increasing function.

Source: USSR, 1986, Table 4.14.

isotopic content and character of material released are heavily skewed toward the nonvolatile radionuclides and actinides, due to fuel fragmentation as the result of the power excursion or other mechanical release mechanisms.

Some characteristics (reactivity excursion) and conditions (presence of graphite and air) of the Chernobyl accident are not prototypical of severe accidents in 6-6

light water reactors. Nevertheless, some aspects of the radionuclide release from Chernobyl can be understood within the context of the existing data base and theoretical cor.siderations for radionuclide release as described below-(1) Enrichment of the release by volatile components (iodine, tellurium, cesium):

At elevated temperatures, radionuclides can undergo a condensed-to-vapor phase change and the vapors are swept away from the fuel. Vaporization release mechanisms are the predominant feature of modern tools for pre-dicting radionuclide release. Vaporization release rates for radionuclides are largely determined by their relative volatilities. Aerosols generated by vaporization are enriched, relative to the fuel, by the volatile species such as iodine, tellurium, and cesium. i (2) Composition of nonvolatile and actinide radionuclides in the release similar to that in the fuel:

This is probably the result of some mechanical release mechanism in which particles of fuel were aerosolized, carrying with them the associated inventory of radionuclides. One theory is that fuel particles were formed as the result of fragmentation during the power excursion and that these were subsequently entrained in air flowing through the core. Another theory is that fuel aerosols were produced as a result of oxidation of UO2 to U3 0s.

(3) Enhanced release rate beginning about 6 days after the accident:

Although no definitive explanation for this has been offered, some pos-sible explanations either individually or in combination are as follows:

(a) Once material deposition was stopped (about May 3), the melting of deposited lead and the pyrolysis of dolomite came to an end, so heat losses from the debris dropped, the temperature of the debris rose, and vaporization release again increased.

(b) Some increase in gas flow over the debris occurred which enhanced material removal by vaporization or enhanced the chemical reactions in the debris.

(c) Oxidation increased from some unidentified mechanism.

(4) Sudden drop in the release rate after May 6:

No definitive explanation for this has been offered. However, three pos-sible hypotheses are as follows:

(a) Nitrogen gas injected under pressure beneath the core succeeded in cooling the core and preventing further oxidation reaction.

(b) During the third phase of the release, parts of the core debris re-heated because of residual decay heat and may have liquefied because of reduced heat loss through the molten cover provided by the depo-sited material. The liquefied debris relocated, eventually falling 6-7

into lower pipe runs where it froze. Continued cooling flow of gas into the pipe runs may have prevented the quenched debris from any further release.

(c) The principal Soviet explanation is that the materials dropped on the core interacted with the radionuclides to produce non-volatile chemi-cal forms.

From the preceding descriptions, it appears that the Chernobyl release was strongly influenced by the unique chemical conditions of the Chernobyl accident associated with air ingress to the core, graphite-fuel interactions, graphite interactions with the radionuclides, and accident management strategies followed by the Soviet officials after destruction of the reactor building and the ini-tial release in order to control further radionuclide release and to cool the reactor.

6.2 Atmospheric Dispersion and Transport Radionuclide release from Chernobyl included, besides noble gases and volatile species, ejection of a large quantity of fuel material in the forms of fragments and particles in an assortment of sizes. The fuel fragments fell on the ground mostly near the site. Most of the fuel particles (sizes varying from less than one to tens of micrometers) also fell on the ground by gravitational settling and dry deposition processes while being dispersed in the air according to the prevailing meteorological conditions and carried by the wind - heavier particles falling in larger percentages closer to the site and lighter particles trans-porting farther out from the site. Because of preferential depletion of heavier particulate material from the plume, only extremely small-size particles of fuel and volatile fission products, and fission products in gaseous or vapor forms transported over large to very large distances from the site. Precipita-tion on the plume during transport would have caused further depletion of par-ticulate or soluble material from the plume. (There is not much information on precipitation during the 10-day release period in the Soviet report. However, according to the INSAG report, there was no heavy rainfall at the reactor site or in Kiev over the period April 26-May 30 because rainclouds moving toward the area were dispetsed when silver iodide was sprayed on them from aircraft.)

Various deposition processes (gravitational settling, dry and wet depositions) resulted in the ground contaminations and reduction in the levels of air contamination.

Over the 10-day period of radionuclide release from Chernobyl the meteorologi-cal conditions in the regions surrounding the plant were quite complex. Varying rate and composition of the radionuclide release, large amounts of energy accompanying the release, and complex meteorological conditions led to very complex patterns of air and ground contamination, both within the Soviet Union and in other countries. However, the patterns of contamination were determined very quickly by means of environmental monitoring.

The cloud which formed at the time of the accident produced a radioactive trail on the ground in a westerly and northerly direction depending on the meteoro-logical conditions governing the transport of air masses. Subsequently, for a considerable time, a stream of gaseous, volatile, and aerosol products continued to flow from the accident zone. The most intense stream was observed during 6-8

the first 2 to 3 days after the accident in the northerly direction where radi-ation levels reached 1000 mR/hr on April 27 and 500 mR/hr on April 28 at dis-tances 5 to 10 km from the reactor at an altitude of 200 m. The height of the stream on April 27 exceeded 1200 m in the northwesterly direction at about 30 km from the reactor site; the radiation level at that height was about 1 mR/hr.

During the following days, the height of the stream did not exceed 200 to 400 m.

The following is a brief summary of meteorological information provided in the i

Soviet report, which, however, is not adequate for detailed analytical evalua-tion of plume dispersion and transport over large distances to regions outside the Soviet Union.

April 26:

In the area around Chernobyl Ground level wind was variable and light.

At altitudes of 700 m to 1.5 km, wind was toward the northwest at a speed of 5 to 10 m/sec.

Wind leaving the Chernobyl area Long-distance transport of air masses in the ground laver was to westerly and northerly directions - radionuclides reached areas on the frontier with Poland on April 26-27.

At altitudes of 700 m to 1.5 km, wind was to a northwesterly direc-tion and subsequently turned to the north.

April 27-29:

Radionuclide transport was in the ground layer of air at a height of 200 m

in a northerly and northwesterly direction from the station.

Meteorological conditions during April 26 to 29 established the basic close-in radionuclide fallout zone to the northwest and northeast of the station. After this period and until May 7 to 8, the wind from the station was to the south, causing fallout in that direction.

The preceding meteorological scenarios as described in the Soviet report are consistent with those in the U.S. inter-agency draft report prepared before the Soviet report became available. The following information related to long-range transport of radionuclides is based on the U.S. inter-agency draft report.

The Chernobyl accident emphasizes the importance of large-scale atmospheric transport and diffusion for major releases of radioactive materials at various elevations extending up to 1 km or higher. Releases of material into the atmosphere well above the surface are generally subject to considerably dif-ferent transport and diffusion conditions than release near the ground.

From available radiological monitoring information, including sampling by air-craft, after the accident a number of relatively distinct " debris clouds" were identified at various heights and locations in the atmosphere. To reach 6-9

the west coast of the United States by May 5, 1986, some fraction of the ini-tial release apparently was injected relatively high into the atmosphere, at levels about 6 km (or even higher) above the surface. The " debris clouds" which meandered over Europe apparently were transported at or below about 1.5 km.

The principal atmospheric transport and diffusion model available in the United States to estimate regional and global dispersion following the accident was the Atmospheric Release Advisory Capability (ARAC) model developed and used by the Lawrence Livermore Laboratory. This model was used to examine various release scenarios regarding the vertical distribution of radioactive material released into the atmosphere.

The model uses the particle-in-cell concept for atmospheric diffusion, is capa-ble of generating a three-dimensional wind field from available meteorological data, and considers dry deposition processes. No precipitation scavenging processes were modeled for Chernobyl. Meteorological data available from selected cities throughout the world typically include hourly or 3-hourly sur-face observations (e.g. , wind speed, wind direction, cloud cover, temperature, dewpoint temperature, visibility, and precipitation). At a fewer number of cities, upper air data which are obtained less frequently from soundings (radiosondes) provide data on wind speed, wind direction, temperature, and dewpoint temperature for selected elevations (e.g. , constant pressure surfaces such as 850, 700, and 500 millibars which correspond to elevations from near the surface to over 10 km aloft). The model considers primarily wind speed and wind direction profiles which show both horizontal and vertical temporal and spatial variations with atmospheric stability inferred from other measurements such as vertical temperature gradient, cloud cover, and wind speed. Analyses of long-range transport and diffusion are somewhat limited because of the large distances between weather stations (which affects spatial variations) and the relative infrequency of upper air soundings (which affects temporal variations).

However, the analyses by the ARAC computer code showed reasonable agreement with known, if very limited radiological monitoring information from outside the Soviet Union, considering the recognized uncertainties in both the calcula-tions and the measurements.

The wet deposition processes, washout and rainout, are extremely important in examining the consequences of the Chernobyl accident. However, because of the complexity of modeling these processes and the relative uncertainties associated with modeling and very limited precipitation data, the effects of wet deposi-tion can only be considered subjectively. Precipitation appeared to have been light and widely scattered during the initial releases and plume transport.

However, subsequent precipitation throughout Europe and Asia caused widespread ground contamination and plume depletion.

6.3 Consistency of Soviet Estimates of Radionuclide Release With Observed Data From Other Countries It is obvious from the Soviet report that large amounts of radioactive materials in the reactor core were released into the surrounding environment. Much of the radioactive materials released was carried away in the form of gases and aerosols by normal air currents. Radioactive materials were widely dispersed in this manner, although most remained inside the Soviet Union.

6-10

r-i

~In the weeks following the Chernobyl' accident, elevated levels of radioactivity-were detected in air, rainwater, and food and on the ground in many European countries. On the basis of measured data on radionuclide concentrations in various environmental media and outdoor gamma ~ intensity levels in these coun-tries, many expert groups attempted to assess the magnitude of-the Chernobyl radionuclide release before the Soviet report was available. However, these were very difficult attempts, because information in several areas needed for extra-long-range plume transport calculations was lacking. Comprehensive meteorological data for a very large region both inside and outside the Soviet Union were not available. Radionuclides only in gaseous or fine particulate forms were transported to large distances (hundreds to thousands'of kilometers),

while the larger particles most likely fell out in the closer-in regions within the Soviet territory. Lack of data on the particle size distribution and physi-cal and chemical properties of the released material with which to model the fallout processes during transport added to difficulties in evaluating the release magnitudes to fit the environmental measurements at large distances.

The difficulties were further magnified because of lack of capabilities of most of the various computer codes used in different countries for (1) tracking of the changing plume trajectory due to changing meteorological conditions (par-ticularly the wind direction and vertical movement of air mass) and (2) analyz-ing the characteristics of single, multiple, and vertically or horizontally split plume (s) developed from energetic release of radionuclides which was vertically distributed at the source up to large heights and lasted as long as 10 days with widely varying release rates. Because of the difficulties posed, each expert group used its own spectrum of simplifying assumptions specifically suited to its computer code for estimating the Chernobyl release magnitudes which would reproduce the measured environmental data outside the Soviet Union.

Some of these estimates (which, however, have large uncertainties) are shown in Table 6.4.

Considering the large uncertainties in these estimates, 50% errors iri the Soviet estimates shown in Table 6.3, and uncertainties in environmental measurements in other countries, it is reasonable to conclude that estimates provided by the Soviet experts are consistent with the estimates of experts of other countries at least for the more-volatile radionuclides. It should be noted that the less-volatile radionuclides were apparently not transported beyond the bound-aries of the Soviet Union to the same degree as the volatile radionulides. This behavior is consistent with the theory that the less-volatile radionuclides i

were transported as fragmented fuel debris which was of comparatively large

( size. These larger aerosols were apparently depleted from the plume more l rapidly than the aerosols formed by condensation of volatile radionuclides.

Measurements in Sweden indicate that most of the iodine in the plume was in vapor or desorbable particulate form. It is not clear, however, whether the iodine was released from the reactor building in these forms or whether it was converted to these forms during transport. Although there has been no report-ing on detection of the noble gases in the environment associated with the Chernobyl release, it has been generally assumed that 100% of these inert gases were released quite early in the accident.

6-11

1 Table 6.4 Estimates of percent of core inventory released based on measurements outside the Soviet Union Radionuclide group British

• French

• Canadian

• LLNL(U.S.)** NRC(U.S.)***

Noble gases Large - -

a 100 Iodine 15-20 - 75 b 20(9)

Cesium 15-20 20 16 c 20(12)

Tellurium Small 7 3(1)

Barium Small - - -

0.7(0.4)

Ruthenium 1 1-2 - -

0.4(0.3)

Lanthanum Small 0.01-0.04 - -

0.06(0.2) 0.01-0.04 Ce 0.06(0.2) Zr Neptunium Small 0.02-0.04 - - 0.04(0.1) 0.04(0.1) Ce Strontium Small - 16 d -

• Reported in OECD/CSNI/GRECA meeting on June 12, 1986, Paris. (Reference available in NRC's Public Document Room, 1717 H St., NW, Washington, DC.)

• • a = 100-200 mci, b = 10-50 mci I-131, c = 1-6 MCI Cs-137, d = 0.001-0.07 mci Sr-90. Reported in LLNL, 1986, Table 2.

• • • Maximum values for the first day's release to fit the observations in Sweden.

Figures within parentheses are updates reported in OECD/CSNI/GRECA meeting, January 14-15, 1987, Paris. (Reference available in NRC's Public Document Room, 1717 H St., NW, Washington, DC.)

6.4 References INSAG, 1986 International Nuclear Safety Advisory Group, " Summary Report on the Post-Accident Review Meeting on the Chernobyl Accident,"

August 30-September 5, 1986, GC(SPL.I)/3, IAEA, Vienna, September 24, 1986.

LLNL, 1986 Lawrence Livermore National Laboratory, " ARAC Response to the Chernobyl Reactor Accident," UCID-20834, July 1986.

USSR, 1986 USSR State Committee on the Utilization of Atomic Energy, "The Accident at the Chernobyl Nuclear Power Plant and Its Consequences," Information compiled for the IAEA Experts' Meeting, August 25-29, 1986, Vienna, 1986.

6-12

4 CHAPTER 7 EMERGENCY PREPAREDNESS AND RESPONSE

' In this chapter is gathered and summarized all available-information on'the-Soviet Union's emergency preparedness for potential accidents at the Chernobyl Nuclear. Power Station; the Soviet response actions to the actual emergency are.

reported.

The fact-finding program in emergency preparedness and response includes:

(1) documenting both offsite and onsite emergency planning and preparedness measures that were in place for the Chernobyl nuclear facility and (2) gather-ing all available information on the response to the accident, and relating it, where feasible, to.the preaccident emergency planning and preparedness acti-vities. Emergency response organizations are identified and their roles de-scribed, where known. The alert and notification system used by the Soviets is examined. Soviet experience with the range of protective actions taken is also studied, including evacuation, sheltering, use of radioprotective drugs, and planned medical arrangements and their implementation during the accident.

Finally, Soviet information pertinent to decontamination, relocation, and re-entry is documented, including descriptions of the radiological monitoring program (s) being used for c'ntaminated, o decontaminated, and disposal areas.

The information which forms the basis for this chapter comes from the meeting held under the auspices of the International I.tomic Energy Agency (IAEA) in Vienna, Austria, from August 25-29, 1986, and a report from the International Safety Advisory Group (INSAG,1986) which met from August 30-September 5,1986, also sponsored by the IAEA. The chapter is also based on information from press clippings, monitored radio broadcasts, Soviet press accounts, etc.

Specific sources are referenced. However, the reliability of some of this information, particularly media accounts, cannot be firmly established at this time.

7.1 Emergency Plans Considering the information available, knowledge on the status of Soviet radio-logical emergency planning for the Chernobyl power station is limited. Known information includes a Russian paper presented at an IAEA workshop in 1980 (Bekrestnov,1981) reporting a general planning framework that describes a plant location strategy, accident classifications, public safety measures, and an acci-dent management organization structure for nuclear power plants M. Sanders and V. Adler of the Federal Emergency Management Agency (FEMA) compiled this chapter.

7-1

,v

the massive mobilization of resources during the Soviet response, along with the Bekrestnov paper and Russian descriptions of response activities, indicating prior planning activities.

Russian admissions that response plans as they existed were of limited value to response teams arriving at Chernobyl, and substantial ad hoc planning ensued Russian regulations for nuclea power plants currently being translated and reviewed to determine the extent to which they contain emergency planning materials In the paper presented at the IAEA workshop in 1980 and coauthored by an offi-cial of the USSR Ministry of Energy (Bekrestnov, 1981), a strategy of locating nuclear power plants 25 to 40 km (16 to 25 mi) from cities is identified. Also, accidents at these plants are separated into three categories based upon degree of severity, and planning of safety measures is based upon the most severe accident categories and their impacts. Safety precautions for the public are taken based upon expected body doses (see Section 7.7) and include the follow-ing measures described in detail by Russian reports and officials in Vienna (Bekrestnov, 1981, pp. 148 and 149):

temporary shelter limited stay in the open air decontamination of skin and clothing limited consumption of contaminated food iodine prophylaxis (KI)

In addition, the Eekrestnov paper describes the hierarchy of an accident manage-ment organization and information needs and responsibilities and/or authorities by managerial level. At the top of the management organization is a "coordina-tion center" involving both government authorities and plant personnel, divided sc into five sections and attending to one of the following problem areas (Bekrestnov, 1981, p. 150):

constant surveillance of the operating conditions of the power plant radiation control dosimetric inspection of the territory around the plant and the environ-mental protection zone s

protection of the population and provisional evacuation, if necessary medical aid for the population and plant personnel, including iodine ,

prophylaxis (KI)

The coordination center appears to be very similar in function to the "special commission" described by the Russian delegation in Vienna as having ordered and coordinated all protective measures and deployments of resources and personnel (INSAG, 1986, p. 79). Indeed, the delegation emphasized the importance of a

" centralized coordination center" (INSAG, 1986, p. 80).

7-2 1

g c l 3

' The remainder of this chapter includes detailed descriptions of a massive mobil-ization of personnel and equipment to accomplish medical transportation, medical i treatment, remedial action, evacuation transportation,' radiological monitoring, decontamination, public alerting, access control, security, relocation, site tunneling, dike construction, and water well drilling. At the very least, this would have required the existence of standard procedures, resource list-ings, and general plans for response to civil emergencies. The Soviet IAEA

< paper, for example, lists one emergency response action as "put plan for popu-lation protection into operation (if necessary)" (Bekrestnov,1981, p.150).

In addition, it was learned at Vienna that the Soviets have a planned 3-km (1.9-mi) safety zone around each nuclear power plant,' and they restrict build-ing of factories within a radius of 3 to 10 km (1.9 to 6.2 mi) once a nuclear power plant is built. The 30-km (18.6-mi) zone within which evacuation took place, was an "ad hoc" measure resulting from the severity of the accident (Warman, 1986b, p. 1).

It was also indicated at Vienna that since 1969, the Soviet Union has had a set of protective action guides which form the basis for protective actions including sheltering, evacuation, and protective action decisionmaking.*

Similarly, the Russian delegation also stated at the meeting that when the re-spolose team from Moscow and other locations arrived at Chernobyl, it found the response plans had only limited value and that the team had to resort to "ad hoc" planning (Sanders, 1986). The massive scale of the accident probably was a major factor in forcing ad hoc planning, as it was noted to have overwhelmed local resources. This was because the release of several million curies ini-tially with similar though smaller releases daily was not included in Soviet preplanning (INSAG, 1986, p. 79; Warman, 1986a, p. 3). For example, a major difficulty was that, because of the " actual situation...not all existing arrangements could be applied" (INSAG, 1986, p. 78).

The extent of ad hoc emergency planning for evacuation transportation during the emergency is illustrated in a Soviet news report by an interview with Gennadiy Vasilyevich Berdov, militia major general and Ukrainian deputy mini-ster of internal affairs; he stated:

When the problem of evacuating the settlement rose, we gathered

- 3all divisional inspectors and told them: let us have all data h on how many buildings and gat'es are [there) in your respective

\ division. We obtained these data and determined the necessary number of motor buses, as well as worked out a plan for the evacuation. In this respect, everything must be clear and well organized. In such cases chaco is impermissible (Zhukovskiy, s 1986).

Another Soviet news report gave similar information as follows:

The main burden of all the difficulties connected with evacua-tion work was borne by precinct inspectors in the city of Pripyat. The speed and precision of the evacuation itself

• Marshall Sanders, FEMA, personal communication, October 1986; also see Sec-tion 7.7.

7-3

- - _ _ _ . - . - _ _ . . . _ , _ , , _ , _.1 1

k depended largely on them.. Lists were drawn up through the night and for half of the next day, staffers were assigned L duties, depending on the number of homes and doorways, trans- .

portation needs were calculated. Buses were allocated to each sector and were given precise routes [Illesh, 1986].

The Russian delegation indicated that this ad hoc p}anning enabled the evacua-

~

1 tion of 45,000 people from Pripyat to be executed within less than three hours, ,

but that the ad hoc evacuation of 90,000 people from the remainder of a 30-km zone around the plant was much more difficult. They identified the refusal of most of.the rural population to leave their animals behind as a major diffi-culty (Warman, 1986b, p. 2). An earlier Soviet news report had also identified this difficulty, indicating that "at the initial stage, there was considerable confusion" (Gubarev, 1986). .The problem was remedied through'the use of mili-tary trucks (probably.also ad hoc) for evacuating about 19,000 cattle

'(Sanders, 1986, pp. 2 and 4).

~

Another very important measure taken by the Soviets, before evacuating Pripyat,

may have either been covered by in place plans (possibly for civil defense) or was an ad hoc action.'. This was the covering (with a polymer substance) of land areas along roads to be used as evacuation routes (Sanders, 1986, p. 4). This action was-required because unlike many evacuations in nuclear power plant drills and actual hazardous materials incidents, the Chernobyl evacuation had been preceded by a severe release of a hazardous substance over evacuation routes. This route preparation measure demonstrated effective foresight, was unique, and was apparently quite successful. Information provided at Vienna indicated that the 45,000 Pripyat evacuees received an average body dose of 3.3 ren, far below Soviet standards for levels of exposure (Warman,1986b,

p. 3).

These evacuations and their preparations are described in more detail in Sec-tion 7.4. Another important protective action, potassium iodide (KI) distri-bution, is also menti w d here because Soviet officials indicated that virtually all peasants enthusiastitC N took KI tablets (Warman,1986a, p. 6). This in-plies Soviet plans were in p h ce for availability and distribution of the tablets.

There are severa1' indications that the Soviets intend to improve emergency pre-paredness. Yevgeni Velikhov, the vice president of the Soviet Academy of

' Sciences, was quoted as saying that "the Chernobyl event will influence and affect our decision in future technical and administrative policies" (Post, 1986d). A top-ranking Soviet nuclear power official, Gennadi Veretennikov, also was quoted as saying that the government has issued new " operating in-structions" for all its nuclear stations as soon as the Chernobyl accident occurred and that the directives covered unspecified " organizational measures" (NY Times, 1986c).

The Soviet Union also has programs, regulatory bodies, and regulations for nuc-lear safety. The supervision of nuclear power plant safety is established by the following regulatory agencies, which oversee compliance with regulations

).. and standards in the d,esign, construction, and operation of nuclear power plants for the functions indicated (Semenov, 1983):

7-4 L - - -

• State Committee on Supervision of Safe Operations in Industry and Mining under the supervision of the Council of Ministers of the USSR - engineering safety State Nuclear Safety' Inspection - nuclear safety State Sanitary Inspection of the USSR under.the Ministry of Public Health - radiation safety The primary regulatory document on nuclear power plant safety in the USSR was issued in 1973 and is entitled " General Regulations To Ensure the Safety of Nuclear Power Plants in Design, Construction, and Operation." This document prescribes tasks required to ensure safety (Semenov, 1983). Other regulatory documents are " Regulations for Design and Safe Operation of Components for Nuclear Power Plants, Test and Research Reactors, and Installations" and

" Nuclear Safety Regulations for Nuclear Power Plants." The latter document, issued in 1975, contains the main technical and organizational requirements to ensure nuclear safety in the design, construction, and operation of nuclear power plants, and, the training requirements for personnel involved with reactor operation (Semenov, 1983).

The primary document for radiation safety is " Radiation Safety Standards" (RSS-76). This document reflects recommendations of the International Commis-sion on Radiological Protection (ICRP) and establishes a system of dose limits (Semenov,1983). A separate document, "The Health Regulations for Design and Operation of Nuclear Power Plants," issued in 1978, extends the application of the basic RSS-76 document to siting, monitoring, and inspection (Semenov, 1983).

Copies of the documents mentioned above were not available for review; therefore, it is not known if any of them contain integrated plans for radiological emer-gency response. Dose limits and training requirements for reactor operating

. personnel, which apparently are included therein, are relevant to radiological emergency planning and response and may have provided guidance during the Chernobyl accident. In addition, on the basis of a suggestion at the Vienna meeting, the United States has obtained copies of the following Soviet regula-tory documents from the IAEA:

" Main Sanitary Norms, Central Regulations, and Operation of Nuclear Power Plants" (SP-NP-79; September 1981)

• " General (or Central) Rules To Secure Safety of Nuclear Powe: Plant Design, Construction, and Operation" (OPB-82; 1972)

These documents are currently being translated and will be reviewed to deter-

'mine the extent of emergency planning content, which based upon the document titles, is expected to be of a generic nature.

One knowledgeable source, a nuclear engineer formerly associated with a nuclear power program in a European communist country, has stated that radiological emergency planning at communist nuclear power plants is extensive. He also stated that he is convinced that planning is tied in very closely with their civil defense system and is highly centralized.*

• Aladar Stolmar, personal communication, July 29, 1986.

7-5  !

l 1

i

C b

h However, despite all of the foregoing information, it is still not definitely

, known whether a site-specific overall emergency plan or perhaps individual

plans dealing with functions such as evacuation and KI distribution were in s place at the time of the accident. It was noted in the IAEA report on the Vienna meeting (INSAG, 1986) that the short time available during the meeting prevented a detailed discussion of preplanning components. It was suggested in the report that this topic be discussed at a future meeting, particularly with regard to technical aspects and criteria, problems encountered, and lessons to

) be learned (INSAG, 1986, p. 81). One particular planning component of special F

interest, whether it was preplanned or planned and executed on an ad hoc basis, g is the covering of evacuation route land areas with a polymer substance. Con-i ventional thinking about evacuations as precautionary measures before evacua-L tion routes were contaminated by major releases of hazardous substances may 4 benefit greatly from increased information on how Chernobyl emergency response planners and operational personnel dealt with this problem.

L i

7.2 Emergency Organization and Facilities t

4 The available information clearly indicates that many organizations and func-s tional groups took part in the response to the emergency at the Chernobyl power i station. It also indicates that a "special commission" ordered and coordinated g emergency response activities (INSAG, 1986, p. 79). Whether the commission was

[ configured like the prototype " coordination center" described in Section 7.1 as F having five sections dealing with various components of emergency response is

{ not known. Also not known is whether the commission was comprised of the spe-cialist team dispatched immediately from Moscow, plus the local authorities and L

plant officials they were sent to assist (INSAG, 1986, p. 77). However, it is "1 known that Soviet officials at Vienna emphasized the importance of a centralized

" emergency coordination centre with all the authority and powers to direct the

[

n response organization." Also, the generic functional responsibilities described for the Chernobyl coordination center are essentially the same as those deli-

[ neated in the 1980 Soviet paper (see Section 7.1) presented at an IAEA workshop (INSAG, 1986, p. 80; Bekrestnov, 1981, p. 150).

F  :

3 Despite the special commissica, Soviet information provided at Vienna and ear-  !

i lier Soviet statements indicate that emergency response was hindered by a lack i of adequate equipment and facilities, and an underestimation of the severity of the accident by plant personnel and local officials. A Soviet official in-

[ dicated that personnel dealing with the accident did not have all the equipment f they needed. Deputy Premier Ivan Silayev said that "better facilities" were c needed. After the accident he indicated that "we have invited our designers e

and machine builders here. We are showing them what is required in such cir-b cumstances, what facilities there ought to be...the things that we lacked" L (Chicago Tribune, 1986). An example of the lack of special equipment cited

1. in Vienna was the absence of hydraulic lifters to place firefighters on the

{ burning roofs at the plant site (INSAG, 1986, p. 63). i k

I Another factor hindering emergency response was identified by the Soviets at '

[ the Vienna meeting in August when they reported initial problems in accurately  ;

reporting the severity of the accident situation at the plant and off site (INSAG, 1986, p. 77). The director and chief engineer of the Chernobyl power i station were both subsequently dismissed for mishandling the disaster at the

[ plant. Pravda reported that they failed "to insure correct and firm leadership  ;

in the difficult conditions of the accident and displayed irresponsibility and hr 5

5 7-6 2

=

EE.

E . , '

inability to organize. They were unable to give an assessment of what had happened and to take cardinal measures to organize effective work of all the departments in the liquidation of the consequences of the accident" (NY Times, 1986g). Similarly, the chairman of the Soviet news agency, Valentin Vanin, has stated that "the first reports of the power plant were incomplete and turned out to be incorrect _(UPI, 1986; also see Section 7.11). The prototype emergency organization set forth in the 1980 Soviet paper at an IAEA workshop (Bekrestnov, 1981, p.150) lists the following responsibilities for nuclear power plant officials:

- Compare accident with theoretical accident categories.

Form preliminary conclusion about the category of failure.

- Form conclusion about consequences.

-' Form conclusion about radiological situation in the region.

Inform authorities.

- Put plan for population protection into operation (if necessary).

Relevant to the stated problems, in his public statement on May 14, Soviet leader Mikhail Gorbachev indicated that in the future, greater attention will be paid to the reliability of equipment and " questions of discipline, order and j organization" at nuclear power plants (Post, 1986a).

The Soviets indicated that the initial protective actions were coordinated from -

the Communist Party headquarters in the early morning hours of April 26 (Warman, j 1986a, p. 5). It is not known whether the arrival of the specialist team from .

Moscow resulted in a move to another location.

Given the major roles played by the specialist team sent from Moscow and the special commission which, once established, directed the emergency response, dissemination of organizational and operational " lessons learned" information by them could prove quite useful for such organizations in other nations.

T 7.3 Alert and Notification System 1

! Although details are lacking, it is possible to characterize generally the alert t and notification system that was used to respond to the Chernobyl accident.

i' Since the accident occurred during the middle of the night on April 26 and the initial protective action decision was to call for in-place sheltering of the public, Soviet officials decided not to notify residents of the affected area until 08:00 (Warman, 1986a, p. 5). Notification was carried out by the system of Soviets in each apartment house and block, who also distributed potassium iodide (KI), and who were assisted by young Communist Party members. (Warman, 1986a, pp. 4-5; INSAG, 1986, p. 77). Another source indicates that the evacua-tion of Pripyat was announced at 12:00, with buses arriving from Kiev at 14:00 to evacuate those without vehicles (Warman, 1986a, p. 6). In addition, it is apparent that no siren system was used, and that telephones could not be relied on because most Russians do not have them (Warman, 1986a, p. 4). One Soviet official stated that "In principle, warning methods in my opinion require some thorough study and discussion" (Warman, 1986a: p. 5).

A nuclear engineer experienced in planning at nuclear power plants in communist countries stated that public alerting is primarily accomplished by a wired radio system installed in each house or apartment near the power plant. According to 7-7 n

him, the door-to-door notification is probably a backup means to ensure that the residents have taken recommended actions.*

The foregoing information clearly describes the alerting and notification of Pripyat but does not describe when and how the other residents in the 30-km zone were alerted to the accident and_ notified that they were going to be~ evac-usted. Particularly in view of the large size of this zone, dissemination of this information could prove useful to emergency planners, particularly those planning for rural communities.

7.4 Protective Actions Taken The available information indicates that Soviet protective actions during the Chernobyl emergency consisted of sheltering, administration of KI, evacuation, decontamination, and measures to prevent radiation exposure in the ingestion pathway. As described in Section 7.1, all the protective measures and deploy-ment of resources and personnel were ordered and coordinated by a "special commission" (INSAG, 1986, p. 79). Pre-established criteria or referent levels were used in making decisions on emergency protective actions (Sanders, 1986, pp. 2 and 4).

Sheltering _of the general public in Pripyat, including the closing of schools i

and kindergartens, was the chosen protective action from the time of the acci-dent early on the morning of April 26 through noon on April 27 (INSAG,1986, pp. 77-78). Concurrently, potassium iodide (KI) tablets were distributed door to door and KI was ultimately consumed as well by the 45,000 residents of Pripyat and some 90,000 peasants in 71 villages within 30 km (18.6 mi) of the nuclear power plant (Warman,1986a, p. 6).

The decision to shelter the residents of Pripyat rather than to evacuate them on the day of the accident was based on the permissible levels of radiation measured in Pripyat, while at the same time high levels were measured along potential evacuation routes. Thermal and wind conditions associated with the initial releases carried most of the radioactive materials above and around Pripyat (Sanders, 1986, p. 3). Although the accident occurred at 01:24 on April 26, the official door-to-door notification to shelter and stay indoors with the windows closed was not given to the residents of Pripyat until 08:00 on the same day (Warman, 1986a, p. 5; Warman, 1986b, p. 2). Since the accident occurred at night, Russian authorities reported that it would be impractical to wake people up to tell them to stay in bed. The time from 02:00 to 08:00 was spent in emergency planning and obtaining and distributing KI tablets for issuance to individuals at 08:00 (Warman, 1986a, p. 5).

The Russians were apparently well prepared for large-scale distribution of KI l

tablets to the general public as evidenced by the distributions described above.

The KI was distributed to prevent the accumulation of radioactive iodine in the thyroid glands of members of the general public. Thousands of measurements of I-131 activity in the thyroids of the exposed population suggest that the ob-

!. served levels were lower than those that would have been expected had this i prophylactic measure not been taken (INSAG, 1986, p. 93). The use of KI by the J

i *Aladar Stolmar, personal communication, July 29, 1986.

7-8 t

! A

Pripyat population in' particular was credited with permissible iodine content - '

~

(less than 30 rad) found in 97% of the 206 evacuees tested at one relocation center (Sanders, 1986, p. 5). It.is also important to note that no serious side effects of KI use have been reported to date (INSAG, 1986, p. 93; Sanders, p.' 5; Warman~, 1986b,'p. 3).

Sub' sequent decisions regarding evacuation were based on increasing radiation levels in areas' surrounding the Chernobyl plant. Late in the night of April 26, radiation level.s in Pripyat started rising and it soon became apparent that the lower intervention level for evacuation and eventually .the upper intervention level could be exceeded if the population remained in their homes (INSAG, 1986, p. 78).

Evacuation of Pripyat did not commence until about 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after the accident at Chernobyl because of this delayed increase in radiation levels at Pripyat and the need for coordinating the needed logistical resources, and preparing evacuation routes. Ad hoc evacuation plans had to be prepared since not all

" existing arrangements" could be applied (INSAG, 1986, p. 78). Arrangements for transportation, setting up relocation centers, providing radiation monitor-ing and decontamination services for people, providing replacement clothing and other necessities, identifying and augmenting medical facilities, are some of the things that-had to be done in order to carry out an effective evacuation.

These actions were planned and put into place during the roughly 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> from the time of the accident to the start _of the evacuation (Sanders, 1986, pp.3-4).

Time.was also needed to take precautions along the evacuation routes that had been contaminated above permissible levels. This was done by using a polymer substance to cover land areas along the roads used for the evacuation (Sanders, 1986, p. 4).

The population of Pripyat was evacuated primarily by buses obtained from Kiev approximately 80 km-(50 mi) away, since there were very few private automobiles in the Chernobyl area (Warman,1986b, p. 2). At noon on April 27, permission was given to people who had their own vehicles to evacuate, and the general evacuation of Pripyat began at 14:00 on April 27 when the buses arrived from Kiev (Warman, 1986a, p. 6). The 45,000 residents of Pripyat were evacuated in 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> (Sanders, 1986 p. 4).

Evacuation of an additional 90,000 inhabitants within the 30-km (18.6-mi) zone started several days later and was not completed until a week after the acci-

{ dent had occurred (Warman, 1986b, p. 1). Altogether, the Soviets announced

that 135,000 people had been evacuated from the 30-km area (USSR, 1986, p. 38).

A major difficulty that was reported in carrying out this evacuation was that many peasants refused to abandon their animals, so an evacuation of animals was ordered to convince those peasants to leave (Warman, 1986a, p. 6). This forced the ad hoc planning of livestock evacuation described in Section 7.1. Another problem dealing with the evacuation was the fact that the evacuation route ap-parently coincided with the plume centerline for a fairly large distance, re-sulting in high exposures received by some of the bus drivers (Warman, 1986a,

p. 3).

Generally, the behavior of evacuees was reported by the Soviet official who supervised the evacuation to be exemplary. No panic was observed, although 7-9

^

. . - - _ -= .- -

"some psychological problems required overnight hospitalizations of a few dis-traught persons to calm them down" (Warman, 1986a, p. 4).

Other protective action measures that were reported during the emergency in-cluded decontamination (see Section 7.8) and measures taken to prevent or mini-mize radiation exposure via the ingestion pathway. Decontamination activities have been extensive in the 30-km zone and other measures have extended beyond that zone, particularly to the city of Kiev (see below). Another account, given at the Vienna meeting, indicates that the primary contamination of evac-usted dairy cows was surface contamination and most animals were washed down.

Those animals which had not been washed down or were injured during evacuation were slaughtered (Warman, 1986a, p. 7). In addition, intervention levels for I-131 in milk, 75% of which is exported from the area (Warman, 1986a, p. 7), as well as leafy vegetables, were established with the object of limiting the dose to a child's thyroid to 30 rem per year. Other, unidentified standards were selected for I-131 in meat, poultry, eggs, and berries. Later, still more

. foods were included and an overall dose limit of 5 rem for an individual in the first year was established (INSAG, 1986, p. 86). No specific information was available on how or to what extent these limits were enforced.

The Ukrainian Health Minister, Anatomy Y. Romanenko, appeared on television and told the people of Kiev that they were in no danger, but advised them to keep children indoors, to wash their hair daily, to wipe the dust indoors with wet cloths, and to take several other precautions (NY Times, 1986e).

. There is concern by the Soviets about potential contamination of the groundwater and surface water in the area of the Chernobyl power station. These water sup-plies are being monitored and remedial work has been done. In the early stages of the accident, as a preventive measure, the residents of Kiev used well water rather than surface water. The public water supply has been used subsequently, but with constant sampling (Warman, 1986a, p. 2 of section on specific radio-logical matters). The highest levels of I-131 concentrations observed in the Kiev reservoir, the source of most concern, were 3x10 s curies / liter on May 3, 1986 (Sanders, 1986, p. 7). The Russians also reported that in June, con-struction of a series of hydraulic engineering structures was initiated in order to protect the groundwater and surface water in the Chernobyl power sta-

, tion area from contamination (USSR, 1986, p. 33). In addition, a unique aspect )

of the Soviet emergency response was the seeding of clouds by aircraft to break l them up and prevent rainfall in the region for a number of weeks after the accident (Warman, 1986b, p. 2). This cloud seeding was accomplished by spray-ing with silver iodide (INSAG, 1986, p. 83).

I Although much is now known about the protective measures taken as a result of the accident at Chernobyl, little is known about the details of the evacuation, particularly the additional evacuation of the 90,000 people after the initial Pripyat evacuation (Sanders, 1986, p. 4), and any spontaneous or unordered evacuation. Also, little is known about how people were advised of ingestion pathway protective measures and how food consumption restrictions were enforced.

7 7.5 Radiological Monitoring and Exposure Control Available information indicates that radiological monitoring was conducted by the Soviets at the Chernobyl power station at the time of the accident, and subsequently in nearby and outlying areas affected by the radioactive releases 7-10

. .. . - - -~ -- . ._

i (INSAG, 1986, pp. 67-69). The Soviet working document presented in August at

, . Vienna (USSR, 1986,'p. 35) indicates that:

I ~

When.the accident occurred, the official meteorological, radiation ,

and public health monitoring system began to operate on an emergency footing. As soon as the scale of the accident became evident, the monitoring system was widened to bring in additional groups of ex-4

.perts and technicians.- In the first days after the accident...the

. monitoring system began to be extended to cover long-term problems also'. - Among the organizations involved in the establishment of the

. system were the State Committee on Hydrometeorology and Environmental Protection, the Ministries of Health of the USSR and of the Union 1

Republics, the Academies of Science of the USSR, the Ukrainian SSR and the Russian SSR, the State Committee on the Utilization of Atomic Energy and the State Agro-industrial Committee.

In addition, reports indicate that dosimetry for radiological exposure control

' was used by emergency workers during the early stages of the accident response.

One Soviet press report (Polyakov, 1986, p. 5) describes the use of dosimeters by the helicopter pilots:

"Everyone can determine at any moment with the help of an individual

. dosimeter what dose of radiation he has received," said Major General i of Aviation V. Kobyakov, member of the Military Council and chief of l~ .the district Air Force Political Department. "And yet even we senior 4

comrades sometimes need to have recourse to monitoring. Certain I pilots are very reluctant to report the dose received and are afraid that it will be recognized as high and that they will be taken off n flights and removed from the region. We have to explain: You will be replaced at once by another crew, a fresh one - don't' worry..."

The use of the word "high" relating to doses received, with an associated impact described as being "taken off flights and removed from the region" implies some i

system of radiological exposure control for these emergency workers. As men-tioned in Section 7.1, the Soviet document entitled, " Radiation Safety Stan-dards," establishes a system of dose limits for nuclear power plants, but it is not known whether there are standards for operational workers only or also for emergency workers. No information was presented at the Vienna meeting re-( garding any radiological exposure control system for emergency workers, although l there was discussion of strict dosimetric monitoring of all transport and of

( transferring working personnel from one vehicle to another at three surveillance zone. boundaries within the 30-km zone (Warman, 1986b, p. 2).

'Whatever the radiological exposure control system, certain pilots were reluc-tant to report doses and may have received doses above those usually allowed.

This may have been allowed because of the critical importance of their mission to people in the region.

A similar situation existed for the firefighters who responded to the initial explosion and fire. Another Soviet press report (Alimov,1986) noted the use of-dosimetry by the firemen, but also noted the extreme life-saving nature of their mission:

7-11

]

In this menacing situation, when the fate of the power station -

and-not only the power station - was being decided, none of the firemen faltered or gave way. They all underst>od clearly and consciously what they were going into - by that time the dosi-meter operators had already given the terrible warning -

radiationt But there.was simply no other way out. They knew what was at stake in their struggle:against the fire.

The article quoted the chief of the Chernobyl fire unit, who was . hospitalized in serious condition from radiation exposure, as saying: ."We only knew one-

- thing, we must stay to the end. That was our duty to [the) people."

The above examples indicate that for these critical emergency workers at least, the magnitude of the disaster hindered and in some cases forced abandonment of radiological exposure control. However, another Soviet-press report (Zhukovskiy, 1986, p. 3) stated that when an operational headquarters was set up at the

- Pripyat city militia station early in the accident response, " militiamen on their way to the posts.were additionally armed with desimeters," indicating practice of exposure control under a less critical immediate situation.

In.the period following the initial response to the explosion and fire at Chernobyl, available information indicates that radiological monitoring of food and of the environment has been extensively used to determine the extent of radiological contamination. In Gorbache 's public address on Soviet television on May 14 (Pravda, 1986, p. 1) he stated:

Organizations of the meteorological service are constantly moni-toring the radiation situation on the ground surface, on water, and in the atmosphere. They have at their disposal the necessary technical systems and are using specially equipped planes, heli-copters, and ground monitoring stations.

Tables 7.1 and 7.2 present contamination levels of various agricultural products and milk, respectively, which the Soviets measured in the aftermath of the acci-dent (USSR, 1986, Annex 7, pp. 58 and 60).

According to the Soviets, "it proved possible to keep population exposures l within the established limits" (USSR, 1986, p. 38). As noted in Section 7.1, <

the 45,000 evacuees from Pripyat received an average whole-body dose of 3.3 rem. This reflects the effectiveness of the evacuation mentioned in that sec-tion and the relatively low dose rates during the first day. Additional infor-mation provided by the Russian delegation at Vienna indicates that:

The 90,000 evacuees residing within 3 to 30 km (1.9 to 18.6 mi) received an average whole body dose of 16 rem and an average 4 thyroid dose of less than 30 rem. The 24,000 person subgroup within 3 to 15 km (1.9 to 9.3 mi) received an average dose of 43 rem. These large doses reflect the fact that many of these persons were not evacuated until late in the first week follow-

, ing the accident, despite the fact that fuel fines were widely deposited in that area (Warman, 1986b, p. 4).

The higher doses resulting from the longer evacuation times were also partly due to delays caused by peasants refusing to evacuate until their cattle were 7-12

Table 7.1. Agricultural products in which the perm 5.tted radioactive contamination was found to be exceeded

-Food products and proportions (%) which did not comply with regulations Milk &

dairy Vege-

. Republic- Region. Heat produce . Greens Berries tables Fish Byelorussia Minskaya 10 5 - - -

Gomelskaya 40 30 15 10 5 90 Brestskaya 10' 50 5 3 5 -

Mogilevskaya 20 -10 - - - -

Grodhenskaya -

5 - - - -

RSFSR Tulskaya -

15 - - - -

Brynskaya -

30 - - - -

Kalujskaya -

20 - - - -

Kurskaya -

30 - - - -

Orlovskaya -

10 - - - -

. The Ukraine Kievskaya -

10 20 -

20 Source: USSR, 1986, Annex 7, p.-58.

4 Table 7.2 Comparison of estimated and actual levels of milk contamination by I-131 in May 1986 in I

10 regions, subjected to the greatest radio-active contamination by Chernobyl accidental release products, mci / liter Regions Estimated levels Actual measurements Gomelskaya 0.2 - 14 0.02 - 14 Kievskaya 0.06 - 7.3 -

Pryarskaya 0.04 - 5.0 0.02 - 1.3 Jitomirskaya 0.03 - 3.3 -

Mogilevskaya 0.02 - 2.5 0.02 - 2.0 Orlovskaya 0.02 - 2.3 0.02 - 0.8 Chernigovskaya 0.02 - 2.3 -

Tulskaya 0.02 - 2.0 0.06 - 6.5 Cherkasskaya 0.01 - 1.5 -

Brestskaya 0.01 - 1.3 0.2 - 9.0 Source: USSR, 1986, Annex 7, p. 60.

l l.

7-13 i

i b w

1 I

also evacuated (see Sections 7.1 and 7.4). Overall, the Soviet report prerented at Vienna (USSR, 1986, Annex 7, p. 58) stated that: "The dose levels of e.t-ternal gamma radiation from the cloud of effluent and radioactive fallout for the majority of the population did not exceed 25 rem...."

Altogether, the dose to the 135,000 evacuees was estimated at 1.6x10 6 person-rem (INSAG, 1986, p. 85). Among the 135,000 evacuees examined by doctors, nurses, and other medical personr.al for clinically manifest signs of acute radiation syndrome, no cases were found (INSAG, 1986, p. 93), Monitoring and examination of injured and contaminated Chernobyl site workers is described in Section 7.6.

Chapter 8 of this report provides extensive amounts of information on radio-logical monitoring of people, food, and the environment. Despite the descrip-tive information on the use of dosimetry by emergency workers, little is known about the Soviet radiological exposure control system for emergency workers and whether the system aided in keeping worker dose levels down. More information on worker assignment rotations, etc. , could prove valuable to radiological emergency planners.

7.6 Medical Treatment Medical treatment by the Soviets was extensive during the response to the Chernobyl emergency. The Soviet written report and presentations in Vienna on the medical response to the accident were extensive and open. Much of the dis-cussion dealt with the handling of the 203 plant and response personnel who suf-fered acute radiation sickness (Sanders, 1986, p. 5). By the time of the Vienna meeting (August 25), there had been 31 fatalities and 30 persons remained hospi-talized (Warman, 1986b, p. 3). Two sources reported that two workers at the plant died immediately as a result of the accident, but not from radiation in-juries. One died from severe heat burns, and the other died whan part of the reactor building collapsed (WHO,1986a; USSR,1986, p. 39). The majority of the patients suffering from acute radiation sickness had made a clinical recovery by the end of June. The Soviets attributed their success in diagnosis and treat-ment to previously acquired experience and recommendations made by international radiology centers (Sanders, 1986, p. 5).

The " medical and health section servinF the plant" was informed of the accident at about 02:00 on April 26 (USSR, 1963, Annex 7, p. 1). These medical person-nel assisted the first 29 victims within the first 30 to 40 minutes, sending them immediately to the hospital (USSR, 1986, Annex 7, p. 1). As an indicator of the speed and extent of the emergency medical response, the Russians reported that by 06:00 on April 26, 108 people had been hospitalized and an additional 24 were admitted during the day. After initial diagnosis in local or regional hospitals, 129 patients were sent to a specialized hospital in Moscow and 72 patients were sent to clincial institutes in Kiev. All of these patients suf-fered from acute radiation sickness (Sanders, 1986, pp. 5-6). Teams of spe-cialists arrived within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />; these teams consisted of physicists, radiol-ogy therapists, laboratory assistants, and hematologists. Within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, these specialized medical teams had examined some 350 persons and performed about 1000 blood analyses (USSR, 1986, Annex 7, p. 1). This suggests that pre-existing plans for medical assistance requests and ambulance support may have existed.

7-14

According to Soviet officials, a detailed diagnosis and treatment. regimen was implemented (USSR, 1986, Annex 7, pp. 2-70). The victims were categorized as having any of four degrees of acute radiation syndrome, based on a number of diagnostic criteria, with the fourth degree being the most severe and the first degree.being the least severe (USSR, 1986, Annex 7, pp. 3-4). Autopsies were performed on those who died (USSR, 1986, Annex 7, p. 7).

According to Soviet officials, of the 129 victims who were sent to Moscow in~ i the first two days of the accident, 84 were diagnosed as suffering from degrees II-IV of acute radiation syndrome and 27 were diagnosed as suffering from degree I of acute radiation syndrome (USSR, 1986, p. 39). Of patients treated  :

in Kiev, 17 were diagnosed as being afflicted with degrees II-IV, and 55 with '

degree I (USSR, 1986, p. 39).

Ultimately, 203 persons were treated for acute radiation.cyndrome resulting from gamma- and beta-ray exposure (USSR, 1986, Annex 7, p. 1; INSAG, 1986,

p. 89). Beta-ray exposure resulted in severe skin burns in 48 victims (INSAG, 1986, p. 90). Dr. Robert Gale, a U.S. physician, assisted Soviet doctors in giving bone marrow transplants to 13 of those who received substantial radia-tion' exposures, but 12 of these did not survive (INSAG, 1986, p. 91).

Dr. Angelina Gus'kova, one of the Russian representatives at the Vienna meet-ing, expressed the opinion that bone marrow transplantation would not be

~

expected to play a significant role in any future major accident (Warman, 1986b, p. 3). Many of the deaths were hastened by burns resulting from beta

-exposure (INSAG, 1986, p. 90).

An Israeli specialist, biophysicist Yair Reisner, who worked with American and

. Soviet doctors in performing bone marrow transplants, said that there were de-lays in testing victims' blood which made-it impossible to determine how much radiation they had been exposed to or to find suitable donors (Post,,1986b).

However, another source praised the blood testing as a "very efficient and adequate" method, while recognizing that between 48 and 55 hours6.365741e-4 days <br />0.0153 hours <br />9.093915e-5 weeks <br />2.09275e-5 months <br /> is needed to culture the blood samples (INSAG, 1986, p. 90).

Despite whatever problems may have occurred, a wide variety of treatments was used. In addition to bone marrow transplants, transfusions of platelets, chemo-therapy, administration of various antibiotics, and infusions of concentrated gamma globulin were given to patients with bone marrow insufficiency (INSAG, 1986, p. 91). Intestinal radiation syndrome was treated successfully in a num-ber of cases with artificial intravenous feeding and measures to prevent bac-teriemia and septicemia of intestinal origin, including intensive antiseptic measures to prevent infection (INSAG, 1986, p. 91). Burn therapy was used on

', - patients with extensive beta exposure, but this was not generally successful

, "in cases of very extensive involvement of the teguments" (INSAG,1986, p. 91).

\

\ In addition, medical care for workers involved in " eliminating the consequences of the accident" was provided for at a polyclinic with four 24-hour first aid brigades set up in Chernobyl (USSR,1986, Annex 7, p. 67).

Reports have also indicated that medical attention and treatment were provided for evacuees. In order to provide medical care for those people evacuated dur-ing the first few days after the Chernobyl accident, 450 brigades of doctors, 7-15

t

' nurses, assistants, and health physicists were mobilized and provided with an-

'.bulances to care for evacuees. Including' rotations based on. radiation condi-tions, 1240' physicians, 920 nurses, 360 physicians' assistants, 2720 assistants

-with secondary school education, 720 students from medical institutes, and a large group of members of scientific. research institutes provided medical care.

After being decontaminated, all evacuees were examined by physicians and re-ceived compulsory dosimetric monitoring and laboratory blood tests. Examina-tions were repeated where necessary (USSR, 1986, Annex 7, p. 67).

Evacuees with health irregularities were hospitalized in "special sections" set

-up at central regional hospitals (USSR, 1986, Annex 7, p. 67). Dr. Leonid Ilyin, head of Moscow Hospital, which' treated the most seriously injured, said that after the evacuation that followed the accident, 18,000 people reported to hos-

~

pitals for checkups (NY Times, 1968f). Dr. Ilyin, who was a member of the Russian delegation'at the Vienna meeting, indicated that evacuees were suffer--

ing from headaches, coughing, respiratory trouble, and some were spitting up t blood. Dr. Ilyin said that they had suffered from anxiety and "none of the-18,000 had [ serious] problems." All were released after a few days (NY Times, 1986f). About 100,000 children, including children living in populated areas near the 30-km zone, have been examined (USSR, 1986, Annex 7, p. 67). No cases of acute radiation syndrome were diagnosed among the 135,000 evacuees from the 30-km zone, which is consistent with the fact that exposures among this group did not reach the threshold for clinically manifest signs of this disorder (INSAG, 1986, p. 91).

i The distribution of KI to the evacuees did not result in a single case of hos-pitalization, although insufficient time has passed to determine the frequency L of thyrotoxicosis which may have been induced (INSAG, 1986, p. 93). At the j same time, measurements of I-131 activity in the thyroid glands of evacuees suggest that the use of KI reduced the exposure levels of the thousands who used it below what would otherwise have been expected (INSAG,1986, p. 93).

" 7.7 Soviet Guidance on Acceptable Levels of Public Radiation Exposure The decision to evacuate was based on pre-existing intervention levels, which i are summarized in Table 7.3, in which Level A appears to be a point above which protective actions are optional, and Level B is the point at which emergency evacuation is mandatory (Warman, 1986a, p. 2). In addition, Professor Ilyin in-dicated during the international meeting on Chernobyl at Vienna that the Soviet Union has had these protective action gtiides in place since 1969. He also in-dicated that they were the basis for protective action decisions regarding sheltering, evacuation, and KI distribution following the accident (Sanders, 1986). Protective action decisions were also based on dose projections which were modeled daily during the accident (Warman, 1986a, p. 1).

l It appears that these criteria were followed in deciding to evacuate Pripyat.

Although the radioactive plume initially bypassed Pripyat (Warman, 1986a, l pp. 3-4), the situation changed during the night of April 26, when radiation levels there reached 1 R/hr (INSAG, 1986, p. 78; USSR, 1986, p. 38). This triggered the decision to evacuate Pripyat the next afternoon (INSAG, 1986,

p. 78).

i

! 7-16

Table 7.3 Criteria for making decisions for protection of the population Radiation or Measurement contamination units' A* B* Protection measures External p ,-y-radiation _ Temporarily sheltering

~(radiation dose) ren ' 25 - 75 and limiting the time in an open space Dose to thyroid resulted KI prophylaxis, tempo-from radioactive iodine rem 25 250 rarily sheltering, and through inhalation evacuation (children)

Integrated specific mci / liter activity in the air:

Children 3 20 Adults 20 200 Total consumption of pCi 0.8 8 Eliminating or limit-f I-131 with food ing the consumption of contaminated food, re-relocating dairy cattle to uncontaminated pas-tures, KI prophylaxis Maximum contamination of pCi/ liter fresh milk or daily pCi/ day 0.06 0.6 food ration Initial density of

I-131 disposition pCi/m 2 0.4 4 on pastures

• Level A: If a dosage does not exceed this level, there is no need to perform urgent measures which will temporarily disrupt normal

! life of the population.

! Level B: If a dosage reaches or exceeds this level, urgent measures have to be taken, even if the measures will temporarily disrupt nor-mal life of the population and economic developments in a partic-ular region.

If a dosage exceeds Level A but does not reach Level B, decisions should be made in accordance with a concrete situation and local conditions.

Source: Egavov, 1985.

7-17

7.8 Decontamination The Soviets initiated decontamination activities during the early stages of emergency remedial work and decontamination continues at the Chernobyl power station itself, among evacuees, and in outlying areas affected by radiological contamination.

Evacuees were decontaminated as they arrived at the reception centers to which the evacuation buses took them. According to Soviet officials, each evacuee showered and was given new clothing. The old clothing was destroyed (Warman, 1986a, p. 6).

After the accident, three surveillance zones were established: a special 3-km zone, a 10-km zone, and a 30-km zone. Strict radiological monitoring of all transport was established in these zones as well as at decontamination points.

At each zone boundary, workers transferred from one vehicle to another to re-duce the transmittal of radioactive materials (Sanders, 1986, p. 7; USSR, 1986, Part I, p. 32; Warman, 1986b, p. 2).

Soviet leader Gorbachev described the longer term decontaminati~on effort during his May 14 public address on Soviet television (Pravda,1986) as follows:

Extensive end long work still lies ahead. The level of radiation in the station's zone and on the territory in the immediate vici-nity still remains dangerous for human health. The top-priority task as of today, therefore, is operations to deal with the effects of the accident. A large-scale program for the decontami-nation of the territory of the electric power station and the settlement, of buildings and structures has been drawn up and is being implemented. The necessary manpower, material, and techni-cal resources have been concentrated for that purpose.

Some reports shed light on the implementation of these plans. One source indi-cates that approximately 1000 emergency workers employed in 5-hour shifts have fanned out over the plant site and beyond to locate and encapsulate the most highly radioactive debris. These crews are applying a decontaminating film of unidentified composition at the rate of 240,000 square yards a day throughout the territory according to Izvestia (ENR, 1986). Other Soviet press reports indicate that a radiation-isolating substance described as " liquid glass" is also being applied to the Chernobyl plant's numerous buildings (ENR, 1986). A

, report from the World Health Organization (WHO, 1986b) states that " work to de-I contaminate the territory, buildings and facilities of the power station, as well as the motor roads and other facilities located in the nearby terrain has begun on a large scale with the use of up-to-date materials and technical means."

Decontamination of buildings within the 30-km (18.6-mi) evacuation zone has been proceeding. Approximately half of the released material was deposited within this 30-km zone (INSAG, 1986, p. 81). According to Soviet officials, the con-tamination level of such structures was found to fluctuate greatly (USSR, 1986, Annex 3, p. 5). The method of decontamination has been to spray the building l surfaces with " decontamination solution" from " automatic filling machines" at a i

flow rate of 10-15 liter /m2. As a result, the dose rate from the buildings l was reduced to background levels, with the beta contamination not greater than i 1000 beta particles /cm 2 min. However, this caused the contamination level of 7-18

the earth along.the walls to. increase by 2 to 2.5 times, necessitating the-burial or removal of this earth.

Extensive plans. also have been made for decontaminating the agricultural areas within the 30-km (18.6-mi) evacuation zone, although specific actions must await more detailed data (USSR,.1986, Annex 3, p. 4)'. These include fixing radio-nuclides in the soil by spraying sorbents (clayey suspension and zeolites) on '

i the soil to prevent uptake by vegetation, adding line and mineral fertilizers and sorbents following~the harvest of perennial grasses and winter crops to increase soil fertility, removing a contaminated surface layer of turf-(either by mechanical means or after consolidation following application of latex

[ . emulsion SKS-65 gp), and restricting the extent of dust producing cultivation, the uses of the crops that are being harvested, and the types of crops and -

processing that will'be permitted in the future. .Meanwhile, " agricultural harvesting work. . .in the evacuation zone and in the strict control zone. . .is

?'

being. carried out as normal in accordance with the special measures worked out together with the State Agricultural Programme of the USSR and the Ukrainian SSR and the USSR Ministry of Health" (USSR, 1986, Annex 3, pp. 4-5).

i The contaminated forests are an area of concern because they act as accumulators of radionuclides, "first in the crown and then in the litter" (USSR, 1986, Annex 3,

p. 5). Consequently, fire prevention measures are being strengthened (USSR, 1986, Annex 3, p. 5).

Although the descriptions given above provide much information on Soviet decon-I tamination efforts to date, little can be known yet about their overall success in achieving decontamination throughout the 30-km area because of the ongoing nature of this work.

7.9 Site Recovery i

This section addresses the radiological aspects of site recovery. It is not intended to cover the accident scenario, radionuclide release, reactor shutdown, or off-site actions. As a result, essentially none of the preaccident publi-cations or literature are directly relevant. This section will attempt to describe the actual results of actions taken during the crisis stage and those actions taken after the reactor and site were secured in order to permit site recovery and restart of the undamaged units.

The actions taken to date can be divided into three classes: initial responses to stabilize the situation,' actions taken to immobilize radioactive materials, and actions taken to relocate radioactive materials (decontaminate).

Shortly after the initial explosions, several fires were identified within the reactor complex. They were in the cable spaces and turbine hall of the reactor building, on the roof (70-m [230-ft) level) of the reactor building, and in the walls separating Units 3 and 4. These fires were extinguished within hours in spite of fields of extreme radiation.

From April 27 to May 10, more than 5000 tonnes of lead, sand, clay, boron, and dolomite were dropped from helicopters onto the reactor core, as the graphite moderator continued to burn. This appears to have been effective in helping to extinguish the reactor fire, in shielding the exposed core, and in providing 7-19

_ .. __ _. __ _ - _ _ - . _ - _ _ _ _ _ . _ . _ . _ . - _ _ . _ - a

I a filtering and condensing plateout function for radioactive materials being re-

! leased from the core (USSR, 1986, p. 27; INSAG, 1986,-p. 65). Radioactive material (dispersed _from the core) that fell on the ground nearby was immobi-lized when the area was sprayed with a liquid polymer material.

In early May, workers entered the lower spaces of Unit 4 to drain water from a

the suppression pools to avoid the potential of a ' steam explosion in the event E the core melted through. Soon afterward, miners began tunnelling under the

reactor building-to build a concrete basement and install a nitrogen cooling

~

system to help cool the lower portions of the core, to prevent oxygen from  ;

reaching it,-and to freeze the ground beneath the suppression pools (INSAG, i 1986, p. 65). This work was completed in late June. A " makeshift flat heat exchanger" also was built underneath the reactor building to help cool the core (INSAG, 1986, p. 66).

l The longer term Soviet plans for.the site include decontamination and reloca-tion of radioactive material (USSR, 1986, pp. 30-32). First, in order to pre-vent radioactive dust from spreading, the roof of the turbine hall and the shoulders of roads were sprayed with "various polymerizing solutions" (USSR, j 1986, p. 30). Second, the site itself was divided into separate zones in order to facilitate decontamination (USSR, 1986, p. 30). Third, decontamination of -!

j the site has begun, including removal'of " refuse and contaminated equipment from the site," decontaminating building-surfaces, removing a 5- to 10-cm )

soil layer (and its containerized storage in a waste repository in the fifth unit), laying concrete slabs'on some areas, filling some areas with clean soil,

}

and coating various concrete or soil areas with " film-forming compounds" (USSR, 1986, pp. 30-31). Consequently, the " total gamma background in the area of the [ damaged reactor] unit" has been reduced to 20-30 mR/hr, mainly due to con-tinued radiation from the reactor itself (USSR, 1986, p. 31).

Another source discussed the site recovery effort within the various buildings (INSAG, 1986, pp. 81-82). In addition to the measures described above, spray-

ing with water, spraying with decontamination solvents, steam ejection, polymer j covers, and washing the surface (by hand) have been used (INSAG, 1986, p. 82).

l As a result, the dose rate within the units has dropped from 100-600 mR/hr to

, 2-10 mR/hr (INSAG, 1986, p. 82).

The damaged nuclear reactor is being entombed in order to reduce radiation

+

levels to normal and to prevent further escapes of radioactive materials (USSR, 1986, p. 31; INSAG, 1986, p. 70). Dose rates not exceeding 5 mR/hr at the roof and 1 mR/hr at the walls of the structure are being sought (INSAG,1986, p. 71).

It is not clear whether this entombment is intended for permanent disposal of

the debris and fission products in the damaged reactor unit (INSAG, 1986, p. 71).

More than ten options for carrying out the entombment were studied before the i final selection was made (INSAG, 1986, p. 71). In addition, other areas are to

! be sealed with concrete (USSR, 1986, p. 31). Many of the concrete walls are to be 1 m or more thick (USSR, 1986, p. 31).

l Much information is now available about site recovery operations, specifically in relation to the damaged No. 4 power unit. However, details are still lacking on the extent of contamination in the other three units and the specific prob-

less associated with their decontamination.

7-20

- . _ - .-.- . . ~ - .

-7.10 ~ Relocation and Reentry (Off Site)-

Although some residents have already reentered some portions of areas that were evacuated,'further reentry is being delayed until monitoring and decontamina-1 tion activities are finished. It now appears that reentry to certain_ areas will b'e suspended indefinitely and that residents who formerly lived in these

', ar'eas will be relocated elsewhere permanently.

Since'the' radiation conditions continue to change, and various radionuclides

-are still being redistributed over parts of the 30-km area, the question of resettling the population will not be addressed until the radiation situation over the whole area has been stabilized. Such reentry must also await the en-

'tombment of the damaged reactor, decontamination of the plant site, and immobi-

-lization of the. radioactivity in offsite places where there are high levels of contamination (USSR, 1986,-p. 33).

The Soviets said in Vienna that they_did not see the people of Pripyat return-ing to their deserted town "for the foreseeable future." _They gave no forecast

-on the return of the people evacuated from other areas within the 30-km zone (Sanders, 1986, p. 8). According to Soviet officials, "the radiation conditions

~

-will continue to change significantly for 1-2 years particularly in regions with.

.a high contamination level gradient" (USSR, 1986, Annex 3, p. 3).

-To address the contamination from the' accident, the area within a 30-km radius of the Chernobyl power plant has been divided into three zones: a special zone of about 4-5 km.around the plant where re-entry of the general population is not 1 anticipated-in the near future and where activity will be restricted to that at the power station itself; a 5-to-10-km zone where partial re-entry and some special activities may be allowed after an unspecified period of time; and a 10-to-30-km zone which the general population may eventually be allowed to re-enter and in which agricultural work may be resumed under a " strict program of radiological surveillance" (INSAG, 1986, p. 79).

i As described in more detail in Section 7.8, special agro-engineering and decon-tamination procedures have been established and are now being implemented in order to return the land to economic use. These procedures include changes to

. the previously used system of soil treatment, use of special materials for dust

- suppression, and modifications of the harvesting and crop processing methods

~(USSR, 1986, p. 33).

Until allowed to return to evacuated areas, evacuees have been resettled in surrounding areas. The Soviet report gave no information about details of this relocation effort, although there are numerous unverified accounts in the press about relocation areas and the construction of new housing. Because.the cleanup is an ongoing project, little is known about the timing of re-entry of former residents into selected areas in the 30-km evacuation zone.

7.11 Public Education and Information Programs Given the available information, it is not known if the Soviets have a coordina-ted public education and information program on radiological emergency response.

~

As discussed in Section 7.12, the residents of Pripyat apparently had received some type of emergency preparedness guidance before the accident. However, it is not known whether the " test and training" received before the accident by 7-21

Z

'Pripyat residents (Warman, 1986a, p. 4) were accompanied by a public education and information campaign.

. An indication that at least some' parts of the public may not have been previ-ously educated about the dangers of radiation was the refusal of some peasants in'the 30-km zone to follow instructions.to destroy milk from." privately kept cows" after the accident. These instances resulted in the highest doses of l

rac'. tion recorded among evacuees. In addition, the refusal.of peasants to be c.vacuated unless their farm animals were also evacuated may indicate lack of

~

o education about the dangers of radiation among this segment of the population.

On the other hand, " virtually all peasants enthusiastically took" potassium iodide tablets, which could indicate either public education or simply trust of evacuation officials (Warman, 1986a, p. 6).

The Soviets have been criticized widely in the media for being slow to release

-information about the Chernobyl accident, especially in the first days of the j j emergency. The chairman of the Soviet news agency Novosti, Valintin Falin, has stated that the receipt of detailed, factual information which could.be released '

i was substantially delayed because first reports of the power plant management l

about the accident were incomplete and turned out to be incorrect (UPI, 1986).

Several weeks after the accident Pravda openly criticized the delays in-report-ing the' disaster, and stated that public alarm in the first few days after.the

disaster "came from uncertainty, which was caused at times by delayed informa-tion about-the real situation at the site of the accident" (NY Times, 1986b).

Pravda also reported that "in the first days, shifts in people's moods came from uncertainty that was sometimes promoted by belated information on the real state

! of affairs at the site of the accident" (LA Times,1986a).

In his public address on Soviet-television' (Pravda,1986), Soviet leader

'Gorbachev said:

The seriousness of the situation was obvious. It was necessary to evaluate it urgently and competently. And as soon as we received '

! reliable initial information it was made available to [the] Soviet people and sent through diplomatic channels to the governments of foreign countries.

An effective public information action was taken by the Ukrainian Health Minister Anatomy Y. Romaneko when he appeared on Kiev television (NY Times,

- 1986e) after the wind shifted and radioactive dust began blowing toward the city. In that appearance, he assured the people of Kiev that they were in no danger, but advised them to keep children indoors, to wasn their hair daily, to wipe the dust indoors with wet cloths, and to take several other precautions.

Similarly, there is some evidence that Soviet officials made efforts to combat the many rumors which were spread. Rumor control efforts included articles in

~t he Soviet press, some of which resulted from interviews granted to the press by Soviet government officials for the purpose of dispelling rumors (NY Times, 1986d and e; Post, 1986e and f).

7.12 Training Program

' On the basis of the available information, it is not known how much radiological emergency response training was received before the accident by personnel l

l 7-22 "O y- --p-=we-e my -

w- ww- e =wy-- --,is e-,,-- -e ew --a----w-r w -

ws-+ ry,- -

ew

• P - '-+-"- '--

affected by and involved in'the emergency activities during the Chernob'y1 disaster. Apparently the residents of Pripyat had received some type of emer-

~

gency preparedness guidance regarding evacuation before the accident. The Soviet official who supervised the evacuation stated that personnel " responded according to the. test and training and a majority accepted the situation." 'He

-also noted that, besides Pripyat, dozens of villages evacuated in an orderly manner _(Warman, 1986a, p. 4).

Similarly, although during the fire at Chernobyl, many firemen and workers re-ceived high ~ radiation exposures when they fought the fire, it appears these exposures were'due to insufficient equipment and procedures _for a disaster of 1 such magnitude. Effective previous training was demonstrated by the accomplish-j ment of the primary objective of preventing the fire, which was rapidly gaining j in strength, from spreading along the top of the machine hall to the adjoining third. reactor unit (USSR, 1986, p. 25). Water was effectively us.ed to extin-guish the machine hall roof and cable room fires and to quench graphite blocks

~

with foam sprays used in areas with flammable materials. Foam sprays were be-lieved-to have contributed to the inhibition of the resuspension of radio-

-nuclides (INSAG, 1986, p. 64). However, it appears that the fire and radiation ,

release were of such an extreme intensity that even though the firefighters knew the radiation was present, existing procedures and protective equipment, '

usually considered adequate, were' insufficient in this instance. In such a case, exposure to high levels of radiation was unavoidable unless the fire-

. fighters retreated from the site. Instead, the fires on the machine hall roof and Unit 4 were localized by firefighters on April 26 at 02:10 and 02:30, respectively, and the fire was quenched at 05:00 (USSR, 1986, p. 25; INSAG, 1986, p. 63).

It is also possible that the director and the chief engineer of the Chernobyl power station performed poorly because they had not received sufficient training.

, Regarding the evacuation, much of the planning and measures taken (see Sec-tion 7.1) evolved ad hoc because "not all existing arrangements could be ap-plied" (INSAG,1986, p. 78). The ability to improvise and still conduct the evacuation may reflect prior training, possibly for civil defense.

f _However, decontamination of evacuees appeared to be based upon specialized

. training. All evacuees took showers and received new clothing as they arrived at their destinations. This was done using portable facilities supplied by chemical detachments of the Soviet Ministry of Defense. The personnel decon-tamination was accompanied by dosimetry measurements, and old clothing was

' destroyed by the military detachments and civilian officials administering the -

reception centers (Warman, 1986a, p. 6). Similarly, the notification of resi-dents of Pripyat and distribution of potassium iodide tablets to them by the system of Soviets and young Communist Party members was apparently efficient (see Section 7.2) and may reflect prior training.

There are also accounts of lack of training and experience of medical personnel

-at local medical hospitals (Post, 1986b and c). In an interview with the Soviet Literary Gazette, Oleg Shchepin was quoted as saying (Post, 1986c):

7-23

- ~_ _ _ _ _.__ _ _ _ _ _ - . _ _ _ . _ , _ _ .---- _ _ -

I k

- Unfortunately, locally, there are a few specialists in the field of medical radiology, but the majority of medical workers are not well prepared in this regard and not well informed. This is one of the serious gaps in the training of people in our health system.

r r This resulted in movement of heavily exposed persons to a radiation treatment

" center in Moscow, where specialists were available for diagnosis and treatment -

(INSAG, 1986, p. 92).

I h

The foregoing information, with some exceptions, seems to indicate effective

performances of emergency response activities and to reflect prior training.

- Additional information on prior training activities that proved to be most T

useful to the Soviets during this response could prove quite helpful to other y radiological emergency planners.

7.13 Summary Limited information is available about Soviet radiological emergency planning fg at Chernobyl. The Soviets had developed a framework for the planning and or-ganizing of onsite and offsite response to nuclear power plant accidents. They k also had established a safety zone between zero and 3 km from the plant, and i t

I prohibited new factory development between 3 and 10 km from the plant.

I In 1969, they had established criteria for making decisions on emergency mea-

{

sures for protecting the public living in the vicinity of nuclear power plants.

It has been asserted that Soviet emergency planning actually is quite extensive, tied very closely to civil defense. The evacuation of some 135,000 people with-in 30 km (18.6 mi) of the reactor, starting 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after the accident was pre-ceded by sheltering of 45,000 people in Pripyat and covering evacuation route land areas with a polymer substance. The evacuation was accomplished with a

great deal of ad hoc planning and the required mobilization of enormous re-i sources in a relatively short period of time. This suggests that prior plan-r ning, perhaps for civil defense, proved useful.

1 The available information indicates that many organizations and functional groups took part in the emergency response to the Chernobyl accident. A "special com-mission" very similar to one described in a Soviet emergency planning framework U coordinated the protective response. Organizational deficiencies appear to have P hindered the response, including a lack of adequate equipment and facilities, E

and underestimation of the severity of the accident by plant personnel and local

? officials. As a result of some of the difficulties, the director and chief I engineer of the Chernobyl power station were dismissed. After the plant was stabilized, Soviet General Secretary Gorbachev made a statement in which he said g that in the future, greater attention will be paid to the reliability of equip-7

- ment and " questions of discipline, order, and organization" at nuclear power plants.

Initial notification in Pripyat was delayed intentionally because the accident occurred at night and the protective action was to shelter in place. When noti-fication was given at 08:00 that morning (April 26), it was by door-to-door visits, using the system of Soviets in each apartment house and block. The notification to evacuate by bus at 14:00 the next day (April 27) also relied on radio announcements. Apparently people with private vehicles were given ..

_ . ..- -. ~_

E E_

r E

permission to evacuate at 12:00 on April 27. Neither a siren system nor tele-phones were used for notification. One Soviet official suggested after the y accident that " warning methods, in my opinion, require some thorough study and discussion."

h P Extensive protective actions based on existing exposure criteria were taken dur-E ing the emergency, including sheltering, administration of potassium iodide (KI),

i F

evacuation, decontamination, and measures to prevent radiation exposure in the

[

r ingestion pathway. Sheltering in Pripyat, accompanied by the door-to-door dis-tribution of KI to the general population, was the chosen protective action from T the beginning of the accident early on April 26 through 12:00 on April 27. When

radiation levels began rising in Pripyat, a town with a population of about

45,000 located about 5 km (3.1 mi) from the reactor, a staged evacuation of the o

town ensued. This was followed several days later by evacuation of and distri-

[ bution of KI to approximately 90,000 peasants in 71 villages within 30 km of r the reactor. About 19,000 cattle were also evacuated from the 30-km zone be-I cause peasants refused to leave without them. Generally, the response of the

! evacuees was reported by a Soviet official to be exemplary. Some evacuees

[ were hospitalized for psychological stress. A major element in the evacuation I

preparations was the covering of land areas along roads used for evacuation j with a polymer substance. A key problem that occurred during the evacuation i was that the plume apparently followed the evacuation route for a large dis-

_ tance; as a result some bus drivers received high exposures.

f Measures that were taken to protect the ingestion pathway included setting in-tervention levels for various radioactive contaminants in milk, vegetables,

( meat, poultry, eggs, and berries. An overall dose of 5 rem for an individual in the first year was established. As a precautionary measure, the residents

of Kiev used well water rather than their normal surface water supply for a

[

b period of time following the accident. Eventually, use of the surface water supply was resumed, but the surface water was monitored constantly for radio-logical contaminatio:.

[

t E In response to the Chernobyl accident, people, land, and food have been moni-

[ tored for radiological contamination. Dosimetry was utilized by emergency g workers responding to the accident, but the massive scale of the accident and g the critical nature of containment activities caused reluctance on the part of pilots to report dosimeter readings and forced firefighters at the plant to I abandon radiological exposure control efforts altogether. The availability and use of dosimetry by these and other emergency workers, and concerns expressed about high readings and potential removal from the region, indicate the prob-able existence of a radiological exposure control system. Many evacuees were also monitored. The vast majority of the population had dose levels below 25 rem, with average dose levels for Pripyat and other segments of the evacuated

[ 30-kmzonerangingfrom3.3to43 rem. The estimated dose to the general popu-s lation was 1.6x10 person-rem, which the Soviets declared to be "within the t

established limits." However, nany emergency workers received doses in excess  ;

of the Soviet dose limits. A food monitoring system became standard procedure

! in Kiev, but some sources indicated that contaminated food and milk was de-  ;

tected in other locations. Land areas also were monitored to determine appro-  ;

i priate evacuation routes shortly after the accident began.

1 4

Extensive medical treatment was given to the victims of the Chernobyl accident.

s The onsite medical staff responded to the emergency immediately after it began, 7-25

and was supplemented by teams of specialists within about 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. Some 203 exposed emergency workers and Chernobyl plant peraonnel were diagnosed and categorized into one of four degrees of acute radiation syndrome. Although 13 bone marrow transplants were performed, 12 of these patients had died by the end of July 1986. A total of 31 fatalities had been recorded as resulting from the Chernobyl accident as of the time of the Vienna meeting (August 25). Burns caused by beta-irradiation were noted as a difficult and complicating factor in a number of deaths. The evacuees, though afflicted with minor medical problems, were also treated. No cases of acute radiation syndrome among evacuees were re-ported. The use of KI by evacuees to prevent radioiodine uptake by their thyroids appears to have reduced the exposure levels of the thousands who used it to below what would otherwise have been expected. None were hospitalized for side effects from ingesting this drug.

The decision to evacuate was based on pre-existing intervention levels, which include one point above which protective actions are optional (25-rem whole-body dose and 25-rem thyroid dose), and another level above which protective action: are mandatory (75-rem whole-body dose and 250-rem thyroid dose).

During the accident, dose projections were modeled daily and used to decide protective actions.

The Soviet decontamination activities began during the early stages of the emer-gency response and are now taking place at the Chernobyl power station itself, among evacuees, and in outlying areas that were contaminated. Each evacuee showered and was given new clothing upon arriving at a reception center.

Vehicles entering and then exiting the 30-km zone were scrubbed upon leaving.

Various measures are being used to decontaminate buildings in this area, and ex-tensive plans have been laid and are being implemented for decontaminating the farmland and forests, including spraying with film to prevent radioactive par-ticulate resuspension, fixing radionuclides in the soil, increasing fertility, removing a contaminated surface turf layer, and restricting the types of crops, cultivation, and processing that will be permitted in the future. Approximately 1000 workers are decontaminating the plant site itself, and decontamination mea-sures have been taken in Kiev, as well. Soviet officials admit that some areas near the reactor may never be decontaminated.

Site recovery activities have included initial responses to stabilize the situa-tion, actions taken to immobilize radioactive materials, and actions taken to dispose of radioactive materials. Initially, actions at the site focused on extinguishing the radioactive fire in the reactor, including dropping more than 5000 tonnes of lead, sand, clay, boron, and dolomite on the reactor to shield it and suffocate the blaze. In May, a concrete basement and nitrogen cooling system were built. Af ter spraying buildings on the site with polymers to pre-vent resuspension of dust, more permanent decontamination measures were begun both inside and out. Finally, the damaged reactor is being entombed, although it is unclear whether this is intended for permanent disposal of the radio-active debris and fission products.

Soviet officials have decided that re-entry can be considered only after the radiation situation has stabilized, the damaged reactor has been entombed, the plant site has been decontaminated, and radioactivity in other areas has been immobilized. Most of those who were evacuated have been relocated to rural areas outside the 30-km evacuation zone, and new housing and barns are being 7-26

constructed for them. Soviet officials have stated that stable radiation con-ditions - one of the pre-conditions for re-entry by residents - are not expected for 1 to 2 years, particularly in highly contaminated areas.

It is not known whether the Soviet Union has a coordinated public education and information program on radiological emergency response. The refusal of peasants generally to be evacuated unless their farm animals were also evacuated, and the refusal of some peasants to destroy contaminated milk from their cows, may have resulted from lack of public education about the dangers of radiation. However, --

virtually all peasants are reported to have " enthusiastically" taken potassium iodide tablets. Also, the 45,000 residents of Pripyat evacuated within a 3-hour period, which may be an indication that a public education program existed prior to the accident.

The Soviets were widely criticized for being slow about releasing information about the Chernobyl accident, especially in the first days of the emergency.

The Soviets have indicated that the first reports Moscow received from plant management were incomplete and turned out to be incorrect, causing substantial delays in the availability of detailed, factual information which could be re-leased to the public. The Soviet media reported public uncertainty and alarm in the first few days after the accident because information about the situation at the accident site was delayed.

The Ukrainian Health Minister appeared on Kiev television to provide protective action information to city residents when the wind changed and began to blow radioactive dust toward Kiev. Many rumors were spread and instances were found where newspapers and public officials disseminated information to refute rumors.

It is not known how much radiological emergency response training was received before the accident by personnel affected by and involved in the emergence ac-tivities during the Chernobyl disaster. Apparently, the firemen and workers who extinguished the fire at the reactor were trained well and accomplished their goal; the large number of deaths was caused by inadequate equipment and procc-dures. According to one Soviet official, the residents of Pripyat received some guidance, which he referred to as "the test and training," regarding evacuation.

Similarly, the ability of evacuation planners to prepare evacuation routes and evacuate despite the fact that existing arrangements were sometimes inapplicable may reflect prior training, possibly for civil defense. It seems that decon-tamination of evacuees was based upon specialized training, but that medical personnel in some nearby locations were not experienced enough, especially in medical radiology. Heavily exposed persons were therefore moved to a radiation treatment center in Moscow where specialists were available for diagnosis and treatment.

7.14 References Alimov, 1986 Alimov, G., "By the Laws of Courage; Fulfilling His Duty:

After the Accident at the AES He Was One of the First To Go Into Danger," Izvestiya, p. 3, May 10, 1986.

7-27

-m. -.. . - - . .

I ly ,,.li Bekrestnov, 1981 Bekrestnov, N. V., and V. Ph. Kozlov, " Aspects of Accident Management at Nuclear Power Plants in the USSR," in J. W.

[

Lathrop (ed.), Planning for Rare Events: Nuclear Accident l

Preparedness and Management, International Institute for Applied Systems Analysis Proceedings Series, Vol. 4, g

pp. 147-151, Pergamon Press, 1981.

j Chicago Chicago Tribune, " Soviet Disaster Plan Lacking," May 23, Tribune, 1986 1986.

Egavov, 1985 Egavov, Yu. A. (Ed.), " Criteria for Making Urgent Decisions on Measures To Protect Population in Case of Accidents at  ;

Nuclear Power Plants," Radiation Safety and Protection of Nuclear Power Plants - Collection of Articles Issue #9,

[ Mo: cow, Energoatomizdat, 1985.

ENR, 1986 Engineering News Record, "Chernobyl Cleanup Proceeds,"

[ p. 12, June 5, 1986.

t Gubarev, 1986 Gubarev, V., and M. Odinets, " Spring of Alarm and Courage.

Our Special Correspondents Report From Kiev," Pravda, (

p. 6, hay 9, 1986.

i Illesh, 1986 Illesh, A., "The Situation Is Under Control. Izvestiya's a Special Correspondent Reports From the Chernobyl AES Area,"

E Izvestiya, p. 6, May 7, 1986.

INSAG, 1986 International Nuclear Safety Advisory Group (INSAG), " Sum-mary Report on the Post-Accident Review Meeting on the Chernobyl Accident," August 30-September 5, 1986, h GLC(SPL.I)/3, IAEA, Vienna September 24, 1986.

a

! LA Times, 1986a Los Angeles Times, "Pravda: Information Delay Caused (E Widespread Anxiety," May 18, 1986.

k NY Times, 1986b New York Times, S. Schmemann, " Soviet Mobilizes a Vast p Operation To Overcome the Disaster," May 19, 1986.

NY Times, 1986c New York Times, T. Shabad, " Soviet Revises Rules of Opera-E tion for Nuclear Plants After Disaster," May 25, 1986.

f?

5 NY Times, 1986d New York Times, " Refugees' Plight Af ter Chernobyl Perplexes p Soviet," May 26, 1986.

k

=

NY Times, 1986e New York Times, " Cloud of Chernobyl Chills a Lush Kiev Spring," May 31, 1986.

l A

NY Times, 1986f New York Times, "18,000 Chernobyl Evacu>.es Given Checkups at Hospitals," June 4, 1986.

New York Times, "Chernobyl Chief Ousted for Erring During f NY Times, 1986g Accident," June 16, 1986.

7-28 l l

Polyakov, 1986 Polyakov, A., "The Soviet Character. From the Region of

.the Chernobyl AES," Krasnaya-Zvezda, p. 5, May 9, 1986.

Post, 1986a_ Washington Post, "Gorbachev Says 9 Died From Nuclear Acci-dent; Extends Soviet Test Ban," May 15, 1986.

Post,_1986b Washington Post, " Soviet Doctors' Inexperience Cited,"

May 20, 1986.

Post, 1986c Washington Post, "Chernobyl Explosion Said To Come During Test," May 22, 1986.

Post, 1986d Washington Post, C. Bohlen, "Chernobyl Death Toll Put at 19, May 27, 1986.

Post, 1986e Washington Post, " Kiev, Its Playgrounds Vacant, Scrubs On,"

June 9, 1986.

Post, 1986f Washington Post,~ "2 Elderly Women Evaded Exodus from Chernobyl," June 11, 1986.

Pravda, 1986 Pravda, M. S. Gorbachev's Address on Soviet Television,

p. 1, May 15, 1986.

Sanders, 1986 Sanders, Marshall, Federal Emergency Management Agency, testimony prepared for the U.S. Senate Subcommittee on Nuclear Regulation of the Committee on Environment and Public Works, (hearing cancelled), September 29, 1986, Washington, DC.

Semenov, 1983 Semenov, B. A., " Nuclear Power in the Soviet Union," IAEA Bulletin 25:(2), 53-54, 1983.

UPI, 1986 United Press International, "Chernobyl Technicians Responded

' Haphazard 1y' to Disaster," p. 1, May 12, 1986.

USSR, 1986 USSR State Committee on the Utilization of Atomic Energy, "The Accident at the Chernobyl Nuclear Power Plant and Its

"._ Consequences," Information compiled for the IAEA Experts' Meeting, August 25-29, 1986, Vienna, 1986.

Wa rman, 1986a Warman, Edward A., Senior Consulting Engineer, Stone and Webster Engineering Corporation, Notes of Private Discus-sions With Soviet Delegates at Vienna Meeting, September 5, 1986.

Warman, 1986b Warman, Edward A. , Senior Consulting Engineer, Stone and Webster Engineering Corporation, " Facts and Observations From the Vienna Meetings on Chernobyl, September 23, 1986.

WHO, 1986a World Health Organization, "Chernobyl Reactor Accident, Report of a Consultation," p.13, May 6,1986.

/

7-29

WHO, 1986b World Health Organization, "Chernobyl Reactor Accident, Information Received on Public Health Measures as of May 29, 1986," May 29, 1986.

Zhukovskiy, 1986 Zhukovskiy, V., V. Itkin, and L. A. Chernenko, " Battle Line Without a Front Line - Resolute Actions Performed by Staff .

Members of Internal Affairs Organisation at the First Hours and on the First Days of the Accident at the Chernobyl AES,"

Kiev Radyanski Ukraina, p. 3, May 8, 1986.

7-30

s

_ \ ,

a t r

- i g $ ,_

f g

[

1 x

- CHAPTER 8 -

_v kr HEALTH AND ENVIR0hMENTAL CONSEQUENCES N s s

[ ,p-

~

i s

' ~

The accident at tlie Chernobyl Nuclear Power Station in the Soviet Union re- p g- leased (in addition to radioactive noble gases) about 50 mci of;various radio- (

g nuclides into the environment. The first sections in this chapter provide C e background information on the major pathways of human exposure to ra4iation -

g from the release, and on the types of health effects that could result. Next, '

[= acute radiation doses and effects are reported for those on site at the time of -

the accident. Colle'rtive doses and potential health effects are then reported -

j or estimated for the ' populations within 30 km of the site, in the Eurapean part of the SovietcUnion, in Europe, and in the United States. Finally, there is a

~

p discussion of the effect of the Chernobyl accident on agriculture in general t and on ecological systems. -

E .x -

g 8.1 Pathways of Human Exposure  ?

s .- 'I Following an airborne release of radionuclides, there are severalJpathways that '

g can result in raliation exposures and doses J.o humans. During the passage of a radioactive cloud, nearby individuals can' receive doses by direct irradiation #

from the cloud and by inhalation of airborne radionuclides. However, except f for locations nehr the source, the more important exposure pathways are ,usually  ;

direct exposure to gaana rays from radionuclides . deposited on the ground and v ingestion of radionuclides that enter the food chain. Inhaled radioicdines %

may, however, significantly contribute to the thyroid dose.

i i ~ 8.1.1 External Dose From Radionuclides Deposited on the Ground -

A major route of radiation exposure from the accident is external irradiation 0 by gamma rays from radionuclides deposited on the ground. These radionuclides may gradually' leach into'the scil. Nevertheless, some radiation will penetrate }

} the overlying soil layer and the walls of structures, irradiating people indoors k j as well as outdoors. Human intervention (e.g., plowing agricultural land or _

washing city streets) may rsduce the gamma ray flux. Moreover, this flux will naturally decrease over time as the deposited radionuclides are removed through

{ radioactive decay and weathering. J i  ;

!i The relative contribution of each deposited radionuclide to the total activity 7

will vary over time, depending mostly on its radioactive half-life. This point

;is illustrated for southerc Finland in Table 8.1, where relative values calcu- 3 lated for the total dose and the doses accumulated for 1-day and 1-year exposure i y periods are displayed. Initial 1Ly, most of the radiation exposure resulted from a I-131, I-132, and La-140; however, over the long term, most of the exposure

~

w j will result from Cs-134 and Cs-137.

\

j 1

y &

, J. Puskin, C. Nelson, N. Nelson, D. Janas and S. Myers of the U.S. Environmental t j Protection Agency (EPA) compiled this chapter. -

8-1 [

l Table 8.1 Radionuclide contributions to external dose based on spec-trometric measurements in southern Finland on May 6 and 7, 1986.

Relative doses for specified periods following deposition Radionuclide 1 day 1 year All time Ru-103 0.02 1.1 1.1 I-131 0.14 1.6 1.6 Te-132, I-132 0.35 1.6 1.6 Cs-134 0.17 52 170 Cs-137 0.11 39 940 Ba-140, La-140 0.21 3.9 3.9 Totals 1.0 99 1100 Notes: Doses have been normalized to a total of one for the 1-day period and rounded to 2 significant places for the remaining periods.

I-132 and La-140 are presumed to be in equilibrium with Te-132 and Ba-140, respectively.

Environmental removal rate coeffi-cient is presumed to be 0.02 y l.

Source: Data are from STUK, 1986, Table 2.

The only radionuclides in Table 8.1 that contribute appreciably to the external dose after the first year are Cs-134 and Cs-137. Cs-137 contributes about 84%

of the total dose even though it accounts for only 11% of the dose in the day following deposition. Since both the total activity and the relative propor-tions of deposited radionuclides can vary substantially from one location to another, the relationship between the total external dose and the dose in the first day will vary accordingly.

After the Chernobyl accident, the geographic distribution of deposited radio-activity was highly irregular. Both the magnitude of the release and its com-position varied over a period of days. Wind directions, which varied as a function of height, shifted frequently, carrying part of the initial release northward over northeastern Poland and parts of Sweden and Finland, but later over large portions of central and southern Europe (see Chapter 6).

Initial estimates of the deposition pattern of radioactivity were calculated using large-scale dispersion and deposition models (ARAC, MES0S, and GRID)

(LLNL, 1986; WHO, 1936b). Although some broad features of the dispersal of material from the accident can be deduced from these preliminary calculations, 8-2

they do not provide an adequate basis for estimating population doses. If subsequent calculations incorporate improved deposition modeling as well as release data for the entire 10-day period following the accident, the results should be more consistent with observed patterns of dispersion and deposition.

Exposures to radionuclides deposited in rainfall greatly augmented the exposure due to dry deposition in some locations. On May 9, in Sweden, for example, the external exposure rate near Gavle was estimated to be more than 300 pR/hr, while the exposure rate in Stockholm, about 160 km away, was only about 30 pR/hr.

J. O. Snihs (NIRP, 1986) attributes much of the variation to differences in deposition of radionuclides in precipitation. This wide variability in deposi-tion between areas separated by relatively small distances occurred throughout Europe.

Deposition in the United States was generally much lower than in Europe, be-cause of additional dilution of the cloud and because of the action of removal processes (radioactive decay and deposition) in passage. As in Europe, depo-sition varied substantially between nearby locations. For example, Table 8.2 summarizes some deposition measurements made by the Department of Energy's Environmental Measurements Laboratory (EHL) at Chester, New Jersey, and New York City for the period of May 5 through June 2 (DOE, 1986). The Chester station is about 60 km west of the New York City station. EML staff attributed the higher deposition per unit area at the Chester station to differences in local meteorology (DOE, 1986).

Table 8.2 Radionuclide deposition in two U.S. areas Totals for period 5/6/86 - 6/2/86 Chester, N.J. New York, N.Y.

Precipitation (mm) 45.4 28.2 Deposition (pCi/m2 )

I-131 2380 1200 Cs-137 650 260 Cs-134 290 140 j Ru-103 720 230 Source: DOE, 1986.

8.1.2 Internal Dose From Radionuclides in Food Food pathways provide an additional route for radiation exposure from deposited radionuclides. A fraction of the deposition is directly deposited on plant surfaces. The radionuclides may then be translocated from the surface to other parts of the plant. Processes such as washing (by rain) remove about 5% per day of the deposited materials. Foods harvested shortly after the accident -

especially leafy vegetables or other produce subject to surface contamination -

would be expected to show higher levels of contamination than produce which would not be ready for harvesting until months later.

1 8-3 1

o l

Radionuclides that deposit on the ground can subsequently transfer to plants through their root systems. The concentrations in plants as a result of root uptake are generally much lower than those which result from direct intercep-tion, but may remain significant for long periods of time. Therefore, highly contaminated soil in locations near the release may be unsuitable for produc-tion of food crops for many years. Only longer-lived radionuclides, such as Cs-137, would be expected to enter the food pathway in any significant quanti-ties as a result of this process.

Contaminated animal feeds can contaminate meat and dairy products. Grazing animals can consume considerable quantities of freshly deposited radionuclides from pasture or other feeds. Appreciable fractions of ingested iodine and cesium are transferred to milk in dairy animals. As a result of the Chernobyl accident, milk concentrations (especially of I-131), were high in areas where cows grazed on contaminated pasture. In Lapland, the concentration of cesium radionuclides in reindeer meat rose rapidly because the lichens on which the indeer graze intercept an appreciable fraction of the depositing radio-nt :lides, but have a low mass per unit area of ground surface.

Predicting the radionuclide intake that results from ingestion of contaminated food is subject to considerable uncertainty. Storage time and preparation methods can substantially affect radionuclide levels in food. Differences in diet (a significant part of the Laplanders' food is reindeer meat, for example) can appreciably affect the radionuclide intake for particular groups of people.

As a rule of thumb (if no protective action is taken), doses from ingestion may be similar in magnitude to those from direct exposure. However, a credible assessment of food pathways will require detailed data on levels of contamina-tion and patterns of focd consumption.

8.2 Health Effects Health effects in humans may result from celluar and tissue damage caused by ionizing radiation. As the radiation penetrates the body, energy is deposited, causing damage. The damage depends on the amount of radiation deposited per unit mass (absorbed dose), the type of radiation, and the time over which the dose is delivered. If the dose to certain tissues is very high, the individual may become sick, or even die, soon after the exposure (acute effects). Even at much lower doses, however, health effects may manifest themselves many years later (long-term effects).

8.2.1 Acute Health Effects At high doses of ionizing radiation, many cells will be killed or functionally compromised, possibly damaging the individual severely. The effects of such damage appear rapidly, and at very high doses may include death. These health effects are commonly referred to as nonstochastic effects. For these effects, the incidence and severity increase with the dose of radiation received. More-over, there are levels of exposure below ahich these effects are not expected to occur. All of the dose response relationships noted in the material that follows apply in cases where the radiation dose is delivered in a short period of time, usually in much less than a day. If the exposure is protracted, then the response for a given dose will usually be less severe. In addition, medical supportive treatment may be able to reduce the severity of response for exposures low'er than the minimum lethal dose (WHO, 1961; NRPB, 1983).

i 1

8-4

________1----.--- - _ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - _

After total body exposures of the magnitude indicated below, the following effects would be expected: at greater than 50 rad, radiation sickness includ-ing nausea, vomiting, weakness, etc., with 100% incidence of radiation sickness expected at about 200' rad; at greater than 150 rad, in addition to radiation sickness, start-of hematopoietic syndrome with blood and immune system problems and some deaths within 60 days; at 300 to 500 rad, death in 50% of those ex-posed within 60 days; and at over 700 rad, nearly 100% mortality is expected (NRPB, 1983). Some organs are at particular risk. For example, a 15-rad dose to the testes can temporarily reduce fertility; at higher exposures, the sever-ity and duration of reduced fertility is increased until at 300 to 700 rad, permanent sterility may result. In the ovary, a dose of 200 to 450 rad may cause sterility. A 200-rad dose to the lens of the eye may cause cataracts.

A 250-rad dose to the skin may cause erythema, 700 rad - loss of hair, and more than 2000 rad - severe dermatitis (radiation " burns").

The thyroid presents a special case because it concentrates radioiodines which have been inhaled or ingested. The dose from these radionuclides in the thyroid can greatly augment the thyroid dose received from external irradiation and

-from other internal emitters. Total doses of 200 rad may cause impaired func-tion, but loss of function is more likely for doses greater than 3000 rad.

Complete destruction of the thyroid requires doses of 100,000 rad or more.

8.2.2 Long-Term Effects Energy deposited in a cell by ionizing radiation may not immediately affect vital cell functions but may damage the cell's genetic material, leading to an adverse effect expressed at some later time. These effects are often referred to as stochastic effects. A stochastic effect is one for which the probability of occurrence in a person is proportional to the radiation dose received, but the severity is not. The prime example of a stochastic effect is radiation-induced cancer. Thus, for instance, the probability of inducing a bone cancer is proportional to the radiation dose to the bone, but each bone cancer induced is equally severe or life threatening. Cancer induction and induction of genetic effects are the two types of stochastic' effects associated with radiation exposure. (Note: In discussing stochastic effects, doses are sometimes expressed in " rem" rather than " rad" units. For.the case of the Chernobyl accident, doses esseatially all-came from low linear energy transfer (low-LET) radiation, i.e., X-rays, gamma-rays, or beta particles. As a result, these units can be used interchangeably, as is done in this chapter.)

Cancer: Many types of cancer are known to be inducible by ionizing radiation.

Induced leukemias and bone cancers would occur in the first 30 years after exposure, whereas all other induced cancers could occur at any time during the remaining lifespan following exposure after about a 10-year minimum latent period.

.The most important data for assessing the risk of inducing a cancer by radia-tion are derived from epidemiological studies of people exposed to radiation from the atom bombs at Hiroshima and Nagasaki or to medical radiation. Although the epidemiological data are extensive, inadequacies exist which limit the accuracy of risk estimates. In particular, for absorbed doses below about 10 rad any excess risk of cancer is too small to he detected directly in the exposed populations. Therefore, at lower doses, risk estimates represent ex-trapolations based on theoretical models. The choice of model for this purpose 8-5 n

"is generally based on expert judgment, taking into account laboratory.experi-ments on animals as well as ' studies on cellular and subcellular systems.

For illustrative purposes in this chapter, the staff used a risk factor of 2x10 4 fatal cancers per rad of'(low-LET) radiation to the whole body, corre-  ;

sponding approximately to the linear-quadratic,. relative risk model described in the National Academy of Sciences "BEIR III" report (NAS, 1980). .With minor modifications, this model has recently been adopted by two panels of experts as providing a reasonable central estimate of the risk from~ low-level radiation.

(NRC, 1985a; NIH, 1985). [0thers might recommend a risk factor that is up to  !

3 times higher or lower. Hence, if 1 million people were exposed to one rad of whole-body radiation, about 70 to 600 fatal cancers would be projected.]

Genetics: If.the cell damaged by radiation is a reproductive cell, i.e., a cell giving rise to ova or spera, it may be involved in the conception of a child who has a serious, heritable disorder. Because this is a stochastic '

effect, the radiation dose influences the probability of occurrence rather than the severity of the effect. In estimating genetic effects, only radiation ex-posures that occur before age 30 are considered, since that is about the average age parents' conceive their children.

Current-human genetic risk estimates are extrapolated from animal studies.

According to the BEIR III' report, for every rad of radiation exposure to the parents, there is a risk of about 260 (60 to 1100) serious, heritable disorders per million liveborn infants (NAS, 1980). About 10% of the effects are expected to occur in the first generation born aftar the exposure, the rest in all succeeding generations. These serious, heritable disorders are genetic disorders gnd traits which would cause a serious handicap at some time during a lifetime.

Teratogenesis: There is an additional type of radiation effect which occurs under certain circumstances, when the radiation injury occurs in the developing fetus. Whether. teratogenic effects should be classified as acute or long term, as stochastic or nonstochastic, is not yet clear. At present, the only radiation-induced teratogenic effect that is quantified in man is severe mental  ;

retardation. There is a window from the 8th to the 15th week of gestation dur-  !

ing which the risk of inducing severe mental retardation is estimated to be 4x10 3 per rad (Otake, 1984). The data on which this risk estimate was based included an elevated risk in the 1-rad to 9-rad dose group and were consis>.ent with a linear nonthreshold model.

Other types of teratogenesis have been observed in animal studies following

, radiation doses as low as 5 rad, but there are no corresponding human data. Al-l though it is suggested that teratogenesis may occur during the first trimester of gestation following doses of 25 rad or less, most human data are case reports in which the exposure was 200 roentgen or more, or unknown but high.

f 8.3 Radiological Effects on the Soviet Union l At the International Atomic Energy Agency (IAEA) Experts' Meeting in Vienna, j held August 25-29, 1986, Soviet representatives presented their report (USSR, 1986) on .ill aspects of the accident, including information on radiation ex-l-

posures and doses in different regions of the European part of the Soviet 8-6 L h

q Union. .The Soviet report and additional = discussions which took place at the meeting have'been. summarized in a report by the International Nuclear Safety

! Advisory Group (INSAG, 1986). The discussion here is largely based on these two sources.

8.3.1 -Acute Effects in Onsite Personnel Y After'the Chernobyl_ accident, acute radiation effects were diagnosed in 203 I individuals, all.of whom were either working at the reactor or were brought in to deal with the emergency. Twenty-nine persons were reported to have shown some acute effects within the first 30 to 40 minutes after the accident, and within'the first 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />, acute radiation sickness was diagnosed in 203 in-dividuals. Estimates of radiation doses received were based on clinical cri-

teria, not on dosimetric data. Of 22 persons estimated to have received more-than 600 rad, 21 died in_4 to 50 days; I died later. Of 23 estimated to have received 400 to 600 rad, 7 have died. All 53 persons estimated to have received

-200 to 400 rad and all 105 estimated to have received 80 to 200 rad have sur-

vived. At this time, 29 persons have_ died as a result of their exposures; in

addition, 1 person died of severe burns and another was killed when part of the reactor building collapsed. Assuming that the Soviet dose estimates are reasonably accurate,'these data (above) suggest a median lethal dose above 400 rad.

As supportive therapy, transplantation of marrow or fetal liver cells was of marginal utility;. fresh unpooled platelets were reported to have had signifi-cant efficacy in combating some aspects of the acute radiation syndrome.

4 8.3.2 Late Effects in the Population Near Chernobyl

'A much larger population is at risk from delayed effects of the radiation, including cancers, genetic mutations, and teratological effects. Apart from

' workers at the reactor site, the largest doses were received by the 135,000 f~ people who lived within 30 km of the plant. According to the Soviet report, the 45,000 inhabitants of the town of Pripyat were evacuated on April 27. The other 90,000 were said to be evacuated "in the first few days after the acci-dent," but elsewhere in the report it is said that the evacuation took place after 9 to 10 days, on May 4-5.

The Soviet report states that doses "for the vast majority of the population did not exceed 25 rem," although some people in the most contaminated areas may

'have received 30 to 40 rem. However, Table 7.2.2 in the Soviet report indicates that some inhabitants who remained in the area for 7 days or more before being evacuated would have received at least 60 to 80 rem from external radiation alone.

In Table 7.2.3, moreover, the average dose for inhabitants of the zone 3 to 7 ka' around the plant is estimated to be 54 rem. That no acute radiation sickness 1 symptoms were observed despite doses in excess of 50 rem might be explained by the fact that doses were protracted over a period of days. On the other hand, the tabulated values are once referred to as " maximum estimates," and this may help to explain some apparent inconsistencies - i.e., 30 to 40 rem may be intended as a more realistic' estimate of the maximum dose received off site. The report

! indicates that the dose estimates for the evacuees are preliminary and that I more accurate estimates will be forthcoming.

i 8-7 i

l' A

l The maximum collective external dose delivered to the 135,000 evacuees by direct radiation from the effluent cloud and by radionuclides deposited on the ground was estimated by the Soviet officials to be 1.6x10 8person-rem, an average of about 12 rem per person. On the basis of that collective dose estimate and assuming a cancer risk factor of about 2x10 4/ rem, one would calculate about 320 excess fatal cancers in the population attributable to the external radiation exposure. It would, however, be very difficult to detect this excess since, according to the Soviet report, in the course of normal events about 12% of the evacuees (approximately 16,000) will normally die of cancers from other causes.

Although inhabitants of the 30-km zone were given potassuim iodide (KI) to minimize uptake of radioiodines, the population received appreciable doses to the thyroid through inhalation and ingestion of I-131 and I-132. The uptake of I-131 in the 30-km zone and elsewhere along the path of the radioactive cloud was monitored extensively, particularly in children (100,000 children were mea-sured in all). Doses to children are of special concern, primarily because their smaller thyroid gir.nds receive higher doses for a given intake and because of their high consumption of milk, a food in which I-131 fallout is likely to become concentrated. From the monitoring, it was estimated that most doses to the thyroid from inhaled or ingested radioiodine were less than 30 rad, although a few children may have received doses as high as 250 rad. Children receiving more than 30 rad to the thyroid were put under continuing medical observation, but the risk of hypothyroidism appears to be negligible below about a 1000-rad thyroid dose from I-131 (NRC, 1985b).

If the average dose to the gland were about 30 rad, the collective thyroid dose would be about 4x106 person-rad. The number of excess cancers and benign tumors resulting from such a dose is highly uncertain. The most serious uncertainties relate to: (1) the possible reduced effectiveness per unit dose from I-131 (as compared to X-rays and gamma-rays) in causing thyroid cancers and benign tumors and (2) the long-term risk to those irradiated as children.

If one adopts the thyroid risk coefficients presented in recent reports pub-lished by the Nuclear Regulatory Commission (NRC, 1985a; NRC, 1985b), and the above collective thyroid dose (presumed mostly from I-131), about 100 excess thyroid cancers in the population, 10 of them fatal, are estimated. This estimate is based on an absolute risk model and assumes that beta irradiation of the thyroid by I-131 has about one-third the carcinogenic potency per unit dose as external X-rays.

In addition, a somewhat larger number of benign thyroid nodules might occur as a result of the irradiation. Thyroid effects, being generally nonfatal, are less important than other radiation-induced tumors in the population. However, the excess incidence of thyroid cancers and benign nodules may be detectable since the background incidence rate is expected to be low.

Also of concern in the evacuated population are possible radiation-induced birth defects, particularly mental retardation for fetuses irradiated in the critical 8- to 15-week period of gestation. There is evidence that such a fetus may have an excess risk of about 4x10 3/ rad of being severely mentally retarded, and that this risk is proportional to dose, at least down to a few rad. Thus, a fetus receiving 25 rad would have perhaps a 10% risk of mental retardation. The risk may, however, be significantly lower because this estimate was based on studies 8-8

~ _ _ _ _ _ _

4 Hof the atomic bomb survivors at Hiroshima and Nagasaki, who ~ received their doses-almost instantaneously; in contrast, the exposure in the case of the evacuated Russian population was spread out over' days.

The estimated average individual dose to the evacuated population was 12 rad; thus, unless therapeutic abortions were performed on pregnant women'in the popu-

, lation, about_5% of all fetuses in the population who were in the critical 8-to 15-week' period at the time of the accident may be born mentally retarded as a result. -Typically, a population of 135,000 in an industrialized society.

would, at any time, include about 300 women in the critical period of pregnancy, although the number would naturally vary depending on the age structure of the population and other factors. Hence, if therapeutic abortions were not per-formed, about 300 children who are at increased risk of being mentally retarded because of their in utero radiation exposure may be born to the evacuees.

) Extrapolating from the experience with the Japanese atomic bomb survivors, approximately 15 of these children (5%) may be severely retarded as a result of the. exposure. An excess of this magnitude should be readily detectable since fewer than 1% of all children (in developed countries) suffer from severe mental retardation.

8.3.3 Exposure Pathways and Doses in the European Soviet Union li The Soviet report also attempts to assess the collective radiation impact on the nation. The bulk of the exposure was determined to occur in the European

~

part of the Soviet Union, more particularly, in the Ukrainian SSR, the Byelorussian SSR, the Moldavian SSR, and the Russian SFSR. The size of the exposed population is about 75 million people.

i As discussed above, the most important exposure pathways for this population i will be: (1) external irradiation by radionuclides deposited on the ground and (2) internal irradiation by ingested radionuclides. There will also be some contribution to doses from inhaled radioactivity resuspended into the air from j the ground'on which it was deposited.

a As previously discussed, most of the long-term dose - both internal and external - will be from Cs-137 and Cs-134; however, in the first few weeks after i- the accident I-131 was an important contributor to the ingestion dose.

! Immediately after the accident, intervention levels were established for the l concentration of I-131 in milk and milk products and in leafy vegetables, i Methods of ensuring compliance with these levels were introduced and enforced.

The levels were based on the principle that the dose to a thyroid of a child should not exceed 30 rem per year. In addition, standards were set governing I-131 content in meat, poultry, berries, and raw materials used for medical purposes. Later, when the activity from radioiodine had decayed away and Cs-137 and other longer-lived nuclides became predominant, intervention levels were set for these radionuclides based on the principle that the effective dose to an individual should not exceed 5 rem in the first year (INSAG, 1986).

Estimates of the external dose were provided in the Soviet report for various regions of the European part of the Soviet Union, for urban and rural dwellers, respectively. Estimated doses tended to be higher for people in rural areas because they spend more time outdoors and eat more locally produced food. The 8-9 n

individual doses for the year 1986 ranged from 3 mrad to about I rad. The collective dose to all 75 million people over the next 50 years was estimated to be 29x10s person-rad, about 30% of which would be received in 1986.

~

The Soviet report also estimates exposure through the food pathway. For food-produced in 1986, there will be contamination.from a variety of radionuclides, especially_I-131,-Ru-106, Ce-144, Cs-137, and Cs-134. Most of this contamina-

' tion will result from the direct deposition of airborne radioactivity onto vegetation. .More important over the lon'g term will be contamination of food by ground-deposited Cs-134 and Cs-137, which are_taken up from the soil'by crops.

Uptake of Sr-90 frca soil may also be important, but the data on Sr-90 deposi-tion were considered to be too' scanty to draw any conclusions at this time; hence, its contribution to'the collective dose was neglected. The highest-doses from Cs-134 and Cs-137 were believed to be in the Ukrainian and Byelorussian regions of Poles'ye where an estimated 10 Ci 5 of Cs-137 was depo-sited (about 10% of that released in the accident). A critical consideration in the calculation was that the soil in this region is such that uptake inte plants was expected to be enhanced 10 or even 100 times over what it would be in other soils.

8.3.4 Collective Dose and Health Effect s in the Soviet Union -

~

The collective dose delivered through the food pathway to the population of the Poles'ye region for a period of 70 years after the accident was estimated to be 2.1x10s person-rad. Experts at the IAEA Review Meeting questioned this

-figure because previous experience in estimating collective doses from release of cesium to the atmosphere (e.g., from nuclear weapons tests) suggests that the dose via food consumption is roughly equal to that from external exposure.

Furthermore, preliminary whole-body scanning measurements suggest that cesium

- transfer through the food chain may be only about 10% of what was predicted for the region. According to the U.S. attendees of the IAEA meeting, there was general agreement among both Soviet and Western experts there that the esti-mated collective dose given in the report was probably too high, perhaps by about an order of magnitude. A more definitive assessment of the collective dose via the food pathway must await further measurement of cesium and stron-tium concentrations in soil and uptake into food throughout the contaminated areas of the European Soviet '. tion, including those outside Poles'ye. The _'

Soviets have initiated a program for carrying out such measurements. A major purpose of that program is to help formulate measures to reduce the population dose.

The estimated effect of the Chernobyl accident on the exposed population of 75 million is, from the standpoint of potential health effects induced, quite substantial. Even if the Soviet report overestimates the dose via the food i pathway by an order of magnitude, one estimates a total collective dose of 4

about 5x107 person-rem. Assuming a risk factor of 2x10 4/ rem, about 10,000 fatal cancers (plus a comparable number of nonfatal cancers) would be projected over the next 70 years. Mitigation measures will reduce the collective dose, t

but final consideration of the enhanced cesium uptake by crops in the Poles'ye region as well as inclusion of neglected sources of exposure (e.g., from con-taminated crops in other parts of the European Soviet Union, from uptake of i Sr-90, and from inhalation of resuspended radioactivity) may substantially increase the final estimate.

8-10 N _ _ _ _ _ _

.The radiation exposure may also induce severe genetic disorders. These have

'been estimated to be_ comparable in number to the excess fatal cancers.

Although they will be distributed over.all future generations, roughly 10% are expected to occur in-the next generation'. Any postulated induction of mental retardation in-the fetustat theLvery low incremental doses'and dose rates caused by.the fallout from Chernobyl over most of the. European Soviet Union would be extremely speculative. In any case, even' assuming that a linear non-threshold dose-response relationship is applicable during the sensitive 10-week *

. period, the number of such cases would be expected to be very small compared with the number of excess fatal cancers.

f

.Although the number of excess fatal cancers predicted on the bssis of the Soviet report is very large,uthese will be widely distributed over a popula-tion of 75 million people and over decades. The Soviet report indicates that about 9.5 million cancer fatalities would be predicted for the population over 70 years. tThis is almost a factor of two fewer than what would be predicted for a'U.S. population of that size, but more than enough to render undetectable the excess due to the accident.

Correspondingly, the risk to an avertge individual in the population owing to the accident is relatively small. Assuming that the original Soviet estimate ,

of dose received through the contaminated food pathway is high by a factor of 10, the estimated average individual dose from external and internal pathways round would'beabout0.67 radiation over a period rad,roughlyequivalenttothedosereceivedfrombackg/

of 7 years. Based again on a risk factor of 2x10- rad,

.this dose would give an estimated lifetime risk of 0.013%, which is only about 0.1% of the stated Soviet baseline risk of fatal cancer (12-13%). Individual doses and risks could, however, be substantially higher for some inhabitants of the Poles'ye region whose diets, despite intervention measures taken by the government, may still consist largely of locally grown food.

8.4 Radiological Effects on Europe Outside the Soviet Union f

8.4.1 Exposure Pathways and Doses Beginning with the initial detection at the Forsmark nuclear power station in Sweden on April 28, of radiation from the release, radioactivity was monitored in air, on the ground, and in food throughout Europe. The quality and com-pleteness of these data, however, vary greatly by country.

= Data on radiation levels in Europe for the period following the accident were collected by the World Health Organization (kHO) and published in a series of reports. A full summary of all the data is contained in the final report of

• June 12 (WHO, 1986a). Every country in Europe reported that levels of radio-activity had increased because of the accident. Table 8.3 summarizes the maxi-l- mal values reported by countries outside the Soviet Union. Included in the

table are only those countries reporting either ground exposure levels of l 100 pR/hr or I-131 levels in milk exceeding 15,000 pCi/ liter. The former level

! represents about 10 times normal background, the latter is the Preventive Action Guide prepared by the U.S. Food and Drug Administration, above which actions for mitigation'are recommended.

l 8-11

.b ~

se

' Table 8.3.. Maximum' radiation' levels'found in Europe'following.

the' accident, by country Ground exposure rate I-131 in cows' milk Countryi (pR/hr) .(pCi/ liter)

Austria 240 41,000-Czechoslovakia 200 42,000 Finland. 385- -

Hungary. - -

70,000

. Italy -

160,000 Poland 1000 54,000 Romania 350 78,000 Sweden' 500 78,000 Switzerland 150 50,000 Turkey 100- -

United Kingdom 100- 31,000' West Germany -200 32,000 Yugloslavia 150 -

Source: WHO, 1986a.

More than 10 European nations have produced reports on the effects of the Chernobyl accident. Among the more detailed reports which attempt to assess collective long-term doses in their respective countries were those published by Italy-(ENEA-DISP, 1986), Finland (STUK, 1986), and Sweden (NIRP, 1986).

The Italian report focuses chiefly on the food pathway; other exposure routes (including direct irradiation by ground-deposited radioactivity) were judged less important in Italy. Taking into account the measures adopted to restrict the consumption of contaminated food, it was estimated that the committed population thyroid dose up to the 25th of May was 107 person-rad. It was fur-ther estimated that the dose would have been 3.5 times higher had the restric-tive measures not been taken. The collective committed effective dose for the same period was estimated to be about 5x10s person-rem, or about 10 mrem per person. Inclusion of the projected dose over all future time would increase this figure by less than a factor of 2. 1 Average individual doses estimated for Finland and Sweden were considerably higher than for Italy. The Finnish report projects an average dose from ex-ternal irradiation of 20 arem and 160 mrea for 1 year and over all time, respectively. The-average internal whole-body equivalent dose was estimated to be 50 mrem for the first year; the total internal dose over all time was not calculated. Thus, the average committed dose over all time was estimated to be 210 mren'plus any additional committed internal dose froa ingestion of radio-nuclides after the first year. The Swedish report estimated a collective dose of 300,000 person-res and an average dose of 40 mrem for the first year, pri-marily from external and internal irradiation by Cs-134 and Cs-137. 'The maxi-mum individual doses are expected to be about an order of magnitude higher.

Estimates of lifetime doses attributable to the accident have also been reported (GSF, 1986) for the area around Munich, West Germany, where significant deposi-tion of radioactivity in rain occurred. The average internal dose was estimated 8-12 i

. - - ~ . ~ , . .

^ b

r to be 100 to '250. area and 50. to 200 mres, ~ for children and 'adu' l ts, ' respectively.

Comparable ranges for' external irradiation by ground-deposited ~ cesium are 200 to 300 mrea and 100 to 200 mren, respectively.

~

. 8.4.2 Estimation of Collective Dose and Health Effects

~

The assessment of both short .and long-term collective external doses requires

.a population-weighted sum of doses from ground-deposited radionuclidesfover geographical areas. Consequently, the deposition pattern for Europe had tx>

first be determined. Efforts to do this began soon after the accident, but

-- everything published so far in this regard has been.very preliminary (for ex-ample, see WHO, 1986b). Estimates of the deposition pattern should ultimately be base' on both measurements of. local deposition and computer models describing atmospheric dispersion of material from the source and incorporating detailed

- weather'information. It is.important that the areal grid used to define the deposition be fine enough to reflect the significant variations resulting from

-wind and rainfall patterns. As previously noted, because of local precipita-tion, deposition often varied enormously over rather small distances.

The assessment of long-term doses received through the food pathway will re-quire data on deposition, particularly of Cs-137, and on agricultural patterns, coupled through a mathematical model to estimate contamination levels in food.

Assessment of doses received through. ingestion of radionuclides in the first few weeks-after the accident-(primarily from I-131) will probably also have to rely heavily on model calculations. These calculations should, where possible, be compared against measured levels of radionuclides in food and in people.

' Estimates based on model calculations or measurements of food must be adjusted, moreover,.to take into account any mitigative measures that decreased human

, intake.

Until the analysis outlined above is completed, any estimates of collective

! dose outside the Soviet Union must be regarded as highly tentative. A rough approximation can be made, however, by projecting from locations where.a fairly complete analysis has been performed. For example, in the area around Munich,

, the average dose over all time was estimated in the GSF report to be a few 3 hundred millires, about 20% of which would be received in the first year.

The GSF report also indicated that the maximum level of radiation recorded there was about 100 pR/hr. An examination of the World Health Organization

-final report (WIIO, 1986a) would seem to indicate that (excluding' Spain, Portu-gal, Ireland, England, Denmark, and most of France, all of which received very little of the fallout) the maximum levels of outdoor exposure recorded at most locations in Europe were generally in the range 10 to 1000 pR/hr above back-ground levels. Most locations would seem to fall in the lower portion of this range (10 to 40 pR/hr), although higher readings were fairly widespread (see Table 8.3). On the basis of an examination of the data, it is estimated that the maximum exposure from the fallout, averaged over all locations in Europe (outside the Soviet Union and the countries listed above), is 20 pR/hr (to within about a ' factor of 2). Extrapolating from the Munich area data, this would imply an average lifetime dose of about 60 mrem (12 mrem in the first year). 1 A similar extrapolation based on the data on Sweden, where the maximum exposure was 500 pR/hr (WHO,1986a) and the maximum first year dose was a few hundred arem (NIRP, 1986), would be consistent with this analysis. Nevertheless, it should be noted that the geographical variability in the relative activities of 8-13 2

)

deposited radionuclides, among other factors, may introduce appreciable error into such extrapolations.

Thus, as a tentative approximation, the average individual in Europe (outside the Soviet Union and the other countries named above) will receive a 60-mrem dose from the accident, this dose being spread over a period of years. For comparison, this individual will receive about 100 mrem each year from back-ground radiation. Using this estimated average dose and a total population of about 350 million people in that part of Europe being considered, a collective dose of 2x107 person-rem is calculated. Based again on a risk factor of 2x10 4/ rem, about 4000 excess cancer deaths outside the Soviet Union may be calculated to result from the accident. These deaths would be completely masked by the 70 million or so cancer deaths predicted in the population over the next 70 years.

8.5 Radiological Effects on the United States Radionuclide concentrations in the United States as a result of the Chernobyl accident were generally lower than those in Europe and the resultant intakes and exposures were lower accordingly. Using preliminary data, C. R. Porter

• has estimated the total U.S. deposition of radionuclides of iodine and cesium 4

to have been approximately 4x10 4 Ci and 10 Ci, respectively. Table 8.4 sum-marizes Porter's estimates of maximum individual doses to groups in the United States from exposures or intakes in the year following the accident, calculated using data obtained from DOE (1986), WHO (1986a), and other sources.* Thyroid doses were dominated by the intake of I-131 in milk and show a strong age dependence. Effective dose equivalents were dominated by external irradiation from deposited Cs-134 and Cs-137 and show no significant age dependence. For comparison, a typical background annual effective dose in the United States is about 100 mrem. After Chernobyl, C. R. Porter

• estimated the U.S. collective dose to the thyroid from I-131 in pasteurized dairy milk to be 10 5person-rad (within a factor of 3). Using this collective thyroid dose and the thyroid risk estimates noted earlier, the projected thyroid effects in the United States would be about two excess thyroid cancers. For comparison, based on recent cancer statistics, roughly 200,000 thyroid cancers are expected to occur among current residents of the U.S. over the remainder of thein lifetimes.

8.6 Global Effects on Agriculture and Food The Chernobyl accident disrupted agriculture and other segments of the food industry. Some of this disruption will continue well into the future. Land close to the accident site was determined to be so badly contaminated that its cultivation may be impossible for years to come. Land between 5 km and 10 km from the power station site falls into this category (INSAG, 1986). In other locations within the European Soviet Union, it may be necessary to modify farm-ing practices in order to minimize human exposures through the food pathway.

In particular, the zone from 10 km to 30 km distant from the reactor site falls into this category (INSAG, 1986). With some exceptions, however, problems with respect to contamination of agricultural land outside the Soviet Union are much less severe, and extensive decontamination or control of farming practices will

• C. R. Porter, private communication of preliminary data submitted by the U.S.

Environmental Protection Agency to the Nuclear Energy Agency (OECD), U.S. EPA Eastern Environmental Radiation Facility, Montgomery, Alabama, September 1986.

8-14

/L_

Table 8.4 Maximum individual doses (area) to groups in the United States due to exposures _or intakes in the first year after the accident Radionuclides Pathway ' Iodine

• b b

. Cesium Other External e Immersion- 1.6x10 s 2.0x10 7 2.0x10 s Irradiation from deposited activity -

4.4x10 1 -

Internal d Inhalation 8.0x10 s 1.0x10.s 1.0x10 4 Ingestiond (milk and milk products")

" Adults 5.0x10 1 1.0x10 3 -

Children (under 10 years) 3.0 9.0x10 3 -

Infants (under 1 year) 1.4x10+1 4.0x10 1 -

a) Thyroid dose equivalent.

b) Effective dose equivalent.

c) Within an order of magnitude.

d) Within a factor of 3.

e) Based on maximum total intake of I-131 from drinking pasteurized milk as reported for 65 U.S. cities.

Source: C. R. Porter, private communication of preliminary data sub-mitted by the U.S. Environmental Protection Agency to the Nuclear Energy Agency -(OECD), U.S. EPA Eastern Environmental Radiation Facility, Montgomery, Alabama, September 1986.

not be required. However, elevated levels of cesium and strontium isotopes in crops are expected to persist for a number of years.

Fallout from the accident deposited on crops over much of Europe, and in many places fruits and vegetables were removed from the marketplace. Initially, dairy products derived from animals grazing on contaminated pastureland were most severely affected, especially by I-131 (cf. Table 8.3). Within a matter of weeks, radioiodine levels had dropped to acceptable levels, but contamina-tion of meat and other foods with Cs-137 and Cs-134 remains a concern in some places. Following the accident, many nations, including the United States, began to monitor food products for radioactivity. As a result, some imports into the United States were deemed unacceptable.* Some countries in Western

• As of mid-December 1986, the Food and Drug Administration (FDA) has measured radionuclide concentrations in 690 samples of shipments presented for import into the United States. Of these, 4 have exceeded the FDA's level of concern.

8-15

.__n ~

2 3

Europe banned importation of. agricultural produce from Eastern European

~

countries. Total losses to agriculture will be in the hundreds of millions of

-dollars.

One localized problem that persists in Lapland concerns the high concentration of Cs-134 and Cs-137 in reindeer meat. Concentrations up to 20,000 Bq/kg 4

(540,000 pCi/kg) have been measured - well in excess of the 300 Bq/kg reference

level used.in Sweden as the maximum concentration allowed in meat sold for human consumption-(NIRP, 1986). The concentrations are expected to persist above the reference level for several years. One consequence of this situation is the disruption of an important industry of the Laplanders, the production of reindeer meat. .A second is that the doses to the Laplanders (for whom reindeer meat is an important dietary item) could be as high as 1 rem per year or more (NIRP, 1986).

8.7 Ecological Effects With the exception of the' area immediately around the damaged reactor (0 to 30 km from the site), no direct adverse ecosystem effects are expected. In the 4

reactor cooling pond and parts of the Pripyat River, exposures of aquatic biota

may be high enough to harm some individual organisms or sensitive species.

I Within the 30-km zone around the site, discrete areas of high contamination may show significant changes in radiosensitive species. However, even there, effects may not be detectable.

In addition to potential effects on freshwater ecosystems noted above, the

! possibility of long-tere. effects on terrestrial and aquatic species and ecosystem effects at both high and low doses has been raised (INSAG, 1986).

The Soviet report listed a number of research programs which would be initiated to determine if there will be long-term ecological effects, particularly on i

aquatic biota.

l Although transport of radionuclides through ecosystems may not affect the eco-

~

system itself, there still may be an effect on man. For example, the concen-i trations of cesium and its transmission to man in reindeer in Lapland will not affect the tundra biome, but man will be affected if the food chain is not controlled. Likewise, transport of radionuclides to groundwater and to the 4

j water supply for man must be controlled, even though there is no effect on j ecosystems. A major problem in this regard is the potential contamination of the Kiev reservoir, which the Soviets have taken measures to prevent.

8.8 References

DOE, 1986 U.S. Dept. of Energy, Environmental Measurements Laboratory, "A Compendium of the Environmental Measurements Laboratory's Research Projects Related to the Chernobyl Nuclear Accident,"

EML-460, New York, October 1986.

ENEA-DISP, Italian Agency for Nuclear and Alternative Energy - Directorate 1986 for Nuclear Safety and Health Protection, External Relations and Information Department, "The Chernobyl Accident: Radiolo-gical 1986 Consequences in Italy. Report to 27th of May 1986,"

DOC./ DISP (86)1, Rome, June 1986.

8-16

. . C

GSF, 1986 Gesellschaft fur Strahlen-und-Umweltforschung, "Umweltradioaktivitat und Strahlenexposition in Sudbayern durch den Tschernobyl-Unfall," Bericht des Instituts fur Strohlenschutz, Munchen-Neuherberg, June 15, 1986.

INSAG, 1986 International Nuclear Safety Advisory Group, " Summary Report on the Post-Accident Review Meeting on the Chernobyl Accident,"

August 30-September 5,1986, GC(SPL.I)/3, IAEA, Vienna, September 24, 1986.

LLNL, 1986 Lawrence Livermore National Laboratory, " ARAC Response to the Chernobyl Reactor Accident," UCID-20834, July 1986.

NAS, 1980 National Academy of Sciences, "The Effects on Populations of Exposure to Low Levels of Ionizing Radiation: 1980 (BEIR III),"

National Academy Press, Washington, D.C., 1980.

NIH, 1985 National Institutes of Health, " Report of the National Institutes of Health Ad Hoc Working Group To Develop Radioepidemiological Tables," NIH Publication No. 85-2748, January 1985.

NIRP, 190o National Institute of Radiation Protection, J. O. Snihs, "Conse-quences in Sweden Chernobyl Accident. IAEA General Conference, Scientific Programme for Safety, 2-3 October 1986," SSI-report 86-21, Sweden, September 30, 1986.

NRC, 1985a U.S. Nuclear Regulatory Commission, E. Gilbert, " Late Somatic Effects" in Health Effects Model for Nuclear Power Plant Accident Consequence Analysis, NUREG/CR-4214, 1985.

NRC, 1985b U.S. Nuclear Regulatory Commission, H. Maxon, S. A. Book, C. R. Buncher, V. Hertzberg, and S. R. Thomas, " Thyroid Effects,"

in Health Effects Model for Nuclear Power Plant Accident Consequence Analysis, NUREG/CR-4214, 1985.

NRPB, 1983 National Radiation Protection Board, H. Smith, " Dose-Effect Relationships for Early Response to Total Body Irradiation,"

NRPB-R139, Chilton, England, 1983.

Otake, 1984 Otake, M., and W. J. Schull, "In Utero Exposure to A-Bomb Radiation and Mental Retardation; A Reassessment," Brit. J.

Radiol. 57, 409-414, 1984.

STUK, 1986 SHteilyturvakeskus StrS1sskerhetscentralen, Second Interim Report.

" Radiation Situation in Finland from 5 May 1986," STUK-B-VALO 45, Joint report of Finnish Centre for Radiation and Nuclear Safety and NBC Defence Office of the General Headquarters Rescue Department of the Ministry of the Interior, Helsinki, May 1986.

USSR, 1986 USSR State Committee on the Utilization of Atomic Energy, "The Accident at the Chernobyl Nuclear Power Plant and Its Conse-quences." Information compiled for the IAEA Experts' Meeting, August 25-29 1986, Vienna, 1986.

8-17 a _ ._

WHO, 1961 World Health Organization, S. A. Killmann, E. P. Cronkite, V. P. Bond, and T. M. Fliedner, " Acute Radiation Effects on Man Revealed by Unexpected Exposures," pp. 151-164 in Diagnosis and Treatment of Acute Radiation Injury, Columbia University Press, New York, 1961.

WHO, 1986a World Health Organization, Regional Office for Europe, " Summary Review of Measurement Results Relevant for Dose Assessment,"

Update Revision No. 7, Copenhagen, June 12, 1986.

WHO, 1986b World Health Organization, Regional Office for Europe, " Summary Report of Working Group on Assessment of Radiation Dose Commit-ment in Europe Due to the Chernobyl Accident," Bilthoven,

-June 25-27, 1986, Copenhagen, September 8, 1986.

8-18

~ c,ro=~

,a s. m v1.,veaAu nutuo ,co .ss,o. . u *on u ~uwou uz <-.* * <<oc. .en .

,o U'," 'E: CCUOGRAPHIC DATA SHEET NUREG-1250 sea ennvauctio=s og tat nevense

a. TeTLt Asso sutisTLE 3 Llavg sta

/

eport on the Accident at the rnobyl Nuclear Power Statfor 7 .,,,,,,,,,,,,,,a,,,

-o u A.

g 3 ,.ur o.,,,

/ January 1987 Multi Authors ,,,,,,,,,,,,,,,,,

f anomin vtam ,

January I 1987

7. Pts 'omasNG oRfeAagilAT6Qeg NAM, AagQ M neG AcomEss(saraweele Cesks

/ l

[ PRoJECitT AsE7WomE uMIf NuwSER Department of Energy Inst, of Nuclear Power 0perJ -------

Electric Power Research stitute ' ~ oa caANi auwan a Environmental Protection ency Federal Emergency Manageme Agency -------

Nuclear Regulatory Commissi

,0, sPoMsonsNG onGamitateose ssawt Aeso s. AILING Aoont anweele Coded II. TY't of stront U. S. Nuclear Regulatory Commi ion Joint Agency Washington, D. C. 20555 et PERaOO Co.into tracave=, ermsJ it sue *Lautuvanv uorts

83. AssTR ACT (Jop weres or as.es

\

This report presents the compilation of informa . n btained by various organ-izations regarding the accident (and the consequ' s of the accident) that occurred at Unit 4 of the nuclear power station a hernobyl in the USSR on April 26, 1986. Each organization has independen accep*.ed responsibility for one or more chapters. The various authors a i tified in a footnote to each chapter. Chapter 1 provides an overview of he ort. Very briefly the other chapters cover: Chapter 2, the design of e Ch obyl nuclear station Unit 4; Chapter 3, safety analyses for Unit 4; apter the accident scenario; Chapter 5, the role of the operator; Chapter 6. an assess at of the radioactive release, dispersion, and transport; Chapter 7 - he activit s associated with emergency actions; and Chapter 8, information >n the health' d environmental consequences from the accident. These subje s cover the ma aspects of the accident that have the potential to prescrit . w information a lessons for the nuclear industry in general.

The task of evaluating the information obt' ned in these various as and the assessment of the potential implications been left to each org 'zation to pursue according to the relevance of the bject to their organizati Those findings will be issued separately by the ognizant organizations, basic Purpose of this report is to provide the aformation upon which such a ssments can be made, i c

n oocuw. o A ALuis.. u o.os,o nc.,,vo.s g is A.. 6. 4 1 Chernobyl Accident, Russian Reactor, Severe Accident, Core Melt, Radioactive Release, Reachivity Accident, Graphite Fire, Unlimited

& Pressure Tube Reactor 13 Sicumstv CL Ass #8eCatsom s .our.. ..s,o, .. .. n. s "IIn~D assi fied

, r.e ,

j Unclassified it Nuweta o* PaGis 209

. . . ..c t

h

!.t#,6 ,fD$.

r6D EPRI Electric Power Research Institute

,y t.D b rq

$Oh I,

1,

,$ rY

% rny In<, tit ut e o' l JPV Nin ie, e Power Operations Federal Emergency Management Agency

- ; . . . 9.

..