Mark ở vũ trụ khácVIMark học AI
Mark ở vũ trụ khác · Another Universe Anatomy of a Disaster · Nuclear · Incident investigation

Chernobyl

01:23:40

Unit 4 · 26 April 1986, 01:23 · Chernobyl nuclear power plant, Ukraine (USSR)

Whatthe reactor's power surged during a test, two explosions
Toll2 killed that night, 28 dead of radiation sickness in 1986, 116,000 evacuated
Root causea reactor unstable at low power, a flawed emergency shutdown, a test changed on the spot
Main sourcesIAEA INSAG-1 (1986) and INSAG-7 (1992)

Source: Chernobyl Forum, Chernobyl's Legacy (2006), pp. 10–11 and 14 (deaths, evacuations); IAEA INSAG-7 (1992).

Re-read in 1 minute

Essence

Two reports, two culprits1986: the operators broke the rules. 1992: the reactor itself was unstable.
The stop button added heatGraphite tips on the control rods: the moment they went in, the reaction rose.
Known since 1983The flaw was found at the Ignalina plant. Nobody fixed it, nobody warned.
The number no one could seeThe reactor's safety margin was not on the control panel and did not trip anything.
The death toll depends on what you count31, 4,000 or 9,000: each figure measures something different.

Source: IAEA INSAG-7 (1992), sections 2.2, 4.1, 4.2, 6; INSAG-7 Annex I (the official 1986 account); WHO (2005, 2006).

Part 1

The question of the case

Same explosion, same international expert group: why did the 1986 conclusion blame the operators while the 1992 one pointed at the design? The answer teaches us how to write incident reports: the first version is usually the easiest story to tell, not necessarily the truest.

1983Flaw knownAt the Ignalina plant, engineers see that control rods can increase the reaction.
→
26/4/198640 secondsThe test starts at 01:23:04. The emergency stop is pressed at 01:23:40. Then two explosions.
→
1986 → 1992Two conclusionsINSAG-1 relied on the Soviet account. INSAG-7 rewrote it once new data emerged.

Source: INSAG-7, section 4.1 (Ignalina 1983) and foreword; times from INSAG-7 Annex I, as compiled by the World Nuclear Association.

Part 2

What happened

Unit 4 was powered down for a safety test: if the grid power failed, could the turbine, still spinning on momentum, run the cooling pumps until the backup diesels started?

Unit 4 power, 25 to 26 April 1986. 01:06 on the 25th, power reduction from 3,200 MW thermal begins. 03:47, held at 1,600 MW for almost 20 hours because the grid needed it. 14:00, emergency core cooling disconnected. 23:10, reduction resumes. 00:05, 720 MW. 00:28, at about 500 MW, power drops to about 30 MW. 01:00, raised and held at 200 MW. 01:23:04, the test begins. 01:23:40, emergency stop AZ-5 pressed. 01:23:43, power above 530 MW and surging, two explosions. 3,200 1,600 200 0 from 14:00: emergency core cooling disconnected held at 1,600 MW for the grid 720 ~30 200 MW, not 700 explosion 01:0603:4723:1000:0500:2801:0001:23:0401:23:40 thermal power (MW) · time axis not to scale, vertical axis compressed to show low levels
A day dragged out, a night rushed. The reactor ran at half power for almost 20 hours, dropped almost to zero, then was pulled back to 200 MW, far below the 700 MW in the test programme. The test went ahead anyway.Source: times and power from INSAG-7 (1992) Annex I, as compiled by the World Nuclear Association; 700 MW and 200 MW: INSAG-7, section 5.2.2; design output 3,200 MW: OECD/NEA (2002), chapter I.
1983 · Ignalina, LithuaniaFirst discovery that control rods can raise the reaction as they start to go in. The chief design engineer announced changes; none were made.
25/4/1986, 14:00 · Emergency cooling disconnectedPart of the test programme. INSAG-7 later noted this was permitted if the chief engineer authorised it.
26/4, 00:28 · Power falls to about 30 MWDuring a switch of control mode. Operators pulled out more rods to bring power back up.
01:22:30 · Equivalent of 8 rods leftPost-accident calculations: the reactivity margin was only 8 equivalent rods, below the minimum of 15.
01:23:04 · Test beginsSteam to the turbine is shut off. Coolant flow falls and the water in the core boils harder.
01:23:40 · AZ-5 pressedEmergency shutdown. Three seconds later, power is above 530 MW and surging. Two explosions, 2–3 seconds apart, destroy the core and the roof.
27/4 · Pripyat evacuatedAbout 50,000 residents moved out within 40 hours of the accident.
28/4 · The world finds outSweden and Finland announce elevated radiation. On the evening of 28 April, the USSR confirms a severe accident.

Source: INSAG-7, sections 3(1), 3(5), 4.1; INSAG-7 Annex I via the World Nuclear Association table (01:22:30, 01:23:04, 01:23:40, 01:23:43); OECD/NEA (2002) chapter I (two explosions); Chernobyl's Legacy (2006), p. 17 (Pripyat); A. Salo, IAEA Bulletin 28(3), 1986 (28 April).

Post 1

What happened

the test40 secondsAZ-5evacuation
Post 2

Why

two reportsa self-accelerating reactorflawed stopdeath toll
Post 3

Work lessons

blame people or fix the systemreport v2test the stop button
Part 3

Why: five layers of cause

Physics layer: a reactor that speeds itself up

positive void coefficientINSAG-7, sections 2.1, 4.2
The RBMK's positive feedback loop. More power makes more water boil. Steam absorbs fewer neutrons than liquid water. The reaction strengthens and power rises again. At low power this loop overwhelms the other slowing effects. 1 · power rises 2 · more water boils 3 · steam absorbs fewerneutrons than water 4 · reaction strengthens Other designs differ water both cools and slows neutrons; more boiling, less reaction RBMK at the accident: void and power coefficients both positive
At low power, the loop wins. INSAG-7 says the void coefficient "overwhelmed the other components of the power coefficient, and the power coefficient itself became positive." Its conclusion: "the physical characteristics of the reactor made possible its unstable behaviour."Source: INSAG-7 (1992), section 2.1 ("At the time of the accident, the void and power coefficients of reactivity were both positive"), section 4.2 and section 6(2), p. 23. The comparison with other designs is Mark's explanation.

Design layer: a stop button that raised the reaction

positive scramINSAG-7, sections 2.2, 2.3, 6(4)
An RBMK control rod. The upper part is neutron absorber. Below it, separated by 1.25 metres of water, is a graphite section. With the rod fully withdrawn, the graphite sits in the middle of the core with water at both ends. When the stop is pressed and the rod moves down, the graphite pushes water out of the bottom of the channel, so at the bottom of the core the reaction rises. Full insertion took 18 seconds. core A · fully out + + + B · AZ-5 just pressed absorber 1.25 m water graphite 1.25 m water Graphite pushes water outwater absorbs neutrons, graphite not Core bottom: reaction risesexactly when it must stop 18 seconds to fully insertcut to 12 seconds afterwards
The safety mechanism became the trigger. INSAG-7 calls rod insertion "probably a decisive contributory factor." The flaw had been found at Ignalina in 1983. The report says: "It is reprehensible that such a deficiency had been known of for so long without its having been eliminated."Source: INSAG-7 (1992), sections 2.2 (1.25 m of water), 2.3 (18 s), 4.1 (Ignalina 1983), 5.1, 6(4); Appendix (12 s). Illustrative diagram, not to scale.

Information layer: the number no one could see

operating reactivity margin (ORM)INSAG-7, sections 4.2, 5; Annex I, section I-3.4
Operating reactivity margin, measured as the equivalent number of control rods in the core. About 30 rods: the stop shuts the reactor down strongly. 15 rods: the required minimum. At 01:22:30, only the equivalent of 8 rods. At 7 rods, pressing the stop adds reactivity. After the accident, the minimum was raised to 43 to 48 rods. 0 7: the stopspeeds it up 8 · at 01:22:30 15required minimum ~30strong shutdown 43–48new minimum after 1986 equivalent control rods still in the core
The most important limit was invisible. INSAG-7: the ORM "was not conveniently available to the operator, nor was it incorporated into the reactor's protection system," and operators "were not aware that it had safety significance." They "were ill served by the plant's design."Source: INSAG-7 (1992), section 4.2 (15-rod limit), sections 5 and 5.1; Annex I, section I-3.4 (30, 15 and 7 rods); Appendix (43–48 rods); 8 rods at 01:22:30 from post-accident calculations, per the World Nuclear Association table. OECD/NEA (2002) gives "6–8 control rods" and a minimum of 30, which differs from INSAG-7.

Operations layer: a test rewritten on the spot

ad hoc test changesINSAG-7, sections 3, 5.2.2, 6(6)

Below the programme

The test began at 200 MW, "well below that prescribed in the test procedures" of 700 MW.

Procedure changed that night

"Unapproved changes in the test procedure were deliberately made on the spot."

Margin through the floor

The minimum ORM was violated by 01:00. Running 11 hours without emergency cooling is "indicative of an absence of safety culture."

Source: INSAG-7 (1992), sections 3(1), 3(5), 5.2.2 (p. 19) and 6(6) (p. 24).

Organisation layer: two reports, two stories

INSAG-1 vs INSAG-7IAEA, 1986 and 1992
INSAG-1 (Aug 1986)INSAG-7 (1992)
Written after the accident4 months6 years
Relied mainly onthe Soviet accounta 1991 Soviet state commission report and new data
Main cause"an extremely improbable combination of violations" by staff"the physical characteristics of the reactor" made it unstable
Emergency-stop flawnot in the initial account"probably a decisive contributory factor"
The "violations"many actions labelled violations"certain actions ... were in fact not violations"
Where safety culture was lackingfocus on the plant"not only at the Chernobyl plant", also design, manufacture, regulation

Source: INSAG-7 (1992), foreword, sections 1, 5.1, 6(2), 6(4), 6(5), 6(6); Annex I, section I-1 (quoting the official 1986 account). The INSAG-1 PDF could not be opened during research, so INSAG-1 is quoted through INSAG-7.

More: INSAG-7 did not erase human error

INSAG-7 says plainly: "As pointed out in INSAG-1, the human factor has still to be considered as a major element in causing the accident." The report did not swap one culprit for another. It showed operators doing risky things inside a system that did not show them the risk, overseen by a regulator that "did not function as an independent component in ensuring safety."

The 1987 trial came before that picture existed. Plant director Viktor Bryukhanov and deputy chief engineer Anatoly Dyatlov each received 10 years in a labour camp.

Source: INSAG-7, sections 5.6.1 and 6(6); ANS Nuclear Newswire (2 Nov 2021) on Bryukhanov; New York Times (30 Jul 1987) on Dyatlov (via a secondary source).

Part 4

Fact check: what is true and what is myth

First, the most argued question: how many people did Chernobyl kill? Each number is right for its own question.

Death figures on a log scale. Counted: 2 killed that night by injuries; 15 thyroid cancer deaths by 2002; 28 deaths from acute radiation syndrome in 1986; 31, the early official figure. Model projections: up to 4,000 among the 600,000 most exposed; up to 9,000 adding 6.8 million people with low doses; about 16,000 for all of Europe by 2065; 93,000 according to Greenpeace. 985,000 according to Yablokov and colleagues, strongly rejected by scientists. 1101001,00010,000100,0001,000,000 killed that night thyroid cancer, by 2002 radiation sickness 1986 early official figure 600,000 people, projected + 6.8 million, projected all Europe, projected Greenpeace, projected Yablokov et al. 2152831 up to 4,000up to 9,000~16,00093,000 985,000 · rejected ■ counted ■ model projection ■ method rejected · log scale
From 2 to almost 1 million: nearly six orders of magnitude. Counted figures are deaths with names and records. Projections multiply estimated radiation doses by a risk factor (the linear no-threshold model), so they cannot point to any particular person. UNSCEAR notes that any rise in cancer at low doses "will be difficult to detect in epidemiological studies." Another 19 survivors of acute radiation syndrome died in 1987–2004 of various causes, "not necessarily" from radiation.Source: 2, 28, 19 people and 15 thyroid cancer deaths: Chernobyl's Legacy (2006), pp. 14 and 16; 31: OECD/NEA (2002), chapter I; 4,000: WHO (5 Sep 2005); 9,000 and 5,000 for 6.8 million people: WHO (13 Apr 2006) and Peplow, Nature 440 (2006); 16,000: Cardis et al., Int. J. Cancer (2006), IARC; 93,000: Greenpeace report 2006, via IPS (3 May 2006); 985,000: Yablokov, Nesterenko and Nesterenko, Annals of the NYAS 1181 (2009), review by M. Balonov (2010). UNSCEAR remark: UNSCEAR's Chernobyl page summarising the 2008 report, Annex D.

14 things often said about Chernobyl, checked against the primary record. Click each row to see why.

SOLIDThe RBMK was unstable at low power

INSAG-7: at the time of the accident the void and power coefficients were both positive; "the physical characteristics of the reactor made possible its unstable behaviour" (sections 2.1, 6(2)).

SOLIDPressing the emergency stop first increased the reaction

The graphite section at the rod's tip pushed water out of the bottom of the channel. INSAG-7 calls this "probably a decisive contributory factor" (sections 2.2, 6(4)).

SOLIDThe control-rod flaw was known before 1986

Found at Ignalina in 1983; the design was not changed and no compensating measures were taken (INSAG-7, sections 4.1, 6(4)).

SOLIDThe world learned from radiation measured abroad before the USSR confirmed

Sweden and Finland announced on 28 April 1986; the USSR confirmed that evening (A. Salo, IAEA Bulletin 28(3), 1986).

SOLIDChildhood thyroid cancer rose sharply

UNSCEAR: more than 6,000 cases among those exposed as children or adolescents, by 2005. These are cases, mostly treatable, not deaths.

SOLIDThe psychological impact is the largest health burden

Chernobyl Forum: the mental health impact is "the largest public health problem unleashed by the accident to date," along with a "paralysing fatalism" (Chernobyl's Legacy, pp. 37, 41).

CAUTIONThe accident was caused by operators breaking the rules

That was the 1986 conclusion. INSAG-7 revised it: "certain actions by operators that were identified in INSAG-1 as violations of rules were in fact not violations," but the human factor "has still to be considered as a major element," because the test was altered on the spot and run below the prescribed level (section 6(6)).

CAUTION"Chernobyl killed only 31 people"

31 is the early official count of immediate deaths (OECD/NEA 2002). It leaves out later fatal thyroid cancers (15 by 2002 per the Chernobyl Forum; WHO in 2005 said "at least nine children") and all long-term projections.

CAUTION"Chernobyl killed 4,000 people"

This is a projection of lifetime cancer deaths that may occur among about 600,000 most exposed people, not a count. WHO in 2006 added about 5,000 for 6.8 million people with low doses, for up to 9,000 in total (Nature, 2006). Note: the 2005 WHO release says "some 50 emergency workers who died of acute radiation syndrome," while the Chernobyl Forum and UNSCEAR give 28.

CAUTION"Chernobyl will kill more than 93,000 people"

Greenpeace's 2006 projection for Belarus, Russia and Ukraine to 2056. It uses assumptions and data very different from the UN agencies; cite it clearly as an advocacy group's estimate, next to the others.

FALSEThe reactor exploded like an atomic bomb

The first explosion was a steam explosion as overheated fuel met water; the second may have involved hydrogen, cause uncertain (OECD/NEA 2002, chapter I). Not a bomb-type nuclear explosion.

FALSEOperators illegally switched off emergency cooling

INSAG-7: disconnecting the emergency core cooling "was in fact permissible at Chernobyl if authorized by the Chief Engineer" (section 3(1)). The problem was running 11 hours like that, not that it broke a rule.

FALSEChernobyl has killed nearly a million people

The 985,000 figure (Yablokov et al., 2009) comes from statistical comparisons between regions that cannot separate radiation from poverty, illness and the collapse of the USSR. Scientist M. Balonov, in a review published by the New York Academy of Sciences itself in 2010, called it closer to "science fiction" than science (secondary source).

FALSERadiation caused a wave of birth defects

WHO (2005): no evidence of increases in congenital malformations attributable to radiation, and no decrease in fertility.

Part 5

Assessing the case

Scores are Mark's assessment based on the sources in Part 8, not figures from a study.

Avoidable
4/5
Warnings existed beforehand
4/5
Transparent investigation
3/5
Lessons retained
4/5
Done right afterwards
  • The IAEA publicly rewrote its own conclusion
  • RBMK reactors modified: margin of 43–48 rods, rods inserted in 12 seconds
  • Safety culture shown to be lacking at every level, including the regulator
Not done right
  • Operators were tried before the full truth was known
  • The USSR only confirmed the accident on the evening of 28 April
  • The death toll became a weapon for both sides of the debate

Source: INSAG-7 (1992), Appendix and section 6; A. Salo, IAEA Bulletin (1986); ANS (2021) and NYT (1987) on the trial.

Chernobyl shows that the first investigation report can be wrong, and that a trustworthy organisation is one willing to write the second.

More: why the first version tends to blame people

Mark's reading: the first version was written fast, relying on insiders with interests of their own: the reactor's designers belonged to the same system as the people giving the account. Blaming a few individuals who were in the control room was the neatest story, and it did not require fixing dozens of reactors still running.

INSAG-7 came after a 1991 report by a Soviet state commission, with data that had not been made available in 1986.

Source: INSAG-7, foreword and Annex I. The first paragraph is Mark's inference, not an IAEA conclusion.

Part 6

Work lessons: blame people or fix the system

Use it whenever your team writes an incident report: an outage, a wrong shipment, a late project.

Four steps for an incident report: mark the conclusion as provisional, ask why the action made sense to the person at the time, re-test the safety mechanism, and give every known defect an owner and a deadline. 1 · "provisional" verdictINSAG-1 → INSAG-7reopen when new data arrives 2 · why did it make sense?what was on their screenwho told them the limit 3 · re-test the stopis the safety net safe?rollback, breaker, alerts 4 · known defect: owner + datea name, a fix-by datedon't repeat Ignalina 1983 "Caused by X's carelessness" is where an investigation starts, not where it ends.
Each step answers one failure at Chernobyl. The first verdict was fixed too early, the safety limit was invisible, the stop button was never tested in the bad case, and a known flaw had no one responsible for fixing it.
Incident reports get a "v2"Book a re-read a month later. Write down what is still unknown.
Critical limits must be visibleIf a number is a safety limit, put it on the screen and let the system block, don't just write it in a manual.
Don't pick a sideINSAG-7 fixed the system but kept the human factor. Ask both: who did what, and how did the system make it easy.
Every number says what it measures31 and 4,000 are both "right". Say counted or projected, which group, up to when.
It is reprehensible that such a deficiency had been known of for so long without its having been eliminated.IAEA, INSAG-7 (1992), section 5.1, on the control-rod flaw found in 1983.
Part 7

Further reading

IAEA, INSAG-7: The Chernobyl Accident: Updating of INSAG-1 (1992)About 30 pages of main text, readable. Section 6 holds the conclusions; read it first.
Chernobyl Forum, Chernobyl's Legacy (2006)The summary by 8 UN agencies and three governments on health, environment and society.
Serhii Plokhy, Chernobyl: History of a Tragedy (2018)The political history, from the control room to the Kremlin.
Anatomy of a Disaster #05: Knight Capital (2012)A trading firm lost more than 460 million USD in 45 minutes after a software deployment (per the SEC, 2013).
Part 8

Sources

Primary documents first. Wherever only a secondary source exists, it is flagged in the Fact check section.

  1. IAEA, INSAG-1, Summary Report on the Post-Accident Review Meeting on the Chernobyl Accident, Safety Series 75-INSAG-1, 1986. iaea.org (quoted via INSAG-7)
  2. IAEA, INSAG-7, The Chernobyl Accident: Updating of INSAG-1, Safety Series 75-INSAG-7, 1992, with Annex I (report of the USSR State Committee commission, 1991). iaea.org
  3. The Chernobyl Forum, Chernobyl's Legacy: Health, Environmental and Socio-Economic Impacts, 2nd revised version, IAEA, 2006. iaea.org
  4. WHO, IAEA, UNDP, "Chernobyl: the true scale of the accident", 5 Sep 2005. who.int
  5. WHO, Health Effects of the Chernobyl Accident and Special Health Care Programmes, 2006, and press release of 13 Apr 2006.
  6. UNSCEAR, 2008 Report, Annex D, and the Chernobyl summary page. unscear.org
  7. OECD/NEA, Chernobyl: Assessment of Radiological and Health Impacts, 2002 Update, chapter I. oecd-nea.org
  8. M. Peplow, "Counting the dead", Nature 440, 982–983, 2006. nature.com
  9. A. Salo, "Information exchange after Chernobyl", IAEA Bulletin 28(3), 1986. iaea.org
  10. World Nuclear Association, "Chernobyl Accident Appendix 1: Sequence of Events" (compiled from INSAG-1 and INSAG-7). world-nuclear.org
  11. Cardis et al., "Estimates of the cancer burden in Europe from radioactive fallout from the Chernobyl accident", Int. J. Cancer, 2006; Yablokov, Nesterenko, Nesterenko, Annals of the NYAS 1181, 2009; Greenpeace report 2006 (via IPS, 3 May 2006).
  12. ANS Nuclear Newswire, "The man held responsible for the Chernobyl accident has died", 2 Nov 2021. ans.org