How Does an RBMK Reactor Explode

In 1975, a nuclear reactor at the Leningrad Nuclear Power Plant in the Soviet Union was undergoing maintenance. Leningrad Unit 1 was the first of a new generation of Soviet nuclear power plants to be built - the first prototype of a class of reactor known as RBMK.

The reactor's operators were attempting to restart the reactor from a low power level. To their surprise, they found the reactor would not restart - not without the operators withdrawing nearly all of the control rods that regulate the reactor.

As power slowly climbed, more and more control rods were removed from the reactor. The operators lost the ability to properly regulate and distribute power throughout the reactor. Some sections of the reactor core were barely ticking over. Others were rapidly overheating.

Deep in the core, a single channel filled with fuel and water overheated and ruptured, flooding the reactor vessel with radioactive steam. Water inside the reactor boiled rapidly, more and more of it turning to steam. Power in the reactor accelerated with each passing second, boiling more water, making more steam.. Alarms blared in the control room.

There is a button on the reactor operator's control panel, hidden behind a wax-sealed guard labelled AZ-5. AZ-5, in this case, being translated as Emergency Protection System 5. It is one of a number of emergency power reduction and shutdown modes available to the reactor engineer. This button immediately forces all control rods to be inserted into the reactor at once to shut the reactor down as fast as possible.

The operators at Leningrad push the button. It has to be held in place or the control rods will stop. For tense moments, power continues to climb out of control, threatening catastrophe.

For several long seconds, the reactor doesn't do what it's supposed to. It doesn't stop.

Eventually, to everyone's relief, the control rods begin to take effect. The reactor finally grinds to a halt.

Radioactive steam is vented from the plant. The core is saved. There is no Leningrad disaster.

No information about this accident is shared. Instead, it is classified as a State secret, known only to the reactor's designers and those who happened to be in the control room at the time. Meanwhile, Leningrad Unit 1 will be repaired, and continue in service until 2018.

At this time, Reactor 1 at Chernobyl Nuclear Power Plant is still 2 years from completion. The foundations for the largest nuclear accident in history, have just been poured.

--------

How does an RBMK reactor explode?

This is one possible narrative. One which assumes there are no villains in Chernobyl. There are just people who went to work one evening, working as the system required of them, and the reactor, working as physics required of it.

The result is catastrophe.

---

To figure out why an RBMK reactor can explode, first we have to understand how an RBMK reactor works. It's not actually that complicated. A uranium atom splits - small particles called neutrons fly out from the atomic shrapnel and they each find another uranium atom. When they collide with it, they break it apart too, letting more neutrons find more Uranium atoms to break in a chain reaction. Out of each split we get energy. Once split, the fragments snap apart as the energy holding them together is released - like cutting an elastic band. These fragments explode away, run into the atoms next to them at high speed. Much like the brakes in your car, that speed is turned into heat as the fragments stop. This Heat is used to boil water to steam. This steam turns a turbine. This turbine turns an electric generator and, eventually you get electric power out of it.

Now, it's not quite that simple. Big, heavy atoms like Uranium come in multiple different versions - called Isotopes - sort of like different models of the same car. They're all Uranium, but they're all slightly different at the same time. The most well known, are Uranium 235, and Uranium 238. U238 is by far and way the most common - on the order of 99% or more of Uranium on Earth is U238. It's a big, heavy fat atom that doesn't really like to split - it takes a very fast neutron to break it apart - and the neutrons released by U238 fission aren't fast enough in turn to cause a further fission.

On the other hand, U235 is much happier to break apart - taking a lot less energy to do so. Unfortunately, it's about as rare as common sense. Out of a large block of Uranium, only a small amount is actually useful in a reactor.

Out of the ground, less than 1% of your Uranium fuel is actually fuel.

More than that, in order to have a chain reaction, the neutrons released by one atom splitting have to be able to cause further atoms to split. Otherwise everything just runs down. It turns out, that the neutrons released by fission are extremely fast - too fast to split U235 but still not fast enough to split U238. For a fast neutron, the probability that it will cause another fission is really low.To keep the chain reaction going, each fission event needs to cause at least one further fission. Either you need a lot more U235 around it to get the probability of another fission up, or you need to find someway of slowing it down. If you slow it down - the probability of fission goes way up. This is done by a Moderator.

For most reactors, this moderator is water. Ordinary - albeit extremely pure - water. Water is a good moderator, but it has one slight drawback - it absorbs neutrons. Absorbed neutrons do not get to go and make another fission happen - they just turn the water radioactive. Using water to moderate a reactor absorbs so many neutrons, that the quantity of U235 in the reactor fuel has to be increased beyond that which is in natural Uranium. This process is called enrichment. It's expensive and energy intensive - and it turns out if you enrich Uranium to about 80% U235 it can be used to make an atomic bomb.

Which, naturally, is why Israel got so pissy about Iran having the ability to enrich Uranium. The difference between safe reactor fuel and weapons-grade bomb fuel, is time in the centrifugal oven to bake.

Now, doesn't it seem eminently sensible to find a way to build a reactor that will be happy on regular, non-enriched Uranium?

Canada did it with the CANDU reactor. Instead of regular water, a CANDU reactor uses 'heavy' water. 'Heavy' water is like ordinary 'Light' water, except the Hydrogen atom that's the H in H2O is a little different. It has one neutron and one proton, rather than just a single proton. It absorbs less neutrons, which means more neutrons are free to cause more fission. In fact, Heavy Water is so effective that CANDU reactor doesn't need enriched fuel. The Nazis appearred to have tried a similar appoach, and the destruction of their Norwegian Heavy Water factories stalled their weapons program. On the other hand, heavy water - while common - is still fairly expensive.

It is a case of swings and roundabouts. Either suffer the increased fuel costs, and international oversights of enriched Uranium, or suck up the costs of seperating heavy water from seawater. Both are expensive.

What if you could build a reactor that ran on natural uranium, that didn't need heavy water?

The very first self-sustaining nuclear reactor - Chicago Pile 1 - used blocks of Graphite as a moderator. It ran at so low a power, it didn't require cooling.

The first Hanford Reactors also used graphite. They also used regular, light water as a coolant to keep the reactor from melting down with its own heat. This hot water was dumped merrily into the local river along with whatever contamination it picked up along the way. Of course, somebody had worked out that if the reactor lost cooling water, it would very quickly begin to run out of control so the Hanford reactors were built miles from anywhere inhabited. They never generated a watt of electricity- but they did create the Plutonium for your nuclear weapons.

The British Government, aware of this risk of a runaway reaction, built the Windscale Piles to be Air cooled - with giant fans blowing air over hot graphite and metal. These then went and caught fire. In the end, the solution was to use graphite and an inert gas, like carbon dioxide, to cool the core. This was still extremely expensive, an inefficient due to the limitations of the materials used.

The Soviet Union looked at this and thought; We can build a graphite moderated reactor, cool it with regular light water and so long as we don't fuck up, we'll have a shitton of free energy.

We know the result already. But that's being a little bit churlish. These people weren't fools.

This why an RBMK reactor is different to every other reactor built anywhere else in the world. It's in the name - Reaktor Bolshoy Moshchnosti Kanalnyy - Big Powerful Channel Reactor. The majority of modern nuclear reactors are basically big pressurised kettles, filled mostly with pressurised water. This water either boils in the kettle- or it is under such a high pressure that it remains liquid and is used to boil water in a second circuit. In an RBMK reactor, the fuel is contained in more than 1600 vertical channels cut through the graphite moderator. Inside these channels, light water flows as coolant. It enters a pair of drums high above the reactor where any steam bubbles in the water seperate and are drawn off to the turbine to generate power - while the liquid water is recirculated, being mixed with cooler water coming back from the turbine. Interspersed within these channels are more than 200 others - each contaning a control rod. These control rods are also cooled by liquid water - but at a much lower temperature.

The main steam circuit on an RBMK reactor operates at somewhere around 270 degrees and 60-odd Bar of pressure. The control rod circuit operated at 70 degrees.

The light water in the channels still absorbs neutrons sure - but because there's so much less of it, the reactor will still run on natural unenriched Uranium. It also means that, since each fuel assembly has its own individual channel, it can be removed, moved and replaced without shutting down the reactor. This is a feature few other reactors have - most reguire a shutdown to open the reactor vessels to refuel. This is good for fuel economy, and good for efficiency. A neutron reflector surrounding the core reflected neutrons that would've otherwise escaped, back into the core where they could go on to cause more fission. Finally, an RBMK reactor did not require high quality materials, or the specialised construction methods used to construct the large pressure vessels used to hold conventional reactor cores. An RBMK reactor could be built and maintained reliably with less-skilled labour.

The people who designed the Chernobyl reactor weren't fools. There were compelling reasons for making the decisions they did. It made a big, powerful reactor cheap and easy to build, while improving the reactor's fuel economy and general uptime. And you could potentially fuel a weapons program with it.

The one clear drawback with this should be obvious. When the cooling water boils, its replaced by a bubble of steam. This steam absorbs far fewer neutrons than liquid water - meaning more neutrons become available for fission, which means more fission, more heat, more steam, more neutrons, and more fission.

This is called a Positive Void Coefficient. It is an example of positive feedback - where an action creates a stronger action in the same direction. Positive feedback is like setting a ball rolling at the top of a hill, it's only going to start rolling faster as it gets further down. Engineers love positive feedback -it usually has entertaining results.

This is potentially a problem for an RBMK reactor specifically because the water does not act as a moderator - more correctly, it provides little to no moderation. In a conventional reactor, the water also provides moderation. If water is boiled away by heat, the moderation in the reactor reduces, neutrons get faster, the probability of fissions gets lower, less fission happens, heat decreases and the problem self-corrects. In an RBMK reactor - even if all the water in the core is somehow removed, the moderator is still present in the form of the graphite to keep the reaction going.

It would be dangerous to have a reactor which behaved like this. The engineers who designed Chernobyl were, of course, aware of this. Real physics is not that simple. As the fuel heats up and gets more energetic, it responds to neutrons differently. The hotter it gets, the harder it is for a neutron to cause a fission. Hotter fuel is less likely to fission - so an increase in power will actually reduce the ability of the fuel to fission and create power - in effect an automatic brake provided free by simple physics. This is called Negative feedback, and is basically the same as you feeling a tug in the steering wheel of your car, and steering the other direction to compensate.

Positive feedback acts to destabilise. Negative feedback acts to stabilise.

If the negative feedback from the fuel heating is stronger than the positive feedback from the steam boiling, the reactor's power level will self stabilise and everything will be fine.

For a large part of the reactor's life this was true. Even if the cooling water boiled off, the reactor would still self-correct as the increase in temperature in the fuel would have a stronger effect.

This changed as the reactor got older.

In general, the higher the proportion of neutrons that are absorbed by the water in the reactor in comparison to all other neutron absorbers in the reactor, the stronger the void coefficient became. Where a reactor has been running for several years- the fuel gets more and more depleted of fissionable attom. In addition, more and more reactor poisons are added, each of which absorbs neutrons differently or introduces additional hazards into the reactor. To compensate for the reduced reactivity of the older fuel, fixed neutron absorbers were removed from the reactor. With less absorbers in the reactor, a higher proportion of neutrons were lost to absorption in the reactor coolant.

At the time of the accident, the reactor in Chernobyl had been running for about three years. After this amount of time, the void coefficient had become so strong, that the negative feedback from the fuel heating was no longer strong enough to counterbalance the effect of the void coefficient.

By the time of the accident, under certain conditions, the reactor operated in a positive feedback loop.

An increase in power, left unchecked would create a further increase in power. Only the reactor's control rods then kept the reactor under control, The majority of these control rods inserted from the top of the reactor. Some inserted from the bottom. They served to absorb any excess neutrons in the core and act as the final brake on the reactor to keep it in control, to keep the reactor critical.

Fission reactors are at their happiest when they're critical. A critical reactor is a reactor running in a balanced steady state at a constant power. It's the desired state of being. Every fission is creating one further fission and that's it. A reactor that is supercritical, is a reactor that's accelerating - each fission creates more than one further fission. A reactor that is subcritical, is a reactor that's decelerating - each fission creates less than one further fission.

The reactor is moved from state to state by adding or removing reactivity. Reactivity is like the throttle and brake on the reactor. It's not really the current power level - it's close to the potential change in power level. Positive reactivty means fission is more likely to happen than it is now - which will cause an increase in power. Negative reactivity, means making fission less likely to happen - which will cause a decrease in power.

In theory, there is no limit to the amount of negative reactivity you can add - all it does is stop the reactor faster. There is a limit to the positive reactivity.

When an atom fissions, the vast majority of neutrons are released instantaneously - at the moment of fission. The neutrons fly away, get themselves moderated, and in the space of microseconds find more atoms to collide with and split. The scientists of the Manhattan project called this a 'Shake' and it is an extremely short interval of time - from nanoseconds to microseconds. These are called Prompt neutrons.

Fission with prompt neutrons happens so quickly, that there is little to no mechanical process capable of controlling and regulating it. If the universe had been created in such a way that there were only prompt neutrons - controllable fission power would likely be impossible.

Had this been the case, the Chicago Pile 1 experiment could have had a far more amusing result.

Luckily for the citizens of Chicago, a very small fraction of the neutrons released by a fission event are delayed - they happen seconds, to minutes later. It is this miniscule fraction of delayed neutrons which enables every nuclear fission reactor to be controlled. It is possible therefore, to have a reactor which is critical on the combination of the Prompt, and the Delayed neutrons. This is how things normally are. Even a supercritical reactor will take seconds to minutes, to change power output. There's time there for the process machinery of the reactor to respond to changes and stabilize.

However, if the reactor is pushed to the point that it is capable of achieving criticality on the prompt neutrons alone - before any delayed neutrons are emitted - things get interesting. Instead of a power increase that happens on the order of seconds to minutes - now the only limiting factor the the reactor's power increase is the time it takes for one neutron to find the next atom to fission and however long the reactor manages to withstand the energies that are being very rapidly liberated. A reactor which has gone prompt critical, has become, in effect, a really, really shit nuclear bomb. The big difference being that bombs take advantage of physics, inertia and a dozen other things to keep the reaction going that few nanoseconds longer it takes to go from 5 tons of TNT, to 15 Kilotons of TNT.

Scientists at the Manhattan project, for whatever reason, called this interval a 'Dollar' of reactivity. Once you get a reactor past that point - unless it's a type specifically designed to go there and self recover - the reactor will be destroyed. Importantly, this does not have to happen within the entire reactor - it can be limited to a very small part of the core where conditions align like the stars over R'lyeh.

At the Chernobyl reactor, Reactivity was added by fresh fuel, by removing control rods and by boiling water to make steam. Reactivity was removed by increasing water flow, adding control rods, heating up the moderator and fuel, and by another factor.

The shrapnel left over from fission creates what's known as 'fission products'. Most of these are hideously radioactive. Many of these are effective at absorbing neutrons, and hence are called poisons. Absorbed neutrons reduce reactivity, which has to be compensated for either by withdrawing control rods, or by removing the used fuel and replacing it with fresh fuel. One of the most effective neutron absorbers is an isotope of Xenon, called Xenon-135.

A product of radioactive decay, it starts to appear about six hours after the fission events that effectively 'created' it. The amount of it that's created, is in direct proportion to the quantity of fission that happened six hours ago. So if a reactor is run at full power for a long time, and then throttled down, Xenon will continue to appear according to that fuel burned six hours previously. It's a bit like the exhaust from your car's engine magically taking longer to form after the combustion in the cylinders. Normally, with the reactor in a steady-state, Xenon is created as quickly as it is consumed - the physics balances out. It can make it very difficult to increase or reduce power - if power is reduced too quickly, and the Xenon continues to build, the reactor might even be stalled by it.

It can also mean that, if the fuel in the reactor has been active for a long time - there may not be sufficient reactivity in the remaining fuel to overcome this Xenon pit. The reactor will stalled and effectively impossible to start, no matter how many control rods are withdrawn.

This is important. After a few more hours, the Xenon goes away. More than that, Xenon which absorbs a neutron also 'goes away' - it's no longer Xenon-135 and it's massive ability ot hoover up neutrons is suddenly gone.

Keeping all of these positive and negative reactivities in balance is the job of the Senior Reactor Engineer, who manipulates the reactor core's systems and control rods to achieve the required stable power output. The Engineer at the reactor's controls has only so much control as the rods will give them.

The Control rods of an RBMK reactor are manufactured from boron. Boron absorbs neutrons, which reduces reactivity, and causes a power drop. The deeper they go into the reactor - the more neutrons are absorbed - the further reactivity decreases. They can also be moved independently of each other - which changes where and how power is produced throughout the reactor, to compensate and balance for old and fresh fuels and how they're distributed through the reactor.

But, at the tip of the control rod on a telescoping extension, is a single slug of graphite. The graphite tip of the control rod acted as a displacer. Its purpose was to push water out of the control rod channel, to remove it and its neutron absorption effect after the rod was withdrawn. In effect, instead of giving the control rod an action of -3,-1 - they are something like -3,+0. They graphite displacer gives the control rod a stronger control action. It makes it more powerful by adding reactivity after the rod is withdrawn. There was about 1.5 metres of water between the control rod proper, and the displacer rod.

This is the first generation RBMK reactor, as built at Leningrad Unit 1.

Shortly after these first reactors were completed, computer models had begun to show some unexpected tendancies in the reactor core. When running at low power, the reactor began to behave strangely. It became less and less stable, and harder to control. Attempting to balance power in the bottom part of the reactor by adjusting the control rod positions could cause momentary power-surges and hot spots - especially towards the edge of the reactor close to the neutron reflector. This could potentially damage the reactor, damaging fuel elements, or potentially rupturing the fuel channel

In one possible worst case scenario, the fuel would superheat to the point where it began to melt, triggering a chemical reaction between the molten fuel, the zirconium cladding of the fuel, and the now suddenly superheated steam in the channel. Hydrogen gas would be released, along with quantities of oxygen - potentially leading to explosive results.

Finally, there is the concept of the Reactivity Margin. This is an estimate of the amount of reactivity the reactor operator can still add to the reactor to increase the power or move power around the reactor. In an RBMK, the reactivity margin was measured in numbers of control rods, where One Control Rod of reactivity, was the equivelant reactivity introduced by removing one average control rod fully from the reactor. A reactivity margin of Thirty Control Rods did not necessarily mean there were Thirty control rods inserted fully into the core - this would be spread out amongst the different rods, each inserted at a different height in the reactor to properly balance power.

In general, the higher the reactivity margin, the further the control rods are inserted in the core and the more reactivity can be added to the core by removing them . A reactor with fresh fuel will have a very high reactivity margin. A reactor with old fuel, or with xenon poisoning, will have a low reactivity margin. It may seem that a low reactivity margin might be 'safer', because now there's less reactivity that can be added by the control rods (which are already out of the reactor at low margin). At a high reactivity margin, more control rods are inside the reactor. More of them can be withdrawn, to push the reactor further into the supercritical - more positive reactivity can be added to the reactor.

The Chernobyl reactor was happy around about 30 Rods of reactivity. The equivalent of thirty full control rods were left in the reactor. The official limit, was somewhere around 15 Rods of reactivity.

This was not considered a safety limit. Running at low reactivity margins could be a mark of skill of the reactor operator. A low reactivity margin meant less scope for moving power around the reactor and keeping things in balance. It increased the risk that sections of the core could be overloaded.

It was never thought of as a safety limit. In November 1975, Leningrad Unit-1 an accident occurred. A fuel channel rupture while operators were trying to increase power after a shutdown. A similar incident happened at Chernobyl Reactor 1. In both cases, the reactor's safety systems operated correctly. Radiation was still released through the plant's ventilation systems. Neither incident was reported in the media.

Reactor 4 at Chernobyl is slightly different. Reactor 4 was a second generation reactor. Over the years, a few improvements to economise the reactor and try to stabilise the reactor's void coefficient are made. There're changes in fuel enrichment, control rod design, and rod configuration. Nothing seemed major. As part of these changes, the control rod tips were shortened by approximately a meter.

These modifications led to an unsettling side-effect when tested in practice. The control rods, when fully withdrawn, allowed a 1.5 metre high column of water to remain in the bottom of the reactor. This water would absorb neutrons in the bottom of the reactor, acting as a gentle brake on fission.

When a newly-built RBMK reactor at Ignalina in Lithuania was being run through its commissioning tests in 1984, it was discovered that, where control rods had been pulled all of the way out of the reactor and where most of the fission in the reactor was happening at the very bottom of the core - an attempt to slow the reactor down by inserting the control rods could cause a momentary increase in power before the boron control rods travelled the full height of the core to quence the reactor.

The water slugs at the bottom of the control rod channels were replaced with graphite for a few seconds. The graphite moderated neutrons, where the water had absorbed them. Consequently, an increase in reactivity occured at the bottom of the core.

Instead of decreasing, power momentarily increased.

The engineers at Ignalina wrote a letter to the reactor's designers, advising them of the deviation. This was not initially thought to be much of a concern - power changes in the reactor after all, take longer than it takes for the rod to travel.

A similar effect was noted at an RBMK in Smolensk, at Chernobyl reactor 3, and finally, at Chernobyl reactor 4 when it was completed.

It gradually became clear to the designers that accidents with the RBMK were not only possible - but even likely in some circumstances. Still - it would reflect badly on the designers and the ministry they worked for if the reactor they had overseen was found to have a potential flaw, especially after millions of rubles had been spent on building them. Careers, influence and bureaucratic prestige were at stake. It was quietly buried as a footnote in the reactor documentation. Not as a threat, or a risk - just as a deviation of the reactor from its design specifications. This effect was something that happened from time-to-time in very specific circumstances, but one which had never really caused a problem.

Even when the Soviet government found out about the cover-ups, no overt action was taken, no matter how furious they were in private. The world at large couldn't know. Even so, nature could only be be fooled for so long. A series of modifications were proposed - changes to the sequencing of the control rods especially - which should've reduced the probability of this 'tip-effect' causing the reactor to run up. The plan was to quietly fix the reactors, saving face before the world. These fixes were to be implemented at Chernobyl Reactor No. 4 at it's next scheduled maintenance shutdown. Before that, however, one further test of the reactor's safety systems was required.

We do not yet know how an RBMK reactor explodes. But we know what we need to know.
 
Last edited:
The Chernobyl Nuclear Power Plant, and the city of Pripyat beside it, had been the brainchild of Viktor Bryukhanov. Bryukhanov has taken the city and its power plant form a paper concept, to a living, thriving thing. By 1986 Pripyat had become a model for the best in Soviet life. The shelves were well stocked, the apartments comfortable and the amenities accessible. There is a hotel, a swimming pool, multiple schools and a 'Palace of Culture', where residents can indulge in their hobbies.

Pripyat is what the Soviet Union wishes it was. The new, safe, reliable Nuclear Power Plant is featured in Soviet Life - to show the best of the Soviet Union to America.

By 1986, four reactors had been completed at Chernobyl, with two more under construction. Pripyat and Chernobyl at this time are planned to be the largest nuclear power complex in the entire world. Chernobyl Reactor 4 was finished in 1983, a few weeks ahead of schedule, earning Bryukhanov an award from the government. On the other hand, there have been some corners cut. Fireproof materials for the roof were not available, so conventional materials were used. Some safety tests were failed when initially attempted - but the deadline was looming, so the reactor was put into service anyway.

This was normal. Deadlines still had to be met. Failure meant demotion and loss of position. Success meant promotion, awards and an improvement in status.

The reality of the Soviet Union on the ground, rarely if ever matched the paperwork submitted high above.

The tests however, still had to be completed. Eventually, someone would check. Or the tested system would fail in use and questions would be asked of signed paperwork which stated it was suitable and commissioned.

One final test remained to be completed at Chernobyl Reactor Four.

Over the next three years the test is attempted a further two times - failing each time. In one case, an engineer forgot to turn the datalogger on to record the results. Finally, the fourth time was the night of April 26th, 1986.

The test was of a safety-critical system, but was not considered safety-crtical in and of itself. It was not really thought of as a test of the nuclear systems. The test program had been drawn up by an electrical engineer and from there it made its way to the desk of Nikolai Fomin, the station Chief Engineer. Fomin was not a nuclear engineer by trade and had only a basic knowledge of the reactor systems. He had also only just returned to work after a serious car accident. Fomin reviewed it, and not seeing it as potentially hazardous to the reactor, signed off on the proceedure.

The procedure, in truth was less than clear about what was required from the reactor.

The test, was an attempt to answer a question. If offsite power was lost due to accident or grid failure, and no other sources of power were available to the reactor, how would the electrically driven cooling pumps be operated? These pumps had to be kept running - they could not be permitted to stop. The pumps themselves each required 30MW of power. They could each move 12 Megalitres of water per hour. And there were 8 of them - of which 6 were normally in use.

If, at full power, the reactor were to lose cooling water and the control rods were to somehow fail to fully insert, it was calculated that it would take just 40 seconds for the fuel channels in the core would begin to buckle and warp. They would lose all resiliance. A breach in just three fuel channels out of the more than 1600 in the reactor could introduce enough steam pressure into the reactor chamber to lift the lid off the reactor - like the lid on a boiling pot hopping. Lifting the lid on the reactor would sever every single steam tube in the reactor at once. The test report predicted that this could have dramatic consequences.

The reactor did have emergency diesel generators, but these took a full minute to start up.

Suffice to say, it was necessary to find another source of sufficient energy to keep the pumps running.

This was planned to be the reactor's own turbine generator. At the first moment of an accident, the throttle valve to the turbine would close, but sheer force of inertia would keep the turbine and its generator spinning. Thousands of tons of steel rotating at 2500rpm may have just enough remaining energy to keep the reactor pumps circulating. Doing this involved careful switching and regulation of the generator, both to keep the turbine from slowing too quickly, and to keep enough power flowing to run the pumps.

This test is important enough that Deputy-Chief engineer Anatoly Dyatlov chooses to supervise it personally. Dyatlov was not well liked - by all accounts he was an abrasive man and very strict about professionalism. He had friends outside work - those who had come with him from his previous posting - but not many.

He was a man who dedicated himself to his work by day - and at night indulged in Soviet culture and art. He was the son of a Siberian river lamplighter, who now lit the lamps across all of Ukraine. He had worked with reactors for the Soviet Navy, and had been the victim of a nuclear accident - receiving nearly 200 rads as a result. A subsequent investigation had determined that his actions had caused the accident - but that he was not responsible for the accident.

The Soviet Government covered the incident up. Dyatlov's son died shortly afterwards of a radiation-related illness.

He was feared for his harsh treatment of his subordinates - regularly dressing-down those who found themselves beneath his gaze. He was respected for his knowledge and experience - knowing every centimetre of the reactor and every corner of its workings.

Even he found something deeply unknowable about the core of Reactor 4.

Also in the control room of Reactor 04 that night was the team actually operating the reactor. There are three main areas of responsibility. The Reactor engineer is responsible solely for maintaining the balance of reactivity in the core, keeping the core critical and operating at a stable power point. A Unit engineer is solely responsible for maintaining the flow of water through the reactor, and balancing it against the power produced to keep steam flowing to the turbine. The turbine engineer monitors the turbine, condensers and generator, to make the best use of steam generated. All three have to work together to keep the reactor running smoothly.

The groundwork for the test is laid during the previous dayshift. The emergency core cooling system is disabled - a process which takes hours manually cranking valves closed - to prevent it from being triggered accidentally by the test. The dayshift operators also wind the power of the reactor down from its normal 3000 MW, down to 1500MW. The reactor operators measured core power based on the heat energy produced inside the core - the thermal power - a figure which is typically three times higher than the electrical energy output.

The test procedure calls for the reactor to be at a self-sustaining power level, where it generates enough electricity to power its own pumps. This is set around and about 700MW thermal. Before they can do this, the day-shift are told to maintain power by the local grid controller.

The end of the month is approaching, and the Soviet system requires its factories to meet their monthly quotas.

It isn't until after midnight, and a shift change, that Chernobyl is given permission to reduce power. The dayshift has long gone home, and the night shift has taken over.

Aleksandr Akimov, the Shift supervisor, and Leonid Toptunov - who at age 25 was a Senior reactor engineer - will now be responsible for the reactor. Controlling the pumps, will be Boris Solyarchuk, overseen by Yuriy Tregub - a reactor engineer who stuck around from the dayshift to watch the test. The Turbine and its generator are to be the responsibility of Igor Kirchenbaum. Observing are two trainees - Viktor Proskuryarkov and Aleksandr Kudryavtsev. Elsewhere in the plant, a team from the turbine's manufacturer will take the opportunity to run vibration tests on the turbines. There are other hangers on in the control room, watching, curious about the test. The procedure is unusual, and unusual things might be a learning experience.

Above all, these are dedicated, skilled and motivated people. They have trained for years, often working after-hours to build up their experience and knowledge of the reactor. They are proud of their work.

Just after midnight, Dyatlov orders the reactor's power to be brought down to the test level.

Toptunov begins to work the power down. As he winds the reactor down, Xenon is still being produced according to the high power levels from 6 hours previously. Toptunov has to precariously balance a reactor that suddenly seems to be trying harder and harder to shut itself down, as more and more negative reactivity is added to the core by the Xenon. It gets harder and harder to reduce the power safely.

Under the gaze of Dyatlov, a mistake is made. To try and stabilise Power, a setting is switched. The setting has the opposite effect of that intended.

The chain reaction collapses. The reactor stalls.

With power below 30MW, the test is fucked. There isn't even enough energy to spin up the turbine. By some accounts, there is a discussion between Dyatlov and Akimov. There are no raised voices. There is no argument. It is a professional discussion. The content can only be speculated at.

Should the reactor be shut down, or should it be restarted? What does the rulebook say? What're the consequences of each decision?

A shutdown would allow any Xenon in the reactor to decay, and make restarting it easier. A shutdown would prevent the test from being completed, again. Trying to restart a poisoned reactor will be difficult.

Even if the origin of the order is unclear, what is certain, is that the reactor is restarted. Dyatlov himself will later claim to have been out of the room when the decision to increase power is made.

The reactor, unaware of the requirement to follow orders, doesn't want to start.

The Xenon poisoning is so strong, the reactor is effectively completely poisoned out.

Toptunov begins to withdraw control rods. He does so haphazardly at first - until Tregub steps in to give him guidance on where to pull from. They withdraw almost all the control rods they can but still the reactor does not want to start. They disconnect some of the automatic rods from the computer control, and withdraw them from the core. Of the two hundred and eleven control rods, over two hundred are taken clear out of the reactor. They are all at the exact same, zero, position. The graphite displacers at the tip of the rod are now dead centre in the reactor, with a meter either side of the displacer being filled with liquid water.

The power level in the reactor grinds up to 200MW. At this point, the majority of the core is nearly dead. The reaction is pinned to the extreme top and bottom of the core, away from the poisoned centre. he reactivity margin continues to drop, making Toptunovs job harder and harder with each passing minute. There is less and less control action available to him.

Balancing the reactor in this state is a fine art, risking either another sudden shut-down, or a power imbalance in the core that can cause structural damage.

Even so, there is barely enough power to spin up the turbine to the required speed, but the reactor is self-sufficient.

Dyatlov is satisfied. It's still enough to complete the test.

On the other hand, the low power levels are creating problems for Stolyarchuk running the pumps. Water is moving too fast through the reactor. Water levels in the steam separators are getting too low - reducing pressure and risking steam recirculating into the reactor. This would be bad for the pumps. An automatic emergency shutdown is triggered, threatening to terminate the chain reaction and finish the test.

Dyatlov orders the emergency shutdown to be overridden. This is not a violation of procedure. It's permitted to disable the automatic emergency shutdown when the reactor is at low power levels.

The low power level still causes trouble. In order to make enough steam to keep the turbine spinning, hot water is being recirculated back to the reactor from the steam separators, faster than it can be cooled. Still, Stolyarchuk is able to stabilise flow and keep steam flowing to the turbine. The reactor is now stabilised - the difficult part is over.

At 1:23:00, Dyatlov orders the test be begun.

The datalogger is turned on. Kirchenbaum closes the throttle valve to the turbine. The turbine begins to coast. The generator is disconnected and switched over to directly supply half of the cooling pumps. Half of the pumps are left running at full power using grid electricity. Normally, the reactor would have shut itself down as soon as the throttle valve closed. But the automatic shutdown has been disabled. The reactor continues to operate at 200MW of power.

As the generator slows, so do the pumps. Less and less water moves through the reactor. More and more steam is generated. The positive void coefficient begins to take effect. The reactor control system automatically compensates for this using the few rods it still has at its command. Power level remains almost constant throughout the test.

For forty seconds, everything proceeds as normal. Everything looks normal.

The test is successful. The stalling turbine is able to maintain the pumps for long enough for the diesel generators to start.

There is no moment of foreboding. There is no sense of impending doom.

With the test completed, Akimov calmly instructructs Toptunov to smother the reactor.

This should terminate the reaction.

At 1:23:40, Toptunov puts his finger on the button and holds it. It has to be held in place, or else the rods will stop moving.

The control rods begin to move into the reactor core, sliding down their channels. They can move at a speed of 0.5 metres per second. It will take thirteen to fourteen seconds for the control rods to move the full height of the reactor.

The graphite displacers push forward, pushing water out of the reactor ahead of them. This water, which absorbs neutrons, is replaced by graphite, which moderates neutrons. Reactivity is added to the bottom of the reactor, even as it is being removed from the top.

If multiple control rods are moving together, enough reactivity could be added to momentarily cause an overall increase in power.

At this moment, two hundred control rods are moving in unison, pushing reactivity down into the bottom of the core. More and more water is being converted to steam, creating voids which further increase reactivity.

So long as the reactor stays within the delayed-critical regime, this is not a problem. It will take seconds for the control rods to push through this regime - not long enough for the power to even start to run away with itself. This is what the designers expect will happen. This is what has always happened.

This is not what happens.

For the first second, power drops as it should. The boron shaft of the control-rod proper enters the top of the core. The reaction at the top of the core is quenched. The loss of power from the top of the reactor, counterbalances the increase from the bottom.

This changes in a moment.

Power begins to rise - it rises far faster than it should. Steam forms. Reactivity increases. Heat increases. More steam forms. The control rods keep moving. The control room is filled with a sound not unlike the moan of a massive engine coasting downhill, resonating through the entire structure of the building. Whatever is happening in the reactor hall is not seen by human eyes. Anyone in a position to see the lid of the reactor, would not have had time to leave the room.

The rate of increase in power triggers an alarm on Toptunov's panel. Three seconds after AZ-5 has been pushed, the power level has doubled to 500MW. A number of sensors warn of extreme neutron levels, before going offline.

The time is 1:23:43.

The control rods have travelled less than two meters. The graphite displacer tips are situated in the bottom of the core. There is no more water in the bottom of the control rod channels. At the top of the core, the reaction has been quenched. In the middle of the core, the reaction is still being smothered by Xenon.

In one small section of the core bottom - likely towards the edge of core, close to the neutron reflector - the reactivity added by the control rod tips passes that one dollar mark for one brief instant. It becomes Prompt Critical. Instead of taking seconds or minutes to increase, the reaction is now only limited by the few microseconds it takes for each neutron to find the next atom.

In one moment, the reactor power is 500 Megawatts. Within three seconds, it exceeds 22000MW - eight times it's normal operating limit - and keeps going. It is drawn by the datalogger as a vertical line on the graph, running straight off the top. For one brief instant, Chernobyl Reactor 4 has become a nuclear bomb.

What happens next in the next few seconds can only be guessed at.

Power accelerates far beyond the ability of the system to monitor.

Superheated fuel rods shatter to dust and burst from their casings, instantly vapourising the water around them into a bubble of steam. Steam reacts with the melting zircalloy cladding of the fuel, tearing apart into hydrogen and oxygen. The cooling pumps - each one as powerful as the propulsion system of a nuclear submarine - are momentarily thrown into reverse as this bubble of steam rapidly expands. Water levels in the steam drums surge.

The metal structure of the reactor itself is boiled by the intense release of energy. Fuel channels blow apart flooding the core chamber with high pressure steam, hydrogen and still-fissioning fuel fragments, instantly overwhelming the pressure relief system. In less than a second the reactor chamber overpressurises, blasting the reactor lid clean off the top of the reactor, tearing control rod and fuel rod channels free of the reactor stack, effectively terminating the reaction. Process gauges tied directly to the reactor coolant circuit blow themselves apart. Steam blasts through the accident surpression systems.

The explosion rattles the men in the control room. But they have no idea what's really happened - there is no 'Core exploded' indicator light. Stolyarchuk sees this on his control panel as a water hammer. Toptunov sees alarms for steam pressure dumping into the reactor chamber, followed by an indicator light warning him that there is no power to the control rod circuit. Akimov sees the control rods jam in place - indicator dials unmoving. He tries to disconnect the power to the clutches to let them drop under gravity in the core. Tregub sees every single pressure relief valve open at once - something that should theoretically be impossible.

The reactor lid drops back down onto its side, a tangle of control and fuel rods trailing behind it like some hideous medusa. At some point in the destruction, a concrete panel is dislodged from one of the steam seperators, and is able to fall into the now emptied reactor vessel, coming to rest in a location underneath the reactor lid. The reactor lid - which weighs more than two thousand tons, was launched high enough into the air for this panel to have time to fall beneath it, before the lid itself came crashing back down onto the top of the reactor vessel.

For two more seconds, the cooling pumps continue to run normally, picking up speed again. There is still enough water in the remains of the cooling circuit to keep them supplied, even if they are now pumping water into an open reactor pit and the rooms beneath the core.

All of this water pours across superheated remnants of the reactor. It doesn't even boil - the sheer heat of the graphite cracks it apart, splitting water into even more oxygen and hydrogen, filling the open reactor core with explosive gas. A spark from any one of a hundred broken cables lights this off in one massive explosion - more powerful than the first.

The second explosion blows the building clean open, collapsing the southern pump room to rubble. The four main circulating pumps stand proud of the wreckage, one knocked partly off its seat by the blast. The remaining core of the reactor is ejected skywards in a fountain of radioactive debris, dropping back into a burning heap in the reactor hall. Fragments of burning fuel light spot fires across the remaining roof of the building. Radioactive fuel rods fall into the turbine hall below. Finally, the graphite itself ignites, burning like the devils own barbeque, spewing hot radiation high into the atmosphere.

The radiation from the open reactor core is so powerful, it is splitting the molecules of the atmosphere apart, ionising the air itself. A bright laser-beam of blue light reaches like a searchlight to the heavens, marking the birth of a new and terrible Godzilla.

That is how an RBMK reactor explodes.

----------



EDIT:
Added some details on a precursor incident at Leningrad nuclear power plant
Changed some wording to account.
Note: This is based on 2nd and 3rd hand accounts and really shouldn't be used as an authorotative fact. It's meant to be a good, interesting read summarising a number of concepts I've read. This is definitely not an academic paper.
 
Last edited:
It's like a less dramatized version of Chernobyl, but only slightly less chilling.


This nicely expands on the things the TV show simplified or left out.

Also, didn't you post this to FB way back when?

If @Dartz read the same book I did, Midnight in Chernobyl, a lot of the stuff above only came out after the show Chernobyl (excellent as it is) came out.

In particular, as you say the chain of events surrounding the AZ-5 were different in real life. In the show, the button is pressed because the power of the reactor is already rising dramatically. In real life, it started rising dramatically after the button is pressed.
 
It is something I've been sitting on for a while. It started as a reading for a fic on a fictional fusion-reactor accident in a story I wrote. It ended up first on the Chernobyl subreddit - when someone ironically asked 'Tell me, how does an RBMK reactor explode' - as an ironic reply.

There's still a lot I could've added in, but it didn't really matter to the basic facts.

It started sometime before I read Higginbotham's book - but there're bits that've been added from it. One of the few sources in the English language prior to Chernobyl (The series) was Grigoriy Medvedev's Chernobyl Notebook - which introduced a lot of the common themes that're continuously repeated. Dyatlov forcing the operators to raise power, the channel caps hopping on the reactor lid (impossible, if you look at the design), an operative being in the reactor hall moments before the blast to witness this, and the power surge happening before AZ-5 is pushed.

A lot of it is Soviet-era mush - obscuring the depth the reactor's defects and placing the blame on the dead. Many of the regulations that were supposedly broken, didn't actually exist, or weren't regarded as 'this reactor might explode if you do this' regulations. Some of it is just honest mis-remembrance of something that happened 35 years ago. It's telling that Leonid Toptunov and Alexandr Akimov did give accounts of what they did that night to Soviet Investigators. To my knowledge, these are still sealed and classified. Dyatlov - the so called monster - would write to Toptunov's parents after the accident, explaining how heroic their son was and how he had done his work correctly.

Everyone has their own agenda to inspire their versions of the truth

I can't even tell how right this is. The best I can say is that this feels kind of right. It requires no real malice from anyone - no recklessness. All of those involved are competent, and care about what they're doing. It's a lot less dramatic, but it's got a level of truthiness to it.

Midnight in Chernobyl is a good book - it shows a lot more of the social reality going on around the plant, and all of those involved.
Ablaze by Piers Paul Read is also worth a read.
A lot of the technical details on the Ignalina plant in Lithuania are public, which is where I got some of the expected failure modes of the reactor from.

Some of the original datalogger printouts from the test are also floating around on the internet somewhere and some oddball facts bubble up in the Chernobyl subreddit from time to time.

That the Chernobyl reactor was being shut down for maintenance - and one of the planned maintenance items was a change to the control-rod sequencing to prevent a power surge on AZ-5 - appears to be one of the more unfortunate truths. The accident happened at the last possible moment it could have happened.
 
Last edited:
In particular, as you say the chain of events surrounding the AZ-5 were different in real life. In the show, the button is pressed because the power of the reactor is already rising dramatically. In real life, it started rising dramatically after the button is pressed.
IIRC, the precise chain of events there is still uncertain.

Edit : The show does place the SCRAM very late though. IIRC, the question is whether the rise had started already, and picked up after SCRAM, or whether the reactor was stable before it

I can't even tell how right this is. The best I can say is that this feels kind of right. It requires no real malice from anyone - no recklessness. All of those involved are competent, and care about what they're doing. It's a lot less dramatic, but it's got a level of truthiness to it.
There was definitively recklessness though, but you can argue that this recklessness was normal within the Soviet nuclear management and operator culture.

For various reactor states, there existed a minimum amount of control rods that had to be kept in the core at all times. This limit was ignored in order to get the reactor back online.
 
Last edited:
It is a degree. There's a difference between going YOLO on the controls, and doing what's been done a thousand times before without incident. The reactivity margin had been just as low the previous day - though at a much higher power level. Which'd be more NASA syndrome than anything.

Whether the power begins to rise or not depends on the reactor's own governors. Throughout the test, it's still operating under automatic control with the auromatic regulation rods still managing reactor power and compensating for the increasing voiding in the coolant. It does appearr that, regardless of whether power had begun to rise or not, nobody was alarmed in the control room prior to AZ-5 being pushed. There was no cause for concern.
 
The accident happened at the last possible moment it could have happened.
Well, per definition catastrophic accidents tend to occur in the last possible moment.

Just that if Chernobyl reactor number four hadn't gone ahead to try and meet it's five year quota for heat energy generation in a few milliseconds on the night in question, it would likely never again have gotten an opportunity to.

Good lesson on why good enough is not something to settle for in NPP design, and why NPPs should be continually upgraded and updated throughout their operational lifetime.
 
It is something I've been sitting on for a while. It started as a reading for a fic on a fictional fusion-reactor accident in a story I wrote. It ended up first on the Chernobyl subreddit - when someone ironically asked 'Tell me, how does an RBMK reactor explode' - as an ironic reply.
If this is the level of thought you go to for stories, then I think I want to read your stories.

Where can I find the one you're referring to?
 
That's the big mistake a lot of fic writers make, but that's another place and time for that discussion. I've a hate-on for competetence fics, and the like.
 
This is downright Lovecraftian horror. An excellent piece of science writing that had me hooked with creeping dread.
 
The Chernobyl Nuclear Power Plant, and the city of Pripyat beside it, had been the brainchild of Viktor Bryukhanov. Bryukhanov has taken the city and its power plant form a paper concept, to a living, thriving thing. By 1986 Pripyat had become a model for the best in Soviet life. The shelves were well stocked, the apartments comfortable and the amenities accessible. There is a hotel, a swimming pool, multiple schools and a 'Palace of Culture', where residents can indulge in their hobbies.

Pripyat is what the Soviet Union wishes it was.
This part is really poetic. It says a lot about the Soviet Union's hopes and dreams.
 
This is downright Lovecraftian horror. An excellent piece of science writing that had me hooked with creeping dread.

I think I read a review somewhere calling the Sky series, an exceptional Godzilla film. The series really does create that ominous sense of horro-movie dread, especially in the first episode where everyone is dealing with something they really don't fully understand and may be killing them while they're completely unaware.

One of the scenes is of two of the operators (Proskuryakov and Kudryavtsev) stumbling out into the remnants of the wrecked reactor hall and looking down into the flaming maw of an open nuclear reactor. The series illustrates their skin reddening as smoke and debris whirls around them - and then they look down into the thing that'd just killed them and know.

The reality was just that bit more unnerving. They entered a dust filled corridor, blocked mostly by debris. They walked a short distance down the hallway, shining a single flashlight into the wreckage.

What they actually saw? Aleksandr Yuvchenko, who held the door for them, would later say that they said they saw nothing in there. And when he insisted on going in for a look himself, they told him in no uncertain terms what there was nothing in there for him to see. This likely saved his life.

However close they go to the reactor, was still close enough for them to receive a hideous radiation does. Most of the air was filled with pulverside reactor graphite and fuel rod - most of which would still be furiously radiactive with short-lived fission products.

Yuvhcenko lived until 2008 - despite getting radiation burns from the dust on the door.

There is a lot the series doesn't show. Higginbotham's book is well worth a read because it goes into some very specific details, far beyond what we need to here.

And the disaster illustrates how badly the missed.

The disaster was uniquely Soviet in a lot of ways, but the failures that lead to it occurring weren't unique to the Soviet Union. And to assume they are, invites them happening again.

Modern BWRs have a negative void coefficient. But what happens when there's some good boiling going on in the core and something happens to cause all those voids to collapse. In truth, it would seem that a large coefficient of reactivity in any direction can be dangerous in the wrong circumstances. And it has been admitted that there are failure modes for these that can cause them to Stackpole merrily, but these haven't been elaborated on.

The real difference between Chernobyl and Fukushima say - Chernobyl didn't have a full containment structure over it, so the exploded core was open to atmosphere rather than being sealed in a concrete chamber.

Legasovs's memoirs - as featured in the Sky series - were far more dry in reality and weren't partiicularly earth shattering or hidden, but this is one of the factors he pinpoints as being a cause for the disaster.

"The approach to nuclear safety, which also, in my opinion, applies to any technologically complicated or potentially dangerous object, must be made up of three elements:
-The First; to make the object, for example a nuclear reactor, as maximally safe as possible.
-The Second, to make the operation of the object as maximally reliable as possible, but 'maximally' can never mean 100 percent reliability.
The philosophy of safety demands the introduction of a third element, which admits that just the same, an accident will take place. "

Make it safe, make it reliable, and stick it in a box it can't get out of incase you're wrong about the first two.
 
Last edited:
Make it safe, make it reliable, and stick it in a box it can't get out of incase you're wrong about the first two.
A good set of rules, which apply to all forms of engineering.

I don't have anything as dramatic to talk about, and much of what I could, I'm not sure I'm allowed to. Discussing the internals of Google's services while still working for Google is... probably counterindicated. We apply the same rules, however. It's something only an engineer could love, but I get the same sense of creeping horror from some of the outages I've heard described, as I got from this story.

The rules are always written in blood. I'm just lucky enough that it's less likely anyone will die... though the scale is huge enough that, should search go down, people will die anyway.
 
You know, all three elements are actually contained within Murphy's Law of "If something can go wrong, it will go wrong".

If you engineer something and it has in its design a way for it to go wrong, then eventually, it will go wrong because if it is possible then over a long enough span of time eventually you'll role that Nat 1. So the first step is to eliminate all the ways that it can go wrong. If you are designing strain gauges to be inserted into a test set up, make it physically impossible to accidentally insert them the wrong way and thus invalidate a test.

And even then, assume that at some point, somehow they will go in wrong. Then what? Well, build in some sort of indicator or calibration process that will tell you that the gauges are inserted correctly, which will also help you catch bad gauges.

Chernobyl is terrifying in large part because so many things had to go wrong all at once that it shows you just how fragile our assumptions can be.
 
Back
Top