The Chernobyl accident, step by step

Chernobyl 4 was an RBMK-1000: 3,200 thermal megawatts, 1,000 electrical, a graphite core twelve metres across crossed by 1,661 vertical pressure tubes carrying light water that boils inside the channel itself. The graphite moderates; the water only cools. That split of duties defines everything that followed.

In a PWR or a BWR the water is both moderator and coolant: if bubbles form, there is less moderation, fission falls and power drops by itself. In the RBMK the moderator is solid and stays where it is. Bubbles only remove water, which was also absorbing neutrons, so removing it adds reactivity. That is the positive void coefficient, and in the state the core was in that night it was of the order of +4 β: more steam, more power, more steam.

On top of that, the reactor had no containment building. It sat in an industrial hall with a light roof, because the worst accident the design contemplated was the rupture of one or two tubes, not of the whole core.

The test itself was reasonable: check that, after a loss of offsite power, the coasting turbogenerator could feed the cooling pumps until the diesels came up. It had been postponed since 1982 and was run at the end of a long day, with the reactor on its way to a scheduled shutdown.

On 25 April the reactor came down from 3,200 to 1,600 MWt and stayed there for some nine hours at the grid dispatcher's request. At 00:28 on the 26th, during a transfer between regulating systems, power collapsed to about 30 MWt. In a reactor that has been at high power, xenon-135 — a fission product that devours neutrons — builds up exactly when power falls: the reactor poisons itself and will not come back up.

Getting it to the 200 MWt at which the test was finally run meant pulling rods, and pulling rods, and pulling rods. At 01:22:30 the calculation gave an operating reactivity margin of 8 equivalent rods, against a regulatory minimum of 15. That margin was neither displayed to the operator nor wired into the protection system: it had to be requested. The reactor was left at low power, with xenon in the middle, with almost every rod withdrawn and with very little steam flow: precisely the state in which the void coefficient is most dangerous.

At 01:23:04 the turbogenerator inlet valves closed and the machine began to slow. The main circulation pumps, fed by that same generator, lost flow. Less water through each channel means the water heats up more on its way through, and with the reactor already close to saturation that means more steam.

More steam, in a reactor with a positive void coefficient, means more power; more power, more steam. Power began to climb slowly. At 01:23:40 the shift chief ordered AZ-5, the emergency shutdown button, which drives every rod into the core at once. It was the correct move: in any other reactor, that is where the story ends.

Of the 211 control rods, 187 entered from above at 0.4 metres per second: eighteen to twenty seconds to cross the seven metres of core. The other 24 are shortened rods that come up from below, and their job is to flatten the power profile in the lower half; the ones that matter here are those from above. Because an RBMK rod was not only absorber: nearly all of them carried a 4.5-metre graphite displacer hanging from the boron carbide, and it was there for neutron economy. With the rod withdrawn, the displacer filled the channel so it would not fill with water, which absorbs neutrons and makes fuel more expensive, and it sat centred in the fuelled region, leaving 1.25 metres of water above it and 1.25 metres of water below.

There is the mechanism. When the rod starts down, the first thing to enter that bottom metre and a quarter is not the absorber: it is the graphite tip, pushing the water out of that part of the channel. In an instant, at the bottom of the core, an absorber — water — was removed and a moderator — graphite — was put in its place. Local reactivity rises. The rod keeps going down and seconds later the boron shuts that region off, but for those seconds the emergency shutdown begins by adding reactivity instead of removing it. INSAG-7 calls it the positive scram effect, and notes that its magnitude depends on how power is distributed through the core.

That night it was distributed in the worst possible way. With xenon poisoning the middle and the rods withdrawn, the neutron flux had sunk towards the bottom of the core, exactly where the graphite tips would arrive first. The yardstick for this is β, the fraction of neutrons that come not from fission itself but from the later decay of some fragments, about six thousandths of the total: while reactivity stays under 1 β — one dollar — the chain depends on those late neutrons and the reactor is governed in seconds. Cross the dollar and the chain sustains itself on prompt neutrons alone, and the characteristic time becomes milliseconds.

The contribution of the graphite tips at the bottom of the core, on top of the steam already forming in the channels with a void coefficient of the order of +4 β, crossed that threshold. From that point no rod travelling at 0.4 metres per second was going to arrive in time: the reactor was no longer governed by mechanisms, it governed itself, by destroying itself.

At 01:23:43 the power-excursion signals fired. The records show power passing 530 MWt and still rising; later reconstructions put it at the order of a hundred times rated power before the instruments stopped being of any use. All of it happened in about four seconds.

Fuel does not melt at that speed: it shatters. Thousands of broken uranium oxide pellets dumped their heat into the channel water at once, the water flashed explosively to steam and the pressure tubes burst. The first explosion, of steam, lifted the 2,000-tonne upper shield. Two or three seconds later came the second, attributed to hydrogen from the zirconium cladding reacting with steam at high temperature.

With no containment building, that energy took the roof off the hall and left the core open to the air. The graphite burned for ten days and the fire's thermal plume carried fission products kilometres up: some 14 EBq of total radioactivity, 5,200 PBq in iodine-131 equivalent. Two workers died in the explosions and 28 more of acute radiation syndrome in the following weeks, most of them firefighters and plant staff. Pripyat, three kilometres away, was evacuated on the afternoon of the 27th; the 30-kilometre zone, some 116,000 people, during 1986.

The IAEA's first report, INSAG-1 in 1986, put the blame on the operators. In 1992, with the full Soviet data on the table, INSAG-7 corrected it: the operators did break rules, but the accident happened because the reactor could reach a state in which its own emergency shutdown blew it up, and that was in no operating manual.

The RBMKs that kept running were modified. Enrichment went from 2.0 to 2.4% and later to 2.8% with erbium as a burnable poison; between 80 and 90 fixed absorbers were installed in fuel channels; the minimum rod margin went from 26-30 to 43-48 equivalent rods; the rods were redesigned so that, withdrawn, no water was left beneath the displacer; shutdown time went from 18 to 12 seconds and a fast system of 24 rods was added that inserts at least 2 β of negative reactivity in under 2.5 seconds. The void coefficient ended up of the order of +β.

Unit 4 was covered by the sarcophagus in November 1986 and since 2016 sits under the New Safe Confinement, a 108-metre-tall steel arch assembled alongside and slid over the building. The other three units kept generating: unit 2 until 1991, unit 1 until 1996 and unit 3 until December 2000. Of the seventeen RBMKs built, seven remain in operation, all in Russia.