Two official accounts of the night of 26 April 1986 exist, six years apart, and they do not describe the same accident. The first was written in Moscow in the summer of 1986 and presented to the world in Vienna in August. The second was written by a commission of the Soviet nuclear regulator in 1991, after the Soviet Union had begun to come apart, and published by the IAEA in 1992 with the IAEA’s own revised judgement on top of it. The entry gives the outline. This piece follows the two reports more closely, because the distance between them is itself a lesson about how an organisation explains a failure of its own.

The first version

The analysis began on 27 and 28 April, when specialists reached the records of the unit’s last hours. Two things were obvious at once, the working group of Soviet experts wrote later: the speed of the process, and “the fact that there were hardly any control rods in the core during the run-up to the accident.” The first official version was drawn up at the plant on 5 May by an interdepartmental commission under A. G. Meshkov, the first deputy minister of the Ministry of Intermediate Sized Machinery, the ministry whose institutes had designed the reactor. It said the reactor had run away because steam had formed in the fuel channels after a breakdown in the circulation of the coolant, caused by a mismatch between the feedwater and the coolant flows. The operators had set up the mismatch; the pumps had failed; the reactor had followed.

That version did not survive May. Four days before it was written, on 1 May, Vladimir Volkov, who headed the Kurchatov Institute’s research group on the reliability and safety of RBMK plants, had given the institute’s director, Anatoly Aleksandrov, a different account, and on 9 May he sent it to the country’s leaders in a letter. The accident, he wrote, was due “not to the actions of the operating personnel, but to the design of the reactor core and a lack of proper understanding of the neutron physics processes going on in it.” The specific mechanism he named was the one that would take the official bodies six years to accept: the positive reactivity put into the bottom of the core by the graphite displacers when the rods dropped, in a reactor whose void coefficient was already large and positive. At the end of May the designers of the main circulating pumps, together with the Gidroproekt institute and the All-Union Heat Engineering Institute, analysed the pumps’ behaviour and found no cavitation and no break in circulation: the lowest margin against cavitation had come at 1:23:00, forty seconds before the runaway, and it had been enough. In the same days a group of engineers from the Ministry of Power, which operated the plants, sent an addendum to the official investigation in which the first cause listed was “the fundamentally faulty design of the RCPS rods”, followed by the positive void and power coefficients, the high coolant flow, the low margin and the low power, the absence of warnings in the design and the rules. Dyatlov wrote later that Volkov “was quickly disposed of with an invalidity pension.”

The Interdepartmental Science and Technology Council met on 2 June and 17 June, with Aleksandrov in the chair. The calculations from the All-Union Scientific Research Institute for Nuclear Power Plant Operation that showed the design’s share of the accident were, in the words of the 1991 commission, given “insufficient attention”, and “all the causes of the accident were reduced exclusively to personnel errors.” The commission added that these decisions “paved the way for the one-sided presentation of information on the causes and circumstances of the accident submitted to the IAEA, a wide range of specialists and the general public.” On 15 June Pravda announced that the plant’s director and chief engineer had been dismissed.

Vienna

At the Post-Accident Review Meeting at the IAEA in Vienna, from 25 to 29 August 1986, the Soviet delegation, led by Valery Legasov, first deputy director of the Kurchatov Institute, gave what INSAG called “the first published account of the accident”, and gave it at length. Legasov spoke for most of the first day. A British delegate’s cable from the meeting records him saying that the operators had felt under extreme pressure to finish the experiment that night, since they knew it would be a year before they had another chance; that it had been “a tremendous psychological mistake” on the part of the reactor’s designers not to foresee that more protection would be needed in the core; and, of his own community, “We have started later than other specialists to think about the need to protect against this kind of human stupidity and it is our fault.” He offered an analogy: it was as if the pilot of a passenger aircraft had begun testing the aircraft in flight, opening and closing the doors and switching off the safety systems.

The written report said that “the prime cause of the accident was an extremely improbable combination of violations of instructions and operating rules committed by the staff of the unit.” It said the accident “assumed catastrophic proportions because the reactor was taken by the staff into a non-regulation state in which the positive void coefficient of reactivity was able substantially to enhance the power excursion.” It listed six violations in a table, each with its motive and its result: running with the reactivity margin far below the permitted value, to get out of the xenon pit; letting the power fall below the programme’s figure, through an operator’s error in switching off the local control system; connecting all eight pumps with their flows above the limits, to meet the programme; blocking the trip on the shutdown of both turbines, so as to be able to repeat the experiment; blocking the protections on the steam drums’ level and pressure, to go on with the test despite an unstable reactor; and shutting off the emergency core cooling system, to avoid a false actuation during the test. “The basic motive in the behavior of the personnel,” it said, “was the attempt to complete the tests more quickly.” As for the designers, they had not provided protection against such a set of deliberate violations “since they considered such a set of events impossible.” The report described the moment of the button as a response to a rising power: “The increase in power might have prompted the personnel to press the EPS-5 button. Since, in violation of the Operating Procedures, the personnel had withdrawn more than the permissible number of manual control rods from the core, the EPS rods were not effective enough and the total positive reactivity continued to grow.” It said nothing about the graphite displacers.

The IAEA’s International Nuclear Safety Advisory Group, INSAG, wrote its own summary of the meeting that autumn, INSAG-1. It found the Soviet explanation plausible and, by its own later admission, “made no attempt to generate alternative scenarios”. It repeated what the Soviet experts had told it, including two things that were not true: that continuous operation below 700 megawatts thermal was “forbidden by normal safety procedures owing to problems of thermal-hydraulic instability”, and that the blocked turbine trip “would have saved the reactor”. It coined the phrase “safety culture” for what the operators had lacked, and its first two lessons were that “Nuclear plant designs must be as far as possible invulnerable to operator error and to deliberate violation of safety procedure” and that “Procedures relating to the operation of the plant must be carefully prepared with the safety significance of what is intended continuously in view.” It also said, on its second page, that it would be surprising indeed if a report issued after so short a time were correct in every detail.

In the West the analysts who tried to reproduce the Soviet power curve from the published data found they could not do it with the void coefficient alone, and began looking for another source of reactivity; the positive scram effect was, as INSAG put it, “publicly postulated, apparently first in some western analyses”. The United States Department of Energy’s team, in November 1986, wrote that the rapid excursion “was possibly accelerated by a positive reactivity insertion introduced during the initial portion of the scram”. Soviet experts acknowledged the effect for the first time at a conference in Vienna in the autumn of 1987. A Kurchatov Institute report approved after the Vienna meeting had already gone through thirteen candidate scenarios, from a hydrogen explosion in a steam drum to sabotage, and found that only one, the effect of the rod displacers, did not contradict the recorded data.

The second version

The commission that produced the second account was set up on 27 February 1990 by the USSR State Committee for the Supervision of Safety in Industry and Nuclear Power, the regulator, under Nikolai Shteynberg, with Yu. E. Bagdasarov, A. G. Kuznetsov, M. I. Miroshnichenko, V. A. Petrov and A. D. Zhuravlev, and it reported in Moscow in 1991. Its method was the regulator’s: to set the design of Unit 4 against the Soviet Union’s own safety regulations of 1973 and 1974, article by article, and then to set the operators’ actions against the rules they had been given. It found the design in breach of nine articles of the nuclear safety regulations and six of the general safety provisions, and it found that the technical safety report for the plant had listed none of these as violations, so that no compensating measures had ever been required. It found that the dangerous features had been known before the accident, through the Leningrad accident of 1975, a design study of 1980 and the Ignalina and Chernobyl start-up measurements of 1983, and that nothing had been done. It listed the operators’ violations and then weighed each one: the emergency cooling system’s isolation did not affect the accident; the eight pumps, “if anything hindered the reactor runaway”; the changed set points were not causes; running at 200 megawatts broke no rule, since none existed; running with the margin below fifteen rods was a violation, and the personnel “cannot be held to blame” for not knowing what it meant, because nobody had told them. Of the button it wrote: “The Commission was unable to establish why the button was pressed.” Its conclusion was that the accident “was initiated by erroneous actions on the part of the operating personnel” and “had disproportionately disastrous consequences because of deficiencies in the design of the reactor”, and its sharpest sentence was this: “The design parameters and characteristics of the RBMK-1000 reactor on 26 April 1986 violated the safety standards and regulations so seriously that it could only be operated in a country where there was an inadequate safety culture.”

INSAG published its revision, INSAG-7, in 1992, with the Shteynberg report and the report of a working group of Soviet experts under A. A. Abagyan as annexes, “since they are not generally available”. It went through its own 1986 table line by line and corrected it: the emergency cooling system’s isolation had been permitted and approved; there had been no rule against low power; the fall to 30 megawatts was not an operator error as such; the turbine trip had been blocked in accordance with procedure and would not have saved the reactor; the steam drum protection had been changed at 0:36, not 1:19, and the operators should not be blamed for it. It kept two charges: that the reactor had been run with a margin below the limit, “important for different reasons from those previously understood”, and that “most reprehensibly, unapproved changes in the test procedure were deliberately made on the spot, although the plant was known to be in a condition very different from that intended for the test.” On the design it wrote that the scram “may well have been the decisive contributory factor”, and that whether it was or not, “it does not really matter”; what mattered was that “such a deficiency existed and that it could have been the cause of the accident. It is reprehensible that such a deficiency had been known of for so long without its having been eliminated.” Its summary said that the weight INSAG-1 had given to the Soviet view, “which laid blame almost entirely on actions of the operating staff, is thereby lessened”, and that the accident “can be said to have flowed from deficient safety culture, not only at the Chernobyl plant, but throughout the Soviet design, operating and regulatory organizations for nuclear power that existed at the time.”

Dyatlov, by then free, replied in 1995 that INSAG had still got it wrong. The experts, he wrote, had kept their 1986 charges because they were bound by their 1986 report, and in finding that the scram “may well have been the decisive contributory factor” they had effectively blamed the staff for pressing a shutdown button. “True, the staff did not know,” he wrote of the reactivity margin’s effect on the void coefficient, “where could they have got to know about it, if the reactor designers did not know?” His verdict on INSAG-7 was that it “gives an inaccurate and simply false reading of events and processes”, and his verdict on its annexes was the opposite: “The factual material in these two Annexes is accurate, and for specialists certainly valuable.” On that, at least, the operator and the regulator’s commission agreed.

Sources

• International Nuclear Safety Advisory Group, The Chernobyl Accident: Updating of INSAG-1 (INSAG-7), IAEA, Vienna, 1992, including Annex I (the Shteynberg commission, 1991) and Annex II (the working group under Abagyan). www-pub.iaea.org
• USSR State Committee on the Utilization of Atomic Energy, The Accident at the Chernobyl Nuclear Power Plant and its Consequences, August 1986, in the US Department of Energy’s quick translation as released by the UK government in FOI2019-08634, which also holds the British delegate’s cable from Vienna; the “extremely improbable combination” passages in the IAEA’s translation as quoted in INSAG-7. assets.publishing.service.gov.uk
• US Department of Energy, Report of the U.S. Department of Energy’s Team Analyses of the Chernobyl-4 Atomic Energy Station Accident Sequence, DOE/NE-0076, November 1986. osti.gov
• Anatoly Dyatlov, “Why INSAG has still got it wrong”, Nuclear Engineering International, September 1995. neimagazine.com
• United Press International, “Chernobyl director and chief engineer fired”, 16 June 1986. upi.com