At thirty seconds past 1:22 on the morning of 26 April 1986, in the control room of the fourth unit of the Chernobyl nuclear power plant, a computer called SKALA wrote the state of the reactor to magnetic tape. It did this every five minutes. It recorded the positions of the control rods, the currents of the sensors in the core, the flows and pressures and water levels, about four thousand points in all, and from them, when asked, it could calculate the one number the operating rules cared about most: the operating reactivity margin, counted as the number of control rods’ worth of absorber left inside the core. The rules said the reactor should run with twenty-six to thirty. Below fifteen it was to be shut down at once. Nobody asked the computer that night, and it could not have answered quickly. The calculation took it ten to fifteen minutes, and the machine stood about fifty metres from the console.

The tape was read when everything was over, at the Smolensk nuclear power plant, by the programme that should have read it at Chernobyl. The number it gave was eight.

Thirty-four seconds after the tape was written, at 1:23:04, the stop valves of turbogenerator number 8 closed, and the experiment the night shift had stayed on to finish began. Thirty-six seconds after that, at 1:23:40, the button marked AZ-5 was pressed. It drops every control and protection rod into the core, and it is how an RBMK reactor is shut down, in an emergency or at the end of an ordinary day. The emergency power signals came three seconds later. The signal that reads “rupture of a fuel channel” came at 1:23:49. The entry in the chief reactor control engineer’s log for 1:24 says: “Severe shocks; the RCPS rods stopped moving before they reached the lower limit stop switches; power switch of clutch mechanisms is off.”

Everyone knows what happened next. This entry is about what happened before: a safety test designed in 1976, failed in 1982, repeated in 1984 and 1985, and scheduled for the afternoon of 25 April 1986; the nine hours by which a grid dispatcher in Kiev moved it; the state the reactor was in when it finally ran; and a letter of December 1983 that described, two and a half years early, what the button would do.

Who ran it

The Chernobyl plant was the Soviet state in its two halves. The USSR Council of Ministers had decided on 29 September 1966 to build 8,000 megawatts of RBMK-1000 reactors, and the decree split the work between two ministries. The Ministry of Intermediate Sized Machinery, which ran the Soviet nuclear industry, was to design the reactors and manage the science; the Ministry of Power was to design the plants, build them and run them. The reactor’s Chief Design Engineer was the Scientific Research and Design Institute for Power Technology in Moscow, under Nikolai Dollezhal. Its Scientific Manager was the Kurchatov Institute of Atomic Energy, under Anatoly Aleksandrov, who was also president of the Academy of Sciences. The plant’s General Designer was the Gidroproekt institute. The plant was sited near the village of Kopachi in the Kiev province in 1967 and named for the nearest town; the technical design for Units 3 and 4 was approved by the Council of Ministers on 1 December 1975. Unit 4 went into commercial operation in December 1983. The regulator, the State Committee for the Supervision of Nuclear Power Safety, had been set up three years before the accident, and until 1984 it was a division of the Ministry of Intermediate Sized Machinery, the body whose reactor it was supposed to supervise.

The plant’s director was Viktor Bryukhanov and its chief engineer Nikolai Fomin. Neither was in the building when the test ran. The deputy chief engineer for operations of the second stage, Units 3 and 4, was Anatoly Dyatlov, born in 1931, who had come to Chernobyl in 1973 from a physics laboratory in the Soviet Far East where he had worked on small reactors for ships. He drew up the test programme, and he was in the control room on the night, about ten metres from the men at the panels. The night shift came on at midnight: Aleksandr Akimov, the unit shift supervisor, and Leonid Toptunov, the senior reactor control engineer, who was twenty-six. Yuri Tregub, whose shift had just ended, stayed to watch. The electrical side of the test belonged to Gennady Metlenko of Dontekhenergo, a contractor from Donetsk, who had brought an oscilloscope and two assistants. In the room as well were the unit control engineer Boris Stolyarchuk, the turbine engineers Igor Kershenbaum and Razim Davletbayev, and two trainee reactor control engineers from other shifts who had come to see a rundown. Grigori Medvedev, a nuclear engineer who had worked at the plant in the 1970s and later talked to the survivors, counted fourteen people in the control room at 1:23.

What they were trying to find out

A reactor that has been shut down still makes heat, and it has to be cooled. At Chernobyl the cooling depended on electric pumps, and the worst case the designers had planned for was a large pipe breaking at the same moment as the plant lost its outside power. The diesel generators would start, but they needed time to come up to speed, nominally forty to fifty seconds by the account the United States Department of Energy gave in November 1986. For that gap the design had an answer that cost nothing: the turbogenerator. A 500-megawatt turbogenerator weighs 3,500 tonnes and goes on spinning after the steam is cut off. In 1976 the Chief Design Engineer’s institute proposed in a letter that this rundown be used to keep the main circulating pumps and the feedwater pumps alive until the diesels took over, and the idea was written into the design of the RBMK plants. The technical safety report for the Smolensk plant put it in one sentence: “In a design basis accident, involving total loss of power for the unit’s internal requirements, cooling water is fed to the damaged part by feedwater pumps powered by the turbogenerator rundown.”

That was the hypothesis: that a coasting turbogenerator, with a suitable regulator on its excitation system, would hold its voltage long enough to drive the pumps through the gap. The Soviet commission that re-examined the accident in 1991, under Nikolai Shteynberg, wrote that “the main idea of the programme is to test the design basis conditions as realistically as possible and there is nothing wrong with the programme itself.”

What was strange was that Unit 4 had been handed over for commercial operation without the test ever having been passed. In 1982 the test was run on Unit 3 with Dontekhenergo and representatives of the General Designer, and it failed: the generator’s voltage fell too fast, and the excitation regulator had to be redesigned. The test was run again with a modified “rundown unit” in 1984 and in 1985, and again it did not satisfy. Each programme connected the coasting generator to the pumps: one main circulating pump on each side of the reactor in 1982 and 1984, two on each side in 1985 and 1986. From 1984 the programmes also had the emergency core cooling system shut off by hand, so that it would not flood the circuit when the test’s imitation of an accident signal was given. The 1986 run was the fourth attempt, with a year to wait if it was missed.

Valery Legasov, first deputy director of the Kurchatov Institute, who led the Soviet delegation to Vienna that August and later recorded his own account on tape, thought the question had been asked in the wrong place. “This is an experiment that should not have been performed at a nuclear power plant,” he said, “because the value of turbine coastdown at idle is something that should be measured on a special stand built by the designer of the turbine.” Medvedev wrote that the experiment had been proposed to many nuclear power plants, and that “because of the experiment’s riskiness, they had all refused. The management of the Chernobyl plant had agreed.”

There was a second claim buried in the first, and nobody wrote it down. The test was classed as electrical. The reactor’s part in it was to make steam for the turbine at the start, and then to sit at a few hundred megawatts, with its emergency cooling disconnected, while four of its eight pumps slowed down. Whether an RBMK reactor could safely do that was not a question the programme asked, because its authors did not know it was a question. The Shteynberg commission put it exactly: “The causes of the accident lie not in the programme as such, but in the ignorance on the part of the programme developers of the characteristics of the behaviour of the RBMK-1000 reactor under the planned operating conditions.”

What they built

The RBMK-1000 is a graphite block seven metres high and 11.8 metres across, pierced by 1,661 vertical channels that hold the fuel. Water is pumped in at the bottom, boils as it rises past the fuel, and the steam goes to two turbines; the water comes back round. The core sits inside a cavity closed at the top by a plate weighing 2,000 tonnes, through which the channels pass. Among the fuel channels run 211 channels for the control and protection rods, boron carbide absorbers that are driven in from above to reduce the chain reaction, or dropped in all at once on the AZ-5 signal. They travel at 0.4 metres a second, and take about eighteen seconds to go from the top to the bottom.

Two things about this reactor mattered on the night, and both were known.

The first was the void coefficient. In a water-cooled reactor the water does two jobs: it carries the heat away, and it absorbs neutrons. If more of it turns to steam, there is less water to absorb neutrons. In most designs the loss of water also slows the chain reaction, because water is what moderates the neutrons to the speed at which uranium fissions. In the RBMK the graphite does the moderating, so steam takes away an absorber and gives back nothing. More steam means more power, and more power means more steam. The design documents said the coefficient was negative. The measurements, from the first unit at Leningrad in 1973 onward, said it turned positive as the fuel burned up and the fixed absorbers were pulled out of the core to make room for fuel, and that by the time a core reached its steady refuelling state it was strongly positive. The Shteynberg commission found that no calculations and no measurements existed for the coefficient at any power below half of nominal, and concluded that the designers “evidently did not expect any dangerous characteristics in the behaviour of the reactor at low power levels.” Nothing in the rules forbade running there.

The second was the rods. Below the absorber of each rod hung a graphite “displacer” 4.5 metres long, joined to it by a telescope, whose purpose was to keep water out of the channel when the rod was withdrawn, since water absorbs neutrons and graphite does not. When a rod was fully up, the displacer hung in the middle of the core with 1.25 metres of water above it and 1.25 metres below. On a scram the absorber came down into the top of the core and the displacer went down into the bottom, pushing the water out ahead of it. For the first second or so of travel, in the lower part of the core, that was not a shutdown. It was the removal of an absorber: a small insertion of positive reactivity, in the one part of the reactor where the rods were not yet reaching.

Whether that mattered depended on where the rods started from. If they were partly inserted, their absorbers were already in the flux and the first increment of travel reduced power; if they were all at the upper stops, it did the opposite. That is what the operating reactivity margin measured, though nobody told the operators so; the rules treated it as a tool for keeping the power distribution flat across the enormous core, which it also was. The calculations in the Shteynberg report give the other meaning: with a margin of about thirty rods, a scram put in strong negative reactivity; with fifteen, very little in the first six seconds; with seven, the reactivity in the first eight seconds was positive, “the chain reaction is being accelerated rather than terminated.”

This had been seen. During the physical start-up of the first unit at Ignalina in Lithuania, in November and December 1983, and at Chernobyl Unit 4 itself, the positive effect of rod insertion was measured. On 23 December 1983 the Kurchatov Institute, the Scientific Manager, wrote to the designers that when power fell to half, as when a turbine was switched off, the margin shrank and the flux distorted, and that “Triggering of the EPS in this case may lead to the introduction of positive reactivity. It seems likely that a more thorough analysis will reveal other dangerous situations.” On 2 February 1984 the Chief Design Engineer’s institute told the other organisations and every RBMK plant that it intended to limit the number of rods that could be fully withdrawn to 150, with the rest inserted at least half a metre. The limit never went into the operating rules. The rod was not redesigned. A proposal of 1977 to drop the short absorber rods into the bottom of the core on a scram was not fitted at Chernobyl. There had been an earlier warning, a fuel channel failure at Leningrad on 30 November 1975 with the reactor on a margin well below fifteen rods, and the operators at Chernobyl were never told its causes. The IAEA’s advisory group wrote in 1992: “Apparently, there was a widespread view that the conditions under which the positive scram effect would be important would never occur. However, they did appear in almost every detail in the course of the actions leading to the accident.” The paper trail, from 1975 to 1984, is in The letter of 1983.

The programme for 1986 was a plant document, a few pages, headed “Test Programme for Turbogenerator No. 8 of the Chernobyl Nuclear Power Plant in a Rundown Regime with the Plant Internal Load”, and approved by the chief engineer, Fomin. It called for the reactor at 700 to 1,000 megawatts thermal, about a quarter of full power; for the emergency core cooling system to be shut off by its hand valves, which the plant’s rules allowed the chief engineer to authorise; for all eight main circulating pumps to run, so that four would still be turning on the grid when the other four had coasted to a stop; for a special button, marked for the design basis accident, that would send the accident signal to the rundown unit and the diesel start circuit; and for Metlenko’s oscilloscope. The safety section, Dyatlov wrote later, “did look blank”. The plant’s operating procedures said that programmes for devices used on a reactor at power and not covered by the design had to be cleared with the Scientific Manager and the Chief Design Engineer; the commission of 1991 found that the regulations in force did not require that for a test of this kind, and it was never sought. Legasov said on his tapes that the plan “was drawn up very poorly, very imprecisely, and not authorised by the specialists by whom it should have been authorised”, and that the State Committee’s own inspectors at the plant did not know it was happening. He had, he said, the tape of a telephone call made on the eve of the test, in which one operator asks another: “here in the program, it’s written what needs to be done, but then a lot of it is crossed out. What should I do?” The answer was: “You do what is crossed out.”

Nine hours

The shutdown began at six minutes past one in the morning of 25 April, with the margin at thirty-one rods. By 3:47 the reactor was at 1,600 megawatts, half power. A reactor coming down from full power poisons itself: xenon-135, a fission product that eats neutrons, builds up faster than it burns away, and for the better part of a day the operators have to withdraw rods to hold the power they want. At 7:10 the computer gave the margin as 13.2 rods, below the shutdown line. The shift held at half power and waited for the xenon to pass; the commission of 1991 called that a deliberate violation, though not a cause of what followed, since the margin recovered through the day. At 1:05 in the afternoon turbogenerator 7 was taken off the grid. At 2:00 the emergency core cooling system was isolated, as the programme said.

At 2:00 the load dispatcher of the Kiev grid asked the plant to stay on line. Another station on the grid was late coming up, and a Friday afternoon was not the time to lose a unit. Unit 4 held at half power, with its emergency cooling valved off, for nine hours. INSAG, the IAEA’s advisory group, said later that running so long with the cooling system out was “indicative of an absence of safety culture”, but it was no part of the accident. At 11:10 that night the dispatcher released the unit. At midnight the shift changed. Akimov took over from Tregub, and Toptunov sat down at the reactor desk. By Dyatlov’s account the power was then 760 megawatts and the margin twenty-four rods.

The test should have been run in the afternoon by the men who had prepared it. It would now be run by the night shift, on a reactor that had spent eleven hours at half power and was poisoned in the way the letter of December 1983 described, with the centre of the core eaten out by xenon and the flux in two humps.

At 0:28, as the reactor came down through about 500 megawatts, Toptunov switched from the local automatic control system, which works in twelve zones of the core and only above ten per cent power, to the main automatic regulators. Something went wrong in the handover, and the power fell to 30 megawatts thermal, which on the neutron instruments read as zero. Every account agrees on the fall; they do not agree on whose fault it was. The Soviet report of August 1986 called it an operator error. The commission of 1991 said the cause was unknown and the operating documents contradictory. INSAG in 1992 said there was “no operator error as such”. Dyatlov wrote that “the reactor power drop at 00:28 was nothing remarkable, it was not a rare event at all.”

What came next was the decision. At that power the xenon would build for hours, and the choice was to shut down and wait a day, or to pull rods and climb back. Medvedev’s account, from the survivors in hospital, has Toptunov and Akimov refusing to raise power and Dyatlov shouting them down, with Tregub standing by as the man who would do it if they would not; Medvedev gives Dyatlov the words “the rules do not prohibit it”, and on the rules Dyatlov was right. Dyatlov’s own account is that the power had fallen, the operator had balanced his controller and switched it to automatic, and “then he began to raise the power”; and that he, Dyatlov, decided on 200 megawatts for the test “in view of the adequacy of this, and not because of impossibility.” By 1:00 the reactor was steady at 200 megawatts thermal, a sixteenth of its rating, and could not be taken higher. At 1:03 and 1:07 the seventh and eighth main circulating pumps were started, as section 2.12 of the programme said. With the power so low and the core offering little resistance, the eight pumps drove 56,000 to 58,000 cubic metres of water an hour through it, more than the rules allowed for some of the pumps, and the water came in only three degrees below boiling. The extra flow squeezed the steam out of the core, which pushed the power down, which the operators answered by pulling more rods. The water levels and pressure in the steam drums fell, and the operators held them by hand as well as they could. When Soviet specialists first read the records, on 27 and 28 April, what struck them, their working group wrote later, was “the fact that there were hardly any control rods in the core during the run-up to the accident.”

The state of the reactor at 1:23, as the commission of 1991 reconstructed it: power 200 megawatts; margin, from the tape at 1:22:30, eight rods; neutron flux in two peaks, the larger at the top; coolant flow 56,000 cubic metres an hour; feedwater 200 tonnes an hour; the rest “close to stable values”. The Soviet report of 1986 had put it more plainly: “By the beginning of the tests, namely at 01:23, the reactor parameters were closer to being stable [than] at any other time.”

What it looked like from inside

Several people have left accounts of the room, and the three fullest disagree about the one thing that matters, which is why the button was pressed.

The Soviet report of 1986 said that at 1:22:30 the operator saw on a printout that the margin required a shutdown, and that “this did not stop the personnel, and the tests began.” No such printout existed; the computer had not been asked. Medvedev has Toptunov reporting eighteen rods and Dyatlov walking the room: “Another 2 or 3 minutes, and it will all be done. Cheer up, lads!” INSAG decided in 1992 that “it is likely that the operator did not know the value of the ORM during the critical part of the test.”

At 1:23:04, on Metlenko’s command “Oscillograph on”, Kershenbaum closed the stop valves of turbogenerator 8. Six and a half seconds later the accident button was pressed, the rundown unit cut in, and the four pumps on the coasting generator began to slow. The signal that would have scrammed the reactor on the loss of its second turbine had been disabled at 0:43, which the rules permitted below 100 megawatts electrical, and which the shift had done so that the test could be repeated if the first run gave Metlenko nothing. For thirty-six seconds the test did exactly what it was meant to. The flow through the coasting pumps fell, the flow through the other four rose a little, and the total fell by ten to fifteen per cent. The commission of 1991 went through every recorded parameter for those seconds and found that none of them “required any intervention by the personnel or by the engineered safety features”. The automatic regulators were holding the power. The Soviet report of 1986 said “a slow increase in power began some time after beginning of the test”, and built on it the account in which the button was pressed against a runaway. The United States team and the commission of 1991 both found no power rise in the record before the button.

Dyatlov’s account, written in 1991, is in the first person. It had been agreed at the briefing, he wrote, that on the command “start oscilloscope” the turbine’s steam would be cut, the accident button pressed, and “the reactor would be tripped using the AZ-5 button, which is used both in emergency and normal conditions.” It was quiet in the room, he wrote, with no conversation, until someone spoke and he turned and saw the operator saying something to the shift foreman. “I was about ten metres away from them and could not quite make out exactly what the operator said. The shift foreman ordered him to trip the reactor indicating with a finger: ‘push the button.’ The foreman himself turned back to the panel he was watching. Their behaviour showed no signs of particular concern.” Four years later he wrote it again: “There was actually one reason for dropping the protection rods: a wish to shut down the reactor when work was finished.”

Medvedev’s reconstruction has Toptunov saying to Akimov, “The emergency safety needs to be activated, Aleksandr Fedorovich, we have an excursion”, and Akimov reaching for the button. The report of 1986 says the plant shift manager gave the order. The commission of 1991, after four years and every record, wrote one sentence: “The Commission was unable to establish why the button was pressed.”

What the instruments show is this. The AZ-5 signal was recorded at 1:23:40, 1:23:39 on the teletype. The rods began to move. On the power recorder, which took its signal from the ionisation chambers around the outside of the core, the power dipped and then rose. At 1:23:43 every chamber signalled an emergency: the power above 530 megawatts and rising with a period of less than twenty seconds. At 1:23:46 and half a second later the two pairs of coasting pumps dropped off their generator. At 1:23:47 the flow through the other four pumps fell by forty per cent and the pressure in the steam drums began to climb; by 1:23:48 the steam dump valves had opened. At 1:23:49 the computer logged the pressure rise in the reactor cavity that means a fuel channel has burst, and the loss of the 48-volt supply to the rod drives. The rods had stopped between two and two and a half metres down a seven-metre core. Akimov cut the power to their clutches so that they would fall under their own weight. They did not fall.

People outside heard two explosions, a few seconds apart. Dyatlov put the first at 1:23:46 or 47 and the second “one or two seconds later” and bigger. Legasov said on his tapes that “it has been absolutely reliably established, and it must be unambiguously written, that there were two consecutive explosions, the second more powerful than the first”, with a force he put at three or four tonnes of TNT. The Soviet report of 1986 gave the time of the explosions as 1:24. The 2,000-tonne cover plate lifted, severing every channel that passed through it, and with them every remaining rod. The United States team’s summary was that “the entire accident occurred in a period of only about 40 seconds”, that any small disturbance after 1:23:04 could have started it, and that “once the power began to rise rapidly, there was nothing that could have been done to stop it.”

What happened

What the physicists reconstructed over the next five years runs like this. The rods dropped from their upper stops. Their absorbers entered the upper core, where the flux was highest, and pushed it down; their displacers entered the lower core and pushed the water out of some two hundred channels at once. The core was by then behaving almost as two reactors with a poisoned band between them, and the lower one went critical on its own. The models agree that the power rose by tens of times within about five seconds, nearly all of it in the bottom two metres; they disagree on how much, from three and a half times the starting value to eighty. In the hottest channels the fuel reached the heat at which uranium dioxide does not melt but shatters. Fragments met water; the water flashed; the channels burst; the steam voided the rest of the core, and the void coefficient did the rest. Three or four broken channels were enough to lift the plate.

The accounting began at once and went wrong at once. An interdepartmental commission at the plant on 5 May blamed a breakdown in the coolant circulation. A Kurchatov Institute reliability specialist, Vladimir Volkov, wrote to the country’s leaders on 9 May attributing the accident “not to the actions of the operating personnel, but to the design of the reactor core”, and named the displacers. At two meetings in June of the Interdepartmental Science and Technology Council, chaired by Aleksandrov, the calculations pointing at the design were set aside and, in the words of the commission of 1991, “all the causes of the accident were reduced exclusively to personnel errors.” That became the report the Soviet delegation took to Vienna.

At the IAEA’s Post-Accident Review Meeting, from 25 to 29 August 1986, Legasov presented what INSAG called “the first published account of the accident”. It said that “the prime cause of the accident was an extremely improbable combination of violations of instructions and operating rules committed by the staff of the unit”, listed six violations in a table, and said nothing about the displacers. “The basic motive in the behavior of the personnel,” it said, “was the attempt to complete the tests more quickly.” INSAG’s own report that autumn adopted the account, and coined the phrase “safety culture” for what the operators had lacked. The positive scram effect was first acknowledged by Soviet experts in Vienna a year later. In 1991 a commission of the Soviet regulator under Nikolai Shteynberg set the design against the safety regulations of 1973 and 1974, found it in breach of fifteen articles, and wrote that it “violated the safety standards and regulations so seriously that it could only be operated in a country where there was an inadequate safety culture.” In 1992 INSAG published its second report with the commission’s as an annex, and shifted its judgement. The operators had violated rules, and “most reprehensibly, unapproved changes in the test procedure were deliberately made on the spot”; but “it is reprehensible that such a deficiency had been known of for so long without its having been eliminated.” On the question of which weakness had actually caused the accident it asked whether that mattered, “if any of them could potentially have been the determining factor”. The two reports, and the distance between them, are in The two reports.

After

Pripyat, the plant’s town of about 50,000 people a few kilometres away, was emptied within forty hours. By the end of 1986 some 116,000 people had been evacuated from the most contaminated land of Ukraine and Belarus, and a concrete and steel shelter had been built over the wreck between May and November. Two men died in the unit that night. Of 134 plant workers, firemen and emergency staff diagnosed with acute radiation syndrome, 28 died in 1986. Akimov died on 11 May and Toptunov on 14 May, in a Moscow hospital, and were buried at Mitino. Akimov, Medvedev wrote, kept saying while he could still speak: “I did everything correctly. I do not understand why it happened that way.” By 2002 more than 4,000 cases of thyroid cancer had been found among those who had been children in the fallout. The wider toll, in illness, land, money and trust, has been argued over for forty years and is not the subject here.

On 15 June 1986 Pravda announced that Bryukhanov and Fomin had been dismissed “for not being able to organize leadership and discipline, for meekness and lack of administrative ability”. In July 1987 the two of them, Dyatlov and three others were tried in the Palace of Culture of the evacuated town of Chernobyl, before a deputy chairman of the USSR Supreme Court, for breach of safety rules at an explosion-prone enterprise. Dyatlov told the court, by the United Press account of the first day, “With so many deaths I can’t say I am completely innocent.” On 29 July Bryukhanov, Fomin and Dyatlov were sentenced to ten years in a labour camp, and the other three to five, three and two. No designer was in the dock. Dyatlov, who had taken a dose of about 600 rem, served until October 1990 and spent the years after writing that “the design of the RBMK-1000 was not a contributor, not a major factor, but the sole reason for the Chernobyl accident.” Legasov recorded his tapes in the two years after Vienna and killed himself in the spring of 1988. The three weeks in court, and what came before and after them, are in The trial.

The reactors were changed within weeks, in ways that said what had been known. Eighty fixed absorbers went into every RBMK core; the shutdown margin went from fifteen rods to thirty; the rods were rebuilt without the water column, their drives speeded from eighteen seconds to twelve, and a separate fast scram of twenty-four rods, acting in two and a half seconds, was fitted to every unit. A display of the margin was put in the control rooms, and a limit of 700 megawatts written into the rules. Four and a half years after the accident, the Kurchatov Institute’s representatives wrote the sentence the commission of 1991 chose to quote: “the safety of nuclear power plants cannot be based on instructions. If a particular parameter exceeds certain limits, the reactor must be shut down automatically without the intervention of the operator.”

What it taught

Start with what it was not. It was not an accident during a test of the reactor. The reactor was not under test; a generator was, and the reactor was there to make steam and keep out of the way. It was not a failure of attention. For thirty-six seconds the flows, levels and pressures did what the programme said they would. And it was not a mystery. The last recorded event before the power rose was the shutdown command, and what happens in the bottom of an RBMK core when the rods start from the top had been measured in 1983, described in a letter and proposed for a rule.

An experiment has to be able to stop. The test needed four things from the reactor: steam at the start, a low and steady power, eight pumps, and a shutdown at the end. Only the fourth was taken for granted, because every reactor has a button. At Chernobyl what the button did depended on a number the design had made invisible and the rules had made a matter of power distribution. Before a trial on a living system, write down how it will be ended, and check that the ending is the one step that cannot be made unsafe by the conditions the trial creates.

A warning filed is not a warning acted on. The Ignalina measurement went into a report. The Kurchatov letter went to the designers. The designers’ letter went to every plant. A proposal of 1977 and a commission’s findings of 1976 went into drawers. Each step was taken by competent people, each left the next to someone else, and in April 1986 the operators at Unit 4 knew none of it. INSAG’s name for what was missing was “safety culture”, and part of what it meant was an organisation in which a finding like that of December 1983 cannot be allowed to rest. The knowledge was in the system for two and a half years. It was never in the room.

When the conditions change, the hypothesis has changed. The programme said 700 to 1,000 megawatts. The reactor was at 200, with eight rods’ worth of absorber instead of twenty-six, flux in two humps and water at the edge of boiling. INSAG’s judgement in 1992 was that when the power could not be restored, “the operating staff did not stop and think, but on the spot they modified the test conditions to match their view at that moment of the prevailing conditions.” That is the operators’ share, and it is real. But nobody had told them the change could matter. No document limited the power; no instrument showed the margin. “No matter how paradoxical it may seem,” the commission of 1991 wrote, “low power levels proved to be the most dangerous ones and the safety of the reactor at these levels had not been studied or analysed in the design documentation.” A test run under conditions its authors never analysed is a different test.

The schedule is part of the apparatus. Nine hours moved the test from the people who had written it to people who had not, and from a reactor coming down steadily to one that had sat poisoned at half power all afternoon. The dispatcher in Kiev did nothing wrong. But a programme that could be delayed by a telephone call, with no rule for what the delay did to its starting conditions, had left its most important variable to the grid.

The instrument that matters has to be in front of the person who decides. The margin was computed fifty metres away, every ten to fifteen minutes; the diagnostic recorder kept the positions of nine rods out of 211 and did not record power or reactivity; the neutron detectors all sat at mid-height of a core whose flux was in two humps. The one number that determined what the button would do was the one number nobody could see. The commission of 1991 quoted the operators’ side of the bargain: “the personnel had the right to expect, under any operating conditions, that the EPS would function and effectively terminate the chain reaction and prevent runaway of the reactor.” They had been given a stop button and told it was a stop button. Medvedev’s sentence stands over the whole story: “The killing was done by what should have been the protector, which is why death was not expected from that direction.”

Check the story before you learn from it. The power at 1:23 is 200 megawatts in every reconstruction, but the margin is 8 rods on the tape read at Smolensk, 6 to 8 in the Soviet working group’s account, 1.9 by the same programme with a standard flux profile, 18 by Toptunov’s word in hospital, and not less than 15 by Dyatlov’s reckoning of the rods the computer had not counted. The explosions are at 1:24 in the 1986 report, at 1:23:46 or 47 and one or two seconds later in Dyatlov’s memory, “two or three seconds apart” in what the Americans were told. The button was pressed because the power was rising, or because the test was over, or because a shift foreman pointed, and the commission that spent four years on it could not say which. What the record supports without argument is the sequence: a measurement in 1983, a letter, a limit never made a rule; a test postponed nine hours; a reactor at a sixteenth of its power with almost no rods in the core; thirty-six seconds of a test going well; a button. That is enough to learn from, and all of it was known before anyone pressed it.

Sources

• International Nuclear Safety Advisory Group, The Chernobyl Accident: Updating of INSAG-1 (INSAG-7), Safety Series No. 75-INSAG-7, IAEA, Vienna, 1992. The main text (the reactor’s features, the revised sequence, the positive scram, the quotations from INSAG-1 and the 1992 judgements); Annex I, the report of the commission to the USSR State Committee for the Supervision of Safety in Industry and Nuclear Power chaired by N. A. Shteynberg (Moscow, 1991), with the chronology, the test programme’s history, the Ignalina finding and the letters of December 1983 and February 1984, the reactor state at 1:23 and the “unable to establish” sentence; Annex II, the report of the working group of USSR experts chaired by A. A. Abagyan, with the second chronology and the three models. www-pub.iaea.org
• International Nuclear Safety Advisory Group, Summary Report on the Post-Accident Review Meeting on the Chernobyl Accident (INSAG-1), Safety Series No. 75-INSAG-1, IAEA, Vienna, 1986. Its statements on the 700-megawatt limit, the turbine trip, the lessons on page 31 and the caution on page 2 are quoted here as INSAG-7 quotes them; the IAEA’s own copy of INSAG-1 is no longer on its site, and the INIS record is behind a bot check. inis.iaea.org
• USSR State Committee on the Utilization of Atomic Energy, The Accident at the Chernobyl Nuclear Power Plant and its Consequences, information compiled for the IAEA Experts’ Meeting, Vienna, 25 to 29 August 1986. Read in the US Department of Energy’s quick translation of the Russian text, which the UK Atomic Energy Authority filed with its own 1986 Vienna papers and which the UK government released under the Freedom of Information Act in 2020 (FOI2019-08634, a 579-page scan with uneven text recognition): the dispatcher’s request, the table of violations, “the basic motive”, “considered such a set of events impossible”, the 1:22:30 printout and “a slow increase in power”. The “extremely improbable combination” sentence and the passages on the start of the test are quoted in the IAEA’s translation as reproduced in INSAG-7. The same release holds a British delegate’s cable from the Vienna meeting of 25 August 1986 recording Legasov’s spoken remarks. assets.publishing.service.gov.uk
• US Department of Energy, Report of the U.S. Department of Energy’s Team Analyses of the Chernobyl-4 Atomic Energy Station Accident Sequence, DOE/NE-0076, November 1986. The purpose of the test and the forty to fifty seconds for the diesels, the nine-hour delay, the 1,661 channels, the control rod appendix and Figure G-2, the “about 40 seconds” and the two explosions as reported to the team. osti.gov
• Valery Legasov, the five tapes recorded in 1986 to 1988, in the English translation by Yury Timofeyev, The Legasov Tapes, 2019 to 2020 (CC BY-NC-SA 4.0): tape 2 side B on the plan, its authorisation and the telephone call; tape 3 side B on the simulations not made; tape 4 side A on where the test should have been run, the diesels and the two explosions. legasovtapetranslation.blogspot.com, tape 3 side B, tape 4 side A
• Grigori Medvedev, “Chernobyl Notebook”, Novy Mir, June 1989, in the translation by the US Joint Publications Research Service, JPRS-UEA-89-034, 23 October 1989 (published in English as The Truth About Chernobyl, 1991). Who was in the room, Dyatlov’s background, the dispatcher, the argument at 0:28, the eighteen rods, the last minutes, and the deaths of Akimov and Toptunov. archive.org
• Anatoly Dyatlov, “How it was: an operator’s perspective”, Nuclear Engineering International, November 1991, and “Why INSAG has still got it wrong”, Nuclear Engineering International, September 1995. His account of the programme, the margin, the night and the button, and the note on his imprisonment, his dose and his authorship of the programme. neimagazine.com, neimagazine.com
• United Press International, “Six officials of the Chernobyl nuclear power station went on trial”, 7 July 1987; “Western reporters barred from trial”, 8 July 1987; “Six officials from the Chernobyl nuclear power plant were sentenced”, 29 July 1987; “Six Chernobyl defendants sentenced to labor camp”, 30 July 1987; and “Chernobyl director and chief engineer fired”, 16 June 1986, with Pravda’s wording. The trial, the judge, the charge, the pleas, the sentences and Dyatlov’s words to the court. upi.com, upi.com, upi.com, upi.com, upi.com
• TASS, “‘Trial of those guilty’ at Chernobyl continues”, 15 July 1987, quoting Moskovskiye Novosti on the expert commission’s findings, in JPRS-UPA-87-031, Aftermath of Chernobyl Nuclear Power Plant Accident, Part 4, 23 September 1987. archive.org
• The Chernobyl Forum (IAEA, WHO, UNDP and others), Chernobyl’s Legacy: Health, Environmental and Socio-economic Impacts, IAEA, Vienna, 2006. The evacuation of Pripyat within forty hours, the 116,000 evacuated in 1986, the 134 cases of acute radiation syndrome and 28 deaths, the thyroid cancers and the shelter. iaea.org
• Gennady Gorelik, review of R. F. Mould, Chernobyl Record, Physics Today 54 (8), August 2001, for the Pravda publication of the “Legasov Testament” on 20 May 1988 a few weeks after his suicide, and the circulation of the full tapes in Russian. aip.brightspotcdn.com
• IAEA Imagebank, photographs 02790015, 02790024 and 02790061, on Flickr under CC BY-SA 2.0; the first two from the historical collection of the Ukrainian Society for Friendship and Cultural Relations with Foreign Countries, the third the IAEA’s own. flickr.com, flickr.com, flickr.com