| ||||
Before starting the work related to shutdown of the 4th power unit of the ChNPP for scheduled maintenance, the reactor was working on stationary power level of 3,100 MW, and its operating reactivity margin at that time was 30.1 control rods. There were practically no additional absorbers (only one DP) in the reactor core, and most of the core (75%) consisted of fuel assemblies (FA) of initial loading, with burnout fraction (power generation) of about 1,400 MW/day. Power decrease of the unit was started at 01:06 a.m. on April 25’86. Within 3 hours, power level dropped to 1,600 MW (50%), and then replacement of gas medium (helium to nitrogen) in the reactor space started. By 7:10 a.m., power dropped to 1,500 MW, whereupon the external power distribution system prohibited any further decreasing – at first until 2:00 p.m., and then until further notice; also, the instruction was issued to raise power capacity up to 50%. That was done at 4:50 p.m. Fig. 1. Reactor power capacity changes within 24 hours on April 25, and on April 26 – until destruction of the reactor. It was only by 11:00 p.m. that clearance for load relief of the reactor was obtained, and power decrease (from 50%) started at 11:10 on April 25’86. According to the log book data at the time of shift turnover, the current reactor parameters were as follows: Reactor heating capacity ………………... 1,600 MW; Electrical power ….………………….. 470 MW; Maximum fuel channel capacity …………….……. 1.35 MW; Height irregularity ratio …...1.17; Radius irregularity ratio ..…1.47; Minimum safety margin before crisis 1.33; Maximum temperature of the graphite ………..… 525 Ń; Helium content in gas mix in the reactor space (RS) …….…. 35% by weight; Radiation release through ventilation duct ………………………….. 411 Curie per 24 hours. According to the printout from the PRISMA software, operative reactivity margin (ORM) was at that time equal to 26 control rods. The power capacity stipulated by the test program (700 MW) was obtained by 00:05 a.m. on April 26’86. By that time, all the preparatory operations of the program had been completed, except activation of two additional MCP’s (with fixed buses) with the power capacity of 50%. Manual gate valves of the emergency core cooling system (ECCS) line had been closed at 02:00 p.m. After that, according to the test program, it was necessary to activate the two remaining MCP’s, and to start carrying out the main portion of the program. That, however, did not happen, and all the subsequent actions taken by the operating staff of the power plant were just an impromptu balancing between the program and the real situation at the power generation unit. And the real situation was as follows: apart from the turbine generator test program, there was another job to be done – namely, measurement of the turbine vibrations during the generator idle run. As a matter of fact, these two jobs run contrary to each other. They both require to relieve the turbine generator’s load, i.e., to cut it off from the external circuit; however, in the first case, load relief is complete – until idle running is started (i.e., without any power generation), while in the second case, after load relief auxiliary power is still maintained. In the first case, idle run revolutions are obtained by supplying (a little) steam to the turbine, and the reactor is needed for that, and in the second case no steam is supplied, and the reactor is not needed, while number of revolutions decreases relatively fast as auxiliary power is generated. The test program had no provision for such collision. Nevertheless, according to memories of A.S.Dyatlov, supervisor of the tests (and the author of the program) [D23], everything "was clear to him regarding this issue. Besides, A.Akimov had no questions regarding preparation for the last experiment; he checked it on April 25". After that, at 00:05 a.m., A.S.Dyatlov left the unit control room (CRU) temporarily so that Ŕ.Akimov, the unit shift supervisor (SSU), had to sort out himself the situation which looked so clear to both of them. And here’s what happened afterwards. Fig. 2. Reactor capacity changes, safety alarms and actions taken by the operator. The power of 720 MW obtained by 00:05 a.m. was certainly too high to maintain idle running of the turbine generator and to measure the turbine vibrations, so it was further reduced. Meantime, A.S.Dyatlov (who was away at that time) does not know why it was reduced; he only assumes [D24], it has happened "probably due to some misunderstanding between B.Rogozhkin, plant shift supervisor of the ChNPP, and Ŕ.Akimov". During that power reduction, while switching from one automatic control system (LAR) to the other (AR), the operator allowed the reactor power to drop almost down to zero. After recovering from this drop, actions were taken (at 00:41 a.m.) to measure vibrations of the turbine. By that time, A.S.Dyatlov returned to the CRU, just in time to allow [D23] "raising the power level to 200 MW only, instead of 700 MW, as stipulated by the TG Rundown Program." In view such an attitude to the "operating programs" and the "job descriptions" In view such an attitude to the ‘operating programs’ and the ‘job descriptions’ all further mortal sins that the staff have been blamed of are nothing but child tricks; they are hardly worth taking any note of, and, in any case, it was not those tricks that caused explosion of the reactor. Fig. 3. Feed water flow rate and pressure in separator drums. While the reactor was running on low power level and with low reactivity margin, its thermohydraulic parameters and, possibly, neutron field were unstable. This is evidenced by multiple alarms on level in the separator drum (SD), activation of BRU-K, considerable readjustment of feed water flow rate and failures of the neutron power controllers AR1 and AR2. That’s why during the period from 00:35 a.m. till 00:45 a.m., obviously, in order to maintain the reactor on power level, the staff suppressed alarms related to thermohydraulic parameters of the outer reactor cooling loop (MFCC) (and also the signal from the EPS-5 button on turn off the both TG’s). It is up to A.S.Dyatlov to judge whether such actions comply with the operating regulations, and I believe he may be trusted in this respect. Đčń Fig. 4. Heat carrier flow rate and feed water temperature. At 01:00 a.m., in accordance with the test program, the DREG system was set up to record the basic and most important parameters (feed water flow rates, levels and pressure in the SD, flow rates after each MCP, etc.) every 2 seconds, and two more additional MCP’s were activated (at 01:02 a.m. and at 01:06 a.m., respectively). At the same time, aggregate flow rate trough the core rose from 45,390 m/hr to 54590 m³/hr, which was more than 20% higher than the value set forth by the regulations. At 01:16 a.m. vibration measurements were over, and the turbine generator was re-connected to the outer power distribution system (in order to proceed with the rundown program). In accordance with the program, at the beginning of the experiment (test), the following three operations are to be performed simultaneously, at the test supervisor’s command: 1) steam supply to the turbine is stopped (by means of the key at the turbine control panel); 2) the rundown unit is turned on, and the MDA signal is issued (by means of the MDA button on the safety panel); 3) the light-beam oscilloscopes (installed at two different positions) are turned on in order to register rundown parameters. At the same time, the reactor is to be damped automatically by the emergency system EPS-5, upon receipt of the alarm "deactivation of 2 TG’s’quot;. However, in fact, that signal was suppressed. Here is the description of the last stage of the test preparations as described by A.S.Dyatlov [D23]: "Ŕ.Akimov reported readiness to carry out the last experiment." "I called the staff involved in order to brief them on their respective responsibilities and on actions to be taken in case of any problems….." During this briefing, it was allegedly decided that the oscilloscope were to be turned on "at the command–«Oscilloscope – start» issued by telephone", and that all the other synchronous operations were to be performed pursuant to the same command. And since automatic activation of the EPS-5 had been suppressed, therefore, at the same time, "the AZ-5 button was to be pushed in order to damp the reactor. The command for Mr.Toptunov is to be issued by Mr.Akimov.". In fact, however, (as we can see on the oscillogram, Fig.15) the Isolating & Control Valves (ICV) of the turbines were closed 1.3 second later after turning on the oscilloscope, the MDA button was pushed after another 6.6 seconds, while the EPS-5 was never pushed at all. (It was pushed 36 seconds later only, at the end of the test already). They must have decided to start the test at 01:23:00 a.m. By that time, feed water flow rate had been decreasing rapidly after another readjustment, and was close to the original value (as at 01:00 a.m.). The SD pressure was also dropping. At that time, the power generation unit (according to the DREG data and to the instrument records at the CRU) was in the following condition: Reactor heating capacity 200 MW; Electrical power 40 MW; Aggregate flow rate through the core 57,120 MT/hr; Feed water flow rate 164/72 MT/hr Pressure in the MFCC (SD) 63/64 kg/cm²; Levels in the separator drums -50/-500 mm; Water temperature at the inlet of the MCP 280.8/283.2 °Ń. Such a condition was dangerous since cavitation of the RCP and boiling-up of the heat carrier at the core inlet were possible. Fig. 5. Thermohydraulic parameters during the last 5 minutes (left side). Fig. 6. Thermohydraulic parameters during the last 5 minutes (right side). At 01:22:30 a.m., a request was issued to the SCM SKALA to make a printout in order to check the condition of the reactor core; however, the printout was only available after the accident (based on the tape record). Fig. 7. Heat carrier flow rate distribution by the core channels Fig. 8.Neutron flux distribution along the core radius Fig. 9. Neutron flux distribution along the core height. Fig. 10. Neutron flux distribution along the core height. The same printouts (and only they) specify the operative reactivity margin (ORM), because of which the operating staff have been repeatedly blamed of all mortal sins. Such printouts (although they look less beautiful, content is the same) are made from time to time. During April 25, there were four requests for them, and two more came – within one hour of April 26, at 00:39 a.m. and at 01:22:30 a.m. The reactor load relief down to capacity of 200 MW (shown in Fig. 1 and 2) as well as subsequent operation with the same capacity were strongly influencing the ORM, and by 01:22:30 a.m. it had dropped down to 7 control rods – of which no one was aware. Fig. 11. Position of CPS control rods. If you compare positions of the control rods at these two moments, you will see without any calculations that the reactivity margin has decreased dramatically within that period of time. Of course, operators at the control panel are not in a position to carry out such a comparison; however, they can see perfectly current positions of all the rods (selsyn readings) on the display, and they feel well the reactor’s condition. And now, let us ask ourselves the most inappropriate (from the standpoint of an operator, or a shift supervisor) question: what is so terrible about such a low reactivity margin? Why is it prohibited by the regulations, and what will happen if the ORM drops down to zero? Until the reactor explosion at the ChNPP, the answer was obvious: it would be impossible to control such a reactor. If only the least negative reactivity is there, it will cause dropping of power capacity, but there is no way of compensating such negative reactivity and maintaining the reactor power: all the rods are up already, and there is nothing else to take up. Just a minute! Since we are going to stop it, anyway, as soon as the experiment starts, what’s the problem? The regulations only suggested one solution – act of the emergency protection, and that’s what they finally did. And so, the test began. At 01:23:04 a.m. the isolating valves of TG-8 were closed, and rundown was started for the turbine generator TG-8 and the MCP’s Nr.Nr.13,14,23,24.*) By 01:23:43 a.m., activation of the diesel generator and stepped load increase had been completed, and during that period, the said MCP’s had been powered by means of the turbine generator rundown. -------------------------------------------------- *) The moment of closing the valves is registered by three independent data sources: the teletype at the CRU, the DREG records, and the oscillogram of the turbine generator rundown; it is used in order to carry out time correlation of the data provided by these sources. Fig. 12. Level and pressure in the separator drum (during rundown) Fig. 13. Heat carrier flow rate through the continuously powered RCP’s. Fig. 14. Heat carrier flow rate through the RCP’s powered by the turbine generator rundown. Generally, parameters of the power generation unit during the rundown (except the last few seconds of the accident) do not differ from the previous situation, and even look more stable on the outside. Pressure is increasing in the separator drums, flow rate via the core is dropping, and feed water flow rate is maintained within ±50 MT/hr. Calculations, made afterwards in the WNIIAES show that underheating is growing at the inlet of the MCP and in fuel channels. The minimum underheating was registered 2 minutes prior to that. At 01:23:40 a.m., owing to an unknown cause, there was a signal from the EPS-5 button to put in action the emergency protection. What do you mean by ‘an unknown cause’, gentlemen? You said yourselves that the reactivity margin was unacceptably low, didn’t you? L.Toptunov and Ŕ.Akimov must have felt it, so whenever there was a chance, as soon as the diesel generator had been started, i.e., everything was clear about the test, they have taken advantage of emergency protection – absolutely in compliance with the regulations. Some additional data regarding this point may be obtained from Đčń 20 , which shows an aggregate graph of thermohydraulic parameters of the whole reactor as they were changing during the last 2 minutes. The figure also contains data (taken from the Soviet experts’ report for the IAEA in August 1986) regarding travels of the automatic control rods AR1, AR2 and ARÇ during that period of time. After that, the accident process started in the reactor unit, and it developed so fast that time resolution provided by the DREG turned out to be insufficient for comprehensive recording of the process not to mention the instruments in the CRU, where tape handling setting was 60 mm/hr.After that, the accident process started in the reactor unit, and it developed so fast that time resolution provided by the DREG turned out to be insufficient for comprehensive recording of the process – let alone the instruments in the CRU, where tape handling setting was 60 mm/hr. It was the rundown oscillogram that appeared to be the only documentary source with sufficient resolution in order to accurately correlate the principal events during the accident. Fig.15. Rundown oscillogram. Below is the list of the principal events recorded by the DREG over that period (see also Fig. 12 – 14). …01:23:40 a.m. – signal from the EPS-5 button; - level and pressure in the SD as well as feed water flow rate are stable (i.e., without any significant changes); …01:23:41 a.m. – normal level in the SD; …01:23:43 a.m. – reactor power is growing rapidly – following alarms received: - power growth rate, - excessive power level (540 MW), and - individual alarms from each of the [UZM] amplifiers (in fact, data recorders are drawing a vertical curve of capacity growth); - normal flow rates through each of the MCP’s; …01:23:45 a.m. – normal feed water flow rate, pressure and level in the SD, normal flow rates through each of the MCP’s; …01:23:47 a.m. – pressure increasing up to 80 kg/cm² in the SD at the right side of the reactor, - flow rate reduction through the MCP: down to zero – in the running-down MCP’s, and a 30%-40% reduction in the others, - stable feed water flow rate. …01:23:48 a.m. – all the reactor capacity alarms keep coming, - pressure in the right SD grows up to 88.2 kg/cm², - pressure in the left SD grows up to 75.2 kg/cm², - the water level in SD grows by 50-60 mm, - flow rates through the MCP are back to normal values. …01:23:49 a.m. – the water level in SD increases further by 50-100 mm, - the pressure in RS grows up to 1,200 mm of water column; There are no further records since power supply of all the instruments and systems was cut off completely. According to the rundown oscillogram, complete power outage occurred at some point between 01:23:51 a.m. and 01:23:52 a.m. The latest record available (at 01:24:15 a.m.) was made in the operation log, "Heavy blows. The CPS rods did not reach bottom end switches and stopped. Coupling power supply key deactivated." In other words, when the operator saw that the rods had stopped, he turned off power supply of couplings and servo drives to make the rods fall into the core under the action of their own weight. According to the DREG records, it happened at 01:23:49 a.m.; besides, judging by the position in which the rods stopped (3.5 ě) and by their penetration speed (40 cm/sec), it is also possible to presume that the CPS rods stopped at 01:23:49 a.m. to sitemap |
