On 26 April 1986, reactor 4 of the Chernobyl Nuclear Power Plant, located near Pripyat in the Ukrainian SSR of the Soviet Union, exploded. The accident resulted in dozens of direct deaths and a major release of radioactive material into the environment, causing widespread health effects and requiring the establishment of the Chernobyl exclusion zone. The response involved more than 500,000 personnel and cost an estimated 18 billion rubles (about $85 billion in 2026). It remains the most destructive nuclear disaster and the most expensive disaster in history, with an estimated cost of US$700 billion. It is one of only two nuclear accidents rated at the maximum severity on the International Nuclear Event Scale, the other being the 2011 Fukushima nuclear accident in Japan.
The disaster occurred whilst the operating staff conducted a test to prove the cooling capability of the reactor during a complete electrical power failure. The operators continued with the test despite an accidental drop in reactor power and took the reactor into an unstable state. When they shut down the reactor in this condition, underlying design flaws led to a huge uncontrollable power surge. The reactor components ruptured and lost coolant, and the resulting steam explosions and meltdown destroyed the reactor building. That was followed by a core fire that dispersed radioactive contaminants across the Soviet Union and Europe. The Soviet government established an exclusion zone with a 10-kilometre (6.2 mi) radius 36 hours after the accident, initially evacuating around 49,000 people. That was later expanded to 30 kilometres (19 mi), resulting in the evacuation of approximately 68,000 more people. The government did not publicly acknowledge the disaster until two days after the explosion, when elevated radiation levels were detected in Sweden.
Following the explosion, which killed two engineers and severely burned two others, an emergency operation began to put out the fires and stabilize the reactor. Of the 237 workers hospitalized, 134 showed symptoms of acute radiation syndrome (ARS); 28 of them died within three months. Over the next decade, 14 more workers (nine of whom had ARS) died of various causes mostly unrelated to radiation exposure. This is the only instance in commercial nuclear power history where radiation-related fatalities occurred. As of 2005, 6,000 cases of childhood thyroid cancer occurred within the affected populations (15 of them fatal), "a large fraction" being attributed to the accident. Long-term death estimates range from up to 4,000 in Ukraine, Belarus, and Russia (per the United Nations) to 16,000 in total across Europe.
Pripyat was abandoned and replaced by the purpose-built city of Slavutych. The Chernobyl Nuclear Power Plant sarcophagus, completed in December 1986, reduced the spread of radioactive contamination and provided radiological protection for the crews of the undamaged reactors. In 2016–2018, the Chernobyl New Safe Confinement was constructed around the old sarcophagus to enable the removal of the reactor debris, and clean-up is scheduled for completion by 2065.
Accident sequence
Background
Reactor cooling after shutdown
In normal power-producing operation, RBMK reactors as at Chernobyl, use water as a coolant, circulated by electrically-driven main pumps. Reactor no. 4 had 1,661 individual fuel channels, requiring approximately 42 million litres of coolant per hour for the entire reactor. In normal reactor operation, most heat is generated by nuclear fission, but over 6% comes from radioactive decay, which continues after fission ceases. Continued coolant circulation is therefore essential to prevent core overheating or core meltdown.
To allow this continued cooling in the case of a total electrical power loss, each of Chernobyl's reactors had three backup diesel generators to power the main pumps, but they took 60–75 seconds to reach full load capability. Flywheels on each pump allowed continued coolant flow using their rotational momentum to bridge the gap until generator availability. However, a potential safety risk existed if a station electrical blackout occurred simultaneously with the rupture of a coolant pipe. In this scenario the emergency core cooling system (ECCS) must pump additional water into the core. This required electrical power, which would be absent. To cover this it had been theorized that the rotational momentum of the reactor's steam turbine could be used to generate the required electrical power for the feedwater pumps under the control of the ECCS. The turbine's speed would run down as energy was taken from it, but there might be sufficient energy to provide electrical power to run these pumps for 45 seconds. This may not bridge the gap between an external power failure and the full availability of the emergency generators, but would alleviate the situation.
Safety test
The turbine run-down energy capability still needed to be confirmed experimentally, and previous tests had ended unsuccessfully. An initial test carried out in 1982 indicated that the excitation voltage of the turbine-generator was insufficient. The electrical system was modified and the test was repeated in 1984, but again proved unsuccessful. In 1985, the test was conducted a third time, but also yielded no results due to a problem with the recording equipment. The test procedure was to be run again in 1986 and was scheduled to take place during a controlled power-down of reactor no. 4, which was preparatory to a planned maintenance outage.
A test procedure had been written, but the authors were not aware of the unusual RBMK-1000 reactor behaviour under the planned operating conditions. It was regarded as purely an electrical test of the generator, even though it involved critical unit systems. According to the existing regulations, such a test did not require approval by either the chief design authority for the reactor (NIKIET) or the nuclear safety regulator. The test program called for disabling the emergency core cooling system, a passive/active system of core cooling intended to provide water to the core in a loss-of-coolant accident. Approval from the site chief engineer had been obtained according to regulations.
The test procedure was intended to run as follows:
- The reactor thermal power was to be reduced to between 700 MW and 1,000 MW (to allow for adequate cooling, as the turbine would be spun at operating speed while disconnected from the power grid).
- The steam-turbine generator was to be run at normal operating speed.
- Four out of eight main circulating pumps were to be supplied with off-site power, while the other four would be powered by the turbine.
- When the correct conditions were achieved, the steam supply to the turbine generator would be closed, which would trigger an automatic reactor shutdown in ordinary conditions.
- The voltage provided by the coasting turbine would be measured, along with the voltage and revolutions per minute (RPMs) of the four main circulating pumps being powered by the turbine.
- When the emergency generators supplied full electrical power, the turbine generator would be allowed to continue free-wheeling down.
Test delay and shift change
The test was to be conducted during the day-shift of 25 April 1986 as part of a scheduled reactor shutdown. The day shift had been instructed in advance on the reactor operating conditions to run the test, and a special team of electrical engineers was present to conduct the electrical test once the correct conditions were reached. As planned, a gradual reduction in the output of the power unit began at 01:06 on 25 April, and the power level had reached 1600 MW of its nominal 3,200 MW thermal level by the beginning of the day shift.
The day shift was scheduled to perform the test at 14:15. Preparations for the test were carried out, including the disabling of the emergency core cooling system. Meanwhile, another regional power station unexpectedly went offline. At 14:00, the Kiev electrical grid controller requested that the further reduction of Chernobyl's output be postponed, as power was needed to satisfy peak evening demand.
Soon, the day shift was replaced by the evening shift. Despite the delay, the emergency core cooling system was left disabled. This system had to be disconnected via a manual isolating slide valve, which in practice meant that two or three people spent the whole shift manually turning sailboat-helm–sized valve wheels. The system had no influence on the disaster, but allowing the reactor to run for 11 hours outside of the test without emergency protection was indicative of a general lack of safety culture.
At 23:04, the Kiev grid controller allowed the reactor shutdown to resume. The day shift had long since departed, the evening shift was also preparing to leave, and the night shift would not take over until midnight, well into the job. According to plan, the test should have been finished during the day shift, and the night shift would only have had to maintain decay heat cooling systems in an otherwise shut-down plant.
The night shift had very limited time to prepare for and carry out the experiment. Anatoly Dyatlov, deputy chief-engineer of the Chernobyl Nuclear Power Plant (ChNPP), was present to direct the test. He was one of the test's chief authors and he was the highest-ranking individual present. Unit shift supervisor Aleksandr Akimov was in charge of the Unit 4 night shift, and Leonid Toptunov was the senior reactor control engineer responsible for the reactor's operational regimen, including the movement of the control rods. 25-year-old Toptunov had worked independently as a senior engineer for approximately three months.
Unexpected drop of the reactor power
The test plan called for a gradual decrease in reactor power to a thermal level of 700–1000 MW, and an output of 720 MW was reached at 00:05 on 26 April. However, due to the reactor's production of a fission byproduct, xenon-135, which is a reaction-inhibiting neutron absorber, power continued to decrease in the absence of further operator action, a process known as reactor poisoning. In steady-state operation, this is avoided because xenon-135 is "burned off" as quickly as it is created, becoming the highly stable xenon-136. However, with reactor power reduced, large quantities of previously produced iodine-135 decayed into the neutron-absorbing xenon-135 faster than the reduced neutron flux could "burn it off". Xenon poisoning in this context made reactor control more difficult but was a predictable phenomenon during such a power reduction.
When the reactor power had decreased to approximately 500 MW, the reactor power control was switched from local automatic regulator to the automatic regulators, to manually maintain the required power level. AR-1 then activated, removing all four of AR-1's control rods automatically, but AR-2 failed to activate due to an imbalance in its ionization chambers. In response, Toptunov reduced power to stabilize the automatic regulators' ionization sensors. The result was a sudden power drop to an unintended near-shutdown state, with a power output of 30 MW thermal or less. The exact circumstances that caused the power drop are unknown. Most reports attribute the power drop to Toptunov's error, but Dyatlov reported that it was due to a fault in the AR-2 system.
The reactor was now producing only 5% of the minimum initial power level prescribed for the test. This low reactivity inhibited the burn-off of xenon-135 within the reactor core and hindered the rise of reactor power. To increase power, control-room personnel removed numerous control rods from the reactor. Several minutes elapsed before the reactor was restored to 160 MW at 00:39, at which point most control rods were at their upper limits, but the rod configuration was still within its normal limit, calculated as equivalent to having more than 15 rods inserted. Over the next twenty minutes, reactor power would be increased further to 200 MW.
Reactor conditions priming the accident
When an output of 200 MW was reached, preparation for the experiment continued, although power was still much lower than the prescribed 700 MW. As part of the test, two additional main circulating pumps were activated at 01:05. The increased coolant flow lowered the overall core temperature and reduced bubbles (voids) from boiling coolant. Because water absorbs neutrons better than steam, neutron flux and power accordingly decreased. The operators responded by removing more manual control rods to maintain power, resulting in the inserted control rod equivalent value falling below its required level of 15. This was not apparent to the operators, because there were no instruments capable of calculating this value in real time.
These actions left the reactor in an extremely unstable state. Nearly all of the 211 control rods had been withdrawn, and excessive coolant flow prevented the water from adequately cooling between cycles, causing it to re-enter the core at close to boiling point. Unlike other light-water reactor designs, the RBMK design had a positive void coefficient, meaning that voids formed during boiling had the effect of increasing rather than decreasing core reactivity. More boiling and hence more voids tended to intensify the nuclear chain reaction, which caused yet more boiling. Unknown to the operators, this positive feedback loop had little to restrain it, and the reactor became highly sensitive to void formation, and at risk of an uncontrolled power surge.
Accident
Test execution
At 01:23:04, the test began. Four of the eight main circulating pumps (MCP) were to be powered by voltage from the coasting turbine, while the remaining four pumps received electrical power from the grid as usual. The steam to the turbines was shut off, beginning a run-down of the turbine generator. The diesel generators started and sequentially picked up loads; the generators were to have completely picked up the MCPs' power needs by 01:23:43. As the momentum of the turbine generator decreased, so did the power it produced for the pumps. The water flow rate decreased, leading to increased formation of steam voids in the coolant flowing through the fuel pressure tubes.
Reactor shutdown and power excursion
At 01:23:40, as the experiment was wrapping up, an operator pressed the emergency AZ-5 button to initiate a scram (emergency shutdown) of the reactor, perhaps in preparation for scheduled maintenance. The reason for the timing is uncertain, as both Akimov and Toptunov would die shortly after the alarm. The atmosphere in the control room at that point was calm, according to eyewitnesses, and there were no active emergency signals at that time. Representatives of the reactor's design team would later argue that the button must have been pressed only after the reactor had begun to self-destruct.