Safety of Nuclear Power Reactors Nuclear Issues Briefing Paper 14
May 2006
* From the outset, there has been a strong awareness of the potential hazard of both nuclear criticality and release of radioactive materials. * There have been two major reactor accidents in the history of civil nuclear power - Three Mile Island and Chernobyl. One was contained without harm to anyone and the other involved an intense fire without provision for containment. * These are the only major accidents to have occurred in more than 12,000 cumulative reactor-years of commercial operation in 32 countries. * The risks from western nuclear power plants, in terms of the consequences of an accident or terrorist attack, are minimal compared with other commonly accepted risks. Nuclear power plants are very robust.
Since it arose out of the bombs that destroyed two cities, those responsible for nuclear power technology accepted from the start a commitment to devote extraordinary effort to assuring that a meltdown of the reactor would not take place. It had been assumed that a meltdown of the core would create a major public hazard, and if uncontained, a tragic accident with likely fatalities.
In avoiding such accidents the industry has been outstandingly successful. In 12,000 cumulative reactor-years of commercial operation in 32 countries, there have been only two major accidents to nuclear power plants - Three Mile Island and Chernobyl.
It was not until the late 1970s that detailed analyses and large-scale testing, followed by the 1979 meltdown of the Three Mile Island reactor, began to make clear that even the worst realistic casualty to a modern nuclear power plant or its fuel could not cause dramatic public harm. The industry still works hard to minimize the probability of a meltdown accident, but it no longer need fear a potential public health catastrophe.
The decades-long test and analysis program showed that less radioactivity escapes from molten fuel than initially assumed, and that this radioactive material quickly clumps, settles out, dissolves in water and steam, reacts chemically with other material, and plates out on cold structural material. Thus, even if the containment structure that surrounds all modern nuclear plants were ruptured, it would still be highly effective in preventing escape of radioactivity.
It is the laws of physics and the properties of materials that preclude disaster, not required actions by safety equipment or personnel. In fact, regulations now require that the effects of any core-melt accident must be confined to the plant itself, without the need to evacuate nearby residents.
The two significant accidents in the 50-year history of civil nuclear power generation are:
* Three Mile Island (USA 1979) where the reactor was severely damaged but radiation was contained and there were no adverse health or environmental consequences * Chernobyl (Ukraine 1986) where the destruction of the reactor by explosion and fire killed 31 people and had significant health and environmental consequences. The death toll has since increased to about 56.
A table showing all reactor accidents, and a table listing some energy-related accidents with multiple fatalities are appended.
These two significant accidents occurred during more than 12,000 reactor-years of civil operation. Of all the accidents and incidents, only the Chernobyl accident resulted in radiation doses to the public greater than those resulting from the exposure to natural sources. Other incidents (and one 'accident') have been completely confined to the plant.
Apart from Chernobyl, no nuclear workers or members of the public have ever died as a result of exposure to radiation due to a commercial nuclear reactor incident. Most of the serious radiological injuries and deaths that occur each year (2-4 deaths and many more exposures above regulatory limits) are the result of large uncontrolled radiation sources, such as abandoned medical or industrial equipment. (There have also been a number of accidents in experimental reactors and in one military plutonium-producing pile - at Windscale, UK, in 1957, but none of these resulted in loss of life outside the actual plant, or long-term environmental contamination.)
It should be emphasised that a commercial-type power reactor simply cannot under any circumstances explode like a nuclear bomb.
The International Atomic Energy Agency (IAEA) was set up by the United Nations in 1957. One of its functions was to act as an auditor of world nuclear safety. It prescribes safety procedures and the reporting of even minor incidents. Its role has been strengthened in the last decade. Every country which operates nuclear power plants has a nuclear safety inspectorate and all of these work closely with the IAEA.
While nuclear power plants are designed to be safe in their operation and safe in the event of any malfunction or accident, no industrial activity can be represented as entirely risk-free. However, a nuclear accident in a western-type reactor is now understood to have severe financial consequences for the owner but minimal off-site consequences.
Achieving safety: the record so far
Operational safety is a prime concern for those working in nuclear plants. Radiation doses are controlled by the use of remote handling equipment for many operations in the core of the reactor. Other controls include physical shielding and limiting the time workers spend in areas with significant radiation levels. These are supported by continuous monitoring of individual doses and of the work environment to ensure very low radiation exposure compared with other industries.
In the 1950s attention had turned from 1945's atomic bombs to harnessing the power of the atom in a controlled way, as demonstrated at Chicago in 1942 and subsequently for military research, and applying the steady heat yield to generate electricity. This naturally gave rise to concerns about accidents and their possible effects. In particular the scenario of loss of cooling which resulted in melting of the nuclear reactor core motivated studies on both the physical and chemical possibilities and the biological effects of any dispersed radioactivity.
At the outset, to the early 1970s, some extreme assumptions were made, giving rise to a genre of dramatic fiction (eg The China Syndrome) in the public domain and also some solid conservative engineering including containment structures (at least in Western reactor designs) in the industry itself. Licensing regulations were framed accordingly.
One mandated safety indicator is the calculated probable frequency of degraded core or core melt accidents. The US Nuclear Regulatory Commission (NRC) specifies that reactor designs must meet a 1 in 10,000 year core damage frequency, but modern designs exceed this. US utility requirements are 1 in 100,000 years, the best currently operating plants are about 1 in 1 million and those likely to be built in the next decade are almost 1 in 10 million.
Even months after the Three Mile Island accident in 1979 it was assumed that there had been no core melt because there were no indications of severe radioactive release even inside the containment. It turned out that in fact about half the core had melted. This remains the only core melt in a reactor conforming to NRC safety criteria, and the effects were contained as designed, without radiological harm to anyone.
However apart from this accident and the Chernobyl disaster there have been about ten core melt accidents - mostly in military or experimental reactors - Appendix 2 lists most of them. None resulted in any hazard outside the plant from the core melting, though in one case there was significant radiation release due to burning graphite.
Regulatory requirements today are that the effects of any core-melt accident must be confined to the plant itself, without the need to evacuate nearby residents.
The main safety concern has always been the possibility of an uncontrolled release of radioactive material, leading to contamination and consequent radiation exposure off-site. . Earlier assumptions were that this would be likely in the event of a major loss of cooling accident (LOCA) which resulted in a core melt. Experience has proved otherwise in any circumstances relevant to Western reactor designs. In the light of better understanding of the physics and chemistry of material in a reactor core under extreme conditions it became evident that even a severe core melt coupled with breach of containment could not in fact create a major radiological disaster from any Western reactor design. Studies of the post-accident situation at Three Mile Island (where there was no breach of containment) supported this.
It has long been asserted that nuclear reactor accidents are the epitome of low-probability but high-consequence risks. Understandably, with this in mind, some people were disinclined to accept the risk, however low the probability. The physics and chemistry of a reactor core, coupled with but not wholly depending on the engineering, mean that the consequences of an accident are likely in fact be much less severe than those from other industrial and energy sources. Experience bears this out.
At Chernobyl the kind of reactor and its burning graphite which dispersed radionuclides far and wide tragically meant that the results were severe. This once and for all vindicated the desirability of designing with inherent safety supplemented by robust secondary safety provisions and avoiding that kind of reactor design.
Mention should be made of the accident to the US Fermi-1 prototype fast breeder reactor near Detroit in 1966. Due to a blockage in coolant flow, some of the fuel melted. However no radiation was released offsite and no-one was injured. The reactor was repaired and restarted but closed down in 1972.
The use of nuclear energy for electricity generation can be considered extremely safe. Every year several thousand people die in coal mines to provide this widely used fuel for electricity. There are also significant health and environmental effects arising from fossil fuel use.
Achieving optimum nuclear safety: Western reactors (and more recent Russian ones)
To achieve optimum safety, nuclear plants in the western world operate using a 'defence-in-depth' approach, with multiple safety systems supplementing the natural features of the reactor core. Key aspects of the approach are:
* high-quality design & construction * equipment which prevents operational disturbances developing into problems * redundant and diverse systems to detect problems, control damage to the fuel and prevent significant radioactive releases * provision to confine the effects of severe fuel damage to the plant itself.
The safety provisions include a series of physical barriers between the radioactive reactor core and the environment, the provision of multiple safety systems, each with backup and designed to accommodate human error. Safety systems account for about one quarter of the capital cost of such reactors.
The barriers in a typical plant are: the fuel is in the form of solid ceramic (UO2) pellets, and radioactive fission products remain bound inside these pellets as the fuel is burned. The pellets are packed inside sealed zirconium alloy tubes to form fuel rods. These are confined inside a large steel pressure vessel with walls up to 30 cm thick - the associated primary water cooling pipework is also substantial. All this, in turn, is enclosed inside a robust reinforced concrete containment structure with walls at least one metre thick.
But the main safety features of most reactors are inherent - negative temperature coefficient and negative void coefficient. The first means that beyond an optimal level, as the temperature increases the efficiency of the reaction decreases (this in fact is used to control power levels in some new designs). The second means that if any steam has formed in the cooling water there is a decrease in moderating effect so that fewer neutrons are able to cause fission and the reaction slows down automatically.
Beyond the control rods which are inserted to absorb neutrons and regulate the fission process, the main engineered safety provisions are the back-up emergency core cooling system (ECCS) to remove excess heat (though it is more to prevent damage to the plant than for public safety) and the containment.
The basis of design assumes a threat where due to accident or malign intent (eg terrorism) there is core melting and a breach of containment. This double possibility has been well studied and provides the basis of exclusion zones and contingency plans. Apparently during the Cold War neither Russia nor the USA targeted the other's nuclear power plants because the likely damage would be modest.
Nuclear power plants are designed with sensors to shut them down automatically in an earthquake, and this is a vital consideration in many parts of the world. (see paper on Earthquakes)
The Three Mile Island accident in 1979 demonstrated the importance of such systems. Despite the fact that about half of the reactor core melted, radionuclides released from the melted fuel mostly plated out on the inside of the plant or dissolved in condensing steam. The containment building which housed the reactor further prevented any significant release of radioactivity. The accident was attributed to mechanical failure and operator confusion. The reactor's other protection systems also functioned as designed. The emergency core cooling system would have prevented any damage to the reactor but for the intervention of the operators.
Investigations following the accident led to a new focus on the human factors in nuclear safety. No major design changes were called for in western reactors, but controls and instrumentation were improved and operator training was overhauled.
By way of contrast, the Chernobyl reactor did not have a containment structure like those used in the West or in post-1980 Soviet designs.
A different safety philosophy: Early Soviet-designed reactors
The April 1986 disaster at the Chernobyl nuclear power plant in the Ukraine was the result of major design deficiencies in the RBMK type of reactor, the violation of operating procedures and the absence of a safety culture. One peculiar feature of the RBMK design was that coolant failure could lead to a strong increase in power output from the fission process ( positive void coefficient). However, this was not the prime cause of the Chernobyl accident.
The accident destroyed the reactor and killed 56 people, 28 of whom died within weeks from radiation exposure. It also caused radiation sickness in a further 200-300 staff and firefighters, and contaminated large areas of Belarus, Ukraine, Russia and beyond. It is estimated that at least 5% of the total radioactive material in the Chernobyl-4 reactor core was released from the plant, due to the lack of any containment structure. Most of this was deposited as dust close by. Some was carried by wind over a wide area.
About 130,000 people received significant radiation doses (i.e. above internationally accepted ICRP limits) and are being closely monitored. About 4000 cases of thyroid cancer in children have been linked to the accident. Most of these were curable, though about nine have been fatal. No increase in leukaemia or other cancers have yet shown up, but some is expected. The World Health Organisation is closely monitoring most of those affected.
The Chernobyl accident was a unique event and the only time in the history of commercial nuclear power that radiation-related fatalities occurred.
The destroyed unit 4 was enclosed in a concrete shelter ("sarcophagus"), which now requires remedial work.
An OECD expert report on it concluded that "the Chernobyl accident has not brought to light any new, previously unknown phenomena or safety issues that are not resolved or otherwise covered by current reactor safety programs for commercial power reactors in OECD Member countries."
International efforts to improve safety
The IAEA has given a high priority to addressing the safety of nuclear power plants in eastern Europe, where deficiencies remain. The European Union is bringing pressure to bear, particularly in countries which aspire to EU membership.
A major international program of assistance has been carried out by the OECD, IAEA and Commission of the European Communities to bring early Soviet-designed reactors up to near western safety standards, or at least to effect significant improvements to the plants and their operation.
Modifications have been made to overcome deficiencies in the 12 RBMK reactors still operating in Russia and Lithuania. Among other things, these have removed the danger of a positive void coefficient response. Automated inspection equipment has also been installed in these reactors. cf briefing paper # 56 supplement.
The other class of reactors which has been the focus of international attention for safety upgrades is the first-generation of pressurised water VVER-440/230 reactors. These were designed before formal safety standards were issued in the Soviet Union and they lack many basic safety features. Eleven are operating in Bulgaria, Russia, Slovakia and Armenia, under close inspection.
Later Soviet-designed reactors are very much safer and the most recent ones have Western control systems or the equivalent, along with containment structures.
There is a great deal of international cooperation on nuclear safety issues, in particular the exchange of operating experience under the auspices of the World Association of Nuclear Operators (WANO). See also paper on Cooperation in Nuclear Power Industry.
In 1996 the Nuclear Safety Convention came into force. It is the first international legal instrument on the safety of nuclear power plants worldwide. It commits participating countries to maintain a high level of safety by setting international benchmarks to which they subscribe and against which they report. It has 65 signatories and has been ratified by 41 states.
Reporting nuclear incidents
The International Nuclear Event Scale (INES) was developed by the IAEA and OECD in 1990 to communicate and standardise the reporting of nuclear incidents or accidents to the public. The scale runs from a zero event with no safety significance to 7 for a "major accident" such as Chernobyl. Three Mile Island rated 5, as an "accident with off-site risks" though no harm to anyone, and a level 4 "accident mainly in installation" occurred in France in 1980, with little drama. Another accident rated at level 4 occurred in a fuel processing plant in Japan in September 1999. See INES table. Other accidents have been in military plants.
Terrorism
Since the World Trade Centre attacks in New York in 2001 there has been concern about the consequences of a large aircraft being used to attack a nuclear facility with the purpose of releasing radioactive materials. Various studies have looked at similar attacks on nuclear power plants. They show that nuclear reactors would be more resistant to such attacks than virtually any other civil installations - see Appendix 3.. A thorough study was undertaken by the US Electric Power Research Institute using specialist consultants and paid for by the US Dept. of Energy. It concludes that US reactor structures "are robust and (would) protect the fuel from impacts of large commercial aircraft".
The analyses used a fully-fuelled Boeing 767-400 of over 200 tonnes as the basis, at 560 km/h - the maximum speed for precision flying near the ground. The wingspan is greater than the diameter of reactor containment buildings and the 4.3 tonne engines are 15 metres apart. Hence analyses focused on single engine direct impact on the centreline - since this would be the most penetrating missile - and on the impact of the entire aircraft if the fuselage hit the centreline (in which case the engines would ricochet off the sides). In each case no part of the aircraft or its fuel would penetrate the containment. Other studies have confirmed these findings.
In 1988 Sandia National Laboratories in USA demonstrated the unequal distribution of energy absorption that occurs when an aircraft impacts a massive, hardened target. The test involved a rocket-propelled F4 Phantom jet (about 27 tonnes, with both engines close together in the fuselage) hitting a 3.7m thick slab of concrete at 765 km/h. This was to see whether a proposed Japanese nuclear power plant could withstand the impact of a heavy aircraft. It showed how most of the collision energy goes into the destruction of the aircraft itself - about 96% of the aircraft's kinetic energy went into the its destruction and some penetration of the concrete, while the remaining 4% was dissipated in accelerating the 700-tonne slab. The maximum penetration of the concrete in this experiment was 60 mm, but comparison with fixed reactor containment needs to take account of the 4% of energy transmitted to the slab. See also video clip.
Looking at spent fuel storage pools, similar analyses showed no breach. Dry storage and transport casks retained their integrity. "There would be no release of radionuclides to the environment".
Similarly, the massive structures mean that any terrorist attack even inside a plant (which are well defended) and causing loss of cooling, core melting and breach of containment would not result in any significant radioactive releases.
See also Science magazine article 2002.
Switzerland's Nuclear Safety Inspectorate studied a similar scenario and reported in 2003 that the danger of any radiation release from such a crash would be low for the older plants and extremely low for the newer ones.
The conservative design criteria which caused most power reactors to be shrouded by massive containment structures with biological shield has provided peace of mind in a suicide terrorist context. Ironically and as noted earlier, with better understanding of what happens in a core melt accident inside, they are now seen to be not nearly as necessary in that accident mitigation role as was originally assumed.
Advanced reactor designs
The designs for nuclear plants being developed for implementation in coming decades contain numerous safety improvements based on operational experience. The first two of these advanced reactors began operating in Japan in 1996.
The main feature they have in common (beyond safety engineering already standard in Western reactors) is passive safety systems, requiring no operator intervention in the event of a major malfunction.
These designs are one or two orders of magnitude safer than older ones in respect to the likelihood of core melt accidents, but the significance of that is more for the owner than the neighbours, who - as Three Mile Island showed - are safe also with older types.
Safety relative to other energy sources
Many occupational accident statistics have been generated over the last 40 years of nuclear reactor operations in the US and UK. These can be compared with those from coal-fired power generation. All show that nuclear is a distinctly safer way to produce electricity. Two simple sets of figures are quoted in the Table below and that in the appendix. A major reason for coal's unfavourable showing is the huge amount which must be mined and transported to supply even a single large power station. Mining and multiple handling of so much material of any kind involves hazards, and these are reflected in the statistics.
Comparison of accident statistics in primary energy production. (Electricity generation accounts for about 40% of total primary energy).
Fuel Immediate fatalities 1970-92 Who? Normalised to deaths per TWy* electricity Coal 6400 workers 342 Natural gas 1200 workers & public 85 Hydro 4000 public 883 Nuclear 31 workers 8 *Basis: per million MWe operating for one year, not including plant construction, based on historic data which is unlikely to represent current safety levels in any of the industries concerned. Source: Ball, Roberts & Simpson, Research Report #20, Centre for Environmental & Risk Management, University of East Anglia, 1994; Hirschberg et al, Paul Scherrer Institut, 1996; in: IAEA, Sustainable Development and Nuclear Power, 1997; Severe Accidents in the Energy Sector, Paul Scherrer Institut, 2001).
SOURCES
IAEA, 1993, IAEA Yearbook 1993 ANSTO, 1994, The Safety of Nuclear Power Reactors, Nuclear Services Section Background Paper Nuclear Energy Institute, Source Book, 1995 OECD NEA, 1995, Chernobyl Ten Years On. Nuclear Engineering International, August 1999 Twilley R C 2002, Framatome ANP's SWR1000 reactor design, Nuclear News, Sept. EPRI Dec 2002 report Deterring Terrorism: Aircraft Crash Impact Analyses Demonstrate Nuclear Power Plant's Structural Strength on NEI web site Chapin D.M., Levenson M., Pate Z.P., Rockwell T. et al 2002, Nuclear Power Plants and their Fuel as terrorist Targets, Science, Sept 2002. http://www.uic.com.au/nip14.htm
News 
Market Data 
Discover 
