Reactor accidents and what they taught the industry

Every reactor engineer carries a short list of accidents in their head. Windscale, SL-1, Three Mile Island, Chernobyl and Fukushima Daiichi each changed how reactors are designed, operated and regulated, and each one is still taught because its lessons remain current. Read together, they show a pattern: serious accidents grow from a chain of ordinary weaknesses in design, information, procedure and organisation, lined up by circumstance.

Windscale, United Kingdom, 1957

The Windscale piles were air-cooled, graphite-moderated reactors built to produce plutonium for the British weapons programme. Graphite exposed to neutrons at low temperature stores energy in displaced atoms of its crystal lattice, known as Wigner energy, and operators periodically heated the core to release it in a controlled way. In October 1957 one such anneal in Pile No. 1 overheated fuel cartridges, which ignited. The fire burned for about two days before operators flooded the core with water.

Radioactive iodine-131 escaped through the stack. Authorities restricted the distribution of milk from farms over an area of roughly 500 square kilometres around the site for several weeks, a protective step that kept iodine out of the food chain. The accident is rated at level 5 on the International Nuclear and Radiological Event Scale.

Windscale taught engineers to understand the stored-energy behaviour of their materials and to instrument the core well enough to see what is happening inside it. It also showed the value of filters on exhaust stacks: the filters at the top of the Windscale chimneys, added late in construction at the insistence of physicist John Cockcroft, caught a substantial share of the release.

SL-1, United States, 1961

SL-1 was a small experimental boiling-water reactor built for the U.S. Army in Idaho. On 3 January 1961, three operators were reassembling the control-rod drives after maintenance. The procedure required lifting the central control rod by a few centimetres to reconnect it. The rod was withdrawn about half a metre instead, far enough to make the core prompt critical on its own. Power surged within milliseconds, the water in the core flashed to steam, and the resulting pressure wave lifted the reactor vessel. All three men died.

The lesson went straight into reactor design. Modern cores are designed to shut down with ample margin even when the single most effective control rod is fully withdrawn, a requirement known as the stuck-rod criterion. Control-rod drives limit withdrawal speed and travel, and procedures for work on reactivity systems receive particular scrutiny.

Three Mile Island Unit 2, United States, 1979

Three Mile Island is the accident that reshaped how the industry thinks about people and information. In the early hours of 28 March 1979, the feedwater pumps supplying the steam generators of this pressurised water reactor stopped. The turbine and reactor tripped as designed. Pressure in the primary circuit rose, and a relief valve on the pressuriser opened to relieve it, also as designed. When pressure fell, the valve stayed open.

A light in the control room showed that the signal to close the valve had been sent; it gave the operators the impression that the valve itself had closed. Coolant continued to escape as steam. Meanwhile the water level in the pressuriser rose, because steam bubbles forming in the hot primary circuit pushed water into it. The operators, trained to protect against overfilling the pressuriser, throttled the emergency injection system that was supplying exactly the water the core needed. Over the following hours the upper part of the core was uncovered and about half of it melted.

The reactor vessel held the molten material, and the containment building kept the release of radioactivity small. Studies of the health effects found the doses to the public to be very low. The plant itself was a total loss, and the clean-up took over a decade.

The response was broad and lasting. The Kemeny Commission found that the equipment had performed largely as intended and that the decisive factors were human: training, procedures, control-room design and the way information was presented. Control rooms were redesigned around human factors, plants gained full-scope simulators for operator training, symptom-based emergency procedures were introduced, and the U.S. industry founded the Institute of Nuclear Power Operations to raise and share operating standards.

Chernobyl Unit 4, Soviet Union, 1986

Chernobyl is the most severe accident in the history of nuclear power. Unit 4 was an RBMK, a large reactor with graphite moderation and boiling-water cooling in individual pressure tubes. On the night of 25 to 26 April 1986, staff were carrying out a test to show that the turbine, while coasting down after losing steam, could power the coolant pumps for the short time before the emergency diesel generators took over.

The test was delayed for many hours, and the reactor spent that time at reduced power. Xenon-135, a strong neutron absorber produced in operation, built up in the core and depressed the power further. To raise it, operators withdrew far more control rods than the operating rules allowed. When the test began, the reactor was in an unstable condition at low power, with most of its absorbers withdrawn.

Two features of the RBMK design turned this into a catastrophe. First, the reactor had a large positive void coefficient in that state: when coolant turned to steam, reactivity rose, so a rise in power produced more steam and a further rise in power. Second, the control rods had graphite sections at their lower ends. When the emergency shutdown began, the descending rods first displaced water at the bottom of the core with graphite, adding reactivity in that region for the first seconds of travel. Power rose by orders of magnitude within seconds. Steam explosions destroyed the core and the reactor building, and the exposed graphite burned for days.

Two workers died that night. In the following months 134 plant staff and emergency workers were diagnosed with acute radiation syndrome, and 28 of them died. The release contaminated large areas of Ukraine, Belarus and Russia, and more than 100,000 people were evacuated in 1986. Thousands of cases of thyroid cancer among people exposed as children have been linked to radioactive iodine, largely through contaminated milk.

The technical lessons were applied to every remaining RBMK: higher fuel enrichment and additional fixed absorbers to reduce the void coefficient, redesigned control rods and faster shutdown systems. The wider lesson concerned organisations. The IAEA's International Nuclear Safety Advisory Group introduced the term safety culture in its review of the accident, describing an organisation in which safety receives the priority its significance warrants, at every level. Operators worldwide formed the World Association of Nuclear Operators in 1989 to share experience across national borders.

Fukushima Daiichi, Japan, 2011

On 11 March 2011 a magnitude 9.0 earthquake struck off the north-east coast of Japan. The three operating reactors at Fukushima Daiichi shut down automatically, and emergency diesel generators started to power their cooling systems. Roughly 40 to 50 minutes later the tsunami arrived. Waves around 14 to 15 metres high overtopped the site, which had been designed for a tsunami of about 6 metres, and flooded the diesel generators, switchgear and much of the battery capacity.

With the plant in station blackout, cooling depended on systems that could run on steam or battery power, and these were gradually lost. Decay heat boiled away the water in the reactor vessels of Units 1, 2 and 3, and their cores overheated and melted. Hot zirconium cladding reacted with steam and produced hydrogen, which leaked into the reactor buildings of Units 1, 3 and 4 and exploded. Radioactive material was released to the air and the sea, and more than 150,000 people left the surrounding area under evacuation orders or voluntarily.

The radiation doses received by the public were low, and the evacuation itself caused serious harm, especially among elderly and hospitalised people moved under difficult conditions. The IAEA report on the accident pointed to an underestimated tsunami hazard, together with a widespread assumption in Japan that an accident of this scale lay beyond reasonable expectation. Newer evidence about large historical tsunamis had already raised questions about the site's defences.

The lessons were applied worldwide. Regulators required plants to reassess external hazards such as floods and earthquakes against current knowledge. European plants went through stress tests, and U.S. plants adopted the FLEX strategy of portable pumps and generators stored in protected locations, with connection points ready on the plant. Designs and existing plants added filtered containment venting, passive hydrogen recombiners and better instrumentation for spent-fuel pools. Japan reorganised its nuclear regulation under a new, independent Nuclear Regulation Authority in 2012.

What connects these accidents?

Each accident has its own technical story, and the same themes recur across them.

• Decay heat governs the course of a severe accident. Stopping the chain reaction is the easy part; removing the heat that follows is the lasting task. Three Mile Island and Fukushima were both, at heart, failures to keep water on hot fuel.
• Reactivity feedback must work in the operator's favour. Chernobyl showed what a positive void coefficient means in practice; SL-1 showed why criticality should always depend on more than a single rod. Modern design requires negative feedback and generous shutdown margins.
• Information shapes decisions. The operators at Three Mile Island acted reasonably on what their instruments told them. Displays, procedures and training now aim to give a true picture of plant state, especially during the confusing first hours of an event.
• Design bases must keep pace with knowledge. Fukushima's defences matched the hazard estimates of the 1960s. Periodic reassessment of external hazards is now standard practice.
• Organisations make safety. Safety culture, independent regulation and the open sharing of operating experience have become pillars of the industry, all grown directly from these events.
• Defence in depth works when every layer is maintained. At Three Mile Island the vessel and containment held, and the release was small. At Chernobyl the RBMK lacked a containment building of the kind used in Western light-water reactors, and the release was vast.

Where simulation enters the picture

Much of what changed after these accidents depends on analysis. Probabilistic safety assessment, pioneered in the Reactor Safety Study of 1975, maps the sequences of failures that could lead to core damage and estimates their frequencies; Three Mile Island followed a sequence close to those the study had identified as important. Severe-accident codes model core melting, hydrogen generation and the behaviour of radioactive material inside containment, and they shaped the filtered vents and hydrogen recombiners fitted after Fukushima. Transient analysis of reactivity feedback is a routine part of licensing every new core design.

Simulators also train people. The full-scope control-room simulators introduced after Three Mile Island let operating crews practise rare and complex events until the right responses become familiar. In that sense, simulation turned the hard lessons of a few accidents into the daily practice of an entire industry.