NUCLEAR ACCIDENTS AND DEVELOPMENTS IN NUCLEAR SAFETY AND RADIATION PROTECTION How nuclear safety and radiation protection have evolved further to accidents in France and across the world. AUTORITÉ DE SÛRETÉ NUCLÉAIRE • NOVEMBER 2023 LES CAHIERS HISTOIRE DE L’ASN • #01 1969 / 1980 Saint-Laurent- des-Eaux 1979 Three Mile Island 1986 Chernobyl 2011 Fukushima 2004 / 2005 Épinal
INTRODUCTION • Nuclear safety and radiation protection – a continuous learning process 2 • Examples of nuclear accidents and incidents classified on the INES scale 6 FIVE MILESTONE EVENTS • Saint-Laurent-des-Eaux (1969 and 1980), two accidents in France 8 • Three Mile Island (1979), the first nuclear accident that attracted worldwide attention 12 • Chernobyl (1986), the ultimate disaster 16 • Épinal (2005), the risks elsewhere than in nuclear installations 22 • Fukushima (2011), the inevitable disaster scenario 26 GLOSSARY 33 Contents The aim of “Les Cahiers Histoire de l'ASN” magazine is to shed light on nuclear safety and radiation protection through interviews with those involved yesterday and today. It intends to supplement the historical account of the facts with the testimonials of the actors of the time.
This first issue of “Les Cahiers Histoire de l'ASN” is devoted to the subject of “nuclear accidents”. Although some nuclear accidents are well known, to the extent moreover that the name of the site is now part of everyday language, others represent distant memories or have been completely forgotten. This is the case with two accidents at Saint-Laurent-des-Eaux described in this issue. We have a duty to build up a collective memory that can be used by future generations. In our opinion, three key ideas must be considered at this stage. First, in a society that aspires to be risk-free, one must remember that there is no such thing as zero risk and the nuclear sector is no exception to this universal rule. As André-Claude Lacoste, ASN Chairman from 2006 to 2012 pointed out, “nobody can guarantee that there will never be a serious accident in France. It is therefore necessary to do two things: try to reduce the probability of this happening, and mitigate the consequences if it does. That, in a nutshell, is the philosophy underpinning nuclear safety”. Next, with regard to past accidents, one must go beyond their uniqueness to investigate the root causes and draw the lessons that will enable potential accidents to be foreseen and allow optimal management of the accident and the post-accident phase. Many developments in the organisation or the doctrine of nuclear safety and radiation protection stem from the analysis of past experience. We have decided to describe this work through five milestone events, each of which led to major advances in nuclear safety and radiation protection. Lastly, one of the consequences of major accidents is effectively the emergence of international awareness of nuclear-related risks. The message stating that nuclear safety is a common asset and must not form the subject of competition or geostrategic manipulations remains, in view of recent events, more relevant than ever. The ASN History Committee FOREWORD
See glossary pages 33 to 36 Nuclear safety and radiation protection, a continuous learning process Enrico Fermi (1901-1954) Designer of the first ever operational nuclear reactor, Fermi is considered by his peers to be a giant of modern physics. The Italian physicist, who won the Nobel Prize in Physics in 1938, became an American citizen in 1945 and worked intensively on the Manhattan project to produce the atomic bomb. Accidents – random, unexpected and undesired events – are part of the existence of all natural and artificial things. The nuclear sector is no exception to the rule. The discovery of nuclear energy was marred by ill-fated events from the outset. The world’s first uranium-based nuclear reactor, or “atomic pile” as it was referred to at the time, created by Enrico Fermi in 1942 in Chicago, was followed very quickly by the design and then the production of the atomic bomb. Furthermore, it was during the preparatory work on the bomb that the first criticality incident in history took place in Los Alamos in the United States on 11 February 1945. It caused one operator to lose a significant amount of hair but had no lethal effect. In the 1950’s, the civil nuclear activities lent moral support to the nuclear sector: it can be used for other things than killing, such as producing heat. Among the many projects to emerge at that time, the production of electricity by using reactors to heat water to produce steam to rotate a turbine is a concept that is still relevant today. On 20 December 1951, in Idaho Falls in the United States, EBR-1, a fast neutron reactor cooled by liquid sodium produced enough electricity to illuminate the building housing the reactor! The gateway to industrial production was open. 2 • Les cahiers Histoire de l’ASN • November 2023
People were aware of the risk from the very beginning From the construction of the first Fermi pile in 1942, precautions were taken to ensure reactor safety, with several – albeit rudimentary – means of shutdown, but which inspired the systems in use today. An operator was thus stationed above the pile, armed with an axe, ready to cut the rope which retained an emergency stop bar coated with cadmium, a powerful neutron absorber, which would then drop by gravity into the reactor core. A second operator, also stationed above the pile, held a bucket filled with a cadmium sulphate solution ready to be poured onto the reactor if necessary. The pile was controlled by a hand-operated horizontal cadmium control rod and the neutron flux was monitored by measuring instruments. October 1956, the first incident in France In October 1956 in reactor G1 on the Marcoule site, a fuel cartridge that was incorrectly positioned in its channel heated up and caught fire. Seven kilograms of nuclear fuel melted. Thanks to the cladding failure detection system, the reactor pile stopped, but lacking appropriate handling systems, extraction of the cartridge – which was done virtually by hand – was complicated. This first incident in France remains unknown to the general public. The beginning of regulation of nuclear safety Between 1945 and 1955, the first years of development of nuclear energy in France, there were no specific safety rules other than those that the researchers, engineers and technicians imposed upon themselves. At the end of 1957, Francis Perrin, the High- Commissioner for Atomic Energy in France, initiated a reflection of the organisation of nuclear safety. ••• “Nobody can guarantee that there will never be a serious accident in France. It is therefore necessary to do two things: try to reduce the probability of this happening, and to mitigate the consequences if it does. That, in a nutshell, is the philosophy underpinning nuclear safety.” André-Claude Lacoste ASN Chairman from 2006 to 2012 Nuclear accidents and developments in nuclear safety and radiation protection • 3 Criticality In the field of nuclear engineering, criticality is a discipline which aims to assess and prevent the risks of an unwanted chain reaction in nuclear facilities. It is a sub-discipline of neutronics. The criticality risk is the risk of triggering an uncontrolled fission chain reaction.
See glossary pages 33 to 36 Drawing from the American, British and Canadian examples, it resulted in the creation in January 1960 of the Atomic Installations Safety Commission (CSIA), tasked with examining the safety of the current and future facilities of the French Atomic Energy Commission (CEA). For the first time, based on the Anglo-Saxon model, a report was drawn up at the request of the experts, and analysed in 1962 during the design of EDF’s Chinon nuclear power plant (NPP). Presented by the licensee, this document set out an analysis of the risks and means of protection of the installation with the aim of obtaining from the public authorities a construction authorisation and then a commissioning authorisation. The decade of the 1960’s saw the development of the graphite-moderated gascooled reactors (GCRs) designed by the CEA, referred to as GasCooled Reactors (GCRs) in English. These reactors were officially abandoned in 1969, the year in which a core meltdown accident occurred on the reactor at EDF’s Saint-Laurent-des-Eaux NPP. In the mid-1970’s a national nuclear safety organisation began to develop, with the creation of an inspection body – the Nuclear Installations Central Safety Service (SCSIN) within the Ministry for Industry in 1973, and an expert assessment body, the French Institute for Nuclear Safety and Protection (IPSN), created within the CEA in 1976. In the early 1980’s, these bodies began to produce technical regulations, comprising a very small number of good practices guides, technical orders and ministerial guideline notices. These official documents were supplemented by policy documents written by the licensee. These documents jointly constituted the de facto regulations. The emergence of an independent and transparent nuclear oversight body The Three Mile Island accident in 1979 (see p. 12) was a real shock for the French nuclear experts and contributed directly to the introduction of a number of modifications on the nuclear facilities. Alongside the technical changes linked to the improvement in safety, the very organisation of oversight underwent changes with the aim of regulating the monitoring of NPPs. “Any accident is by definition unique. You have to go further and seek out the root causes. That is why we did what was done in France, and more broadly in Europe, following the Fukushima disaster, because there was a real need to take things beyond the particular circumstances encountered at Fukushima or Chernobyl.” Pierre-Franck Chevet ASN Chairman from 2012 to 2018 There can be no grounds for complacency about nuclear safety in any country. [...] Safety must always come first. Yukiya Amano Director General of the International Atomic Energy Agency (IAEA) from 2009 to 2019 ••• 4 • Les cahiers Histoire de l’ASN • November 2023
The Chernobyl accident in 1986 (see p. 16) underpinned the idea that it was vital to have a regulation system that was more transparent, more independent of the industry players and more robust from the regulatory aspect. 2002 saw the creation of the Institute of Radiation Protection and Nuclear Safety (IRSN), a completely independent public institution of the CEA, resulting from the merging of the French Office for Protection against Ionising Radiation (OPRI) – which replaced the Central Service for Protection against Ionising Radiation (SCPRI) in 1994 – and the IPSN. The SCSIN, for its part, after several successive extensions to its scope of action, acquired the status of an independent administrative authority in 2006 and became the Autorité de sûreté nucléaire (ASN – French Nuclear Safety Authority). In the same year, the Act on Transparency and Security in the Nuclear Field (the “TSN Act”) was promulgated, followed by a series of decrees, orders, statutory resolutions, and a recasting of the corpus of the practical guides, gradually replacing the old regulations. In 2011, in the wake of the Fukushima Daiichi NPP accident (see p. 26), the safety of the French NPPs was reassessed via stress tests, referred to in France as “complementary safety assessments”. Nuclear safety: a global common asset The emergence of an international awareness of nuclear-related risks is one of the consequences of the major accidents. In his wishes to the press in 2011, André-Claude Lacoste expressed it strongly: “ASN has an active policy of international cooperation. It considers that nuclear safety must not be a source of competition, but a common asset”. ASN considers that one of the new challenges of global nuclear safety, particularly in the context of the development of nuclear power programmes in emerging countries, is to develop a safety culture and put in place an independent safety authority (regulator) in each country. Alongside these independent authorities, citizens’ associations were created and contributed, with critical and expert positions, to the debate on nuclear-related issues and safety requirements. ■ “I think that the strength of the nuclear sector depends not only on a robust and responsible licensee, but also on a regulator that plays its role in full. This is also what wins the trust of the public, otherwise it doesn’t work.” Dominique Minière Executive Director of the EDF group, in charge of the Nuclear and Thermal Fleet Division from 2015 to 2019 ASN is undoubtedly the second most powerful nuclear regulator in the world. And few people know the key role that André-Claude Lacoste played in defining the international nuclear safety rules when he chaired the Nuclear Safety Standards Committee at the IAEA. Ann MacLachlan Former journalist at Nucleonics week Nuclear accidents and developments in nuclear safety and radiation protection • 5
Examples of nuclear accidents and incidents classified on the INES scale See glossary pages 33 to 36 Level 7 1986 – Chernobyl (Ukraine) Further to a series of human errors as well as design faults, reactor 4 suffered core meltdown followed by an explosion which caused the release of nuclear fuel into the atmosphere. The contamination spread across the whole of Europe. Details p. 16 2011 – Fukushima-Daiichi (Japan) This accident was the consequence of a tsunami caused by an earthquake of magnitude 9 on the Richter scale, resulting in the total loss of the electrical power supplies and the nuclear reactor cooling systems, and substantial radioactive releases into the environment. Details p. 26 Level 6 1957 – Kyshtym (Russia – former USSR) The explosion of a tank of liquid nuclear waste released a radioactive cloud which contaminated an entire region around Kychtym, covering 800 km2. More than 200 people died, 10,000 people were evacuated and 470,000 were exposed to radiation. Level 5 1957 – Windscale, renamed Sellafield (United Kingdom) The graphite core of reactor 1 ignited during a routine annealing operation, and fission products – essentially iodine-131 – were released into the atmosphere. No evacuation was required, but the competent authorities took measures such as prohibiting the consumption of locally produced foodstuffs. 1979 – Three Mile Island (United States) Further to an accidental chain of events, the core of unit 2 reactor of the Three Mile Island NPP (TMI-2) suffered partial meltdown, leading to the release of a small amount of radioactivity into the environment. Details p. 12 Level 4 1959 – Santa Susana (United States) The experimental sodium reactor at the Santa Susana Field Laboratory near Simi Valley in California suffered partial core meltdown. 1969 – Saint-Laurent-des-Eaux (Loir-et-Cher département(*), France) Forty-seven kilograms of uranium dioxide began to melt in GCR 1 during a fuel loading operation. Details p. 8 1969 – Lucens (Switzerland) The rupture of a pressure tube caused a pulse of current and the reactor (a small experimental device built in a rocky cavern) exploded. The reactor was totally destroyed. The core underwent partial meltdown. The majority of the radioactive substances were contained within the cavern. 1971 – Monticello NPP (United States) A water tank overflowed, releasing 190 m3 of contaminated water into the Mississippi River. Radioactive matter subsequently entered into the water intake system of the city of Saint-Paul (Minnesota). 1980 – Saint-Laurent-des-Eaux NPP (Loir-et-Cher département(*), France) Reactor core meltdown occurred on GCR 2. A piece of sheet metal obstructed part of the cooling system. The temperature rose sharply, causing 20 kg of uranium to melt and leading to emergency shutdown of the reactor. The accident severely damaged the facility. Details p. 8 1993 – Tomsk-7 (Russia) A chain reaction occurred in the Tomsk-7 waste reprocessing plant, causing a large explosion and a significant release of radioactive material into the atmosphere. 1999 – Tokaimura (Japan) Further to a handling error, an abnormally large quantity of uranium (16.6 kg), very much greater than the safety value of 2.3 kg) was introduced into a settling tank, causing a criticality reaction. This accident killed two workmen. 2000 – Indian Point (United States) Reactor 2 of the Indian Point NPP released a small quantity of radioactive steam. This was caused by a steam generator malfunction. Level 3 1981 – La Hague (Manche département(*), France) A fire broke out in a non-confined radioactive waste storage silo in the reprocessing plant. * Administrative region headed by a Prefect. 6 • Les cahiers Histoire de l’ASN • November 2023
1989 – Vandellos (Spain) A fire broke out in the turbine hall of the Vandellos NPP, resulting indirectly in a flood and damaging various systems, including the reactor cooling system. The Spanish government decided to shut down the reactor definitively in November 1992. 1991 – Forbach (Moselle département(*), France) Three temporary worker employees were severely irradiated when they entered into an industrial accelerator in operation. 2005 – Sellafield (United Kingdom) Within the Thorp reprocessing plant, 83,000 litres of highly radioactive liquefied fuel containing uranium and concentrated nitric acid leaked into a stainless steel chamber containing 200 kg of plutonium. 2007 – Kashiwazaki-Kariwa (Japan) The power plant was hit by an earthquake of magnitude 6.8 on the Richter scale; the epicentre was situated about 10 km away. The earthquake caused a fire which was brought under control two hours after it broke out, and releases of water containing radioactive elements into the sea. 2008 – Toulouse (Haute-Garonne département(*), France) A temporary-contract employee was irradiated by a cobalt-60 source at the French aerospace research centre (Onera). Level 2 1992 – Sosnovy Bor (Russia) A water intake valve on one of the 1,660 pressure tubes of reactor 3 – a RBMK reactor – closed causing the destruction of the fuel element and the pressure tube. 1999 – Blayais (Gironde département(*), France) During the storm that hit France in 1999, the lower sections of reactors 1 and 2, and to a lesser extent of reactors 3 and 4 of the Blayais NPP, were flooded, forcing the shutdown of three of its four reactors. 2006 – Plutonium technology facility of Cadarache (Bouches-du-Rhône département(*), France) The quantity of plutonium in the containment buildings was underestimated, which significantly reduced the design-basis safety margins established to prevent a criticality accident, the potential consequences of which could be serious for the workers. 2006 – Forsmark (Sweden) The emergency electrical power supply system of the Forsmark NPP reactor 1 failed. The electrical power supply was restored after a few hours, avoiding uncovering of the core. 2007 – Dijon (Côte d’Or département(*), France) A radiographer was irradiated during the radiotherapy treatment of a patient. 2008 – Krško (Slovenia) A leak on the reactor primary cooling system caused the reactor to be shut down. The leak was contained in the reactor containment. 2009 – Cruas-Meysse (Ardèche département(*), France) Systems cooling was lost, jeopardising the safety of reactor 4. 2011 – Fort Calhoun (United States) The Fort Calhoun NPP was flooded when the river Missouri burst its banks. Level 1 More than a hundred level-1 events are observed each year in France. Level 0 More than a hundred level-0 events are observed each year in France. INES (International Nuclear Event Scale) scale for classifying nuclear incidents and accidents Major accident (Chernobyl, Fukushima) Serious accident Accident with wider consequences (Three Mile Island) Serious incident Incident Anomaly Accident with local consequences 7 6 5 4 3 2 1 0 INCIDENT ACCIDENT The need to inform the public of the severity of nuclear events, particularly after the Chernobyl accident in 1986, led to the development of classification scales. The INES scale was originally put into application on an experimental basis in France by the French High Council for Nuclear Safety and Information (CSSIN), starting in spring 1988. It was strongly promoted by Pierre Desgraupes, vice-chairman of the CSSIN, and was adopted by the IAEA in 1991. In 2002, ASN proposed a new version of this scale to take account of radiation protection events (irradiation, contamination), particularly events affecting workers, whatever the place of the incident. Later on, in July 2008, the IAEA published a revised INES scale that allows events occurring in the area of transport or leading to human exposure to radioactive sources to be better taken into account. Nuclear accidents and developments in nuclear safety and radiation protection • 7
See glossary pages 33 to 36 Saint-Laurent-des-Eaux, two accidents in France The two accidents at the Saint-Laurent-des-Eaux Nuclear Power Plant (NPP) are the most serious nuclear events ever recorded in France. Retrospectively rated level 4 on the INES scale by ASN, they occurred on graphite-moderated Gas-Cooled Reactors (GCRs), which are currently being decommissioned as this technology has been abandoned. The Saint-Laurent-des-Eaux nuclear accident of 1969 On 17 October 1969, five fuel elements melted An error occurred during a loading operation on GCR A1. This error prevented proper circulation of the carbon dioxide which served as the coolant. This greatly reduced the cooling of the fuel elements present in a channel of the reactor core. The temperature of the magnesium alloy and zirconium cladding of five fuel elements increased, causing their deterioration. The rise in radioactivity in the reactor chamber caused an automatic reactor trip. The five fuel elements represented about fifty kilograms of uranium. The radiological consequences were limited: the level of irradiation of the uranium was very low given that the fuel elements had just been loaded into the reactor. Clean-up operations About ten days after the accident – the time necessary for the nuclear fuel to cool – the operations to clean up the melted uranium began. On completion of these operations, 47 kg of uranium had been recovered, essentially using remotely-operated equipment. Additional human intervention was nevertheless necessary to recover some of the debris. A full-scale mock-up of the area to clean up was built in order to train the operators tasked with the clean-up. Technological arbitration Two nuclear technologies were in competition at the time: the GCRs, considered to be the “French” solution, and the PWRs The President of the Republic at the time, Charles de Gaulle, preferred the GCR technology, whereas Georges Pompidou, his successor in 1969, preferred the PWR technology. Shortly after the accident, the GCR technology was abandoned in favour of PWRs. The GCR reactors The GCR reactors were the first generation of French nuclear power reactors. They used a natural (nonenriched) uranium fuel, moderated with graphite and cooled by carbon dioxide (CO2) gas. Just before the 1969 accident, EDF had announced that it was abandoning this type of reactor in favour of the Pressurised Water Reactor (PWR) for economic rather than technical reasons. Artist's rendition of Saint-Laurent-des-Eaux reactors A1 and A2. 8 • Les cahiers Histoire de l’ASN • November 2023
The Saint-Laurent-des-Eaux nuclear accident of 1980 13 March 1980, two fuel elements melted A sudden rise in the radioactivity in the reactor pressure vessel led to a reactor trip. The alarms sounded, reactor A2 suffered a partial core meltdown. This meltdown was triggered by the detachment of a piece of sheet metal in the cooling system, blocking a section of it and causing a local rise in the fuel temperature. 20 kg of uranium melted after the reactor trip. Professor Pierre Pellerin, head of the SCPRI, explained to the NPP surveillance committee that “the pressure inside the reactor was equivalent to thirty times atmospheric pressure and a few discharges had to be carried out in order to depressurise the reactor pressure vessel”. The cumulative discharges of radioactive effluents remained low because a waiting period was observed before depressurising the vessel, knowing that the fuel was irradiated. The small volumes discharged remained below the limits authorised at that time, governed by decree. Damage and return to service The quantity of melted fuel was smaller than in 1969 (20 kg as opposed to 50 kg), but the fuel was more radioactive because it had accumulated the fission products and minor actinides during its two years of utilisation in the reactor. The reactor clean-up and repair operations lasted 29 months and involved five hundred EDF employees and subcontractors. The uranium dust dispersed in the reactor building during the accident represented a contamination risk for a long time. Several tonnes of lead were brought into the reactor building to provide radiological protection. The clean-up and repair work lasted until 1982. The facility was restarted in October 1983. The two GCRs A1 and A2 were definitively shut down in April 1990 and May 1992 respectively. Much later, in 2015, a controversy broke out concerning discharges of plutonium into the river Loire following the accident (see next page). The Saint-Laurent-des-Eaux NPP is located on the municipality of Saint-Laurent-Nouan in the Loir-et-Cher département(*) on the banks of the river Loire, between Orléans (30 km upstream) and Blois (28 km downstream). The accidents concern only the two old gas-cooled nuclear reactors A1 and A2, which are currently being decommissioned, and the two associated waste (graphite sleeves) storage silos. These two reactors were commissioned in 1969 and 1971 and shut down in April 1990 and May 1992 respectively. This NPP also comprises two PWRs, B1 and B2, which have been operating since 1983. They each have a unit power of 915 megawatts. A fact-finding mission was undertaken in 2015 The two events were subsequently rated level 4 (accident) on the INES scale (see p. 6), adopted by the IAEA in 1994 in the wake of the Chernobyl accident. A fact-finding mission carried out at the request of the Minister for Ecology concluded that there had been low-level discharges which did not exceed the standards in effect at the time of the events. The year 1980 was also marked by two noteworthy incidents at the Saint-Laurent-des-Eaux NPP. • 13 February 1980 Further to a very rapid increase in power linked to shortcomings in the operating instructions, the cladding of several fuel elements melted, without the uranium suffering the same fate. • 21 April 1980 A container exploded in a pool storing spent fuel bars removed from the reactor and whose cladding was damaged (pending their transfer off the site). Fission products were released into the pool water. * Administrative region headed by a Prefect. Nuclear accidents and developments in nuclear safety and radiation protection • 9
See glossary pages 33 to 36 Plutonium discharges into the river Loire According to the chairman of the NPP surveillance committee: “Once everything had cooled down, a few kilograms of uranium had melted and been deposited in the bottom of the reactor pressure vessel. These materials were loaded with fission products and plutonium. During the clean-up, a rinsing operation was carried out and liquid discharges were washed into the river Loire”. The NPP stated that it “had observed the regulatory discharge authorisation limits applicable at the time, set by the Ministerial Order of June 1979”. On 4 May 2015, a documentary entitled “Nuclear power, the policy of lying?”, broadcast by the French television channel Canal+, stated that following this accident, EDF made totally illegal discharges of plutonium into the river Loire for a period of at least five years. A sampling campaign of sediments in the Loire conducted by a university laboratory established the presence of traces of plutonium extending from Saint-Laurent-desEaux to the estuary, the origin of which could be attributed to either the accident of 1980 or that of 1969 (see above). In IRSN’s opinion, the majority of these traces were not linked to the accident of 13 March 1980 but to the treatment of water from the reactor A2 pool, which was contaminated when a container enclosing an unsealed fuel element burst on 21 April 1980. Based on the dosimetric evaluations carried out using the estimated activity discharged at the time, IRSN considers that the plutonium discharges into the river Loire remained sufficiently low for the health and environmental risks downstream of the site to be considered negligible. Saint-Laurent-des-Eaux, two accidents in France Core sampling technique for taking and analysing sediments from river banks. Steps in the analysis of a sediment on the banks of the river Loire 1. Identification of the best core-sampling site, defined by a multidisciplinary team (geochemists, hydrologists, etc.). 2. Taking of sediment samples at two different depths every metre. 3. Gamma spectrometry analysis of the samples in the laboratory. The tubes are cut in the longitudinal direction and opened. The excess caesium-137 and lead-210 are measured in each section to date them. 4. The radionuclides are analysed in an IRSN laboratory. An expert looks for the plutonium, carbon-14 and organically-bound tritium. The analysis revealed peaks of plutonium in the years 1969 and 1980, which correspond to the two accidents that occurred at the Saint-Laurent-des-Eaux NPP. “We must preserve the memory of those who founded ASN and the various organisations that preceded it. Today we are still treading the path towards ever-greater independence and transparency.” Philippe Saint Raymond Deputy Director of Nuclear Installations Safety (1993 – 2002), then Deputy Director-General of Nuclear Safety and Radiation Protection (start of 2002 to February 2004) 10 • Les cahiers Histoire de l’ASN • November 2023
Creation of the SCSIN Created by decree in 1973 following the first accident at the Saint-Laurent-des-Eaux NPP, the Central Service of Nuclear Installations Safety (SCSIN) was responsible for preparing and im-plementing all the technical measures concerning nuclear safety: regulations, coordination of safety studies, nuclear information. It was this lean structure, attached to the Ministry of Indus-try, that was responsible for examining the Basic Nuclear Installation (BNI) authorisation application files. The Service became the Nuclear Installation Safety Directorate (DSIN) in 1991, and was renamed Nuclear Safety and Radiation Protection Directorate (DGSNR) in 2002. ASN was created directly from the DGSNR in 2006. Improvements in governance and techniques The experts from EDF and CEA considered the accident of 17 October 1969 to be exceptional. The analysis of the causes rapidly led to the cause of the accident being diagnosed as a combination between a human error and an error in the automatic loading system. This event led to improvements in the clad failure detection system of the GCRs and in the fuel handling devices. It was followed up by a group of experts (from the CEA and EDF, as well as the Ministry of Industry) in the months following the event. With regard to communication, the accident was not concealed but little was said about it. On 31 October 1969, an article published in the newspaper Le Monde reported the accident as an “incident”. This caused no particular reaction in France. The events of the accident were nevertheless published in a specialist review, and the Saint-Laurent-des-Eaux NPP produced a film showing the different phases of the repair work. Three international conferences were held in London, Paris and in Germany between October and December 1970, showing a willingness to make the accident and the methods used to resolve it known to the specialists concerned, in France and abroad. Capitalising on lessons learned on a global scale The accident of 13 March 1980 underwent a more formal analysis than that of 1969, given the existence of an oversight organisation within the Ministry of Industry, namely the SCSIN – a forebear of ASN, as well as a public expert attached to the CEA, the IPSN, and an advisory committee of experts. The IPSN drew up two reports, one devoted to the accident of 13 February 1980, which points to organisational and human failures, the other to the accident of 13 March, indicating that there was a design problem. The IPSN experts also mention the failure to take into account the lessons learned from accidents that occurred in other countries: a precursor incident (tearing off of metal sheets) had occurred in the Vandellos NPP in Spain in 1976, a plant which was sold by France and was an exact copy of the Saint-Laurent-des-Eaux NPP (see quote opposite). The IPSN report on the accident of 13 March 1980 points out that: “this incident escaped attention”. Likewise, the risk of a projectile causing loss of cooling, which corresponds to the 1980 accident scenario, had not been taken into account when the loss-of-cooling risk was studied in the mid-1970s in France. ? What lessons can be learned from the nuclear accidents at Saint-Laurent-des-Eaux “ ...EDF must be particularly attentive to the functioning of the various reactors of the same type operating in other countries – especially Vandellos in Spain – in order to draw all the necessary lessons from incident precursor events.” SCSIN “GCR reactor nuclear power plants, Lessons learned from the incidents on the second plant unit of Saint-Laurent-des-Eaux A”, 13 January 1981 Nuclear accidents and developments in nuclear safety and radiation protection • 11
See glossary pages 33 to 36 Three Mile Island, the first nuclear accident that attracted worldwide attention The accident involving partial meltdown of the core of reactor 2 of the Three Mile Island (TMI) power plant demonstrated that combinations of human and technical failures could lead to a severe accident. Rated level 5 on the INES scale, the accident was a major turning point for the nuclear industry and gave rise to an overall review of the risks and approach to reactor safety. A year after it was commissioned, reactor 2 of the TMI NPP situated on an island on the River Susquehanna, suffered a technical failure. The TMI NPP, situated in Pennsylvania in the east of the United States, was commissioned in 1974. In 1979, it was equipped with separate 900 megawatt electric (MWe) PWRs. Wednesday 28 March 1979, 04:00 (4 am) The accident began with a simple operating incident, failure of the main feedwater pumps supplying the steam generator cooling system. The planned safety mechanisms – emergency shutdown (reactor trip) by inserting control rods into the fuel core and activation of the auxiliary feedwater pumps supplying water to the reactor – functioned perfectly. Succession of failures and negligence But then a second failure occurred: despite the activation of the auxiliary feedwater pumps, the water did not reach the Steam Generators (SGs) because, due to an operator omission, the valves situated between the SGs and the pumps were closed instead of being open. These valves were reopened manually eight minutes later. Core meltdown Reactor core meltdown occurs when the nuclear fuel rods which contain uranium or plutonium and highly radioactive fission products start to overheat and then melt. It occurs in particular when a reactors stops being properly cooled. It is considered to be a severe nuclear accident because fissile materials can contaminate the environment with the release of numerous highly radioactive radioisotopes outside the reactor containment. UNIT 2 OF THE THREE MILE ISLAND NPP Reactor containment Relief valve Pressuriser Turbine building Radioactivity coming from the auxiliary building Primary cooling system Condenser Secondary cooling system Auxiliary building Turbine 12 • Les cahiers Histoire de l’ASN • November 2023
During this lapse of time, the pressure in the primary cooling system, which was insufficiently cooled, increased to the point where it triggered opening of the pressuriser relief valve, whose purpose is to evacuate the excess steam towards a tank and thereby reduce the pressure in the primary system. When cooling by the SGs was restored and the primary system pressure reached the pressuriser relief valve closing threshold, a third failure occurred: the pressuriser relief valve received the command to close, but remained jammed in the open position, resulting in the loss of primary coolant via this valve. The operators who checked the pressuriser relief valve position indicator saw a “valve closed” indication. But this indication was false. This is because the indicator in the control room reflected the command received by the valve and not its actual position. The loss of primary coolant activated the safety injection system. The operators in charge of operational management of the plant focused their attention on the level of water in the pressuriser to prevent it from filling up. Faced with the rapid rise in the water level in the pressuriser, and believing the relief valve to be closed, the operators manually stopped the safety injection. The mental picture the operators had of the situation was false; they lacked direct information on the state of the reactor core. Melting of the fuel, then reactivation of safety injection Given the emptying of the primary cooling system, the fuel was no longer cooled. This led to degradation of the fuel, with a significant release of fission products from the fuel into the primary coolant. Two hours and fourteen minutes after the start of the accident, the alarm signalling high radioactivity in the reactor containment was activated. From this moment, the operators could no longer ignore that the situation was serious. The pressuriser relief valve was then closed, stopping the emptying of the primary cooling system. At this stage of the incident, new radioactivity alarms were activated, some situated outside the reactor building. Nine hours and fifty minutes after the start of the accident, a localised explosion of about 320 kg of hydrogen caused a pressure peak of about 2 bars in the reactor building, without causing any particular damage. It took the next twelve hours to purge the primary system of the majority of the hydrogen created by the oxidation of the Zircaloy and the incondensable fission gases released from the fuel during the accident. Wednesday 28 March 1979, 20:00 (8 pm) The accident in itself was over. It was nevertheless necessary to let several days go by before being able to exclude the risk of a hydrogen explosion. The damage suffered by the fuel elements was far greater than that imagined for the most severe design-basis accident considered for the installation. It was not until six years later, in 1985, that it was found that 45% of the fuel had melted, taking with it cladding and structural materials, forming what is called “corium”. Part of this corium, about 20 tonnes, flowed in liquid form into the bottom of the reactor vessel, fortunately without melting through it, possibly thanks to the forming of a space between the corium and the reactor vessel which would have allowed the cooling water to circulate in the vessel. Minimal consequences for the environment Despite the partial meltdown of the reactor core and the large release of radioactivity into the reactor containment, the immediate radiological consequences for the environment were limited. The reactor containment had effectively fulfilled its purpose. The low-level releases into the environment were caused by a system for pumping the primary cooling system effluents, which was kept in service. When unit 2 (TMI-2) suffered its accident in 1979, unit TMI-1 was disconnected from the network. It was put back into service in October 1985, despite public opposition, several court injunctions and technical and regulatory complications. In 2009, its operating license was extended by 20 years, that is to say until 19 April 2034. However, as the site had been losing money for several years, the licensee – Exelon – decided to stop operating it on 20 September 2019. Nuclear accidents and developments in nuclear safety and radiation protection • 13
The TMI accident taught lessons concerning the functioning of the reactors. The lessons from the accident enabled the calculated probability of core melt-down in second-generation PWRs to be reduced by a factor of 10. International public opinion became aware that nuclear accidents represented a real risk that could materialise at any time. The accident marked the widening of the nuclear safety debate from the sphere of the scientists and industry players to that of the citizens and politicians. Setting up of emergency plans in France The TMI accident was partly linked to poor understanding of the situation by the operators. It has been established that it was very difficult for a team to call into question its interpretation of the situation. It thus came to light that setting up an emergency team capable of taking a step back from the situation could be a major improvement. Likewise, the need to better define the role of the different players and the organisation of information circulation in accident situations became apparent. Emergency plans were developed on these bases. The need for regular training exercises also came to light. Emergency plans were thus put in place in France in the 1980’s. On-site Emergency Plans (PUIs) were developed by the nuclear installation licensees with the aim of controlling an accident insofar as possible and mitigating its consequences, assisting any injured persons on the site and informing the public authorities and the media. The public authorities established Off-site Emergency Plans (PPIs) meeting the general aim of protecting the populations in the event of a severe accident occurring in these facilities. The first emergency exercise was organised in 1980 at the Fessenheim NPP (Haut-Rhin département(*), France). See glossary pages 33 to 36 Protect the neighbouring populations by informing them of the risks and the measures to take to respond to them The nuclear safety actors developed extensive information plans for the people living near NPPs. The local authorities, the medical corps and the pharmacists were also directly involved in these actions. ? How did nuclear safety and radiation protection evolve following the Three Mile Island accident Three Mile Island, the first nuclear accident that attracted worldwide attention * Administrative region headed by a Prefect. 14 • Les cahiers Histoire de l’ASN • November 2023
A major step forward Filtration of the air in the reactor containment In the event of an accident, should an increase in pressure threaten to damage the containment, the depressurisation system would, as a last resort, enable the gases in the containment to be released after filtration. The filter is capable of retaining some of the radioactivity and thereby mitigating the environmental consequences of the accident. Valve Sand Steel shell Expanded clay Concrete deck Drain Stack Inside the stainless steel shell, the gases pass through different layers, including 80 cm of sand. Nuclear accidents and developments in nuclear safety and radiation protection • 15 Radioactive gases Reactor building Integration of the lessons learned from monitoring the operation of nuclear power plants The detection of precursor events became a major concern of the licensees and nuclear safety organisations. The organisation of operation and operating experience feedback thus developed around this new priority. Modification of certain technical systems Between 1994 and 2008, ASN sought the opinion of IRSN and the Advisory Committee for Nuclear Reactors concerning technical modifications, of which the main ones adopted are listed below ■ enhanced reliability of commanded opening of the pressuriser relief valves on the 900 MWe reactors: the aim of this modification was to limit the risks of reactor vessel melt-through, particularly in the event of core meltdown further to a total loss of the electrical power supplies; ■ installation of passive auto- catalytic recombiners on all the reactors (installation completed in 2007); ■ improvement in the closing system of the equipment hatch (TAM) for the 900 MWe reactors in order to improve the leak-tightness of the TAM, a containment weak point, to obtain a pressure of about 8 bars; ■ installation of hydrogen detection and reactor vessel corium melt-through detection sensors on the 900 MWe reactors in order to have, in the event of a severe accident, information on the how the situation is evolving.
See glossary pages 33 to 36 Chernobyl, the ultimate disaster The Chernobyl accident resulted from a convergence of events combining human errors and faults in the design of the NPP. A test sequence on the emergency electrical power supply of reactor 4 was to turn into a major catastrophe and raise worldwide awareness of the risks associated with nuclear power. What happened on 25 April 1986 in the building of reactor 4 (RBMK reactor) of the V.I. Lenin NPP situated 18 km from Chernobyl, in Ukraine? A test was to be carried out to check the possibility of energising the reactor recirculation pumps via a turbogenerator set if the electrical power supply failed. This test was to be carried out at about 20% to 30% of the nominal power level. 25 April 1986 The operators started the procedure to lower the power to the level required for the test. However, at the request of the electrical power distribution centre, the reactor was maintained during the day at a higher power level than that required for the test. At 23:00 (11 pm), the operators started to reduce the reactor power level to attain the test conditions but could not stop the power reduction. They therefore decided to withdraw the control rods, beyond the authorised limits, in order to raise the power level. At 01:00 (1 am) on 26 April, the reactor power stabilised at a level significantly below the required level. The team nevertheless decided to perform the test. 25 april 1986 Test linked to the electrical power supply of reactor 4. The safety conditions were not observed. 26 april 1986 The uncontrolled increase in power led to an explosion of the reactor and a graphite fire. Réacteur 4 Réacteur 4 THE ACCIDENT The RBMK reactor This is a Soviet-designed highpower reactor. It is a graphitemoderated reactor that uses boiling light water as the coolant. The fuel is uranium oxide enriched with uranium-235. Each fuel assembly is contained in a “pressure tube” within which the coolant fluid circulates. The major drawbacks of this type of reactor are the complexity of the cooling fluid distribution and collection system, the large build-up of thermal energy in the metal structures and in the graphite, the absence of reactor containment and the difficulty in controlling the reactor core. Eleven RBMK reactors were still in operation in 2023, all located in Russia. 16 • Les cahiers Histoire de l’ASN • November 2023
Réacteur 4 CONSEQUENCES The explosion destroyed a large part of reactor 4 and of the turbine hall and intermediate constructions. 26 April 1986, between 1:03 and 1:07 am Two additional recirculation pumps were put into service. The additional flow caused the temperature in the heat exchangers to rise. At 01:19, to stabilise the water inflow to the moisture separators, the power of the pumps was further increased and exceeded the authorised limit. The system requested an emergency shutdown, but the signals were blocked and the operators ignored the request. 26 April at 1:23:04’’ The test began: the turbine steam supply valves were in closed position. The recirculation pumps slowed down and the flow rate decreased. The core temperature rose, causing – due to the design of the reactor – an increase in the reactivity. The reactor power increased uncontrollably. 26 April at 1:23:40’’ The chief operator ordered emergency shutdown. All the control bars started to descend into the core, but produced the opposite effect to that expected. The power again increased uncontrollably. 26 April at 1:23:44’’ The power peak was reached, exceeding more than 100 times the nominal power of the reactor. The high pressures in the pressure tubes caused them to rupture. An explosion raised the upper plate of the reactor, weighing 2,000 tonnes. The upper part of the reactor core was exposed to the open air. The graphite caught fire, and several fires broke out in the facility. It took the firemen three hours to put out these fires. The graphite fire restarted. It was not definitively extinguished until May 9. From 27 April to 10 May 1986 5,000 tonnes of materials (sand, boron, clay, lead, etc.) were transported by helicopter and released onto the reactor with the aim of covering it to reduce the air flow feeding the graphite fire and the release of radioactive emissions. “Chernobyl confirmed that a major nuclear accident could occur with consequences affecting several countries: in this case Ukraine, Russia and Belarus, as well as a large part of Europe. This led to the widespread realisation that it was necessary to have an international approach to nuclear safety issues.” Pierre-Franck Chevet ASN Chairman from 2012 to 2018 A radioactive cloud was released into the atmosphere. Driven by the winds, it crossed part of Europe (see box on page 20). Nuclear accidents and developments in nuclear safety and radiation protection • 17
See glossary pages 33 to 36 240,000 “liquidators2”, both civil and military, worked on the first sarcophagus and decontamination of the soils in 1986 and 1987. 24,000 years The lapse of time necessary before humans can once again live in Chernobyl 116,000 people2 evacuated from the zone in 1986 (30 km radius around the NPP) 4,000 people1 could ultimately die as a result of radiation exposure further to the accident The causes of the accident, from the power plant design to post-accident management, are numerous and all equally serious. ■ The design of the NPP did not meet safety requirements. ■ The RBMK reactor is naturally unstable in certain situations. These situations were not explicitly mentioned in the operating documents. What is more, the emergency shutdown system has adverse effects in certain situations. ■ The test which caused the accident was not conducted in compliance with the planned conditions and the safety rules were deliberately breached. The situation was aggravated by the lack of a post-accident management strategy: minimisation of the accident to begin with; late evacuation of the neighbouring populations (116,000 people evacuated in 1986, then 220,000 people in the following years); requisitioning of firemen and “liquidators” (recovery workers), without providing appropriate protective equipment; construction of an ineffective sarcophagus (shelter structure), etc. Even today, the human and environmental consequences remain difficult to evaluate. Over and beyond the 30 deaths3 among the liquidators during the first few weeks, the 6,000 cases1 of thyroid cancers in children and adolescents, the 340,000 people rehoused2, the human consequences are difficult to assess with precision and have been the subject of controversy. The toll is very heavy, multifaceted and still forms the subject of numerous studies. This disaster revealed the weakness of the oversight of safety by the Soviet Union’s safety organisations. There has been no evidence of excess cancers in France due to fallout from the accident. 1. Source: AIEA – September 2005 Some NGOs denounce this number which they consider to be below the true figure. 2. Source: IRSN 3. Source: UNSCEAR ACTIONS TAKEN Chernobyl, the ultimate disaster Réacteur 4 25 April – 5 May 1986 Sand, clay and lead were dropped onto the reactor to control the fire and an emergency containment enclosure (first sarcophagus) was installed. 18 • Les cahiers Histoire de l’ASN • November 2023
RkJQdWJsaXNoZXIy NjQ0NzU=