Above: The Zaporizhzhia nuclear power plant was never designed to withstand conflict (Photo credit: Energoatom)
As a complex technical facility, where an accident could result in significant emissions of hazardous substances, nuclear reactors are designed to take into account all kinds of failures and equipment damage. It is estimated that safety systems make up to 40% of the cost of a typical nuclear unit. But designers cannot realistically include measures to protect against extremely unlikely events like the impact of a large meteorite or, in what was perceived to be just as unlikely, the events that actually occurred in Ukraine in 2022. On 24 February a new era in world nuclear industry began – a military invasion of a country with 15 operating high-power reactors.
On the eve of war
Zaporizhzhia nuclear plant is in the south of Ukraine on the left bank of the Dnipro River. It consists of six 1000MWe VVER units and produces about half of Ukraine’s nuclear power and a quarter of the country’s total electricity. The first unit was commissioned in 1984, with the remaining ones energising at one-year intervals. Three units were put into operation after the Chornobyl accident. The start- up of the sixth unit was postponed due to a moratorium and was carried out in 1995 – in what was by then independent Ukraine. Today, it is the largest nuclear plant in Europe.
About 11,000 people work at the plant today. This may seem excessive in comparison with Western norms, but outsourcing at post-Soviet nuclear plants is traditionally low. Consequently, the personnel that perform most of the necessary work and services are all on the station payroll.
Employees and their families live in the town of Energodar some 4km from the station and with about 50,000 inhabitants. Zaporizhzhia thermal power plant is also located here. With seven units and a 3600 MWe total capacity it is the largest in Ukraine. The town and both stations are on the same side of the Dnipro River, 100 km by road from the large regional centre Zaporizhzhia and about 200 km from Crimea – the southern point of the Russian invasion.
Before the invasion, for the first time, all the county’s nuclear units were generating electricity simultaneously. Whereas previously some units were always in outage as a normal element of optimising repair and maintenance resources – human and material – all the units were successfully connected to the grid to meet peak winter energy consumption. Zaporizhzhia and the three other operating nuclear plants in Ukraine are all managed by a single national nuclear utility – Energoatom.
The day before the invasion on 23 February, Ukraine’s power grid was disconnected from Russia and Belarus as scheduled, to confirm the possibility of separate operation and subsequent connection to the European grid. In the event the test conditions turned out to be much more difficult than expected.
Invasion and the outbreak of war
As hostilities broke out the destruction of industrial infrastructure saw electricity consumption in Ukraine drop sharply and some reactor units had to be disconnected from the grid and put in reserve. Power lines also began to turn off. Grid automation normally copes with such events, but they can affect the safety of a nuclear plant. After all, a plant not only generates electricity and delivers it to the grid, but also consumes it. Where units are disconnected, a nuclear power plant uses significant quantities of power and for a long time, for the pumps used to cool down the reactors for example. The blackout of a plant means safety-related systems are powered by emergency diesel generators, which must successfully start and operate to supply external power for a minimum of three days.
For this reason, routine loss of power tests are regularly conducted with loss of power to safety system channels and the start-up of emergency generators. Tests covering loss of power to an entire unit are also carried out at first start-up, but tests with loss of power to a whole station, especially a multi-unit one, are never carried out.
Theoretically, after the disconnection of a unit from the grid, the turbogenerator can and should switch to a very low power level and supply the station’s electric needs. But, in this scenario, the reactor also operates at a low power level, and in general, the regime is dynamically unstable and cannot be considered satisfactory for the long-term.
Within a few days of the invasion of Ukraine, all major settlements to the south of Energodar were occupied and Russian military equipment appeared in nearby villages. The plant staff and town residents hoped that the plant, and hence the town, would not be occupied. After all, why capture a large nuclear facility? One explanation did subsequently emerge. During a conference on the physical protection of nuclear materials, Russian representatives stated that the Zaporizhzhia nuclear station was seized “to save the station from Ukrainian Nazis who were about to commit a terrorist attack”.
On 2 March, the Russian military approached the town, but the townspeople went en masse to the checkpoint and barricaded the entrance to the town. After a resolute refusal to admit them, the Russian forces withdrew, but the next afternoon a column of Russian military equipment, including tanks, entered the town and moved towards the nuclear plant. Plant personnel moved to the units and a shelter. It was a shelter that had been designed to protect personnel in the event of a radiation accident, not for bombardment with heavy weapons.
The standoff continued all night. A detachment of the National Guard of Ukraine tried to resist and as a result, tank assaults were launched on the station buildings. Rockets crisscrossed the night sky and explosions rocked the station. Attempts to reason with the occupiers on a loud plant-wide communication system and to inform them about the potential nuclear danger associated with attacking the plant were unsuccessful. While one unit remained in operation, two were urgently disconnected from the grid during the assault.
In horror everyone waited for a potential nuclear catastrophe that the whole world could watch live on the plant’s surveillance cameras. A fire started in the training building, which, fortunately, did not affect the full-scale simulators. Fire trucks and ambulances were blocked from attending.
By the morning of 4 March, the Russian military had completely seized the station territory and began to smash the offices of the administrative building. A new dark era of nuclear power had begun.
For the operators of the units, this was the most terrible shift in their working lives – anticipating events spiralling out of control sparking catastrophe and in fear for the lives of their families in the town. They worked three eight- hour shifts in a row, as the new shift crew did not have the opportunity to arrive at the plant and relieve them.
The impact on safety
By noon it was possible to make an initial assessment of the destruction. The administrative and training buildings were damaged by shelling, as well as other structures and systems. Unexploded ordnance was found within the station boundaries.
There had been no radiation incident, but nuclear power is characterized by a deeper understanding of safety. One of the important elements of this approach is the ‘almost happened event’ or near miss. What ‘almost happened events’ took place at the Zaporizhzhia nuclear plant on the night of 4 March?
Various elements of the plant infrastructure were ‘almost damaged and/or destroyed’:
The power output system – open switchgear is located directly behind the training building which was shelled. The central control room from which all unit and grid electrical connections are controlled, as well as numerous cable routes with communication, control and protection lines.
The main unit transformers, when this fails all unit systems switch to the backup power supply and, in its absence, to the emergency one if it is available.
The emergency diesel generators, the complete failure of which results in a nuclear accident during a unit blackout.
When shells hit the turbine buildings, with their usual glazing and light roofs, the turbines were ‘almost damaged.’ Each of the four rotors weighs up to 200 tonnes and rotates at 1500 rpm. The tips of the turbine blades have a linear velocity close to the speed of sound and if they experience total failure their debris would destroy everything nearby, including the electrical systems used during normal operation that are located in the turbine halls. It is also possible that tonnes of lubricating oil from the turbine and control systems could catch fire and burn.
The reactor buildings were ‘almost damaged’ and as reactors are designed to withstand a plane crash, a tank attack cannot easily result in critical damage to the building. At the same time, tests with a real aircraft crash on a nuclear plant have not been carried out. Furthermore, the safety of a reactor and the readiness of its safety systems depends not only on the integrity of the building but also on the power supply which was ‘almost completely disrupted’.
In addition, a reactor even in an undamaged building could be subject to negative impacts from the secondary circuit where destruction of the turbine leads to the damage of the main steam and feed water pipelines. Although there are designed-in protection and safety systems to manage such an event by isolating the steam generators and supplying cooling water, in the event of serious problems with both normal and emergency power supply it is impossible to guarantee their reliable operation.
Any analysis of these events would not be complete without considering ‘almost damage’ to the dry spent nuclear fuel storage facility. There are 173 containers on the site, with 24 fuel assemblies in each. Yes, the assemblies are being stored in thick stainless steel casks set in concrete shells and very significant efforts will be required to damage the containers sufficient to release fission products into the atmosphere. This fuel has also been stored in cooling pools for many years and it is not as active as it once was, but it has spent three years in the core of a reactor.
With 163 fuel assemblies loaded into each VVER-1000 reactor, in total there are about 25 reactors worth of spent fuel at the storage site all of which was at significant risk that night.
The impact on station’s operational personnel and their role in safety should also be emphasised. The psychological state of personnel is one of the most important elements of nuclear safety and it is easy to understand how the events of late February and early March could significantly reduce the safety margin provided by this element.
Although all these events ‘almost happened’, luckily they did not actually take place. Nonetheless, the plant and all its complex of scientific and engineering achievements was subjected to an unthinkable and many would consider insane military attack.
The situation now
Since then, two long months have passed and the station and town are still occupied. Entry to and exit from the town is almost impossible and, aside from the Dnipro River, occupied territories stretch for 100km in all directions. The road to the nearest regional centre – Zaporizhzhia – goes through several Russian checkpoints. Passage through them is accompanied by thorough searches with uncertain consequences. There have been cases of confiscation of property and arrests. Cars have come under fire with fatal outcomes and fighting is taking place just 20 km from the road.
So-called green corridors to territory controlled by Ukraine were agreed upon and organized several times for residents of Energodar. Some plant employees used this opportunity and sent their families to less dangerous locations but more than once people were turned back.
All the large shops in the town are closed, though the situation is partly saved by small stores and market sellers they require cash and not a single bank branch is open.
Despite such problems, there is electricity, water, heating, as well as mobile communications and internet access, albeit with frequent disconnections. There are no police and Ukrainian legal authorities have been removed and replaced. The Russian flag hangs over the town hall building.
Zaporizhzhia nuclear plant is still under the control of the Russian military. According to the utility, there are around 50 military vehicles, about 400 soldiers and a lot of weapons and explosives there. Unexploded shells were blown up by the Russian military almost on the site. They do not interfere in the operations of the site, but they force the plant management to coordinate all actions and technical decisions with their representatives. Russia has sent a group of employees of Russian nuclear plants, officially for assessing nuclear safety after the shelling of the station and for assisting in repairs.
Ukrainian plant personnel ensure the safe operation of the units, some have been transferred to remote work and the staff minimise contact with the military. This is challenging given the thousands of people who have already died in Ukraine. Reactor operators should be thinking about operations and reactor safety, not about their personal safety and the masked gunmen nearby.
There have been cases where employees, including staff in main control rooms, have left the town with their families and haven’t returned to work. Some staff were unable to return to the town after vacations. Due to the collapse of transport infrastructure, the station is unable to obtain the spare parts and materials necessary for qualitative and timely maintenance and repair. Its annual purchases run to thousands of items and it was only by the end of the second month that the station managed to deliver humanitarian cargo to the town, including technical equipment that is critical for its activities.
Ongoing hostilities have also seen two of the four high-voltage power lines damaged and more than once only a single line remained in operation. None of this contributes to maintaining the proper safety culture.
The outlook for safety at Europe’s largest nuclear power plant
What happens next with station safety will largely depend on military activity. The most optimistic scenario is that Ukraine will liberate this territory and take the plant under full control following all safety standards. However, the occupying forces recently declared the territory to be part of Russia and that the plant already belongs to the Rosatom system. The south of Ukraine is occupied, and the Russians are on the move to annex these territories.
There is hope that there will be no more hostilities and the Russian military will leave the site and the town without fighting, conducting acts of revenge or laying mines within the territory.
There is another less optimistic scenario – the war will move into an indefinite frozen conflict. There is no reason to believe that Russia will easily give up Zaporizhzhia. After all, the plant is a quarter of the country’s power sector.
Under this scenario it can be assumed that the situation with station safety will worsen. Any isolation of the plant will result in delayed and reduced repairs. Modernisation programmes will be postponed indefinitely or cancelled. Any violation of the safety limits and conditions will force the staff to seek and find compromises that will seem reasonable under the circumstances. The fact that not all units are in operation is a small glimmer of optimism, but the number of human errors and equipment failures will likely increase.
Ukraine is the first country in the world with a developed peaceful nuclear industry that has faced large-scale military aggression. Zaporizhzhia is the first nuclear plant in operation in the history of nuclear power that was fired upon by tanks. We must conclude that the impossible is possible and that a country with a developed civil nuclear industry can stoop to military aggression. There is no relevant experience in the world and no regulatory framework for such a situation. No one knows how the industry should respond to a nuclear-dangerous military attack. Though theoretically possible, a readiness to resist bombing cannot economically be built into the design of nuclear power plants. Obviously, technical and procedural measures will be developed to compensate and mitigate against the negative consequences of a military attack
on nuclear power plants. Anti-tank and air defences will perhaps be added, and protective perimeters to defend against rocket and air attacks built. This event will certainly appear on the list of beyond design basis accidents and
in future probabilistic safety analyses. Many industrial, national and international documents in the field of nuclear safety will be revised and further developed. But these problems are not nuclear industry problems as such, they lie in the realm of politics and our collective inability to prevent military conflicts.
Author information: Olexiy Kovynyevis an independent expert, and former reactor operator and shift supervisor, Ukraine
