The term black box comes from aviation, where each incident and crash is investigated in detail. “Black box thinking” centres on a willingness and tenacity to investigate the lessons that often exist when we fail, but that we rarely exploit.
Inspired by black box thinking, we will try to understand the events leading up to the Chernobyl disaster and study some of the lessons learned to prevent future mistakes. Human nature is often a contributing factor to a disaster and so we have found this exercise highly relevant in making DB pension schemes more robust in an uncertain world.
At Forsmark Nuclear Power plant in Sweden, the executive morning meeting on Monday 28 April 1986 was interrupted. Several reports of increased levels of radiation came in from the checkpoints. The plant went into alert mode and the Swedish atomic agency was immediately informed. According to safety protocol, all non-essential personnel were evacuated. Soon it was clear that the radiation had not come from one of the three reactors at Forsmark – the radiation level was higher outside the plant than inside. After studying the wind direction and identifying the radioactive isotopes, it was clear that there had been a large civilian nuclear accident. Sweden issued the diplomatic statement “There has been a nuclear accident in a country east of Finland”. This is how the western world first learned about the Chernobyl disaster.
Three days earlier, 1,300 km away in the northern part of what is now The Ukraine, the management of the Chernobyl nuclear power plant was preparing for a test – the plant had a safety issue that needed to be addressed. In case of a power failure, it would take the emergency diesel generators more than 60 seconds to deliver enough power to operate the main circulating pumps, cooling the reactor core. Anatoly Dyatlov, the deputy chief engineer, wanted to test if it was possible to bridge this time gap by extracting enough residual energy from one of the main steam turbines while the reactor was powering down.
A safety test that went horribly wrong
The test begun just after midnight on 25 April. The reactor power was slowly reduced and at 2 p.m. it was operating at 50% power. It took until 11 p.m. for the Soviet electricity authority to give approval to power down the reactor. Initially, the shutdown went according to plan, but 30 minutes into the morning of 26 April, the reactor power fell much quicker than expected. Aleksandr Akimov, the unit shift chief, wanted to abort the test and let the reactor stop naturally, but the deputy chief engineer overruled. Dyatlov ordered the removal of additional control rods from the reactor to increase the power. Around 1 a.m. the reactor stabilised.
To continue to operate the reactor at this level of low power, the automatic shutdown mechanism was disabled by Dyatlov at 1:19 a.m. All but six control rods were removed to reach the necessary power level for the experiment. Three minutes later, the pressure channels inside the reactor begun to rupture and the pressure fell sharply in the steam drums. At 1:23:40 a.m., operators hit the emergency shutdown button that would insert all control rods, but the rods got stuck after travelling only one third of the required distance. A few seconds later, the reactor reached more than 100 times its maximum power and the uranium rods in the core began to melt. The water in the pressure channels evaporated, resulting in a steam explosion that blew away the massive concrete lid of the reactor. Oxygen entered and ignited the graphite – the worst nuclear disaster in human history.
The magnitude of the disaster was not understood at first. Dyatlov insisted that it was an explosion in the emergency tank located above the reactor and that the reactor core itself was intact. Within hours of the disaster, the Soviet deputy energy minister wrote a secret message to the Soviet Communist Party conveying this misconception and stating that there was no need to evacuate the nearby city of Pripyat. At 8:00a.m. the morning shift arrived and continued to operate the other reactors, which were not powered down until 24 hours after the accident.
It was the morning of 27 April before the sheer size of the disaster was fully recognized. There are countless reports of unselfish and heroic actions undertaken by the individuals who were fighting the fire and preventing the disaster from worsening in other ways. The early rescue workers did not have protective clothing or even dosimeters. The army called in young men from all corners of the Soviet Union to help, but there was not enough protective clothing for everyone and many had to make their own protection gear by assembling sheets of lead. The construction of a temporary concrete sarcophagus began one month after the accident and was completed in mid-December. The 600,000 people who worked on the clean-up were known as ‘the liquidators’.
The public was kept in the dark
The people living near the Chernobyl power plant were provided no information, let alone training, for what to do in case of a nuclear accident. In Pripyat, home of the power plant workforce, people gathered on a railway bridge leading to the Chernobyl plant to watch the graphite fire that burned in all the colours of a rainbow. This bridge is known as ‘The Bridge of Death’ because those who stayed and watched the fire were exposed to lethal levels of radiation. Life in Pripyat continued as usual and it took more than one and a half days before the order was given to evacuate the city. In the following days, those who lived within a 30 km radius were evacuated. In total, 115,000 had to abandon their homes and leave everything they had behind, never to return.
The Soviet regime imposed tight censorship on the information surrounding the Chernobyl accident. On 28 April there was a very short report on state television. The following day, a Ukrainian newspaper briefly mentioned the accident in six sentences, hidden away on page 3. In the nearby city of Kiev, people and particularly children were ‘motivated’ to join the Labour Day demonstrations on 1 May. The wind had turned and the radiation levels in the city centre were 100 times higher than the limit set by the authorities. It is estimated that 120,000 adults and children participated in the demonstration, but the children of the party elite had already been flown out of the region.
It took almost two weeks before the media begun to mention actions people should take for their own safety. One article said that the dust was dangerous and it was advised that children shouldn’t play outside, but that there was no direct danger of radiation. In the two years following the accident, the KGB deliberately tried to prevent the spreading of information about the Chernobyl accident.
How could this happen?
The RBMK reactor design had its origin in Soviet military plutonium production reactors. These light-water cooled and graphite-moderated reactors were inexpensive to build and cheap to operate. The design did not require heavy water for cooling and could use natural uranium as fuel instead of the more expensive enriched uranium. This enabled the Soviet to build several large reactors that were simple enough to be operated and maintained by local staff.
A drawback with this design was that the reactors had a dangerously high positive void coefficient. The physics behind this is quite simple. Together with the graphite, the light-water acted as a moderator but it was also used for generating steam to power the turbines, generating electricity. Steam as a moderator absorbed less neutrons than water and, under the extreme circumstances of the test, this created a self-reinforcing feedback loop. When the power began to increase, more steam was produced, which in turn led to an increase in power and so forth, leading to a core meltdown.
In the Soviet, the design of the reactor was classified and it was not permitted to discuss flaws in the design, not even by the people operating the nuclear plants. This made it near impossible to learn from minor incidents and continuously improve the safety protocols. Instead it created a culture of covering up and marginalizing incidents. In the memoirs of the First Deputy Director of the Kurachatov Institute of Atomic Energy, he revealed that the scientists had long known the that the RBMK reactors had significant design flaws.
The first International Atomic Energy Agency report, INSAG 1, published in September 1986, effectively placed the blame for the accident on the operators of the power plant for violating rules and regulations. In 1992 a new report was published, INSAG 7, and it concluded that the problems went much deeper. “The accident can be said to have flowed from a deficient safety culture, not only at the Chernobyl plant, but throughout the Soviet design, operating and regulatory organizations for nuclear power that existed at that time.”
The Soviet regime implemented several upgrades of the reactor design that lowered the positive void factor and used higher quality uranium. The World Association of Nuclear Operators was founded in 1989 as a direct consequence of the Chernobyl accident and is dedicated to nuclear safety by openly sharing information and clear communication between operators, similar to the practices used in civil aviation.
Consequences for thousands of years
The long-term consequences of the Chernobyl accident will be present for generations to come for northern Ukraine, neighbouring Belarus and Russia. The 30 km exclusion zone is estimated to be uninhabitable for another 3000 years. The fallout was not uniformly distributed and the area outside the exclusion zone was classified as zone 1 to 4, depending on the level of radiation.
The Soviet regime down played the consequences of the accident and not much was done to find a long-term solution to the reactor ruin. The long-term health of the more than 600,000 liquidators has not been systematically monitored, so it is impossible to assess the long-term consequences for them. . The official death toll reported by the Soviet regime is 31. A UN report estimates the number of premature deaths due to the Chernobyl accident to be 4,000, while there are other estimates in the hundreds of thousands.
After the collapse of the Soviet Union in 1991, discussions around a longer-term solution began. The sarcophagus was a temporary solution kept together by gravity as the construction elements were lowered in place from helicopters. It was clear that something had to be done, but the newly independent Ukraine was far from a wealthy country. The Chernobyl Shelter Fund was set up in 2007, and it has received €1.5 billion from 45 donors. The fund is managed by the European Bank for Reconstruction and Development who contributed an additional €500 million.
In 2010, the construction of the New Safe Confinement began a few hundred meters from reactor 4 and, in October 2017, it was slid into place. It is estimated to have a lifespan of at least 100 years and with its remote-controlled crane system the reactor ruin can be dismantled piece by piece and the debris processed in a safe way. Hopefully future generations will look back on this as the beginning of a new and more positive chapter in the Chernobyl chronicle.
Lessons learned for the DB pension industry
The DB contract suffers from a design flaw similar the RBMK reactor. The DB contract is not financially robust and combined with the current regulation, it is fair to say that the DB system has an extremely high ‘positive void coefficient’. With a strong sponsor covenant the liabilities can be discounted with a higher interest rate, so if the covenant weakens a lower discount rate must be used, which in turn further weakens the covenant. In addition, it is fair to assume that the sponsors’ core business will typically struggle when the economy enters a recession. In that case, the covenant strength will be weakened at the same time as the equity investments of the DB scheme fall sharply. As an industry we need think about how to make the DB contract more robust and amend the regulation so that we lower the ‘positive void coefficient’ in DB.
The communication around the risk in the DB system should be clearer towards its members. It is important that we do not use optimistic assumptions to diminish the size of the funding problem. The members deserve an objective valuation method that they can trust. The core lesson from Chernobyl is not to cover up and quickly allocate blame. We should not be afraid to put all the information on the table and try to find solutions – hiding the problems behind an expert façade and hoping for the best did not work in the old Soviet and it will not work in today’s DB pensions in the UK.