IEER | Table of Contents, NPD

The Nuclear Power Deception

Some terms used in this report can be found in IEER's on-line glossary.

Part II -- More Nuclear Power Plants or a Sound Energy Policy?

It will not be possible to provide the energy needed to bring a decent standard of living to the world's poor or to sustain the economic well-being of the industrialized countries in environmentally acceptable ways, if the present energy course continues. The path to a sustainable society requires more efficient energy use and a shift to a variety of renewable energy sources.
--Johansson et al., eds. 1993173

Chapter 7: "Inherently Safe" Reactors: Commercial Nuclear Power's Second Generation?

Nuclear power has been promoted in the late 1980s and early 1990s in a number of ways enabling it to regain ground lost in the wake of the 1979 partial meltdown in Unit 2 of the Three Mile Island nuclear plant in Pennsylvania. This has included diverse efforts such as DOE and nuclear industry intervention on behalf of the beleaguered Shoreham and Seabrook nuclear plants in New York and New Hampshire (the latter opened, the former did not), to major stories on the cover of Time magazine.174 A wide array of nuclear industry groups, operating in a coalition named the Nuclear Power Oversight Committee, had the ambition of having a new commercial nuclear plant ordered by the mid-1990s.175 As another example, the Nuclear Energy Institute in 1995 published the fifth annual update of its plan to revive nuclear power.176

This time around the industry has also been putting forward an environmental rationale as part of its promotion of nuclear power. Its spokespersons state that nuclear power could be a principal factor in cutting back emissions of pollutants, notably carbon dioxide which results from the burning of fossil fuels. As an article in Fortune magazine put it, "concern about the earth's rising temperature could turn a technological pariah into a savior -- if new reactor designs overcome worries about atomic safety."177

To address the safety concern, the nuclear industry has been promoting a "second generation" of commercial nuclear power reactors, some of which have been labeled "inherently safe" by their proponents. Is that claim reasonable? Another big question is whether such plants can be economically viable. And is nuclear power the appropriate way to address concerns about the build-up of greenhouse gases?

The safety question is a central one, since public skepticism of industry claims grew greatly after the Three Mile Island and Chernobyl accidents. But the road will be a hard one, perhaps impossible due to the choices that were made in the initial development of nuclear power. The safety issues surrounding nuclear power are especially difficult not only because of the technological complexity of the plants, but also because of the potentially catastrophic and irreversible consequences of severe accidents. For instance, after the accident at Three Mile Island, one of the investigators made the following comment:

If there is one thing that I have learned through the [Three Mile Island] investigation, it is this: Nuclear power plants are very large, very complex systems that cannot be completely accurately modeled. Dangerous transients cannot be incurred deliberately so that the actual plant response to all events can be experienced and tested....Current plant performance statistics must not be accepted as "good enough" because they may not be good enough for the future, and one accident is one too many.178

The NRC also re-evaluated its position on the safety of LWRs; there was a general realization that despite all the studies and analyses that had been done, nuclear plants were not nearly as safe as had been assumed. In the mid-1970s, some believed that the probability of an accident at an LWR involving severe core damage was on the order of one in one million per year of reactor operation. The experience of the Three Mile Island accident, along with subsequent plant-specific probabilistic risk assessments in the mid-1980s led to a revision. The reassessment indicated that, on average, the likelihood of a severe accident at existing reactors may be closer to one in 3,000 per year of reactor operation, or about 300 times more likely than previously thought.179

NRC Commissioner James Asselstine, in Congressional testimony in 1986, put the results of the NRC reassessment this way:

The bottom line is that given the present level of safety being achieved by the operating nuclear power plants in this country, we can expect to see a core meltdown accident within the next 20 years; and it is possible that such an accident could result in off-site releases of radiation which are as large as, or larger than, the releases estimated to have occurred at Chernobyl.180

The safety problems with the current generation of reactors have contributed to the widespread resistance to nuclear power. As even the NRC has acknowledged,

Public acceptance, and hence investor acceptance, of nuclear technology is dependent on demonstrable progress in safety performance, including the reduction in frequency of accident precursor events as well as a diminished controversy among experts as to the adequacy of nuclear safety technology.181

Advocates for a second generation of nuclear plants imply or state that this safety problem has been solved with new designs that rely on "passive" or "inherent" safety features. We will discuss some of these designs in the section below.

New Reactor Designs: An Overview

Although there is strong support among nuclear industry manufacturers for the idea of a revitalization of nuclear power, there is considerable debate as to what type of reactor technology should be used for the job.

Many designs have been proposed, ranging from those that are only modest modifications of current light water designs, to substantially different designs cooled by gas or liquid sodium metal. The basic concepts underlying these latter designs have been around as long as nuclear power, but they were edged out of the market in the early years by the light water reactor bandwagon. The "advanced" reactors tend to have the following features;

There is a basic split between the "old guard" which continues to advocate the basic light water design, with improvements, and those who back non-light water designs in the hope that their design will alleviate the widespread concerns about safety associated with light water reactors. Proponents of the LWR believe that its safety can be improved and that investment in its continued dominance of the market is the best strategy for promoting nuclear power. Advocates of newer designs believe that nuclear power may gain more public acceptance through use of the term "inherently safe." But while these designs have been given new life under the label "inherently safe," it has raised concerns among the light water old guard that this nomenclature implicitly brands the LWR as inherently unsafe.

The promoters of variations on the light water design tend to be those who have strong economic interest in reinvigorating the industry on the basis of the existing light water technology, in which they have substantial investment. For instance the Nuclear Power Oversight Committee, mentioned above, has stated that

The extensive operating experience with today's light water reactors (LWRs), and the promise shown in recent technical developments, leads the industry to the conclusion that the next nuclear plants ordered in the United States will be advanced light water reactors (ALWRs).182

According to this industry group, the advantage of the light water reactor approach is that it "rel[ies] on proven technology."183 This attitude is shared by similarly situated industry members in Europe. Karlheinz Orth, an official of the nuclear division of Siemens AG, for example, has said that the contrast between the effects of the Three Mile Island and Chernobyl accidents proved the basic soundness of the pressurized light water reactor. But at the same time Orth criticizes some of the new designs for an over-reliance on passive systems. As he told an international safety conference in 1988:

The importance of passivity is overestimated. Every reactor concept is based on certain inherent safety features and also depends on active and passive engineered safety features.... Where reliance is placed solely on inherent safety features or on purely passive engineered safety features, it would not be possible for an operator to select or even influence the final condition of the plant....There is no reason to leave today's mature LWR technology only in order to experiment with ... half-developed but 'alternative' concepts. Preferences established by publicity can be no substitute for operational experience.184

To advocates of advanced reactor designs, it is precisely such attitudes that are hurting the chance for the development of a new generation of safer reactors. In the words of an advocate of a helium-cooled, carbon-moderated reactor called the MHTGR (Modular High-Temperature Gas-Cooled Reactor):

Deployment of a qualitatively different second generation of nuclear reactors can have important benefits for the United States. Surprisingly, it may well be the 'nuclear establishment' itself, with enormous investments of money and pride in the existing nuclear systems, that rejects second generation reactors. It may be that we will not have a second generation of reactors until the first generation of nuclear engineers and nuclear power advocates has retired.185

We briefly review some of the proposed light water designs and then do the same for the MHTGR.

New Light Water Reactor Designs

The range of new light water designs has been divided in to two broad classes: evolutionary light-water designs (which are similar to recent LWRs, but have enhanced features), and advanced water-cooled designs (which, although water-cooled, have designs which are significantly different than recent LWRs).186 Several examples of evolutionary LWRs include:187

Evolutionary light water reactors tend to be large (the above models are 1,100 MWe or larger). They incorporate some improvements in fuel-cycle efficiency and safety features, but are not fundamentally different from current designs.189 Thus, they have the same essential safety weakness of current reactors: the risk that the reactor core could melt down in the event of a loss-of-coolant accident and cause a catastrophic release of radioactivity. Being large, they also are more financially risky for utilities due to the unpredictability of growth in demand for electric power. G.E.'s ABWR design and Combustion Engineering's System 80+ received approval for their final designs from the NRC in 1994 and the industry expects design certification 1996.190

Advanced light water reactor designs, on the other hand, tend to be smaller than the evolutionary designs (ranging from 320 to 750 MWe), incorporating many features which are referred to as "passive" safety systems. They also tend to incorporate modular construction features which it is claimed will reduce the costs of the plants. Some examples of advanced light water designs are:191

Much is being made by industry of the "passive" or "inherent" safety features of these light water designs, such as the "emergency cooling features, which depend more on natural processes such as gravity than on powered equipment such as pumps."192 They also tend to include a simplification of the overall design. For example, Westinghouse's AP-600 pressurized water reactor requires 50 percent fewer large pumps and heat exchangers, 60 percent fewer valves and pipes, and 80 percent less control cable.193 The power density in its core is lower as well, at 74 kW per liter in comparison to 108 kW per liter for a conventional Westinghouse PWR.194 The industry backers of these designs hope that such simplifications, combined with modular plant construction and streamlined NRC licensing, will lower construction costs and schedules. Some of these features might reduce the risk of serious accidents, but not eliminate it. The potential for loss-of-coolant, runaway chemical reactions between fuel cladding and steam, and catastrophic meltdown will apparently remain. The G.E. and Combustion Engineering advanced reactor designs received design certification from the NRC in 1997.195

Other Reactor Designs

So-called "inherently safe" reactor designs include those which are substantially different from the light water designs referred to above. These include several new versions of liquid metal-cooled breeder reactors, such as the General Electric Power Reactor Inherently Safe Module (PRISM) design, and Rockwell International's Sodium Advanced Fast Reactor (SAFR). As with other supposedly "inherently safe" designs, these claims appear to be more in the realm of propaganda than fact. Any reactor which uses liquid sodium as a coolant is vulnerable to the violent chemical reactions and potential explosions which can occur from contact of sodium metal with water. Moreover, use of breeder reactors generally involves reprocessing of spent nuclear fuel and plutonium fabrication activities, which bring with them a whole host of safety, proliferation, and environmental issues.


Much of the attention regarding "inherently safe" reactors has been garnered by the modular high-temperature gas-cooled reactor (MHTGR). As noted above, this design relies on helium for coolant and is graphite moderated. As is the case with the pressurized light water reactor, the coolant circulates through steam generators which turn water to steam and drive a steam turbine.196

Although there is a fair amount of experience with gas-cooled reactors in Britain (the Magnox design), there have been only two operating commercial plants in the U.S. which have used the high temperature gas-cooled design: Peach Bottom-1, a 40 MWe reactor in Pennsylvania which operated from January 1967 to November 1974, and the 330 MWe Fort St. Vrain reactor near Denver, Colorado. Neither of these plants is still operating.

It is noteworthy that the Fort St. Vrain HTGR in the U.S. had a lifetime capacity factor of 14.5 percent, an availability factor of 30.9 percent, and a forced outage rate of 60.8 percent before it was permanently shut down in August 1989, partly due to its uneconomic performance.197 In fact, by the above measure, the Ft. St. Vrain HTGR was the single, worst-performing commercial reactor in the U.S. nuclear industry.

The variation of this design most generally discussed in the current debate is of the "modular" variety, so named because each reactor unit is considerably smaller (100 or 150 MWe) than many of the existing reactor units, so that a plant would be made up of several "modules." The smaller versions of the HTGR are claimed to be meltdown proof.

Because it has received so much attention among advanced reactor designs, and because it is one of the electricity-producing designs that may be used for military plutonium disposition and tritium production (although DOE is not now actively considering it), we will discuss this design in some detail.


Although there are several variations, the basic MHTGR design in the U.S. is being promoted by General Atomics. General Atomics' promotional literature describes the reactor in the following words:

The MHTGR is a second generation nuclear power system which can satisfy the concerns of the public, the government, the utilities and the investor community about nuclear safety and investment protection. Based on technology developed and demonstrated in the U.S. and Germany, the unique system makes use of refractory coated nuclear fuel, helium gas as an inert coolant and graphite as a stable core structural material. The safety and protection of the plant investment is provided by inherent and passive features not dependent on operator actions or the activation of engineered systems. The high performance MHTGR provides flexibility in power output and siting, competitive energy costs, and can serve diverse energy needs both domestically and internationally.198

According to General Atomics, the basic safety idea which the MHTGR, its different fuel design, combined with a size limitation for the reactor (hence the term "modular"), is supposed to make one of the most commonly feared accident scenarios -- the core meltdown -- impossible.

In contrast to the zircaloy metal-clad uranium oxide ceramic pellets of a light water reactor, the MHTGR fuel form is designed to withstand a much higher temperature. Instead of being arranged in vertical rods, the fuel is in the form of millions of tiny spheres, each about the size of a grain of sand. The fuel "kernels" of these spheres (about 350 microns in diameter) consist of enriched uranium mixture of uranium oxide and uranium carbide. The fuel kernels are coated with two layers of pyrolytic carbon and one layer of silicon carbide. Thorium oxide grains for breeding uranium-233 fuel are similarly configured. A full core of fuel is designed to contain a total of about 10 billion fuel kernels, which are sealed in vertical holes in graphite blocks. The graphite acts as the neutron moderator.199

Normally, during operation or shut-down, the heat generated by MHTGR fuel is carried away by helium gas coolant. If the main heat transfer systems become unavailable through accident or mishap, there is a system which uses natural circulation of air to passively carry away the heat. This system, called the Reactor Cavity Cooling System, operates by natural circulation of outside air through cooling panels along the reactor walls. This system does not depend on active components like pumps, or on actions taken by operators. If by some means even this system is disabled (by vent blockage, for example), the reactor's proponents claim that direct heat conduction from reactor vessel to the reactor cavity wall to the ground is sufficient to remove decay heat without resulting in significant releases of radioactivity from failed fuel elements.200

MIT nuclear engineering professor Lawrence Lidsky, an advocate of another variation of the MHTGR, has described the safety features of the basic design:

The...radically different fuel capable of withstanding very high temperatures. The [MHTGR] reactors are small to ensure that it is physically impossible for such temperatures ever to be achieved. Such reactors are termed "inherently safe." They are sometimes labeled "passively safe" because no action whatever need be taken to mitigate the effects of equipment failure. Whatever the name, these new reactors eliminate the need for the defense-in-depth strategy. They are designed so that the power plant could suffer the simultaneous failure of all its control and cooling systems without any danger to the public living near the power plant.201

The claims of "inherent safety" for the MHTGR are based on its ability to withstand a loss-of-coolant accident without a catastrophic release of radioactivity. The power density and overall reactor size are substantially smaller in the MHTGR relative to present light water reactors, while at the same time the temperature at which its fuel fails is higher than the zircaloy cladding of LWR fuel.202 But this does not mean that the reactor cannot suffer a loss-of-coolant-accident even in theory. However, the time-scale over which such an accident might develop would be far longer than with an LWR, and the fuel design would help reduce releases of radioactivity, especially if the reactor design incorporated secondary containment.

Safety Concerns

In considering the safety characteristics of the MHTGR it is well to recall the warning of a British survey, which commented that advanced reactor designers "tend to concentrate...on one particular aspect such as a [loss-of-coolant accident], and replace all the systems for dealing with that with passive ones. In so doing, they ignore other known transients or transients possibly novel to their design."

In this context it is useful to note that the principal original safety concern when nuclear reactor technology was under development was not that they might melt down, but that they might explode due to heating caused by a runaway nuclear reaction. This could result from an inadvertent increase in the multiplication factor causing the reactor to become supercritical (see Chapter 2). Neutrons are what cause the fission reaction, and in some cases, the neutron spike accompanying a sudden supercriticality can lead to an explosion of the reactor core. It is this sort of event which occurred at the Chernobyl reactor unit 4 in the Soviet Union on April 26, 1986, resulting in a catastrophic release of fission products to the environment (see below).

Such a concern was also present in the early days of U.S. nuclear power, particularly with regard to the proposed use of liquid metal cooled fast breeder reactors, such as the Fermi-I reactor which was built near Detroit, Michigan before a partial meltdown in 1966 damaged its reactor core.

In an ironic historical footnote that carries an important cautionary lesson for the current debate, it is interesting that the term "inherently safe" appears to have first been applied to the light water reactor precisely because its design was resistant to large positive reactivity insertions which could lead to a runaway power excursion accident. For example, a 1955 Popular Science magazine article lauded the Indian Point-1 reactor then under construction near New York City because of its use of the "Old reliable PWR" design, which was characterized by the article as "inherently safe" because of its "built-in gentleness."203

The MHTGR design, it is interesting to note, is apparently susceptible to large reactivity insertion events. As stated in the Union of Concerned Scientists analysis of advanced reactors:

...we do not consider it to be 'inherently safe' that the MHTGR design experiences a very large reactivity insertion if a control rod ejection accident should occur. In the case of a control rod ejection, the reactor coolant system boundary is breached, and a large reactivity insertion (combined with access of the coolant and/or core to the atmosphere) could result in a very large release of radioactivity to the environment.204

A Nuclear Regulatory Commission study of the MHTGR stated, "Both DOE and [Oak Ridge National Laboratory] calculate that the rapid ejection of a control rod could cause the reactor to go prompt critical. For this reason, the potential for rod ejection from the MHTGR must be precluded by design as it is for Fort St. Vrain."205

In the Fort St. Vrain reactor (which, as mentioned above, is one of only two power-generating HTGRs which have actually operated in the U.S.) the control rod ejection issue was addressed by two redundant structural systems designed to prevent such ejection. As the UCS advanced reactor study notes, however, "This feature of Fort St. Vrain is an engineered safety system solution to an important safety issue; it does not represent an 'inherently safe' design."206

In addition to the potential for reactivity insertions, several other potential safety concerns associated with the MHTGR were discussed in the Union of Concerned Scientists advanced reactor study. These include:

In the advanced reactor designs, air passages of the safety-grade decay heat removal systems provide man-sized passages ... from the protected area yard to locations where relatively small amounts of explosives in the form of shaped charges could breach the reactor vessel.212

It is worth noting that versions of the MHTGR design other than General Atomics' reference design may substantially alleviate some of these concerns. For example, the design, advocated by MIT nuclear engineering Professor Lawrence Lidsky, is only 200 megawatts-thermal in size, and employs a direct cycle gas turbine for generating electricity, rather than the use of a steam generator system assumed in the General Atomics design.213 The use of a gas turbine would remove the need for using water in the system, other than for cooling the gas before it is recirculated into the reactor. This would greatly reduce concerns having to do with water contamination and the concomitant risks (such as a reactivity insertion, chemical attack on the fuel elements, and generation of combustible gases from reactions with steam). This design variant may be adopted by DOE or General Atomics should an HTGR be built in the United States or in Russia.

The discussion above illustrates how variations on the same basic design can potentially result in significant differences in safety level and operational characteristics. They also indicate that a vigorous and open debate over designs while they are still in the paper and experimental, small-scale stages is likely to result in a better and more economical outcome than making adjustments later on.

The Semantics of "Inherent Safety

The general arguments of advanced reactor advocates, some of which may be conceptually plausible and appealing, are difficult to either verify or refute in the abstract. This is because they are all essentially in the design stage, with only very limited details made public. Although greater incorporation of passive safety features, if undertaken with care and rigor, could be an advance in reactor design philosophy, we are concerned with the constant references by advanced reactor advocates to the supposed "inherent safety" of their designs.

Regardless of the validity of claims about immunity to the meltdown accident scenario, this terminology of "inherent safety" has more rhetorical merit than technical content. It is fundamentally misleading to describe as "inherently safe" a technology which necessarily contains and produces such large amounts of extremely hazardous material as does nuclear power. Although it may be possible to design a reactor which renders certain accident scenarios virtually impossible -- or to make reactors that are considerably safer relative to existing reactors -- that does not mean that the technology per se can be considered to have acquired safety as an inherent characteristic.

As stated in a 1990 study by the Union of Concerned Scientists (UCS) which considered several advanced reactor designs,

As a general proposition, there is nothing 'inherently' safe about a nuclear reactor. Regardless of the attention to design, construction, operation, and management of nuclear reactors, there is always something that could be done (or not done) to render the reactor dangerous. The degree to which this is true varies from design to design, but we believe that our general conclusion is correct.214

This conclusion is not limited to groups such as the Union of Concerned Scientists, which maintain a healthy skepticism about nuclear power. A study conducted by Oak Ridge National Laboratory also has reached similar conclusions:

A nuclear reactor can never be completely inherently safe because it contains large quantities of radioactive materials to generate usable heat-energy; but nuclear reactors can be made inherently safe against some types of events and have characteristics which limit consequences of certain postulated accidents.215

These cautionary statements raise another crucial concern: the possibility that in designing to eliminate certain now-commonly recognized accident possibilities, new accident scenarios will be unwittingly introduced. As a survey of advanced designs by Britain's Atomic Energy Agency concluded,

Safety arguments, in many cases, are very underdeveloped, making it difficult to gauge if the reactor is any safer than traditional systems. [Advanced reactor] designers tend to concentrate... on one particular aspect such as a [loss-of-coolant accident], and replace all the systems for dealing with that with passive ones. In so doing, they ignore other known transients or transients possibly novel to their design.216

This is an important warning. Nuclear technology is complex, and it has taken many years of analysis and experience to even recognize the existence or the possibility of some accident possibilities for the four-decade-old light water reactor. The history of nuclear power development is replete with instances of incidents occurring at operating power plants which had not previously been thought possible. This is even true of the meltdown scenario discussed above, which was not even recognized as a safety issue until the mid-1960s -- over a decade after the decision to build the Shippingport reactor. In view of this history and the complexity of reactors, it would be prudent to anticipate that similar unexpected discoveries may be encountered in the development of a new generation of reactors based on any new design.

The verification of the safety claims of any particular vendor, of course, requires that the details of the design be made public so they can be examined for potential safety flaws. Handwaving arguments about general design features which are alleged to guarantee inherent safety should not be allowed to substitute for actual design details and real-world data on actual components. To a large extent, however, the fine engineering details do not yet exist for designs that are not yet "construction ready."

The entire debate to date on the issue of the level of safety of new reactor designs has taken place largely on a theoretical level. While theoretical work is a necessary part of design, it cannot settle all essential safety questions by itself. Even the degree of relative safety of a reactor design is no easy matter to determine. Questions relating to the net level of improved safety are highly complex, and rely on substantial analysis of the fine details of design and experience accrued over time.

Safety uncertainties can never be fully resolved in advance, and will inevitably remain large until many years of operating experience have been acquired with advanced reactor designs. That is a crucial problem in the development of nuclear power. Operating experience is needed to make the right decisions about overall designs as well as critical detail, but getting that operating experience in itself involves non-negligible risks, at least if the scale of reactors is anywhere close to those required for large-scale commercial power generation. The only approach that could resolve this aspect of the problem of nuclear power is to study designs on paper thoroughly and then to acquire long experience with small scale devices, much in the manner that small-scale models of airplanes are tested extensively in wind tunnels prior to construction of full-scale prototypes.

Accidents and Nuclear Technology

Three major reactor design concepts have been put forward since the start of the nuclear era that have been implemented in commercial nuclear power:

As with any technology, there have been a variety of problems in the development and implementation of nuclear power plants which have led to improved safety features. Some malfunctions were the result of experiments to test reactor designs, as was the case with the partial meltdown of the EBR I reactor in Idaho. Table 1 shows a list of some reactor accidents, including the major known ones.

Despite the considerable progress in understanding reactor safety over five decades (including experience with Manhattan Project reactors), the potential for catastrophic accidents continues to exist. A major reason is that nuclear power reactor designs were selected too quickly on the basis of energy, economic, military, and political criteria that did not give sufficient weight to the problems associated with catastrophic accident possibilities.

Light water reactors, by far the most common design today, were the simplest for the U.S. to build in the short-term and hence gave the largest propaganda advantage to the United States during the Cold War. But this meant that the laboratory and theoretical work that was needed to understand the most severe accident, the loss of coolant from the reactor core, was completed over a decade after the 1954 decision to build Shippingport. By that time the investment in the light water reactor was so great that the main reaction of the AEC was to try to cover up or downplay the seriousness of the problems.

Table 1: Some Reactor Accidents

Reactor Type


Accident Type


Iodine-131 Release (Curies)


Graphite-moderated, gas-cooled

Sellafield, Britain

graphite fire




Graphite-moderated, water cooled

Chernobyl, Ukraine

supercriticality, steam explosion and graphite fire


7 million, perhaps far greater (see text)

Safety experiment went awry; total release 50 to 80 million curies or more; potential for continuing large releases exists

Sodium-cooled fast breeder

Lagoona Beach (near Detroit) U.S.

cooling system block, partial meltdown


release confined to the secondary containment

Reactor was being tested for full power, but did not reach it; four minutes from indication of negative reactivity to meltdown

Sodium-cooled fast breeder

Monju, Japan

major secondary sodium leak



Secondary sodium was not radioactive; reactor was in test phase; extensive sodium contamination in plant

Light water reactor, PWR type

Three Mile Island, near Harrisburg, U.S.

cooling system failure, partial meltdown


13 to 17

Secondary containment prevented release of millions of curies of I-131; accident developed over several hours

Light water reactor, BWR type

near Idaho Falls, U.S.

accidental supercriticality followed by explosion and destruction of the reactor



Small U.S. Army experimental reactor using HEU fuel; 3 operators were killed

Heavy-water cooled and

-moderated reactor

Chalk River, Canada

lack of coolant for a fuel element


radioactivity apparently contained within building

Highest worker dose 19 rem

Heavy water-moderated, light water-cooled, experimental reactor

Chalk River, Canada

inadvertent supercriticality and partial meltdown


"There was some release of radioactivity"

President Jimmy Carter helped in the clean-up

Heavy water-moderated and -cooled, CANDU type

Narora, Rajasthan, India

turbine fire; emergency core cooling system operated to prevent meltdown system


apparently no release of radioactivity


Sources: Chernobyl: NRC 1987 and Medvedev 1990; Sellafield: Makhijani et al. eds. 1995, Chapter 8; Three Mile Island: TMI Commission 1979 ; Lagoona Beach (Fermi-I) Alexanderson, ed. 1979 and Fuller 1975; Idaho: Horan and Gammill 1963 and Brynes et al. 1961; Monju: press reports; Chalk River: John May 1989 and Weinberg 1994; Narora, press reports.

There are at least three questions pertaining to catastrophic nuclear power plant accidents that are germane to the evaluation of the soundness of nuclear technology as a choice for future energy supply:

    1. Is it possible to learn enough from non-catastrophic accidents in small-scale plants to prevent future catastrophic accidents in large-scale ones?
    2. Is the scale of the accident such that the ill-effects could far exceed the benefits of any economies to be gained from nuclear energy versus some other energy choice?
    3. Which generations would pay the price for the accident consequences -- that which got the energy benefits or future generations?

Similar questions can also be asked about other technologies. We will address some aspects of this issue in the concluding chapter of this report. Let us first examine the Chernobyl accident, by far the worst in the history of nuclear power, for the lessons it might have to offer.


On April 25, 1986, the operators of the Chernobyl Unit Number 4 were scheduled to perform an experiment designed to test an aspect of the safety of the RBMK design. The experiment was delayed for a number of reasons, including difficulty in stabilizing reactor power level. The operators decided to proceed with the test at 1:22 a.m. on the morning of April 26. Thirty seconds after the test began, an automatic computer printout indicated unsafe conditions, requiring the reactor to be shut down immediately.

There followed a runaway supercriticality which greatly increased the power level, heated up the reactor, and increased the steam pressure in it to such high levels that it exploded, blew off the top of the reactor, and destroyed it. Less than 90 seconds had elapsed between the computer warning to shut the reactor and the total destruction of the reactor.

Thirty fires were ignited in the reactor core and in other parts of the power plant, including the turbine building. Fire fighters arrived at the scene an hour-and-a-half later. They extinguished fires other than those in the reactor core relatively rapidly, but the reactor graphite fire lasted for ten days. Radioactivity releases went on for months after the fire had been extinguished.217

It was one of the two worst industrial disasters in human history, the other being the December 1984 disaster at the Union Carbide plant in Bhopal, India during which deadly methyl isocyanate gas was released. In both accidents hundreds of thousands of people were affected during the accident and in its aftermath. Thousands of people died on the night of the Bhopal catastrophe; in the case of Chernobyl the immediate toll has officially been reported as 31, which is on the order of a hundred times lower. But the affected population increased dramatically in the aftermath of Chernobyl -- 130,000 people were evacuated, including the entire population of 45,000 in the town of Pripyat. More were evacuated subsequently, and hundreds of thousands of workers and soldiers were pressed into entombing the leaking reactor, digging up and burying vast quantities of highly contaminated soil, and performing other clean-up jobs.

Official estimates put the cumulative release of radioactivity between April 26 and May 6, when the fire was put out, at about 80 million curies. Of this total, 45 million curies are attributed to xenon-133, 7.3 million to iodine-131, 1 million to cesium-137, half-a-million to cesium-134, and 220,000 to strontium-90.218

These official Soviet estimates are misleading and understate the actual extent of the releases. For instance, the release estimates are adjusted for decay to ten days after the accident began. Xenon-133 has a half life of 5.27 days and most of it was emitted early on in the fire. On this basis, the actual amount in the fallout cloud as it passed over communities was considerably greater. Similarly, iodine-131 has a half-life of 8.05 days and far more of it was deposited on grazing lands than indicated by the decay-corrected estimate of 7.3 million curies.

Zhores Medvedev, the Soviet scientist who first reported on the other nuclear catastrophe in the Soviet Union, the explosion in a high-level waste tank at Chelyabinsk-65 in 1957,219 states in his study of the Chernobyl accident that the official figures for radioactivity releases include only the amounts deposited inside the former Soviet Union and do not take into account the much larger deposition of some radionuclides, such as iodine-131 and cesium isotopes outside Soviet territory. According to his analysis, this is because the Soviet government did not want to acknowledge "any liability for radioactive contamination of the environment in other countries" and hence it insisted that "the amount [deposited outside the Soviet Union] was negligible."220 Medvedev estimates that releases of radioiodine and radiocesium were about three times higher than the official estimates cited above.221

One of the most important, unanticipated features of the Chernobyl accident was ten-day duration of the fire, which was accompanied by a correspondingly long time during which large releases of radioactivity continued. As Medvedev points out, the modeling of nuclear power plant accidents generally assumes a single, short-term release of radioactivity. Weather conditions during such short releases can reasonably be assumed to be constant. As a result severe accidents are assumed to have a fallout trace that forms a single elongated, cigar-shaped pattern, much like the typical fallout pattern from a nuclear bomb explosion near ground level. This assumption is sometimes valid. It was, for instance, the pattern of radioactivity released as a result of the 1957 Soviet explosion in a tank containing highly radioactive waste. But it was not valid for the Chernobyl accident.

During the ten days of the fire, which was accompanied by huge releases of radioactivity, wind directions and the weather changed many times. As a result, large, widely scattered areas in many compass directions were affected. Rainfall in some areas during this prolonged period created hot spots of radioactivity in three states of the Soviet Union, now separate countries: Ukraine, Belarus, and Russia. Countries far beyond the Soviet Union were also affected. Europe was especially affected by the fallout, and levels of iodine-131 in milk exceeded officially permissible levels in many countries. Every country in the northern hemisphere received some fallout from the accident.

An "exclusion zone" 30 kilometers in radius was established and, after delays, 130,000 people were evacuated. Agriculture and commercial activities were also prohibited in the area. But the actual area that was contaminated and the number of people affected was far larger. There were hot spots as much as 100 to 300 kilometers from the accident that had radiation levels on the order of one thousand times above natural background. Long-lived biologically sensitive radionuclides, notably cesium-137 and strontium-90 were deposited in large quantities.

Iodine-131 concentrates in milk; when this milk is consumed, it concentrates in the thyroid glands, especially affecting children. After the iodine-131 decayed away in a few months (ten to twenty half-lives), milk produced in the contaminated regions continued to be affected by cesium-134 and cesium-137 contamination. The ill-effects of cesium-137 will last for a hundred years or more.222 There was a ban on open market milk sales in several regions, affecting 20 to 25 million people for more than a year after the accident.223 Even with these extensive measures, milk production was not halted in all contaminated regions. Some people in the most rural areas immediately around the plant consumed contaminated milk in the aftermath of the accident at a time when sales of such milk had been banned in Kiev. Cesium-137 contamination of milk will continue for many decades.

The region around Chernobyl consists largely of swamps and soggy forest land. Much of the land has been reclaimed for agricultural use, the dominant use at the time of the accident being cattle grazing. The prevalent ecological conditions are conducive to retention of cesium and to its rapid transfer to plants. As a result, agriculture was affected over a vast region. The most immediately affected area was the 30-kilometer radius exclusion zone in which 70,000 hectares (175,000 acres) of fields, grazing land, and vegetable and fruit gardens were abandoned. In June, there was a further evacuation of 113 villages outside the exclusion zone in Belarus and Ukraine. Between 100,000 and 150,000 hectares (250,000 to 375,000 acres) of agricultural land were abandoned.

Levels of cesium-134 and cesium-137 contamination are especially important as criteria for suitability for agricultural use. Medvedev estimates that "if international standards were being applied for the use of agricultural land, nearly one million hectares would be considered lost for a century, and about two million hectares would be lost for 10-20 years."224 There have been anecdotal reports of large increases in farm animals born with genetic defects. At one collective farm, 27 abnormal calves were born in the year after the accident while none had been reported in the five years preceding it. The number of suckling pigs with genetic defects increased from three cases in five years to 64 in one year.225

Most contaminated agricultural land continues to be used for farming. Indeed, many people who were evacuated from severely contaminated areas have returned to them due to economic problems in the areas to which they were relocated and the wish of many older people to live and die at home.

A large amount of agricultural produce in Europe had to be dumped due to contamination from fallout. For instance, most vegetables in the region around Munich were destroyed because they had become contaminated with iodine-131. The southern portion of the former West Germany was more contaminated than the rest of it. There were also severe restrictions on agricultural activities, including sales of meat from three million sheep and lambs in northwestern England and the neighboring portions of Scotland and northern Wales, which were affected by rain-out of radioactivity when the fallout cloud passed over them.

Health Effects

Several categories of people have been and will be affected adversely by radiation doses from the Chernobyl accident:

The assessments of adverse health effects from the accident have varied widely. Official reports have tended to concentrate on the 31 workers who died of severe radiation exposure. But this attitude ignores the far greater numbers of people who were exposed to considerable levels of radiation and who became ill in the months and years that followed the accident and who have an elevated risk of various radiogenic diseases in the years to come. It also does not take into account the effects of the accident for decades to come.

One complicating factor in assessing the health risks due to the accident has been the severe deterioration, bordering in many areas on collapse, of social services, including health delivery services in the former Soviet Union. As a result, the increases in diseases and death due to radiation exposure are mixed up with those arising from the general deterioration in medical care and economic conditions.

Some indication of the potential health damage can be obtained by looking at the radiation doses. The range of exposures of the people who lived in the exclusion zone was generally of the same order of magnitude as the survivors of Hiroshima and Nagasaki -- that is, about one rem to several tens of rems external gamma radiation. In addition, people were exposed to beta radiation and internal doses from various radionuclides such as iodine-131 and cesium-137. The officially estimated cumulative population dose for the 135,000 people who were initially evacuated (with delays) is estimated at 1.6 million person-rem. Applying a risk factor of 0.0004 cancers per person-rem to this dose yields an estimate of 640 fatal cancers.226

Medvedev has pointed out that the official dose estimate includes only external radiation. It does not include doses from consuming contaminated food, such as milk continuing cesium isotopes and iodine-131. It is now clear that internal exposures are a significant factor in long-term effects of the accident. Thyroid diseases, including thyroid cancer in children, generally attributed to the consumption of milk contaminated with iodine-131, have registered huge increases in the fallout areas. Ten to one hundred-fold increases in thyroid cancer among children in the affected region have been reported.227 Over the decades tens of millions of people will have been put at significantly increased risk, and it is reasonable to assume that many will die as a result. The poor state of both medical monitoring as well as curative medicine in the former Soviet Union means that medical systems are not likely to record many of these deaths as having been related to the Chernobyl accident. But that cannot negate the documented magnitude of the immense contamination and risk to which the present and future generations living in tens of thousands of square kilometers of highly contaminated land are being, and will continue to be, exposed.

The number of deaths from increased exposures even in the far off contaminated regions in the European Community (EC) are projected to be large. The British National Radiation Protection Board estimates that up to 1,000 additional cancer deaths will occur in the EC region due to radiation doses from radiocesium and iodine-131. Medvedev considers this a "minimal assessment."228

Medvedev has cited the entire range of estimates for cancer death estimates that have been made. The lowest estimates are 200 to 600 additional cancer deaths in the former Soviet Union, while the highest estimate is 280,000 additional cancer fatalities worldwide.

These estimates do not include adverse health effects on workers and soldiers who were the clean-up crews and hence among the most severely affected. There are no systematic records of their exposure or even of how many of them were involved. Medvedev quotes an eyewitness account of the working conditions of the soldiers who did the clean-up work in the immediate aftermath of the accident:

I saw soldiers and officers picking up graphite [ejected from the reactor core by the explosion] with their hands...There was graphite lying around everywhere, even behind the fence next to our car. I opened the door and pushed the radiometer almost onto a graphite block. Two thousands of roentgens an hour...Having filled their buckets, the soldiers seemed to walk very slowly to the metal containers where they poured out the contents, You poor dears, I thought, what an awful harvest you are gathering...

The faces of the soldiers and officers were dark brown: nuclear tan.

Medvedev estimates that the radiation tan on the soldiers' faces indicates skin doses of 400 to 500 rem, that many of them suffered from acute exposures, and that some died as a result. No records have been kept, or at any rate, made public, of the numbers of soldiers involved in such activities or of their exposures.

Large numbers of workers were also exposed to high levels of radiation in the years that followed when a concrete "sarcophagus" was built around the burned out reactor building to try to encase the radioactivity. Two hundred thousand men, working very short shifts, were involved in its construction. The radiation levels were extremely dangerous, with the most radioactive areas measuring between 5,000 and 20,000 rads per hour. The sarcophagus was built in the hope that it would contain the radioactivity for an extended period. But it has already deteriorated considerably and new measures to contain the radioactivity appear to be necessary. There is no consensus on the appropriate approach to contain the enormous amount of radioactivity in and under the building, but whatever measures are taken, they will be costly. If measures are not taken, the costs, in terms of contamination of important sources of water supply of the region, could be far higher.

The overall costs of the Chernobyl accident are so vast and extend over so many generations that they are impossible to calculate. The official calculation of 8 to 11 billion rubles (1988 rubles), or roughly ten to fifteen billion dollars. But any evaluation is complicated by the fact that a large number of clean-up workers are neither being followed nor treated. It is also very difficult to quantify the economic and social losses caused by the uprooting of hundreds of thousands of people. Further, the high radiation doses received by many mean that problems other than cancer are also likely to occur. For instance, diseases induced by the weakening of immune systems of clean-up workers and off-site populations who received high radiation doses could cause large health and economic impacts. But, given the state of the health delivery systems, they would be difficult or impossible to detect. Finally, the negative impact of Chernobyl on the electricity systems of the former Soviet Union is still being felt and enormous costs loom in terms of preventing the spread of radioactivity from the reactor, preventing accidents at other reactors of the same design, and replacing reactors generally considered to be unsafe well before their design lifetimes. The costs of replacing electric generating capacity not provided by RBMK reactors, which are generally considered to be far too dangerous in the West, could by itself run into tens of billions of dollars.

Some Lessons of the Chernobyl Disaster

The most important and tragic lesson of the Chernobyl accident is the most severe kind of nuclear power accident can actually happen. Nuclear power technology is unforgiving. It has often been stated by proponents and opponents alike that it does not allow room for mistakes. Design, management, and operator errors have typically combined to yield accidents; in many cases, these same features have also helped limit the damage. In the case of Chernobyl, the factors propelling the situation towards a major accident completely overwhelmed any checks in the system.

It is generally agreed that accidents on the scale of Chernobyl or worse are more probable in the Former Soviet Union and Eastern Europe, but they are also possible elsewhere. That potential has been demonstrated events such as the 1979 Three Mile Island accident and the British Windscale reactor fire in 1957. The scale and the irremediable nature of the damage from Chernobyl leads to a crucial question: is it possible to design nuclear reactors that would not be subject to accidents of such catastrophic magnitude? This is not the same as ruling out all accidents, which is clearly impossible with any technology. It is merely to ask whether the damage can be limited so that it is at least remediable in its worst aspects.

As we have discussed, current nuclear power plant designs do not meet this goal. LWRs, graphite-moderated reactors, or sodium-cooled reactors in the West all have vulnerabilities in design and/or operation that could lead to severe accidents. The record shows that the probabilities of catastrophic accidents are lower in the West than in the former Soviet Union. But this is an inadequate response, given the nature of the consequences and the fact that energy alternatives that would avoid catastrophic accident potential are available.

We can grant that the safety of nuclear power plants in the United States has improved over the decades, as public vigilance and the Three Mile Accident have forced the manufacturers to conform to stricter safety standards. However, these efforts cannot negate the fact that current power reactor designs are vulnerable to catastrophic accidents. Chernobyl demonstrates that the effects of such accidents are as devastating as they are irremediable. In this context it is well to recall a criticism of nuclear power plant safety efforts made by Nobel laureate physicist, Hannes Alfven, in 1972:

The reactor constructors claim that they have devoted more effort to safety problems than any other technologists have. This is true. From the beginning they have paid much attention to safety and they have been remarkably clever in devising safety precautions. This is...not relevant. If a problem is too difficult to solve, one cannot claim that it is solved by pointing to all the efforts made to solve it.230

Footnotes to on-line portions of the report
Full references to the report

Reports Main Page
IEER Homepage
Institute for Energy and Environmental Research
Comments to Outreach Coordinator:
Takoma Park, Maryland, USA

Revised May 9, 1996
(Chapter 7 posted September 11, 2001)