The Chernobyl disaster: when the people operating the equipment were blamed before the equipment itself was properly understood.
At 01:23 on 26 April 1986, Reactor 4 at the Chernobyl nuclear power station exploded.
Within hours, the reactor building had been destroyed. Radioactive material was escaping into the atmosphere. The consequences would spread across Europe.
The initial explanation was relatively straightforward.
The operators had violated procedures. They had disabled safety systems. They had taken the reactor into an unsafe operating condition.
In September 1986, the International Atomic Energy Agency's International Nuclear Safety Advisory Group published INSAG-1, largely reflecting the Soviet account of the accident. Its conclusions placed heavy responsibility on the operating personnel, describing an extraordinary combination of operating-rule violations and human errors.
In July 1987, six senior plant officials stood trial. Prison sentences of up to ten years followed.
But the explanation was incomplete.
Five years later, a much more detailed investigation would expose serious deficiencies in the reactor's design, the information supplied to operators and the organisation responsible for nuclear safety.
The people in the control room had made mistakes. But the equipment they were operating had a dangerous characteristic they had not properly been told about.
The design flaw nobody understood
The Chernobyl RBMK reactor had a fundamental characteristic known as a positive void coefficient.
In simple terms, when water in the reactor core turned into steam, the resulting reduction in neutron absorption could increase the nuclear reaction rate.
Under certain operating conditions, more steam meant more reactivity, more heat and still more steam.
It created the potential for a dangerous positive feedback loop.
The problem was compounded by the design of the reactor's control rods.
These rods were intended to reduce the nuclear reaction when inserted into the core. But their graphite displacers created an unexpected effect during the initial phase of insertion.
Instead of immediately reducing reactivity throughout the affected regions, the rods could briefly increase it.
This became known as the positive scram effect.
The emergency shutdown mechanism, intended to make the reactor safer, could initially produce the opposite effect under particular conditions.
The operators did not properly understand the significance of this behaviour. The relevant design characteristics and their safety implications had not been adequately communicated to the people operating the reactor.
The problem wasn't simply that someone pressed the wrong button.
The safety system itself had a dangerous design characteristic that was not properly understood by those relying on it.
The original investigation got the balance wrong
The 1986 INSAG-1 report relied heavily on information supplied by Soviet authorities shortly after the accident.
Its account emphasised operator actions, including alleged violations of operating procedures and the disabling of safety systems.
But as further technical information became available, serious questions emerged.
In 1992, INSAG published its reassessment, INSAG-7: The Chernobyl Accident: Updating of INSAG-1. The report is explicit that it "does not retract INSAG-1, nor does it alter the conclusions of that report except as clearly indicated" — but it states plainly that "the balance of INSAG's judgement of the factors contributing to the accident has shifted."
The change in emphasis was substantial.
The report identified that certain actions originally described as violations of operating rules were not, in fact, violations. Blocking the emergency core cooling system was not prohibited under normal Chernobyl procedures, and had been approved by the Chief Engineer. Running the reactor below 700 MW(th) was not actually proscribed. Several of the requirements cited as violations had, in fact, existed in regulations all along — they had simply never been enforced.
It also identified major deficiencies in the reactor itself:
- Unsafe characteristics in the RBMK reactor design.
- Inadequate safety analysis.
- Insufficient independent safety review.
- Operating procedures that were not adequately founded on safety analysis.
- Poor communication of important safety information between designers and operators.
- Inadequate understanding among operators of the safety characteristics of their plant.
INSAG did not withdraw all criticism of the operating crew. It still considered some of their decisions seriously misguided, and recognised that procedural requirements had been violated.
But the balance of responsibility had shifted.
The accident could no longer credibly be explained simply as a group of operators behaving irresponsibly.
When human error becomes the convenient explanation
There is an uncomfortable lesson here for every engineering organisation.
When an accident happens, the people closest to the event are often the easiest to identify.
They operated the equipment. They signed the permit. They changed the setpoint. They opened the valve. They bypassed the alarm.
Their actions are visible. Their decisions can be reconstructed. Their names appear in the investigation.
The engineering decisions made years earlier are less visible.
Was the equipment designed for the conditions in which it was being operated?
Were its limitations properly understood?
Did the operator have the information needed to recognise an unsafe condition?
Could a safety system behave in a way that contradicted what its designers and operators expected?
Were procedures written around the actual characteristics of the equipment, or around assumptions that had never been properly tested?
Chernobyl demonstrates why these questions matter.
If an investigation stops at the person who made the final decision, it may never reach the engineering decisions that made that decision so dangerous.
Five things to check tomorrow
- Has the equipment design been properly examined? Before concluding that an operator made an error, establish whether the equipment was suitable for the conditions in which it was being used.
- Did the operator know the real failure modes? Were the limitations, dangerous characteristics and failure scenarios of the equipment properly explained and understood?
- Was the alleged procedural violation actually a violation? Check the procedure that existed at the time. Don't assume that a retrospective interpretation of what someone should have done was documented or understood by them.
- Has the same mistake happened with different people? Repeated errors involving different operators may indicate a design, interface, training or organisational problem rather than a series of unrelated individual failures.
- Has the investigation followed the engineering far enough? Examine control-system design, instrumentation, alarms, interlocks, equipment limitations and the assumptions made during the original design.
Human error is not the end of the investigation
People make mistakes. That will never change.
But good engineering recognises that people will sometimes misunderstand, misinterpret or make the wrong decision.
Equipment should be designed with those realities in mind. Safety systems should be sufficiently robust to prevent foreseeable human errors from becoming catastrophic events.
Chernobyl was not simply a story about operators making bad decisions. It was a story about a reactor with dangerous design characteristics, inadequate safety analysis, poor communication and an organisation that failed to ensure the people operating the plant understood its behaviour.
The original investigation placed much of the blame on the control room.
The later investigation revealed how much had been missed by looking there first.
The next time an incident investigation concludes that the cause was operator error, ask one question:
Have we established that the equipment was safe to operate in the first place?
Because sometimes what looks like human error is actually poor engineering, made visible by the person unfortunate enough to be operating it.
Sources
- International Atomic Energy Agency, INSAG-1 (1986), Summary Report on the Post-Accident Review Meeting on the Chernobyl Accident.
- International Atomic Energy Agency, INSAG-7 (1992), The Chernobyl Accident: Updating of INSAG-1.
- US Nuclear Regulatory Commission, NUREG-1250 (1987), Report on the Accident at the Chernobyl Nuclear Power Station.