Mark HibbsZNPP Risk: No Silver Bullet

Last September, six months after Russian forces overran and occupied Ukraine’s Zaporizhzhia Nuclear Power Plant (ZNPP), and less than a month after violence threatening the site had escalated, guarded optimism suddenly broke out concerning the station’s nuclear safety prospects. Relief was at hand, a flurry of media accounts explained, because all six reactors had been idled and were in “cold shutdown.” “A cold shutdown enormously reduces the meltdown risk,” an official at Oak Ridge National Laboratory in the U.S. told interviewers for one such report.  

Two weeks before, the International Atomic Energy Agency (IAEA) had succeeded in posting its personnel inside the plant. Within days, the operating reactors had been pulled off the grid. On September 11 the IAEA announced that five of the six ZNPP units were idled; by October the IAEA could report that all six reactors were in cold shutdown.

To IAEA member state officials in Vienna this news was viewed as easing safety concerns. “The less the reactors operate, the safer they will be,” one said. That conclusion also seemed logical because even before Russia seized control of the plant, Ukraine had begun shutting reactors at ZNPP, and between March and August, only a third of the units were operated.

Shuttered Reactors: Gains and Issues

Precise definitions for “cold shutdown” vary in different countries, but they agree that both temperature and pressure in the reactor’s primary circuit are lower than during operation (temperature, during operation about 300 degrees C, is lowered to below the boiling point of water by a good margin; operating pressure of 160 bar is cut to small fraction, below 30 bar in some VVER-operating countries); the control rods are inserted into the core and boron concentration is high, meaning that “it would be impossible for a chain reaction to occur.” 

During routine operation “cold shutdown” permits personnel to open the reactor vessel for refueling and to perform maintenance. Data for VVER reactors shows that if shutdown is prolonged for six months, the residual heat given off by the fuel is reduced to a small fraction, meaning that for some important accident sequences, personnel may not have to take immediate actions to stabilize the reactor. 

According to one cold shutdown risk assessment, for many or most severe reactor accident scenarios, a reactor in cold shutdown would be better protected than a unit that is operating: Simulations prompted the conclusion that a fuel failure rate as high as 30% would not likely have a significant impact, and a loss-of-coolant accident (initiated by, for example, a pipe rupture) could be “easily handled” by the reactor’s residual heat removal (RHR) system which the IAEA’s definition of “cold shutdown” identifies as responsible for dissipating the heat give off by the fuel. 

But according to experts with deep knowledge of VVER-equipped nuclear power plants, long-term shutdown does not address all severe accident risk issues. In some emergency situations, low pressure and temperature conditions would not exclude a severe accident. “There is a very substantial amount of decay heat produced in the reactor [core], and it has to be removed and disposed of. Even in the seemingly docile conditions of a cold shutdown, reaction rates can change [by] many orders of magnitude in a matter of seconds.”  The above-linked study points out that, in part because the cold shutdown state does not obviate the reactor’s need for off-site power, “RHR failure without replenishment is the transient holding the single biggest risk as to possible meltdown.” 

In fact, at ZNPP the accessibility and function of heat removal has weighed heavily upon safety experts, plant management, and operators. Russian organizations involved in design of VVER-1000-type reactors at ZNPP calculated that loss of off-site power is the biggest single contributor to core damage frequency (CDF) as expressed in a generic Level-1 probabilistic safety assessment (PSA) for the VVER-1000. Since August, shelling attacks threatened and in some cases severed the plant’s connections to off-site power sources. There is also concern about the status of the plant’s ultimate heat sink: water from the Dnipro River. Immediately after the Russian takeover, Ukrainian personnel reported that mines had been planted in the coolant water intake area, and the IAEA in October reported that mines in the vicinity of the water supply had detonated. This month, the IAEA pointed out additional concerns about the water supply.

Restarting Reactors

Beyond the headlines in September, “cold shutdown” was not a panacea. Three weeks after all the reactors were shut cold, in October management began preparing two units, Z-5 and Z-6, for “hot shutdown” and thence for resumed operation at reduced power to supply heat and steam as winter approached for the plant and for the company town of Enerhodar located very near the station.

Under “hot shutdown” a reactor is not critical but its primary circuit temperature and pressure are higher than for “cold shutdown” (in one VVER-operating country in Europe temperature is between 95 and 165 degrees C and pressure between 30 bar and 125 bar.) A main difference is that, as IAEA Safety Guide SSG-56 explains, the RHR is not used to cool the reactor as in cold shutdown; instead the reactor cooling system (RCS) is used, requiring more electricity to drive it–a potentially complicating factor in the case that off-site power should be lost. 

Reactor restarts at ZNPP have been awaiting Russian permission, according to Russian media, asserting that Russia aimed to restart both reactors but continued to raise concern related to shelling attacks for which Russia has blamed Ukraine. In February, decision making about the status of the units was apparently still pending, and according to sources the matter has been under discussion between Russia, Ukraine, and the IAEA.

The stated rationale for operating the two reactors is to serve the energy needs of the plant and of Enerhodar, a town of about 50,000 people, cut off from heat and water by Russian shelling attacks against utility infrastructure in a region where authorities have urged residents to vacate. Since the approach of winter, efforts have been ongoing to secure alternative portable sources for heat and steam. In principle, IAEA member states officials assert, no output from ZNPP would be needed should Enerhodar be supplied by alternative sources.

In the big picture, perhaps the most daunting obstacle to indefinite shutdown of reactors are the designs of Ukraine and/or Russia–both which separately claim to own the plant–to operate the reactors. European VVER experts say that holding the reactors in shutdown mode for many months or longer could damage turbine-side equipment, especially should plant maintenance be insufficient and equipment not be periodically tested and operated including under conditions of power generation. Long outages pose challenges to personnel handling of maintenance procedures and especially safety systems, as well as to possible requirements to modify or specify and implement new maintenance procedures. If these concerns prevail, pressure might build to restart more or perhaps even all the reactors as the war continues.   

Mothball ZNPP?

Looking beyond the decisions last September to shut down all six reactors, one European VVER safety expert and IAEA peer-reviewer said that, in principle, and barring any other complicating factors, the safest condition for ZNPP would be brought about by shutting reactors down, then depressurizing and removing their fuel. Inside the reactors there would be no heat, no pressure, and no radioactivity–implying that there will be no severe nuclear accident.

When the ZNPP reactors were designed, Russian assessment of the plant’s safety did not include threats associated with warfare; these extreme events were excluded by IAEA design guidance for all power reactors. So from the point of view of safety design and analysis, “the situation [at ZNPP] is not a normal situation” the VVER expert said. Specifically, experts in VVER-operating countries warned that removing the fuel from the reactor cores and storing it in pools located under the containment structure of the reactors might even render the plant less safe. Said one: “The refueling pool may be less safe from the protection point of view” because as long as the fuel is in the reactor, the RCS will serve as a barrier, other structures will protect and shield the fuel, and it may be easier to remove the residual heat from the fuel with the fuel in the reactor. 

In 1985, three power reactors at Browns Ferry in the U.S. were shut down and mothballed. Two decades later, all three units had been restarted. In 1988, an earthquake indefinitely shuttered two VVERs in Armenia. Seven years later, in a program supervised by the IAEA, one of the two reactors was restarted for routine operation. In both these cases, reactors were restarted after a significant amount of analysis, testing, regulator involvement, and capital investment. For Ukrainian and Russian nuclear power executives alike, especially should safety benefits be deemed marginal, prolonged reactor outages might be off the table if that action puts operating licenses and assets at risk.  

In 1991, management at the Krsko nuclear power plant in Slovenia, anticipating a possible attack from Yugoslavian military forces, elected to take the plant into cold shutdown–upon having assurance that off-site power and ultimate heat sink would be available. But they did not remove the fuel from the reactor in view of potential security and safety risks that went beyond the confines of the reactor and concerned the unique design of the spent fuel handling system. Unlike at ZNPP, however, the spent fuel pool at Krsko is located outside the reactor containment and was seen as directly vulnerable in the case of an attack on the plant. Unlike at ZNPP, management at Krsko was quite confident that off-site power and, especially, the heat sink would be available in a crisis. Decision making at ZNPP will be informed by different and unique conditions, assumptions, and expectations.


Evolving Nuclear Risk Profile

The safety assessment of any power reactor is based on many components and factors. An assessment can change, but for routinely operating reactors it is normally stable. By comparison, at ZNPP, during a year of hostile foreign occupation the threat picture no doubt has fluctuated and evolved, reflecting decisions and actions of combatants, governments, plant management, and operating personnel; these developments likely increased some specific risks and reduced others. Noteworthy in this regard are actions taken by Russian management to enhance reliability of off-site and emergency power sources, improve physical protection of spent fuel storage equipment, import Russian technicians, and other steps pertinent to the safety and security of the plant. These measures were taken in parallel with Russia tightening its grip on the plant. On the minus side, Russian actions have increased other hazards including those related to more subjective “human factors.”  

What to Conclude?

  • No single reactor management option or strategy for reducing risk for as long as the war continues will minimize or address all hazards. Proposed actions including cold shutdown may address certain specifically identified risks but they may not affect, or they may increase, other hazards. Choosing an optimum approach will be a balancing act taking into consideration many factors. These will include the engineering and physical attributes of reactors but also other items.
  • For a likely combination of operational and safety reasons, the condition of indefinite cold shutdown for all six power reactors which obtained for two months in 2022 did not prevail, and pressure to restart reactors may arise for as long as the war continues.
  • Cold shutdown has lowered the risk of a severe nuclear accident at shuttered ZNPP reactors, but concerns about long-term effects on plant equipment and about off-site power and heat sink vulnerabilities persist, potentially limiting the application of cold shutdown as a strategy to reduce risk.
  • Cold shutdown was chosen by Slovenia in 1991 to reduce risk of a feared attack because management was very confident that off-site power and heat sink would be available. At ZNPP confidence about those issues appears to be less. Cold shutdown at Krsko was intended to meet crisis conditions of a few days–it was not seen as a long-term solution to address the threat following from foreign military occupation.
  • Restarting and operating the reactors to produce energy will increase the risk associated with some key components of assessed core damage frequency. 
  • Operator organizations–Russian and Ukrainian–will not likely favor undertaking prolonged outages at reactors if they believe that that strategy will carry significant regulatory and/or financial burden and/or otherwise put the value of power generating assets in  jeopardy. 
  • Decisions about the operating status of reactors will be influenced by considerations of risk exceeding the engineering boundary of the reactors and extending to matters of fuel management but also nuclear security, including physical protection, sabotage, warfare, and terrorism. 
  • Decision makers might conclude that removing the fuel from reactors will not improve, or perhaps might even reduce, the overall nuclear safety of the plant.
  • Efforts by Russia to tighten its grip on ZNPP may have had and may continue to have impacts on the safety of the plant, both positive and negative. 

Moving Forward

Decision making in 2022 about restarting reactors illustrates that developing a safety strategy for ZNPP requires much more than shutting reactors down into a refueling or maintenance outage mode.

Last month Ukraine’s nuclear power operations director said that Ukraine forces aim to expel Russian occupiers at ZNPP–a sobering reminder that Russian military presence at the station may not be permanent. A safety strategy for ZNPP must anticipate the eventuality that violence around and at the station may quickly and dramatically escalate. Under battlefield conditions, perpetrators might attempt to unleash chaos in the plant, causing an accident, and/or preventing a crisis situation from being effectively mitigated by personnel.

Independent of other factors, there would appear to be little justification in wartime for operating the reactors to make electricity, particularly if the safety gain from not operating them would be large. The war has reduced power demand and economic activity and unleashed population flight in the area served by ZNPP. Attacks by Russian forces against Ukraine’s electricity infrastructure appear to be targeting above all distribution equipment.   

When personnel shut down cold all six ZNPP reactors in September, that decision was most directly prompted by shelling and personnel/management conflict that threatened the plant in real time–not by concern that a future battle between Russian and Ukrainian forces would engulf the plant site and result in a meltdown. But Russia may soon escalate its war and Ukraine is resolved to eject Russian occupiers. The prospect of armed conflict at and around the plant–formally excluded in the guidance for plant design–must be incorporated into thinking about the operational status of the six reactors. That won’t be trivial: Reluctance during late 2022 to continue to shutter reactors indefinitely suggests that decision making about how to manage the power plant in 2023 will be complex, perhaps not consensual, and difficult to implement. 

IAEA Engagement

Rafael Grossi, the IAEA’s Director General, has set for his agency the ambitious goal of brokering a de-escalation of armed conflict–not a business where the IAEA has a track record. After six months this effort, to establish for ZNPP a “nuclear safety and security protection zone” free of warfare, is still ongoing and according to statements this year by both Russian and Ukrainian officials, it is stalling. Some member state officials suggested that Grossi may adjust or modify the IAEA’s engagement with Russia and Ukraine in view of challenges the IAEA has encountered.

Grossi’s efforts to negotiate have been circumscribed by Russia’s violation of international law: Heeding advice that his diplomacy must not strengthen Russia’s claim that it legitimately controls the power plant, Grossi has spelled out clearly for the record that ZNPP “is a Ukrainian plant.” That IAEA statement reflected the votes of 143 members of the United Nations General Assembly in October, but it could not have made it easier for Grossi to engage Russian leaders: One Vienna consultant tracking events in Ukraine said that the overall picture suggests that Russia is “using the plant as a military base.” Ukraine meanwhile has said it will not agree to any outcome that leaves Russia indefinitely in charge of the power plant.

Grossi has said that his proposal to protect the plant from violence is focused “solely on preventing a nuclear accident.” Some member state officials and other observers in Vienna expressed the view that Grossi’s effort to reduce risk from the top down, and decisions at the power plant to reduce vulnerabilities from the bottom up, look like unconnected and separate activities. They would at best be complementary and they might even be linked. Facts are hard to find; member state representatives say that the IAEA has so far provided governments little information about the architecture of Grossi’s proposal. When I asked the IAEA for some specific information concerning safety management at ZNPP, it declined and texted back: “The IAEA is doing what is necessary and in consultations with relevant actors.” Perhaps the more effective plant personnel are in reducing risk on the ground, the less nuclear safety will be threatened by combatants if diplomacy fails to achieve an accord not to attack the plant. Likewise, the less successful ZNPP personnel are in assuring safety, perhaps the greater would be the value of a genuine and robust negotiated agreement.