The narrow field of options for safely managing Ukraine’s Zaporizhzhia Nuclear Power Plant

Last month, Ukraine told the International Atomic Energy Agency (IAEA) it would not permit any of the six reactors at the Zaporizhzhia Nuclear Power Plant (ZNPP) to generate electric power until Russia had given the occupied installation back to Ukraine. Ukraine’s statement challenges Russia’s resolve to prolong and tighten its grip over Europe’s biggest nuclear power station, and it has narrowed the field of options for managing the nuclear plant as the war continues.

One year after Russia’s assault and takeover of the Zaporizhzhia plant, Russians and Ukrainians face decisions about the operation status of the six reactors that will significantly impact nuclear safety and security. Decision makers might mothball the reactors, or instead elect one or more of a range of modes for operating them, on a scale from cold shutdown to resumed criticality and low-power operation.

On February 6, four days before the IAEA made the Ukraine statement public, I published a detailed account of nuclear safety considerations pertinent to forthcoming decisions about whether and under what conditions reactors at the ZNPP would be allowed to operate. Since September and until now, all six reactors have been shut down, but two units have been prepared for restart, an action that could significantly affect the safety profile of the plant. During preparation of that article, the IAEA did not answer my questions about whether, under a proposal for a “protection zone” the IAEA has proposed for ZNPP, the reactors would be permitted to operate.

But the February 10 release of the statement from the State Nuclear Regulatory Inspectorate of Ukraine (SNRIU) addressed that issue in a policy declaration. Ukraine, it said, would “only permit ZNPP to resume power-generating operations after it has been returned to the control of Ukraine and a thorough inspection program and the implementation of any measures deemed necessary to restore the plant to safe working conditions have been completed.”

Since March 5 last year, Russian forces have occupied the Zaporizhzhia facility; Russia has claimed ownership of the station; Russia has declared that the territory on which the plant sits has been annexed by Russia; and the Russian state has set up a company, assisted by Rosatom, Russia’s national nuclear energy corporation, to manage the plant. Russian interference with and intimidation of Ukrainian personnel have degraded nuclear safety and nuclear security. By all accounts, a highly charged relationship between Russian occupiers and Ukrainian personnel and authorities persists. During the second half of last year, cooperation or coercion sufficed to shut down all the reactors, carry out refueling and limited maintenance at some units, and then, beginning last fall, prepare two reactors for resumed operation.

Determination by Ukraine not to permit any reactors at Zaporizhzhia to produce electricity in effect stands in the way of any Russian effort to connect the plant to the Russian power grid, generate electricity, and transmit power to Russian-occupied Ukrainian territory. Ukrainian personnel have asserted since March that occupiers informed them that Russia, aided by Rosatom, planned to take such action.

In theory, Russia, supported by increasing numbers of Russian technical personnel at the station, might decide to start up reactors and generate electricity in defiance of Ukrainian oversight. If so, that step would escalate conflict over control of the station, but it is less certain that the procedure would be successful.

Since Ukraine’s independence in 1991, the six ZNPP reactors, plus nine others located elsewhere in Ukraine, have been steadily upgraded, based largely on Western government and industry assistance. This effort was accelerated by the meltdown of three reactors at Fukushima-Daiichi in Japan in 2011 and by Russia’s seizure of Crimea in 2014. After Fukushima the European Union included Ukraine in an EU-wide program to assess and improve reactor safety, focusing on issues that had contributed to the disaster in Japan. The Crimea takeover marked the beginning of stepped-up cooperation between Ukraine and Western governments to address the physical security and cybersecurity of Ukraine’s strategic infrastructure, including the electrical power system and nuclear power plants. For Ukraine’s nuclear stations, the EU launched a program covering 1.5 billion euros worth of safety improvements.

Significantly, since the 1990s ZNPP has been upgrading instrumentation and control systems and equipment, in partnerships that include vendors in the United States and Europe. Procedures have also become more aligned with Western practice. Should Russian occupiers attempt to restart and operate reactors without assistance from experienced Ukrainian personnel, they might encounter difficulties, take safety risks, and perhaps fail. Should Ukrainian operators with deep knowledge of ZNPP’s technology and operating modes conclude that instructions to start up reactors contravene Ukrainian government directives, it is plausible that they might interfere with or sabotage startup procedures.

Zaporizhzhia plant operating modes. For as long as the war continues, the safety profile of the installation will reflect pending decisions about the operational status of its reactors. Apart from electric power production, Ukraine’s regulator did not specifically exclude any other option for operating the Zaporizhzhia reactors, on a spectrum from cold shutdown to low-power operation.

In September all six reactors were in cold shutdown: In this condition, control rods are fully inserted into the fuel, preventing criticality, and temperature and pressure are reduced to well below operating levels. Decay heat from the reactor is removed by the residual heat removal system; after several idle months the heat load in the fuel would be reduced to a fraction of the operating level. With that final point in mind, six months ago some observers appeared to view cold shutdown as a ready fix for safety hazards at the Zaporizhzhia plant.

But late last year, two reactors in cold shutdown, Z-5 and Z-6, were prepared for low-power operation. They were therefore put into “hot shutdown.” In this state, temperature and pressure are normally allowed to increase in preparation for “hot standby” followed by zero-power operation and then low-power operation. During this transition, temperature and pressure increase, steam begins to form in steam generators, and the turbine will be put into service. Shutdown cooling is shifted from residual heat removal equipment to the reactor cooling pumps, a step having major safety implications. Upon authorization, the reactor may be heated up further to a level permitting criticality, and by manipulating control rods and other variables, reactor power may be slightly increased to allow the turbine to operate but below the level at which the electric generator connected to the turbine would begin producing electricity.

A complex risk profile. How decision makers in fact proceed on operation of the Zaporizhzhia plant will reflect system safety concerns but may also take into account vulnerabilities to terrorism and military attacks and the desire of owner/operators to protect operating licenses and avoid long outages that may damage turbine-side equipment. Cold shutdown conditions normally obtain during refueling and maintenance outages lasting a few weeks; at ZNPP however several reactors have been in cold shutdown for many months.

In 1991, Slovenia anticipated an attack by Yugoslavia against its Krsko nuclear power plant; it chose to put the plant into cold shutdown based on important assumptions, namely, that the crisis would be over in days, and that in an emergency, the plant would be supplied with off-site power and the heat sink would be available to cool the reactor. The situation at Zaporizhzhia looks very different; foreign military occupation is indefinite, and there is less confidence about both off-site power and the heat sink. Shelling attacks have interrupted off-site power—such an interruption occurred after a Russian missile attack this week—and the Zaporizhzhia heat sink—a water reservoir fed by the Dnipro River—may be threatened by mines and by reckless Russian actions away from the power plant that appear to be drawing down the water volume. The nuclear safety risks associated with cold and hot shutdown modes are not identical, reflecting in part requirements for different reactor cooling equipment, and they also depend on plant-specific variables; on March 9 the two units in hot shutdown were put back into cold shutdown after shelling attacks interrupted supply of off-site power.

Should decision makers elect to operate reactors in startup modes for months, personnel under intense pressure from occupiers would be relied upon to carefully micromanage safety-significant reactor parameters. Even under routine conditions, during reactor shutdown operators could unleash severe accident sequences. Vulnerabilities would likely be greater should the war escalate and spread to the power plant site. A Russian counteroffensive may be imminent, and Ukraine’s nuclear power management recently asserted that Ukraine aims to expel Russian occupiers from Zaporizhzhia with force of arms.

Given these risks, in principle the safest option for the Zaporizhzhia nuclear power plant would be to shut all reactors down, depressurize the circuits, and remove their fuel until the end of the war. As an IAEA peer reviewer in one European country with similar reactors said: “There would be no heat, no pressure, no radioactivity, and no severe accident.”

But the plant’s fuel inventory is another key consideration in decisions about how or if the Zaporizhzhia reactors are to be run. If removed from reactor cores, hot, highly radioactive fuel must be safely stored and contained. Ukraine regulations require that the spent fuel storage pool at each reactor accommodate a full core of fuel in an emergency. As part of EU post-Fukushima upgrades, Zaporizhzhia reactors were outfitted with portable equipment to supply water in an emergency to spent fuel pools and to reactor cores. But moving a core of fuel into a pool would significantly increase the heat load, and safe storage margins might be limited following previous re-racking to pack more fuel in the pools. Safety authorities may ultimately decide that the fuel would be better protected if left in the reactors, since they were designed to protect and cool the fuel including in an emergency. Separately, the owner/operator may not want to undertake prolonged outages of de-fueled reactors in the interest of limiting restart authorization requirements.

A year after Russia wrested control of the Zaporizhzhia plant, officials in Russia and Ukraine making decisions about its operating status are challenged by a nuclear safety and security profile that may appear more nuanced and complex than at any time under Russian occupation, especially before all six reactors were idled six months ago. No single reactor-management option for reducing risk will minimize or address all hazards for as long as the war continues, especially since the design basis of the plant does not include risks associated with warfare and foreign military occupation. The decision last September to idle all six reactors may not prevail, and reactors may be ordered to go critical and their nuclear fuel sustain a fission chain reaction. A separate option—to mothball the plant and banish the probability of a severe accident—may so far have been rejected at least in part following a plant-specific safety assessment. Perhaps all six reactors will be managed in a regime fluctuating between periods of shutdown and low-power operation. The choice may reflect a balancing act, taking into account the interests of regulators and safety experts, managers and operators, diplomats, and, ultimately, military commanders. The most significant impact of their decision making might not become apparent immediately but instead if and when violence at and around the nuclear plant intensifies.