Considerations on the Resilience and Potential Risks of the Zaporizhzhia NPP Against Drone Attacks

Thirty-eight years ago, on 26 April 1986, the Chernobyl nuclear power plant accident, the largest nuclear accident in history, occurred in the then-Soviet Union, now Ukraine. The accident attracted enormous attention and its serious consequences have become part of the anxieties of modern times. The accident at a badly designed, poorly engineered reactor – and especially the efforts to initially hide the accident from the international public – had an impact on the world’s energy strategy and hindered the spread of peaceful nuclear energy.

Today, the world’s attention is once again focused on a Ukrainian nuclear power plant, the Zaporizhzhia Nuclear Power Plant (ZNPP), the largest in Europe hosting six commercial 1,000 MW reactor units. Unfortunately for the plant, it has been held hostage to the Russia-Ukraine war: for two years the front line has been the natural border of the Dnieper River, and a stalemate has developed around the plant. In early 2022, Russian troops occupied the site and took it under Russian control, defending it with military forces and stockpiling large amounts of military equipment. Since the autumn of 2022, International Atomic Energy Agency (IAEA) experts have been on site continuously as observers, but they have been able to do little more than periodically raise awareness of the importance of nuclear safety and the dangers of war.

In early April 2024, the international community and the IAEA were alerted by reports of drone attacks on ZNPP, which naturally led to renewed tensions and fears of a nuclear accident. IAEA Director General Rafael Grossi called for compliance with the agency’s key principles preventing nuclear accidents as he said they were violated by the 7 April drone strikes on one of the containment domes at the Zaporizhizhia nuclear power station in south Ukraine.

The IAEA confirmed no critical infrastructure was damaged, but the drone attacks marked the first time since November 2022 that ZNPP was directly targeted in military action.

It is important to note at the outset that we do not know who has carried out these attacks, and the IAEA is not seeking to clarify this. Both Ukraine and Russia have regularly accused the other of attacking the six-unit nuclear power plant, which is close to the front lines in southern Ukraine.

Credible information on the ground is hard to come by and, unfortunately, it may be in the interests of both sides to try to put pressure on the other side and the international community based on fears about the plant. This article is not going to address the question of where these attacks may be coming from. Instead, on the 38th anniversary of the Chernobyl accident, the article will try to answer the question of what the impact of a drone attack on the ZNPP could look like.

 

Main characteristics of VVER-1000 reactors compared to the Chernobyl-type reactors

It is important to note that the ZNPP units are based on pressurised water reactor (VVER-1000/V320 type) technology that is not comparable to the RBMK type at Chernobyl. While the VVER reactors are water-cooled, water-moderated systems, the Chernobyl type is graphite-moderated, water-cooled and therefore exhibits very different physical processes and physical characteristics. The Chernobyl accident occurred in an unstable reactor and the runaway chain reaction produced an enormous amount of heat, 100 times the rated power. This released huge amounts of energy, causing the reactor to explode and releasing many short-lived isotopes. The RBMK had no relevant hermetic containment designed for overpressure. In addition, the huge amount of graphite ignited and burned for ten days, contributing to the release of additional radioactive material into the environment for almost two weeks after the explosions.

There is no graphite to ignite in VVER reactors. For physical reasons, the type of meltdown that caused the Chernobyl accident cannot occur in VVER reactors. And importantly, the ZNPP reactors have not been in operation since September 2022, and the radioactivity of the fissile material in them has been reduced by many orders of magnitude compared to operational levels. They are also in a cold shutdown state, so a serious breach of the hermetic containment would not necessarily result in a radioactive release.

 

Engineering barriers in pressurised water reactors

In pressurised water reactors, four engineering barriers serve to isolate radioactive materials from the environment:

1. the ceramic structure of fuel pellets,
2. the leak-tight metal casing of the fuel rods,
3. the metallic structure of the reactor coolant system designed for high pressure,
4. and the reinforced concrete hermetic containment building.

 

Potential impacts of drone attacks

If a drone or artillery attack were to damage the outermost engineering barrier, the hermetic containment building, the other three engineering barriers would probably still be intact, so that radioactivity (which is now, a year and a half after the reactors were shut down, at much lower levels than in normal operation) would not be released into the environment. A major release of radioactivity would therefore require a simultaneous breach of the fuel and other engineering barriers.

Little is known about the drone attacks that have taken place so far but photographs available on the internet suggest that the drones that have hit the plant have been so small that no structural damage to the containment building would be expected. This is not to say, of course, that these containment buildings cannot be damaged: the VVER-1000 reactors in question are housed in a hermetic containment made of a 1.2 m thick reinforced concrete structure. This is not designed to withstand impacts from military or commercial aircraft, but the 1.2 m thick reinforced concrete structure (1.1 m thick at the dome, at the top of the building) provides protection against many external impacts. This does not mean, of course, that the building is invulnerable: a systematic artillery attack designed for this purpose could cause serious damage to this building, even leading to a loss of its hermeticity. The IAEA’s repeated efforts to remind the parties to the war to keep the site out of the conflict are therefore entirely justified.

What would happen if the concrete containment were damaged? If the roof of the building were damaged in a major attack and large pieces of concrete collapsed into the reactor hall, it is likely that the reactor control and safety rod drives would be the first to be damaged. This would be a major problem for the future operability of the reactor but would not necessarily lead to radioactive releases in the current cold shutdown state. In the case of an operating reactor, damage to this structure could also lead to a loss-of-coolant accident and to damage or loss of the safety-critical reactivity control function (possibly affecting the reactor shutdown function).

However, as long as the units are in their current cold shutdown state, the high discharge consequence is unlikely. In the cold shutdown state, the control and safety rods are already in the reactor core and the primary circuit of the units is not under high pressure, so a high-energy release of coolant is not expected in the event of damage to the primary circuit. Damage to the steam generators and the primary circuit piping system is not expected in the event of a collapse of the building roof, as these installations are protected from above by concrete floors. Damage to the building could also result in damage to the spent fuel pool, but again limited emissions would be expected, with effects mainly in the vicinity of the plant. However, it should be stressed that the plant would not withstand a systematic and planned artillery attack, as virtually no civilian facility could withstand such an attack.

Damage to the containment and the above-mentioned structures would certainly jeopardise the long-term operation of the unit concerned, and restarting a damaged unit after the end of hostilities would require a longer period and extensive reconstruction, if at all possible.

Importantly, the risks of this type of unit are much lower in a cold shutdown state, so it would be essential that units should not be restarted and remain in a cold shutdown state until there could be peace around the plant.

 

 

The possibilities to restart the units are very limited

At the moment, it is very highly unlikely in my opinion that ZNPP can be safely restarted because since the explosion of the Kakhovka dam in June 2023, the necessary water level and the necessary volume of water in the Dnieper riverbed have not been reached, so normal operational cooling cannot be guaranteed on a permanent basis. This is not altered by the fact that now, during the spring snowmelt, the Dnieper is experiencing higher water flow and higher water levels. In a drier period, the water level will be lower again until the Kahovka dam is rebuilt. This is likely to take many years.

Provision could be made to temporarily provide more cooling water, but in the current unstable security situation, this should not be undertaken by the plant operators. (Note: ZNPP’s speciality is that it has a large storage pond of about 800 hectares, which normally holds more than 40 million m3 of water, separated from the Dnieper riverbed. This pond, with its canals, spray cooling and two cooling towers, may be capable of supplying one or two units with normal operational cooling for a period of time, but in the current unstable security situation, it would be very risky to restart a unit on this basis. In addition, the evaporation of the heated cooling water would require a continuous supply of water to the pond, which is also very difficult at present without the Dnieper dam at Kakhovka.)

The possible restart of the units must also be considered in light of the technical condition of the units’ systems. The plant has been shut down for a year and a half. The necessary maintenance has hardly been carried out, and the lack of human resources and spare parts has made it difficult to do so. There is also the question of the status of the operating licence of the units because a prolonged out-of-service status could have led to the loss of the operating licence. Thus, the subsequent restart of the units is likely to create a major maintenance and licensing challenge for the operator, which could take a longer time (many months) to resolve. There will also be a need to address the problem, repeatedly pointed out by IAEA experts, of the large quantities of explosives and munitions stored by Russian troops at the plant. These are hardly included in the safety analyses that form the basis for the operating licence of the units. Under such conditions, a responsible authority can hardly approve the restart of the units.

 

 

The vulnerability of ZNPP systems

Coming back to drone attacks, I don’t think that a drone not carrying a large amount of explosives could do serious damage to the facility. The most vulnerable is the plant’s electrical grid connection. There have been numerous occasions in the last 2 years when the power lines have been damaged and only one grid connection has been left, and there have even been occasions when the last high voltage line has been knocked out by military action. In these situations, the plant is forced to rely on diesel generators, which have been successfully managed by the operators each time, but this is the last resort, we do not like it when a nuclear plant is forced to rely on diesel generators alone for long periods.

To maintain the cooling safety function, you need not only electricity but also cooling water. In these VVER-1000 reactors, the cooling of the emergency cooling system is provided by so-called spray ponds, which can operate with relatively little addition of make-up water. Each unit has three redundant systems so that if a drone attack were to destroy, say, one of these spray pond-based cooling systems, the cooling of the affected unit could still be maintained. But it is obviously true that these systems are not resistant to systematic military attack. For this reason, it is also important that the units remain in cold shutdown during the war, because the current cooling demand is very limited.

As regards the safety of the VVER-1000 reactors in general, they are Generation II pressurised water reactors in a single-wall reinforced concrete hermetic containment structure, built and commissioned in the 1980s. Their safety systems have triple redundancy. The source terms (i.e. the radioactive releases during a potential accident) are similar to the source terms of a Western pressurised water reactor commissioned in the 1980s.

 

 

Human resources issues

At the same time, the situation in Ukraine is currently exceptional, with the entire energy infrastructure under constant attack and the ZNPP on the front line. Many of the original operating staff have fled because of the war, and new staff, much smaller than usual, are present. The war has obviously put a lot of mental strain on people over two years, so the likelihood of failures due to human error is unfortunately higher than normal. In my view, it is important that the units at ZNPP remain in cold shutdown until the war is over and the situation returns to normal.

Prof. Dr. Attila Aszódi

Full professor at the Institute of Nuclear Techniques of Budapest University of Technology and Economics. Currently, he is the dean of the Faculty of Natural Sciences at the Budapest University of Technology and Economics (Hungary). He took part in several projects of the International Atomic Energy Agency and the European Commission. He has more than 300 published scientific articles. His research interest is reactor safety, thermal hydraulics of nuclear reactors, Computational Fluid Dynamics, Particle Image Velocimetry, nuclear power plants, energy policy and sustainability.

The opinions expressed on this page are those of the authors. They do not purport to reflect the opinions or views of the European Nuclear Society.