A credential is a receipt, not a title. Against the laws of physics, it is not even a receipt.
I. THE RECEIPT AT THE REACTOR
Anatoly Dyatlov had all the status he needed. He had graduated with honours from the Moscow Engineering Physics Institute, he had installed reactors in submarines, he had received the Order of the Badge of Honour and the Order of the Red Banner of Labour, and he was deputy chief engineer for operations at the V. I. Lenin Nuclear Power Plant. The credential was real, and it was earned.
On the night of 25–26 April 1986, he produced it as a termination request.
The test was a turbine rundown experiment: simulate a station blackout, see whether the spinning turbine could power the emergency systems long enough for the diesel generators to start. It had been attempted three times before and had failed. The reactor was poisoned with xenon, unstable, and operating at a power level so low that the operators knew it was outside the safe envelope. The shift leader, Alexander Akimov, refused to proceed on the ground that the test violated safety regulations.
Dyatlov did not answer the objection. He produced the a classic status defense. He threatened Akimov with dismissal, and he threatened the assembled engineers that anyone who continued to object would never work in the industry again. He told them that he was the regulation, that safety was whatever he said it was.
That is credential inflation in its purest form. Not here is my analysis of the reactivity margin, but you are not qualified to continue this conversation, and here is the document that ends it.
II. THE MISFIRE
The credential is a qualification to enter an arena. It says: I am at this rung. I could in theory be trusted to perform this job. It cannot make a physical system obey.
The RBMK reactor did not recognise the credential. The operators, under Dyatlov’s direction, withdrew control rods far below the safe operational reactivity margin. They blocked the emergency protection signal tied to the turbine trip. They ran the test at 200 MW thermal when the programme required a stable power level, because Dyatlov had ordered the power raised after the xenon pit and the reactor was climbing out of control. The control rods were graphite-tipped. Each rod carried a graphite displacer on its lower end, below the boron absorber, and when a rod was fully withdrawn the bottom of its channel filled with water. Press the button, and the graphite went in first. It entered the water-filled region at the bottom of the core, displaced the water, and took its place. Graphite slows neutrons and does not absorb them, so for those few seconds the bottom of the core was more reactive than it had been before the button was pressed. The boron absorber, the part that was meant to shut the reactor down, arrived behind it. By then the power spike had outrun it, and the reactor was prompt critical.
A termination request met with a derivation. The derivation was not an argument. It was a prompt neutron pulse.
Dyatlov’s credential failed to work in Chernobyl because the other party was physics, which does not listen to credentials and does not recognise them. It can’t. It’s a physical process.
III. LAZY CALCULATION
Dyatlov was not calculating. He was going through an episode of ego defense.
A reactor makes heat whether or not it is making electricity. When the chain reaction stops, the fuel keeps producing heat from the decay of the fission products that have built up inside it—around six or seven per cent of full power at the moment of shutdown, falling over hours but not to nothing. That heat has to be carried away, which means the cooling pumps have to keep running. If they stop, the fuel overheats.
At Chernobyl, the pumps were driven by the plant’s own turbines. Lose the external grid, and the turbines lose their steam supply, and the pumps lose their power. The plant had diesel generators for exactly this, but the diesels took the better part of a minute to start and come up to load. The question the test was designed to answer was whether the spinning turbine, coasting down on its own momentum after the steam was cut, could generate enough electricity to keep the pumps turning during that minute.
That was a real engineering question, and the answer mattered. The plant’s safety case claimed the rundown would bridge the gap. A claim like that has to be demonstrated, and the test was the demonstration. The test was not frivolous. It was a legitimate piece of safety work that had been attempted before and had not produced the expected result.
What made it dangerous was the state the reactor had to be in to run it.
The test called for the reactor at a specified power level, and for two of its automatic protections to be disabled—the signal that would have shut the reactor down when the turbine’s steam valves closed, and the signal that would have tripped the emergency cooling system. Disabling them was not an accident. The test could not be performed with them live, because the whole point was to let the turbine coast while the reactor kept running.
The night did not go as planned. The shutdown was delayed by about ten hours because the grid dispatcher wanted the power, so the reactor ran at full output far longer than the schedule assumed. When the operators finally reduced power, the reactor dropped into what is called a xenon pit. Xenon-135 is a fission product that poisons the chain reaction, and its concentration rises and falls on a delay. At low power, the xenon builds up faster than it is burned away, and the reactor becomes sluggish and hard to control. Power fell to almost nothing—around thirty megawatts, when the programme called for seven hundred.
To climb back out, the operators withdrew control rods. The rods are the reactor’s brakes: boron absorbs neutrons, and the number of rods still inserted is the reserve of braking power the operators hold in hand, called the operating reactivity margin. Withdrawing rods to raise power spends that reserve. By the time the test began, the reserve was far below the minimum the regulations required—around eight rod-equivalents against a minimum of fifteen—and most of the rods were near the top of their travel.
The reactor was also in the wrong regime for its own physics. The RBMK had a positive void coefficient: steam bubbles in the coolant, which are voids, made it more reactive instead of less. At full power the core already contains a lot of steam, and a small change is a small fraction of it. At low power the coolant is mostly water, and a small amount of boiling is a large fraction of what little steam there is. The same bubbles that were a nuisance at full power were a runaway at thirty megawatts. And the pumps were running flat out, pushing cold water through a core that was barely boiling, so the margin before the water itself began to flash was thin.
Then the test began. The turbine’s steam valves closed. The pumps slowed with the coasting turbine, so less water went through the core, so more of it boiled. Power began to climb. The automatic regulators were already at the limits of their travel and could not bring it back down.
At 1:23 in the morning the shift leader pressed the AZ-5 button—the emergency shutdown, which drives every control rod into the core at once.
The rods did not do what the button promised. Each rod carried a graphite displacer at its lower end, below the boron absorber. When a rod is fully withdrawn, the bottom of its channel is filled with water. Press the button, and the graphite reaches that water first, displaces it, and takes its place. Graphite slows neutrons and does not absorb them, so for a few seconds the bottom of the core became more reactive than it had been before the button was pressed. The boron, the part meant to stop the reaction, arrived behind it. By then the power spike had outrun it, and the reactor was prompt critical.
What Could Have Saved It on the Night
The accident required a specific configuration to become unsurvivable. Reverse any one of the following, and the reactor does not explode.
Keep the operating reactivity margin above the minimum. The ORM—the reserve of braking power held in the inserted control rods—was allowed to fall far below the regulatory floor. The rule was explicit: if the ORM fell to the equivalent of 15 manual control rods, the reactor had to be shut down immediately. By the time the test began, the effective margin was equivalent to roughly six to eight fully inserted rods. The operators had pulled almost all the manual rods out to drag the reactor up from the xenon pit, and the bottom of each rod channel was filled with water rather than boron. Restore those rods, and the reactor has a reserve that can absorb a reactivity excursion instead of amplifying it.
Do not disable the safety systems. The operators blocked the emergency protection signals tied to the turbine stop valves and isolated the emergency core cooling system, because the test could not be performed with them live. This is often described as a technical necessity of the test, but it was also a choice that removed every automatic response that could have intervened. A single live trip—the turbine trip signal, the emergency cooling signal—would have shut the reactor down before the power spike outran the control.
Do not run the reactor in the low-power, low-margin regime at all. At low power, the coolant was mostly water rather than steam, and the RBMK’s positive void coefficient was at its most dangerous. The same bubbles that were a nuisance at full power were a runaway at the power level the test required. The test itself was legitimate, but it did not have to be performed in the most unstable corner of the reactor’s operating envelope. Waiting for a different reactivity state, or performing the test at a higher power level with a healthier margin, removes the trap.
If the scram button is pressed, the rods have to do what the button promises. This is the one intervention that sits inside the accident sequence itself. The AZ-5 scram inserted the control rods from fully withdrawn, and because each rod carried a graphite displacer below its boron absorber, the graphite entered the water-filled bottom of the core first, displaced the water, and added positive reactivity before the boron arrived. If the rods had been designed with the absorber at the bottom, or if the displacer had been removed, the same button would have been a genuine shutdown rather than a trigger. The INSAG-7 assessment is blunt on this point: the scram just before the power rise may well have been the decisive contributory factor. The operators could, in theory, have placed faster-acting absorbers into the core in the seconds before pressing AZ-5, but the probability of a human doing that correctly in five seconds is effectively zero. The fix is the rod, not the reflex.
What Would Have Saved It Permanently
The night was survivable only because the reactor was flawed. Remove the flaws, and the same conduct produces a shutdown rather than an explosion.
The post-accident modifications to the RBMK fleet are the list of what should have been there in 1986:
- Redesign the control rods so that insertion adds only negative reactivity. The positive scram effect was eliminated by changing the displacer geometry, and the rods were made to insert faster.
- Increase fuel enrichment from about 2.0% to 2.4% U-235, and install additional fixed absorbers in the core. Both measures reduce the positive void coefficient, so that a loss of coolant flow produces less of a reactivity increase rather than more.
- Enforce a hard minimum ORM, with automatic protection. The low-ORM trap was removed by making it technically impossible to operate below the limit, rather than relying on a rule that could be overridden.
- Add independent, fast-acting emergency protection that does not depend on the control rods reaching the core in time. The design should assume that operators will make mistakes and that rods may be in the wrong position; the safety system has to work anyway.
What made the RBMK unsafe was not one flaw but a set of flaws that reinforced each other. The first was the positive void coefficient. In most power reactors, if the coolant water boils and turns to steam—a “void”—the reactor becomes less reactive, so a power rise is self-limiting. In the RBMK, the graphite was the moderator, and the water was primarily a coolant that also absorbed some neutrons. When the water boiled away, the neutron absorption decreased, so the reactor became more reactive. A power increase produced more boiling, which produced more reactivity, which produced more power. The RBMK-1000’s void coefficient was around +4.7β, a large positive feedback. At the low power level of the test, the coolant was mostly liquid water with very little steam, so the coefficient was at its most dangerous: a small amount of boiling was a large fraction of the existing void, and the feedback was strongest.
The second flaw was the control rod design. Each rod carried a graphite displacer about 1.25 metres long at its lower end, below the boron carbide absorber. When a rod was fully withdrawn, the bottom of its channel was filled with water. Press the AZ-5 button, and the rod travelled downward. The graphite entered the water-filled region at the bottom of the core first, displaced the water, and took its place. Graphite slows neutrons; water absorbs them. So for the first few seconds after the button was pressed, the rod was making the bottom of the core more reactive, not less. The boron absorber arrived behind the graphite, by which time the power spike had already outrun it. The scram button, in the configuration the reactor was in, was a reactivity insertion rather than a shutdown.
The third flaw was scale and coupling. The RBMK core was enormous—about 838 cubic metres, more than twenty times the volume of a typical pressurised water reactor (PWR). That size meant the core was loosely coupled: a power excursion could develop in one region without the rest of the core responding quickly enough to compensate. The instability was local before it was global.
The fourth flaw was the absence of a containment building. Western reactors of the period were enclosed in a reinforced concrete and steel shell designed to hold pressure and retain radioactive material if the primary circuit failed. The RBMK had no such structure, only a “modular strong-box” arrangement that was never intended to survive a severe accident. When the reactor exploded, there was nothing between the core and the atmosphere.
The fifth flaw was the information system. The SKALA computer did not display the real-time void distribution to the operators; its thermal-hydraulic calculations updated on a 300-second cycle, while the void formation that mattered during the pump rundown happened on a timescale of seconds. The operators were flying a fast aircraft with a dashboard that refreshed every five minutes.
What modern designs do is remove the possibility of the excursion rather than relying on the operators to prevent it.
The first and most important change is the negative void coefficient. In a PWR, the water is both the coolant and the moderator. If the water boils, moderation decreases, and the reactor becomes less reactive. The NRC’s comparison is explicit: PWRs and BWRs “generally have a negative temperature and a void coefficient in the normal operating range,” and the coefficients become more strongly negative as the void content rises. The RBMK’s positive feedback loop is not a feature that modern light-water reactors merely manage better; it is a feature they do not have. The physics itself refuses the excursion.
The second change is passive safety systems in Generation III+ designs. The most significant innovation over earlier generations is the use of systems that do not require active controls or operator intervention—they rely on gravity, natural circulation, and stored energy. The AP1000, for example, has water tanks that can flood the reactor vessel and the containment by gravity, keeping the core in a safe condition for 72 hours without external power or significant operator action. The ESBWR uses a passive isolation condenser and a gravity-driven cooling system to remove decay heat after shutdown with no electrical power. The point is not that these systems are more reliable than pumps and operators. The point is that they do not depend on the pumps and operators being correct.
The third change is control rod design. Modern rods are designed so that insertion always adds negative reactivity. The graphite displacer that made the RBMK’s scram a positive-reactivity event has no counterpart in a PWR or BWR. The rods are also faster: the insertion time in a modern system is measured in seconds, and the shutdown margin is maintained by a hard minimum that the operating procedures cannot override. The RBMK’s scram was slow and, in the configuration of the accident, positive. A modern scram is fast and negative by construction.
The fourth change is containment. Every modern power reactor is enclosed in a pressure-retaining containment structure designed to hold the products of a severe accident. The Generation III+ designs go further, adding features to mitigate core melt—flooding the reactor cavity to submerge the vessel, or a core catcher to spread and cool molten fuel—so that even a beyond-design-basis event does not produce an uncontrolled release.
The fifth change is redundancy and separation. Evolutionary designs like the EPR provide four independent safety trains, each capable of performing the entire safety function, physically separated so that a single fire, flood, or aircraft impact cannot disable all of them. The RBMK’s safety systems could be disabled for a test, and they were. A modern design assumes that operators will make mistakes and that equipment will fail, and it is built so that the failure does not become an accident.
What Dyatlov could have done is narrow and specific, and all of it was available to him in the control room.
The reactor was already in a state the regulations did not permit. The operating reactivity margin had fallen to roughly eight rod-equivalents against a minimum of fifteen, and the rule for that condition was not ambiguous: shut the reactor down. He could have ordered the shutdown and let the test wait. That single decision ends the accident, and it required nothing from him except accepting that the test was worth less than the reactor. Failing that, he could have declined to pull the manual rods out to drag the power back up—the test could have been abandoned, or run another night with a healthy margin and the reactor in a stable regime. He could have left the turbine trip and the emergency cooling signals live and accepted that the test might not produce a usable result. And he could have listened to Akimov, who had refused to proceed, and taken the refusal upstairs rather than threatening the man’s career.
IV. THE TRIAL
The court did not accept the credential either.
In 1987, Dyatlov was sentenced to ten years for gross violation of safety regulations. The operators were sentenced alongside him. The official commission attributed the accident to human error. The receipt was not a defence, because the court was asking for the calculation, and the calculation had not been performed.
But the trial was not the end of the story, and the story is where the credential becomes interesting again.
Dyatlov served four years and was released in 1990 under an amnesty. He then wrote a book, Chernobyl: How It Was, and in it he made the same move again—with a different receipt. The first receipt was the engineering credential. The second receipt was the INSAG-7 report.
INSAG-7, published in 1993, shifted the emphasis of the international assessment from operator error to the design of the control rods and the positive scram effect. The report confirmed that the graphite-tipped rods could insert positive reactivity, that the operators did not know the actual ORM value, and that the design organisation had information it had not passed on. Dyatlov used the report as a termination request against the court’s finding: the physics has spoken, and it says the operators were not culpable.
This is a genuine complication, and it must be stated honestly. INSAG-7 did not vindicate Dyatlov’s conduct. It established that the reactor was fundamentally flawed and that the operators were placed in a system they could not have known was unsafe. But it also established that the test was conducted outside the regulations, that the ORM was below the shutdown threshold, and that the operators disabled safety systems. The design was culpable. The conduct was also culpable. The receipt does not settle the question, because the question has two answers.
V. THE SECOND MISFIRE
The second receipt misfired in the same way as the first, and for the same reason.
Dyatlov used INSAG-7 to correct the address of the court. He said, in effect: you have placed me wrongly, and here is the document that says so. The document was real. It was also not a title to absolution. It was a receipt for a different transaction—the design organisation’s failure—and it did not cancel the receipt for the operational failure.
The comedy is darker here, because the stakes are not dinner party quotes. But the structure is the same. A document was put on the table and asked to do something a document cannot do, and it was put there because the man holding it needed the conversation to stop.
The document was real. INSAG-7 established that the reactor had a fundamental design flaw, that the control rods could insert positive reactivity, and that the operators had not been told. That is a serious finding, and it is true. But it answers a different question from the one Dyatlov needed answered. The question was not whether the reactor was flawed. It was what the operators did inside a reactor that was flawed. The report settles the first. It says nothing about the second.
So it could not do the work he asked of it. It could not end the argument, because the argument was never about whether the design was bad. It was about the test being run outside the regulations, the margin being below the floor, the trips being blocked. INSAG-7 confirms the first; it does not touch the rest. Dyatlov put it down as though it were the last word, and the reason it was not is that it was the last word on a question nobody in the room was asking.
Credential is only as good as the holder performing it. Oh yeah, and this bias isn’t specific to Russia. Look around you.
References
Bergson, H. (1900). Le Rire: Essai sur la signification du comique. Félix Alcan.
Bourdieu, P. (1984). Distinction: A Social Critique of the Judgement of Taste (R. Nice, Trans.). Harvard University Press.
Collins, R. (1979). The Credential Society: An Historical Sociology of Education and Stratification. Academic Press.
Dyatlov, A. S. (1995). Chernobyl: How It Was.
International Atomic Energy Agency. (1992). INSAG-7: The Chernobyl Accident: Updating of INSAG-1. IAEA.
International Atomic Energy Agency. (1986). INSAG-1: Summary Report on the Post-Accident Review Meeting on the Chernobyl Accident. IAEA.
Medvedev, Z. (1990). The Legacy of Chernobyl. W. W. Norton.
Tilly, C. (1998). Durable Inequality. University of California Press.