In principle, nuclear power plants are designed to prevent the release of radioactive substances into the environment. Preventive measures must be taken against potential incidents that might endanger people and the environment, to ensure that certain radiation exposure limits are not exceeded. This includes, for example, measures taken against power failures or external events (earthquakes, extreme meteorological conditions, etc.) to ensure safe operation.

Emergency preparedness measures are in place for unexpected events that the plant is not designed to withstand. Internal emergency preparedness measures are intended to control beyond design basis events and to prevent or at least delay and mitigate significant environmental impacts. If environmental impact cannot be prevented by the on-site emergency measures, off-site emergency measures will be taken to reduce human radiation exposure.

Larger quantities of radioactive substances can, in principle, escape from a nuclear power plant if the measures taken are not effective or not sufficiently effective and, in the worst case, this will lead to an accident with a so-called core meltdown. After permanent failure of the reactor core cooling system, the remaining water in the reactor pressure vessel will gradually evaporate due to decaying heat. As a result, the fuel will heat up to melting temperature and a core meltdown will occur. If the molten mass were to melt through the wall of the reactor pressure vessel, it would enter the containment which, if not designed to withstand a core meltdown, would also fail. This would facilitate the release of radioactive substances from the molten core into the environment. The gases produced during the reaction of the hot core melt with water and concrete can also damage the containment by way of pressure build-up or explosions – as was the case in Fukushima - thus enabling the release of radioactive substances.

As a result of a core meltdown, the radioactive substances contained in the destroyed fuel elements (uranium, plutonium and fission products such as krypton, iodine, strontium and caesium) may find their way into the reactor pressure vessel. If said vessel is damaged (by the molten core for example) the substances may reach the containment and, should this be damaged, too, eventually be discharged into the environment.

Depending on their chemical nature and the temperature and pressure conditions, substances will behave differently when released.

• Gaseous substances, (for example noble gases such as krypton and xenon) will be completely or almost completely released if the containment is destroyed. This also applies to highly volatile substances such as iodine and caesium.
• Less volatile substances such as strontium, uranium and plutonium will be found in dust particles (aerosols) or be bound to dust particles. As to whether the entire inventory contained in the reactor or just certain parts of these substances will be released, and how far they will be transported, will depend on the specific course of the accident.

Finally, the prevailing weather conditions on site, such as wind strength, wind direction and precipitation, will determine the dispersion of radioactive substances outside the plant, and determine where and what kind of protective measures for the population will become necessary. In the case of international events, the IAEA and, with regard to Germany, the Federal Office for Radiation Protection (BfS), will monitor the radiological situation.

In Germany, for example, the BfS is operating a comprehensive monitoring network (Messnetz) using real-time radioactivity measurement sensors. This means that the environment is continuously monitored so that even minor changes in environment radioactivity levels can be detected quickly and reliably nationwide, and long-term trends can be recorded.

As far as the safe operation of nuclear power plants is concerned, the cooling of the fuel elements, the control of radioactivity and the containment of radioactive materials must be ensured at all times. For this purpose, the radioactive substances in the nuclear power plant are multiply enclosed by technical barriers or retention functions to ensure adequate radiation shielding.

A multi-barrier system is in place to contain radioactive substances. The barriers must be designed in such a way that they are, as far as technically possible, independent of one another. This is to ensure that, in the event of internal or external events or impacts, the individual barriers do not fail as a result of the failure of another.

A passive safety device, technical barriers are a central component of reactor safety. Several interlocking technical barriers (multiple barrier system) retain radioactive substances during normal operation and also in the event of an accident. The barriers act independently from each other and on all levels of the applicable safety concept.

The following technical barriers exist:

Fuel tablets

The fuel is contained in a solid ceramic substance, the so-called fuel pellets. Under normal operating conditions, most of the radioactive substances produced during nuclear fission (activation and fission products) will remain enclosed in the heat-resistant crystal lattice of the fuel pellets.

Fuel rod cladding

The fuel pellets in the fuel rods are welded into cladding tubes made of a zirconium alloy "Zirkaloy". The fuel rod cladding is sealed and pressure-resistant. It prevents radioactive fission products from getting into the coolant.
Several fuel rods are bundled together with a support structure to form fuel assemblies. Depending on the reactor type, different numbers of fuel elements are used in the reactor core.

Pressure boundary

The fuel elements are located in a thick-walled reactor pressure vessel made of steel. This is where the controlled nuclear chain reaction takes place. The heat is dissipated using pressurised water (pressurised water reactor) or as steam (boiling water reactor).
The reactor pressure vessel together with the associated piping for cooling water and steam forms the so-called "pressure boundary". It can withstand high temperatures and pressures and encloses the radioactive inventory both in normal operating conditions as well as in the case of accidents.

Biological / Thermal Shield

The biological / thermal shield serves to protect against direct radiation escaping from the reactor core. It surrounds the immediate area of the reactor and shields other areas in the nuclear power plant from radiation.

Reactor containment

The reactor pressure vessel is surrounded by a gas-tight steel containment shell. This shell is designed to safely enclose the radioactive inventory, also in case of an accident.

Reactor building

The containment is located in the reactor building, which is equipped with controlled ventilation and venting systems. The building is also designed to withstand external events, for example weather influences and explosion pressure waves.

The dispute about the justifiability of using nuclear energy has engendered public discussions and disputes in the Federal Republic of Germany for decades. It was against this background that, in June 2000, the federal government and energy utilities first decided to end electricity generation from nuclear energy.

Subsequently, in April 2002, the German Bundestag decided to gradually phase out nuclear energy. In autumn 2010, the lifetimes of nuclear power plants were extended by an average of 12 years as part of the energy concept of the Federal Government at the time. This extension, however, was withdrawn in March 2011 in the aftermath of the devastating reactor disaster in Fukushima. In June 2011, the legislator decided to phase out nuclear energy for good by the end of 2022. This decision was based, among other things, on the results of a highly expert ethics commission of the federal government. Former Chancellor Angela Merkel had appointed this commission right after the reactor accident in Japan, and, after two months of deliberation, the commission declared itself in favour of a nuclear phase-out.

The main reasons for phasing out this technology are the safety risks associated with its use. i.e. the danger of major accidents with a significant leakage of radioactivity, e.g. due to malfunctions in the plant or due to external terrorist or warlike attacks as well as the requirements both during the operation of the plants and the subsequent storage of radioactive material. In addition, the civil use of nuclear power is, in many countries, closely linked to the option of using it for military purposes, too.

The cross-party Bundestag decision to phase out nuclear power in 2011 helped to ease a major social conflict that had lasted for decades, and provided planning security: on the one hand, the quantities of radioactive waste to be disposed of were limited, and on the other hand, the decision enabled energy suppliers to prepare an orderly shutdown of the nuclear power plants and to focus on the transformation of energy production towards renewable energies. The decision also paved the way for a new start in the search for a final repository for high-level radioactive waste in Germany. Further information on the nuclear phase-out in Germany.

The safety of a nuclear power plant is not only ensured by technical measures, but also depends, to a large extent, on the operating staff, who must be available in sufficient numbers and have the necessary expertise.

The safe operation of the system is influenced by

• human factors (e.g. knowledge, decisions, thinking, emotions and actions),
• technical factors (e.g. existing technology and equipment for production and operation) and
• organisational factors (e.g. management systems, knowledge management, organisational structures, governance, and human and financial resources).

The analysis of the Fukushima accident in 2011 has shown that far-reaching events or accidents usually cannot be reduced to the failure of a single factor or component. Rather, events develop from dynamic interactions within and between human, technical and organisational factors.

The system of "safety" is a socio-technical system, which means that a nuclear power plant is not only a technical unit but also comprises human individuals and social structures.

For the safe operation of a nuclear power plant, it is therefore necessary, among other things, to have a minimum number of qualified staff. A clear definition of tasks and responsibilities within the organisation is important, both for regular operation and especially to control complex events.

As far as the current situation of nuclear power plants in Ukraine is concerned, there may be factors affecting the availability of staff - and thus the operational safety of the power plants.

This might be the case, for example, when the minimum staffing level can no longer be ensured, whether due to refugee movements, access restrictions or other reasons. Difficulties may also arise if staff in the facility is under psychological pressure or morally and physically exhausted.

This may lead to errors in the operation of the power plant. Depending on how quickly such errors are recognised and how prudently they are corrected, they may endanger the operational safety of the plant as a whole.

In such cases, it is also important to think about how to ensure a continued safe operation of the power plants. This could be done, for example, by bringing down the plants to a level where fewer staff or fewer switching operations are required.

The original staff at the Chernobyl power plant had been on site continuously for almost four weeks ever since Russian forces had taken over the site on 24 February 2022. A first staff rotation was possible on 20/21 March 2022. Another shift was brought in on 10 April 2022. The Ukrainian supervisory authority and the International Atomic Energy Agency (IAEA) considered the physical and mental health of the staff to be at risk and their safety-relevant work to be unacceptably restricted under such conditions.

The nuclear power plant at the Chernobyl site is no longer in operation. Yet, to ensure the protection of humans and the environment, staff must be able to carry out the work there meticulously and safely. According to information provided to the IAEA by Ukraine, staff rotation at the Chernobyl nuclear power plant has taken place regularly and according to schedule again since 21 April 2022.

For nuclear power plants to operate safely, the cooling of the fuel elements, the control of radioactivity and the containment of radioactive materials must be ensured at all times. Nuclear power plants have numerous electrically operated systems, such as pumps, valves, ventilation, etc., which is why they depend on a steady supply of electricity.

There are three different power supply options for nuclear power plants in Germany:

1. In-house generation

   During normal operation, the plants are powered by the electricity they generate. The remaining electricity produced is fed into the public grid.

2. Via main grid connection from the public grid

   If the power plant is in downtime or has been shut down (for example for an overhaul or after an incident), the nuclear power plant is supplied with electricity via the main grid connection.

3. Via reserve grid connection from the public grid

   If the main grid connection fails, there is a switchover to a reserve grid connection, which is connected to another voltage level of the public electricity grid and is independent of the main grid connection.

Precautionary measures are in place to react to a potential failure of the external power supply of a nuclear power plant.

If the connection to the external power supply fails completely, a nuclear power plant can no longer deliver electrical power to the grid. In such a case, the output will be drastically reduced to a value that corresponds to the plant’s own demand for electrical power. In this way, the nuclear power plant, even though disconnected from the power grid, can continue to supply itself with electricity in island mode operation. This process is called "load shedding on own demand".

If load shedding on own demand fails, the nuclear power plant will automatically be shut down and cover its demand for electrical power, step by step, via

• Emergency diesel generators

  Nuclear power plants in Germany are equipped with several emergency diesel generators supplying power to relevant safety systems (e.g. cooling water pumps, instrumentation and control). Their number and performance varies across the different plants. As a rule, a plant will have fuel stocks to last several days. These can be supplemented if necessary.

• Neighbouring power plant

  A neighbouring power plant (e.g. gas turbine or hydroelectric power plant) or a neighbouring nuclear power plant unit (i.e. for plants with several power plant units on the site) can supply electricity. Some plants have a direct connection.

Unlike a nuclear power plant in operation, Chernobyl no longer produces electricity, so the undisturbed operation of electrical facilities is largely dependent on an external power supply.

Acts of war damage external power supply

Due to several overhead power lines being damaged by acts of war, the Chernobyl site was cut off from the power grid from March 9 to 14, 2022. During this time, the power supply to the main systems was ensured by means of emergency diesel generators.

According to the unanimous assessment of experts from the Federal Office of Nuclear Waste Management (BASE) as well as the International Atomic Energy Agency (IAEA) and the Gesellschaft für Anlagen- und Reaktorsicherheit (GRS), the power supply failure did not result in any increased short-term safety risks. Due to the fact that the spent fuel elements have been in the decay pools for more than 20 years, their activity has already decreased to such an extent that effective heat removal can be maintained even without forced circulation and continuous active cooling water injection.

Consequences of a prolonged power outage

In the event of a prolonged power outage and failure of the emergency power supply - due to a lack of fuel for example - the cooling water would slowly evaporate and the fuel assemblies stored in the cooling pond would gradually run dry. With the water providing a very effective radiation shield, this would endanger the operating staff in particular. They would no longer be able to enter the storage facility to carry out necessary work. Even in such a case, however, there would be no safety-relevant situation in the vicinity of the power plant or in any regions further away.

"External events" are defined as impacts of environmental conditions, natural events or other, man-made events outside the plant. Natural external events include earthquakes or floods, as well as extreme meteorological conditions and their consequences, such as storms, including tornadoes and lightning.

Nuclear power plants are also designed to withstand man-made hazards. These include accidental aircraft crashes, off-site explosions or off-site fires.

With regard to nuclear power plants in Germany, the law stipulates that such external events and the relevant safety systems must either be considered from the very beginning, i.e. during the design stage of nuclear power plants, or be controllable by suitable measures. This also means that safety systems and emergency facilities must remain effective in the event of external impacts. Other countries also have similar safety requirements for nuclear power plants.

Further information:

Precautionary and emergency measures at nuclear power plants

A number of measures and precautions that ensure safe operation are in place at nuclear power plants. Precautions are also taken against external events such as fires, lightning strikes or even accidental aircraft crashes. In addition, every nuclear power plant must be protected against, among other things, wilful damage, deliberate intrusion or theft of nuclear fuel. For this purpose, nuclear power plants have a so-called safeguards concept with associated safety measures. Information about which specific threat situation and weapon types are assumed, and which precautions are taken against such threats, is strictly confidential, as such information is of interest to potential perpetrators.

In some cases, safety measures required to ensure plant safety - for example earthquake- and flood-resistant buildings – can also provide protection against such third-party impacts. In Germany, the Atomic Energy Act and the associated regulations stipulate that the protection against disruptive measures or other third-party impacts - e.g. against terrorist attacks - must be guaranteed for nuclear facilities. Accordingly, an integrated safety and protection concept must be in place, consisting of

• security measures taken by the licence holder (necessary protection against disruptions or other interference by third parties), and
• protective measures taken by the state.

The measures are coordinated with each other.

The operator's measures unfold their effect together with corresponding actions taken by the state's security authorities, which also react to such attacks once alerted. Complete precaution against terrorist attacks without the supportive intervention of state forces is not possible. This also emphasises that the comprehensive safety of nuclear facilities, as required by the Atomic Energy Act, can only be guaranteed in a functioning state and with a given level of internal security.

The following applies with regard to armed conflicts:

The decision as to which precautions are taken against targeted attacks on nuclear facilities is made by the individual states that operate nuclear power plants. Information regarding these precautions is strictly confidential.

The measures and precautions described above do offer a certain degree of protection in the event of armed conflict. However, neither a state nor an operator of a nuclear facility can provide or guarantee complete protection against any conceivable attack with weapons of war, carried out by the armed forces of another state.

In the history of the civilian use of nuclear energy, there has been no precedent where a state using nuclear energy was exposed to a full-scale war of aggression by another state. It is therefore not possible to realistically assess what consequences might arise in individual cases.

In view of the vulnerability of nuclear facilities and the potentially serious consequences of an attack, the International Atomic Energy Agency (IAEA) concluded as early as 2009 that such facilities must not become the target of a threat or the use of military force.

For most events, such as an earthquake for example, the reactor will automatically be shut down once the control rods are inserted. The control rods will capture the neutrons generated in the reactor and thus terminate the nuclear chain reaction. If the arrangement of fuel rods and control rods in the fuel elements remains intact, a revival of the chain reaction is no longer physically possible. In pressurised water reactors, the addition of a neutron poison (boric acid) to the coolant is also necessary to keep them safely shut down even when cold.

However, radioactive substances produced in the fuel during nuclear fission will continue to give off heat. This in turn might heat the fuel pellets to melting point. As a consequence, individual radioactive substances contained therein might become volatile. Cooling is therefore of utmost necessity even after shutdown. Although the heat development ("decay heat") will subside in the course of the first hours and days, it will remain of great importance regarding the safety of the plant for a long time. Cooling must therefore be ensured on a long-term basis.

The nuclear power plants (NPPs) in operation in Ukraine are pressurised water reactors (PWRs). The reactors still in operation in Germany are also pressurised water reactors. In NPPs with PWRs, the heat generated in the reactor is transferred from a pressurised cooling circuit (no boiling) via a heat exchanger (steam generator) to a second circuit, where the steam required for the turbine is generated.

In Ukraine, two series of nuclear power plants (NPPs) with PWRs are in operation, 2 units of the VVER 440 / W 213 type (2nd generation of the VVER 440 series) and 13 units of the newer VVER 1000 series. Compared to German NPPs with PWRs, the Ukrainian NPPs with PWRs show the following design differences:

VVER 440 / W 213 series reactor type:

The output of the VVER 440 NPPs of 440 MW electric is significantly below the output of German NPPs with PWRs (1440 MW electric (gross). They differ from German NPPs with PWRs in particular with regard to the different design of the reactor building. There is no full-pressure containment serving as a safety containment. Instead, there is a pressure room system for individual parts of the reactor cooling circuit (reactor, cooling loops). This results in a lower protective effect against external impacts, especially against man-made impacts such as aircraft crashes. The addition of a so-called wet condensation system (as compared to the 1st generation VVER 440) also ensures safe containment in the event of a double-ended rupture of a main coolant loop.

Compared to German NPPs with PWRs, VVER 440 reactors have 6 cooling loops instead of 4. Further design differences exist in particular with regard to the design of the main components of the reactor cooling circuit, such as the steam generator (horizontal instead of vertical) and the reactor core (hexagonal instead of square fuel element cross-section). The two reactor units Rivne 1 and 2 in Ukraine are VVER 440 of the 2nd generation. Compared to the 1st generation VVER 440, they show significant improvements, especially with regard to accident design. Overall, the VVER 440/W-213 reactors do still show some safety deficits, but they are basically comparable with the design principles of Western plants.

Reactor type of the VVER 1000 series:

The overall design of VVER 1000 NPPs is similar to that of Western NPPs with PWRs. The output of the VVER 1000 reactors is 1000 MW electric, comparable to that of the German PWRs (1440 MW electric (gross) for convoy plants). As with German NPPs, the reactors have 4 cooling loops. In contrast to the VVER 440 plants, the reactor building in particular is designed as a full-pressure containment, which ensures safe containment for the design basis accident of a double-ended rupture of a main coolant loop. As with the VVER 440 plants, there are design differences regarding the components of the reactor coolant circuit. In terms of design principles, especially with regard to accident design and the basic design of the safety system, NPPs of the VVER 1000 series are comparable with Western plants.

In the event of war, nuclear authorities and operators will remain operational as far as possible - as is currently the case in Ukraine. At the same time, parts of the responsibility will be transferred to other government agencies. These must subsequently identify the relevant risks and take measures if necessary.

Generally speaking, the prescribed measures also offer a certain degree of protection in the event of armed conflict. However, neither a state nor an operator of a nuclear facility can provide or guarantee complete protection against any conceivable attack carried out by the armed forces of another state using weapons of war.

The war in Ukraine as a precedent

There is no precedent in the history of the civilian use of nuclear energy that is comparable to the present situation in Ukraine, where a state operating nuclear power plants is exposed to a full-scale war of aggression by another state. Accordingly, it is not possible to realistically assess the consequences.
In view of the vulnerability of nuclear facilities and the potentially serious consequences of an attack, the International Atomic Energy Agency (IAEA) concluded as early as 2009 that such facilities must not become the target of a threat or the use of military force.

Interim storage only a temporary solution

The best long-term protection for humans and the environment with regard to radioactive materials is to isolate them permanently from humans and the environment. In Germany, a new search for a site for a final repository for high-level radioactive waste began in 2017. Until a site is found and taken into operation, interim storage facilities must offer the most comprehensive protection possible against conceivable impacts. The long-term goal must be to store waste in deep geological layers.

Wet storage

After being used in nuclear power plants, spent fuel elements must be stored temporarily. After use, they are placed in so-called decay pools, which are filled with water to shield the radiation emitted by the fuel assemblies, and to prevent the release of radiation. The thermal output of the fuel element will decrease during the storage in the decay pool. These so-called wet storage facilities must be continuously supplied with water and electricity. Protection against external effects must be ensured by the building structures surrounding the storage facility and by a continuous power supply. The majority of fuel elements in interim storage worldwide is currently stored in such wet storage facilities, awaiting final disposal.

Dry storage

Germany has decided to additionally secure the waste during the period of interim storage by means of so-called dry storage. After a few years of decay (about five years) in a wet storage facility, the waste is thus packed into transport and storage containers (so-called Castor casks), which are stored in specially built interim storage facilities. From there, the fuel elements will eventually be transported to a so-called final repository, where the waste will be isolated from humans and the environment on a long-term basis.

Further information:

Post-operational phase of nuclear power plants

Interim storage facilities in Germany must be designed to withstand all kinds of stress.

This also includes precautions against external events such as earthquakes, fires, lightning strikes or accidental aircraft crashes. In addition, each interim storage facility must also be protected against, among other things, the deliberate release and theft of nuclear fuel (e.g. caused by terrorist intentions).

Depending on the site conditions, the safety of the interim storage facilities against possible natural impacts such as earthquakes, floods, storms or lightning strikes must be proven. Also depending on the conditions at the site, precautions must be taken against so-called civilisation-related risks such as an aircraft crash or explosion pressure waves. To safely withstand such stresses, safety-relevant components - in particular the containers - are designed to be very solid.

The operators of interim storage facilities must prove that protective measures against wilful attacks aiming to release or steal highly radioactive materials are in place. To this end, the operator must prove that precautions were taken against conceivable attack in peacetime - for example by terrorists.

The means available in the event of such an attack are regularly assessed by experts from the federal and state governments, and corresponding requirements are defined. These requirements are developed further as needed, and the retrofitting of existing facilities might be necessary as a consequence. This was the case with some interim storage facilities in the past. After 11 September 2001, for example, deliberately caused aircraft crashes were included in the safety assessments of interim storage facilities. Around 2010/2011, all operators of interim storage facilities were told to take respective measures.

Both the underlying assumptions and the specific safety measures are kept confidential, as this information could be used to prepare an attack and its disclosure might thus limit the effectiveness of the measures taken.

The state also protects interim storage facilities

The measures taken by the operator against terrorist attacks develop their effect together with the corresponding actions of the security authorities of the state, which, will take action against such an attack upon being alerted. Against this background, it is clear that the comprehensive security of nuclear facilities, as required by the Atomic Energy Act, can only be guaranteed in a functioning state and with a given level of internal security.