Toxicology is the study of poisons, or, more comprehensively, the identification and quantification of adverse outcomes associated with exposures to physical agents, chemical substances and other conditions. As such, toxicology draws upon most of the basic biological sciences, medical disciplines, epidemiology and some areas of chemistry and physics for information, research designs and methods. Toxicology ranges from basic research investigations on the mechanism of action of toxic agents through the development and interpretation of standard tests characterizing the toxic properties of agents. Toxicology provides important information for both medicine and epidemiology in understanding aetiology and in providing information as to the plausibility of observed associations between exposures, including occupations, and disease. Toxicology can be divided into standard disciplines, such as clinical, forensic, investigative and regulatory toxicology; toxicology can be considered by target organ system or process, such as immunotoxicology or genetic toxicology; toxicology can be presented in functional terms, such as research, testing and risk assessment.

It is a challenge to propose a comprehensive presentation of toxicology in this Encyclopaedia. This chapter does not present a compendium of information on toxicology or adverse effects of specific agents. This latter information is better obtained from databases that are continually updated, as described in the last section of this chapter. Moreover, the chapter does not attempt to set toxicology within specific subdisciplines, such as forensic toxicology. It is the premise of the chapter that the information provided is relevant to all types of toxicological endeavours and to the use of toxicology in various medical specialities and fields. In this chapter, topics are based primarily upon a practical orientation and integration with the intent and purpose of the Encyclopaedia as a whole. Topics are also selected for ease of cross-reference within the Encyclopaedia.

In modern society, toxicology has become an important element in environmental and occupational health. This is because many organizations, governmental and non-governmental, utilize information from toxicology to evaluate and regulate hazards in the workplace and nonoccupational environment. As part of prevention strategies, toxicology is invaluable, since it is the source of information on potential hazards in the absence of widespread human exposures. Toxicological methods are also widely used by industry in product development, to provide information useful in the design of specific molecules or product formulations.

The chapter begins with five articles on general principles of toxicology, which are important to the consideration of most topics in the field. The first general principles relate to understanding relationships between external exposure and internal dose. In modern terminology, “exposure” refers to the concentrations or amount of a substance presented to individuals or populations—amounts found in specific volumes of air or water, or in masses of soil. “Dose” refers to the concentration or amount of a substance inside an exposed person or organism. In occupational health, standards and guidelines are often set in terms of exposure, or allowable limits on concentrations in specific situations, such as in air in the workplace. These exposure limits are predicated upon assumptions or information on the relationships between exposure and dose; however, often information on internal dose is unavailable. Thus, in many studies of occupational health, associations can be drawn only between exposure and response or effect. In a few instances, standards have been set based on dose (e.g., permissible levels of lead in blood or mercury in urine). While these measures are more directly correlated with toxicity, it is still necessary to back-calculate exposure levels associated with these levels for purposes of controlling risks.

The next article concerns the factors and events that determine the relationships between exposure, dose and response. The first factors relate to uptake, absorption and distribution—the processes that determine the actual transport of substances into the body from the external environment across portals of entry such as skin, lung and gut. These processes are at the interface between humans and their environments. The second factors, of metabolism, relate to understanding how the body handles absorbed substances. Some substances are transformed by cellular processes of metabolism, which can either increase or decrease their biological activity.

The concepts of target organ and critical effect have been developed to aid in the interpretation of toxicological data. Depending upon dose, duration and route of exposure, as well as host factors such as age, many toxic agents can induce a number of effects within organs and organisms. An important role of toxicology is to identify the important effect or sets of effects in order to prevent irreversible or debilitating disease. One important part of this task is the identification of the organ first or most affected by a toxic agent; this organ is defined as the “target organ”. Within the target organ, it is important to identify the important event or events that signals intoxication, or damage, in order to ascertain that the organ has been affected beyond the range of normal variation. This is known as the “critical effect”; it may represent the first event in a progression of pathophysiological stages (such as the excretion of small-molecular-weight proteins as a critical effect in nephrotoxicity), or it may represent the first and potentially irreversible effect in a disease process (such as formation of a DNA adduct in carcinogenesis). These concepts are important in occupational health because they define the types of toxicity and clinical disease associated with specific exposures, and in most cases reduction of exposure has as a goal the prevention of critical effects in target organs, rather than every effect in every or any organ.

The next two articles concern important host factors that affect many types of responses to many types of toxic agents. These are: genetic determinants, or inherited susceptibility/resistance factors; and age, sex and other factors such as diet or co-existence of infectious disease. These factors can also affect exposure and dose, through modifying uptake, absorption, distribution and metabolism. Because working populations around the world vary with respect to many of these factors, it is critical for occupational health specialists and policy-makers to understand the way in which these factors may contribute to variabilities in response among populations and individuals within populations. In societies with heterogeneous populations, these considerations are particularly important. The variability of human populations must be considered in evaluating the risks of occupational exposures and in reaching rational conclusions from the study of nonhuman organisms in toxicological research or testing.

The section then provides two general overviews on toxicology at the mechanistic level. Mechanistically, modern toxicologists consider that all toxic effects manifest their first actions at the cellular level; thus, cellular responses represent the earliest indications of the body’s encounters with a toxic agent. It is further assumed that these responses represent a spectrum of events, from injury through death. Cell injury refers to specific processes utilized by cells, the smallest unit of biological organization within organs, to respond to challenge. These responses involve changes in the function of processes within the cell, including the membrane and its ability to take up, release or exclude substances; the directed synthesis of proteins from amino acids; and the turnover of cell components. These responses may be common to all injured cells, or they may be specific to certain types of cells within certain organ systems. Cell death is the destruction of cells within an organ system, as a consequence of irreversible or uncompensated cell injury. Toxic agents may cause cell death acutely because of certain actions such as poisoning oxygen transfer, or cell death may be the consequence of chronic intoxication. Cell death can be followed by replacement in some but not all organ systems, but in some conditions cell proliferation induced by cell death may be considered a toxic response. Even in the absence of cell death, repeated cell injury may induce stress within organs that compromises their function and affects their progeny.

The chapter is then divided into more specific topics, which are grouped into the following categories: mechanism, test methods, regulation and risk assessment. The mechanism articles mostly focus on target systems rather than organs. This reflects the practice of modern toxicology and medicine, which studies organ systems rather than isolated organs. Thus, for example, the discussion of genetic toxicology is not focused upon the toxic effects of agents within a specific organ but rather on genetic material as a target for toxic action. Likewise, the article on immunotoxicology discusses the various organs and cells of the immune system as targets for toxic agents. The methods articles are designed to be highly operational; they describe current methods in use in many countries for hazard identification, that is, the development of information related to biological properties of agents.

The chapter continues with five articles on the application of toxicology in regulation and policy-making, from hazard identification to risk assessment. The current practice in several countries, as well as IARC, is presented. These articles should enable the reader to understand how information derived from toxicology tests is integrated with basic and mechanistic inferences to derive quantitative information used in setting exposure levels and other approaches to controlling hazards in the workplace and general environment.

A summary of available toxicology databases, to which the readers of this encyclopaedia can refer for detailed information on specific toxic agents and exposures, can be found in Volume III (see “Toxicology databases” in the chapter Safe handling of chemicals, which provides information on many of these databases, their information sources, methods of evaluation and interpretation, and means of access). These databases, together with the Encyclopaedia, provide the occupational health specialist, the worker and the employer with the ability to obtain and use up-to-date in- formation on toxicology and the evaluation of toxic agents by national and international bodies.

This chapter focuses upon those aspects of toxicology relevant to occupational safety and health. For that reason, clinical toxic-ology and forensic toxicology are not specifically addressed as subdisciplines of the field. Many of the same principles and approaches described here are used in these subdisciplines as well as in environmental health. They are also applicable to evaluating the impacts of toxic agents on nonhuman populations, a major concern of environmental policies in many countries. A committed attempt has been made to enlist the perspectives and experiences of experts and practitioners from all sectors and from many countries; however, the reader may note a certain bias towards academic scientists in the developed world. Although the editor and contributors believe that the principles and practice of toxic-ology are international, the problems of cultural bias and narrowness of experience may well be evident in this chapter. The chapter editor hopes that readers of this Encyclopaedia will assist in ensuring the broadest perspective possible as this important reference continues to be updated and expanded.

Back

The causes of the 1986 Chernobyl disaster have been variously attributed to the operating personnel, the plant management, the design of the reactor and the lack of adequate safety information in the Soviet nuclear industry. This article considers a number of design faults, operational shortcomings and human errors that combined in the accident. It examines the sequence of events leading up to the accident, design problems in the reactor and cooling rods, and the course of the accident itself. It considers the ergonomics aspects, and expresses the view that the main cause of the accident was inadequate user-machine interaction. Finally, it stresses the continuing inadequacies, and emphasizes that unless the ergonomics lessons are fully learned, a similar disaster could still occur.

The full story of the Chernobyl disaster is yet to be disclosed. To speak candidly, the truth is still veiled by self-serving reticence, half-truths, secrecy and even falsehood. A comprehensive study of the causes of the accident appears to be a very difficult task. The main problem faced by the investigator is the need to reconstruct the accident and the role of the human factors in it on the basis of the tiny bits of information that have been made available for study. The Chernobyl disaster is more than a severe technological accident, part of the reasons for the disaster also lie with the administration and the bureaucracy. However, the chief aim of this article is to consider the design faults, the operational shortcomings and the human errors that combined in the Chernobyl accident.

Who is to blame?

The chief designer for the pressure tube large power boiling water reactors (RBMK) used at the Chernobyl nuclear power plant (NPP), in 1989, presented his view on the causes of the Chernobyl accident. He attributed the disaster to the fact that the personnel failed to observe the correct procedures, or “production discipline”. He pointed out that the lawyers investigating the accident had arrived at the same conclusion. According to his view, “the fault lies with the personnel rather than some design or manufacturing failings.” The research supervisor for the RBMK development supported this view. The possibility of ergonomic inadequacy as a causative factor was not considered.

The operators themselves expressed a different opinion. The shift supervisor of the fourth unit, A.F. Akimov, when dying in a hospital as a result of receiving a dose of radiation of more than 1,500 rads (R) in a short period of time during the accident, kept telling his parents that his actions had been correct and he could not understand what had gone wrong. His persistence reflected absolute trust in a reactor that was supposedly completely safe. Akimov also said that he had nothing to blame his crew for. The operators were sure that their actions were in accord with regulations, and the latter did not mention the eventuality of an explosion at all. (Remarkably, the possibility of the reactor’s becoming dangerous under certain conditions was introduced into the safety regulations only after the Chernobyl accident.) However, in light of design problems revealed subsequently, it is significant that the operators could not understand why inserting rods into the core caused such a terrible explosion instead of instantly stopping the nuclear reaction as designed. In other words, in this case they acted correctly according to the maintenance instructions and to their mental model of the reactor system, but the design of the system failed to correspond to that model.

Six persons, representing only the plant management, were convicted, in view of the human losses, on the grounds of having violated safety regulations for potentially explosive facilities. The chairman presiding over the court said some words to the effect of proceeding with the investigations as regards “those who failed to take measures to improve the plant design”. He also mentioned the responsibility of department officials, local authorities and medical services. But, in fact, it was clear that the case was closed. Nobody else was held responsible for the greatest disaster in the history of nuclear technology.

However, it is necessary to investigate all causative factors that combined in the disaster to learn important lessons for safe future operation of NPPs.

Secrecy: The information monopoly in research and industry

The failure of the user-machine relationship that resulted in “Chernobyl-86” can be attributed in some measure to the policy of secrecy—the enforcement of an information monopoly—that governed technological communication in the Soviet nuclear energy establishment. A small group of scientists and researchers were given an exhaustive right to define the basic principles and procedures in nuclear power, a monopoly reliably protected by the policy of secrecy. As a result, reassurances by Soviet scientists as regards the absolute safety of NPPs remained unchallenged for 35 years, and secrecy veiled the incompetence of the civil nuclear leaders. Incidentally, it became known recently that this secrecy was extended to information relating to the Three Mile Island accident as well; the operating personnel of Soviet NPPs were not fully informed about this accident—only selected items of information, which did not contradict the official view on NPP safety, were made known. A report on the human engineering aspects of the Three Mile Island accident, presented by the author of this paper in 1985, was not distributed to those involved with safety and reliability of NPPs.

No Soviet nuclear accidents were ever made public except for the accidents at the Armenian and Chernobyl (1982) nuclear power plants, which were casually mentioned in the newspaper Pravda. By concealing the true state of affairs (thus failing to make use of lessons based on the accident analyses) the leaders of the nuclear power industry were setting it straight on the path to Chernobyl-86, a path that was further smoothed by the fact that a simplified idea of the operator activities had been implanted and the risk of operating NPPs was underestimated.

As a member of the State Expert Committee on the Consequences of the Chernobyl accident stated in 1990: “To err no more, we have to admit all our errors and analyse them. It is essential to determine which errors were due to our inexperience and which ones were actually a deliberate attempt to hide the truth.”

The Chernobyl Accident of 1986

Faulty planning of the test

On 25 April 1986, the fourth unit of the Chernobyl NPP (Chernobyl 4) was being prepared for routine maintenance. The plan was to shut the unit down and perform an experiment involving inoperative safety systems totally deprived of power from normal sources. This test should have been carried out before the initial Chernobyl 4 startup. However, the State Committee was in such a hurry to start up the unit that they decided to postpone indefinitely some “insignificant” tests. The Acceptance Certificate was signed at the end of 1982. Hence, the deputy chief engineer was acting according to the earlier plan, which presupposed a wholly inactive unit; his planning and timing of the test proceeded according to this implicit assumption. This test was in no way carried out on his own initiative.

The programme of the test was approved by the chief engineer. The power during the test was supposed to be generated from the rundown energy of the turbine rotor (during its inertia-induced rotation). When still rotating, the rotor provides electric power generation which could be used in an emergency. Total loss of power at a nuclear plant causes all mechanisms to stop, including the pumps which provide for the coolant circulation in the core, which in turn results in core meltdown—a grave accident. The above experiment was aimed at testing the possibility of using some other available means—the inertial rotation of the turbine—to produce power. It is not forbidden to perform such tests at operating plants provided that an adequate procedure has been developed and additional safety precautions have been worked out. The programme must ensure that a back-up power supply for the whole test period is provided. In other words, the loss of power is only implied but never actualized. The test may be performed only after the reactor is shut down, that is, when the “scram” button is pushed and the absorbing rods are inserted in the core. Prior to this, the reactor must be in a stable controlled condition with the reactivity margin specified in the operating procedure, with at least 28 to 30 absorbing rods inserted in the core.

The programme approved by the chief engineer of the Chernobyl plant satisfied none of the above requirements. Moreover, it called for the shutting off of the emergency core cooling system (ECCS), thus jeopardizing the safety of the plant for the whole test period (about four hours). When developing the programme, the initiators took into account the possibility of triggering the ECCS, an eventuality which would have prevented them from completing the rundown test. The bleed-off method was not specified in the programme since the turbine no longer needed steam. Clearly, the people involved were completely ignorant of reactor physics. The nuclear power leaders obviously included similarly unqualified people as well, which would account for the fact that when the above programme was submitted for approval to the responsible authorities in January 1986, it was never commented on by them in any way. The dulled feeling of danger also made its contribution. Owing to the policy of secrecy surrounding nuclear technology the opinion had formed that nuclear power plants were safe and reliable, and that their operation was accident-free. Lack of official response to the programme did not, however, alert the director of the Chernobyl plant to the possibility of danger. He decided to proceed with the test using the uncertified programme, even though it was not permitted.

Change in the test programme

While performing the test, the personnel violated the programme itself, thus creating further possibilities for an accident. The Chernobyl personnel committed six gross errors and violations. According to the programme the ECCS was made inoperative, this being one of the gravest and most fatal errors. The feedwater control valves had been cut off and locked beforehand so that it would be impossible even to open them manually. The emergency cooling was deliberately put out of action in order to prevent possible thermal shock resulting from cold water entering the hot core. This decision was based on the firm belief that the reactor would hold out. The “faith” in the reactor was strengthened by the comparatively trouble-free ten years’ operation of the plant. Even a serious warning, the partial core meltdown at the first Chernobyl unit in September 1982, was ignored.

According to the test programme the rotor rundown was to be carried out at a power level of 700 to 1000 MW_th (megawatts of thermal power). Such a rundown should have been performed as the reactor was being shut down, but the other, disastrous, way was chosen: to proceed with the test with the reactor still operating. This was done to ensure the “purity” of the experiment.

In certain operating conditions, it becomes necessary to change or turn off a local control for clusters of absorbing rods. When turning off one of these local systems (the means of doing this are specified in the procedure for low-power operation), the senior reactor control engineer was slow to correct the imbalance in the control system. As a result, the power fell below 30 MW_th which led to fission-product reactor poisoning (with xenon and iodine). In such an event, it is next to impossible to restore normal conditions without interrupting the test and waiting a day until the poisoning is overcome. The deputy chief engineer for operations did not want to interrupt the test and, by means of shouting at them, forced the control-room operators to begin raising the power level (which had been stabilized at 200 MW_th). The reactor poisoning continued, but further power increase was impermissible owing to the small operating reactivity margin of only 30 rods for a large power pressure-tube reactor (RBMK). The reactor became practically uncontrollable and potentially explosive because, in trying to overcome the poisoning, the operators withdrew several rods needed to maintain the reactivity safety margin, thus making the scram system ineffective. Nevertheless, it was decided to proceed with the test. Operator behaviour was evidently motivated mainly by the desire to complete the test as soon as possible.

Problems due to the inadequate design of the reactor and absorbing rods

To give a better understanding of the causes of the accident, it is necessary to point out the major design deficiencies of the absorbing rods of the control and scram system. The core height is 7 m, while the absorbing length of the rods amounts to 5 m with 1 m hollow parts above and below it. The bottom ends of the absorbing rods, which go under the core when fully inserted, are filled with graphite. Given such a design, the control rods enter the core followed by one-metre hollow parts and, finally, come the absorbing parts.

At Chernobyl 4 , there were a total of 211 absorbing rods, 205 of which were fully withdrawn. Simultaneous reinsertion of so many rods initially results in reactivity overshoot (a peak in fission activity), since at first the graphite ends and hollow parts enter the core. In a stable controlled reactor such a burst is nothing to worry about, but in the event of a combination of adverse conditions, such an addition may prove fatal since it leads to prompt neutron reactor runaway. The immediate cause of initial reactivity growth was the initiation of water boiling in the core. This initial reactivity growth reflected one particular drawback: a positive steam void coefficient, which resulted from the core design. This design deficiency is one of the faults which caused operator errors.

Grave design faults in the reactor and the absorbing rods actually predetermined the Chernobyl accident. In 1975, after the accident at the Leningrad plant, and later on, specialists warned about the possibility of another accident in view of deficiencies in core design. Six months before the Chernobyl disaster, a safety inspector at the Kursk plant sent a letter to Moscow in which he pointed out to the chief researcher and chief designer certain design inadequacies of the reactor and the control and protection system rods. The State Supervising Committee for Nuclear Power, however, called his argument groundless.

The course of the accident itself

The course of the events was as follows. With the onset of the reactor coolant pump cavitation, which led to reduced flow rate in the core, the coolant boiled in the pressure tubes. Just then, the shift supervisor pushed the button of the scram system. In response, all the control rods (which had been withdrawn) and the scram rods dropped into the core. However, first to enter the core were the graphite and hollow ends of the rods, which cause reactivity growth; and they entered the core just at the beginning of intensive steam generation. The rise of the core temperature also produced the same effect. Thus there were combined three conditions unfavourable for the core. Immediate reactor runaway began. This was due primarily to gross design deficiencies of the RBMK. It should be recalled here that the ECCS had been made inoperative, locked and sealed.

The subsequent events are well known. The reactor was damaged. The major part of the fuel, graphite and other in-core components were blown out. Radiation levels in the vicinity of the damaged unit amounted to 1,000 to 15,000 R/h, although there were some more distant or sheltered areas where radiation levels were considerably lower.

At first the personnel failed to realize what had happened and just kept on saying, “It is impossible! Everything was done properly.”

Ergonomics considerations in connection with the Soviet report on the accident

The report presented by the Soviet delegation at the International Atomic Energy Association (IAEA) meeting in summer 1986 evidently gave truthful information on the Chernobyl explosion, but a doubt keeps on returning as to whether the emphasis was put in the right places and whether the design inadequacies were not treated much too gently. The report stated that the behaviour of the personnel was caused by the desire to complete the test as soon as possible. Judging from the facts that the personnel violated the procedure for preparing and carrying out tests, violated the test programme itself, and were careless when performing the reactor control, it would seem that the operators were not fully aware of the processes taking place in the reactor and had lost all feeling of danger. According to the report:

The reactor designers failed to provide safety systems designed to prevent an accident in the case of deliberate shut-off of the engineered safety means combined with violations of the operating procedures since they regarded such a combination as unlikely. Hence the initial cause of the accident was a very unlikely violation of the operating procedure and conditions by the plant personnel.

It has become known that in the initial text of the report the words “plant personnel” were followed by the phrase “which showed the design faults of the reactor and the control and protection system rods”.

The designers considered the interference of “clever fools” in plant control unlikely, and therefore failed to develop the corresponding engineered safety mechanisms. Given the phrase in the report stating that the designers considered the actual combination of events unlikely, some questions arise: Had the designers considered all possible situations associated with human activity at the plant? If the answer is positive, then how were they taken into account in the plant design? Unfortunately, the answer to the first question is negative, leaving areas of user-machine interaction undetermined. As a result, onsite emergency training and theoretical and practical training were carried out mainly within a primitive control algorithm.

Ergonomics was not used when designing computer-assisted control systems and control rooms for nuclear plants. As a particularly serious example, an essential parameter indicative of the core state, that is, the number of the control and protection system rods in the core, was displayed on the control board of Chernobyl 4 in a manner inappropriate for perception and comprehension. This inadequacy was overcome only by operator experience in interpreting displays.

Project miscalculations and ignoring human factors had created a delayed-action bomb. It should be emphasized that the design fault of the core and the control system served as a fatal basis for further erroneous actions by operators, and thus the main cause of the accident was the inadequate design of user-machine interaction. Investigators of the disaster called for “respect to human engineering and man-machine interaction, it being the lesson Chernobyl taught us.” Unfortunately, it is difficult to abandon old approaches and stereotyped thinking.

As early as 1976, academician P.L. Kapitza seemed to foresee a disaster for reasons that might have been relevant to preventing a Chernobyl, but his concerns were made known only in 1989. In February 1976, US News and World Report, a weekly news magazine, published a report on the fire at the Browns Ferry nuclear facility in California. Kapitza was so concerned about this accident that he mentioned it in his own report, “Global problems and energy”, delivered in Stockholm in May 1976. Kapitza said in particular:

The accident highlighted the inadequacy of the mathematical methods used to calculate the probability of such events, since these methods do not take into account the probability due to human errors. To solve this problem, it is necessary to take measures to prevent any nuclear accident from taking on a disastrous course.

Kapitza tried to publish his paper in the magazine Nauka i Zhizn (Science and Life), but the paper was rejected on the grounds that it was not advisable “to frighten the public”. The Swedish magazine Ambio had asked Kapitza for his paper but in the long run did not publish it either.

The Academy of Sciences assured Kapitza that there could be no such accidents in the USSR and as an ultimate “proof” gave him the just published Safety Rules for NPPs. These rules contained, for example, such items as “8.1. The actions of the personnel in case of a nuclear accident are determined by the procedure for dealing with the consequences of the accident”!

After Chernobyl

As a direct or indirect consequence of the Chernobyl accident, measures are being developed and put into effect to ensure safe operation of current NPPs and to improve the design and construction of future ones. In particular, measures have been taken to make the scram system more fast-operating and to exclude any possibility of its being deliberately shut off by the personnel. The design of the absorbing rods has been modified and they have been made more numerous.

Furthermore, the pre-Chernobyl procedure for abnormal conditions instructed operators to keep the reactor operating, while according to the current one the reactor must be shut down. New reactors that, basically speaking, are in fact inherently safe are being developed. There have appeared new areas of research which were either ignored or non-existent before Chernobyl, including probabilistic safety analysis and experimental safety bench tests.

However, according to the former USSR Minister of Nuclear Power and Industry, V. Konovalov, the number of failures, shutdowns and incidents at nuclear power plants is still high. Studies show that this is due mainly to the poor quality of the delivered components, to human error and to inadequate solutions by design and engineering bodies. The quality of construction and installation work leaves much to be desired as well.

Various modifications and design changes have become common practice. As a result, and in combination with inadequate training, qualifications of the operating personnel are low. The personnel have to improve their knowledge and skills in the course of their work, based on their experience in plant operation.

Ergonomics lessons are still to be learned

Even the most effective, sophisticated safety control system will fail to provide for plant reliability if human factors are not taken into account. Work is being prepared for the vocational training of personnel in the All-Union Scientific and Research Institute of NPPs, and there are plans to considerably enlarge this effort. It should be admitted, however, that human engineering still is not an integral part of plant design, construction, testing and operation.

The former USSR Ministry of Nuclear Power replied in 1988 to an official inquiry that in the period 1990-2000 there was no need for specialists in human engineering with secondary and higher education as there were no corresponding requests for such personnel from nuclear plants and enterprises.

To solve many of the problems mentioned in this article it is necessary to carry out combined research and development involving physicists, designers, industrial engineers, operating personnel, specialists in human engineering, psychology and other fields. Organizing such joint work entails great difficulties, one particular difficulty being the remaining monopoly of some scientists and groups of scientists on “truth” in the field of nuclear energy and the monopoly of the operating personnel on the information concerning NPP operation. Without available comprehensive information, it is impossible to give a human engineering diagnosis of a NPP and, if necessary, propose ways to eliminate its shortcomings as well as to develop a system of measures to prevent accidents.

In the NPPs of the former Soviet Union the current means for diagnosis, control and computerization are far from accepted international standards; plant control methods are needlessly complicated and confusing; there are no advanced programmes of personnel training; there is poor support of plant operation by designers and highly outdated formats for operating manuals.

Conclusions

In September 1990, after further investigations, two former Chernobyl employees were freed from prison before the end of their terms. Some time later all the imprisoned operating personnel were freed before the appointed time. Many people involved with the reliability and safety of NPPs now believe that the personnel had acted correctly, even though these correct actions resulted in the explosion. The Chernobyl personnel cannot be held responsible for the unexpected magnitude of the accident.

In an attempt to identify those who were responsible for the disaster, the court mainly relied on the opinion of technical specialists who, in this case, were the designers of Chernobyl nuclear power plant. As a result of this one more important Chernobyl lesson is learned: As long as the main legal document that is used to identify responsibility for disasters at such complicated establishments as NPP is something like maintenance instructions produced and changed exclusively by designers of these establishments, it is too technically difficult to find the real reasons for disasters, as well as to take all the necessary precautions to avoid them.

Further, a question still remains as to whether operating personnel should strictly follow the maintenance instructions in the case of disaster or whether they should act according to their knowledge, experience or intuition, which may even contradict the instructions or be unconsciously associated with the threat of severe punishment.

We must state, regrettably, that the question “Who is guilty of the Chernobyl accident?” has not been cleared up. Those responsible should be sought among politicians, physicists, administrators and operators, as well as among development engineers. Convicting mere “switchmen” as in the Chernobyl case, or having clergymen sanctify NPPs with holy water, such as was done with the incident-plagued unit in Smolensk in 1991, cannot be the correct measures to ensure safe and reliable operation of NPPs.

Those considering the Chernobyl disaster merely an unfortunate nuisance of a sort which will never happen again, have to realize that one basic human characteristic is that people do make mistakes—not only operating personnel but also scientists and engineers. Ignoring ergonomic principles about user-machine interactions in any technical or industrial field will result in more frequent and more severe errors.

It is therefore necessary to design technical facilities such as NPPs in such a way that possible errors are discovered before a severe accident can happen. Many ergonomic principles have been derived trying to prevent errors in the first place, for instance in the design of indicators and controls. However, still today these principles are violated in many technical facilities all over the world.

The operating personnel of complex facilities need to be highly qualified, not only for the routine operations but also in the procedures necessary in the case of a deviation from normal status. A sound understanding of the physics and the technologies involved will help the personnel to react better under critical conditions. Such qualifications can only be attained through intensive training.

The constant improvements of user-machine interfaces in all kinds of technical applications, often as a result of minor or major accidents, show that the problem of human errors and thus of user-machine interaction is far from being solved. Continuous ergonomic research and the consequent application of the obtained results aimed at making user-machine interaction more reliable is necessary, especially with technologies that bear a highly destructive power, such as nuclear power. Chernobyl is a severe warning of what can happen if people—scientists and engineers, as well as administrators and politicians—disregard the necessity of including ergonomics in the process of designing and operating complex technical facilities.

Hans Blix, Director General of the IAEA, has stressed this problem with an important comparison. It has been said that the problem of war is much too serious to be left solely to generals. Blix added “that the problems of nuclear power are much too serious to leave them solely to nuclear experts”.

Back