Scottish CND     Safety of Trident
This section looks at the dangers which are inherent in operating nuclear powered and nuclear armed submarines. It considers the principal concerns of reactor and missile safety and the basic issues of human errorand computer failure. There are risksfrom collisions, fires, torpedo explosions and systems failures. There are particular hazards related to missile loading, warhead loading, the Faslane shiplift and reactor defuelling. See also reactor accidents.
The introduction of nuclear powered submarines into the US Navy was at the initiative of Admiral Hyman Rickover, who was recognised as the father of the nuclear navy. He played a key role in the introduction of nuclear power to submarines in the British fleet. In his later years Admiral Rickover became a strong critic of the project on which he had spent a large part of his life. He told the US Congress that the world would be a safer place if the whole nuclear navy was sunk.
There are fundamental problems with the safety of nuclear reactors on submarines. Containment is limited to that provided by the submarine's hull and bulkheads. The safety of the reactor can be compromised if something goes wrong elsewhere on the vessel.
British Trident submarines are powered by a pressurised water reactor, the PWR 2. The reactor provides power both to propel the vessel, support submarine systems and operate the reactor cooling pumps.
A reactor accident could occur as a consequence of an incident elsewhere on a submarine, or as a result of problems within the reactor itself. With regard to problems within the reactor, one of the main dangers with a pressurised water reactor is if cold water is suddenly introduced into the coolant circuit. This may happen if there is a slug of cold water due to uneven flow in the primary circuit or if the steam generators remove too much heat. Cold water can speed up the nuclear reaction.
Older British submarines are powered by the PWR 1. There is a design problem affecting this type of reactor. Hairline cracks have been found where the primary coolant pipework joins the reactor pressure vessel and where it joins the steam generators. This defect led to the decommissioning of 2 submarines and was a factor in the decommissioning of 3 others. The refit of HMS Renown was extended from 2 years to 5 years for the same reason. The cause of the problem has been identified as the water chemistry in the coolant system however this was not fully understood until late 1992. By this time construction of the first Trident submarine, HMS Vanguard, had been completed. So the defect could also affect the PWR2 reactor used on Trident submarines.
The PWR 1 reactor uses hafnium control rods and it is assumed that these will also be used in the PWR 2. Hafnium can buckle and distort under certain conditions. Smooth operation of the control rods is vital for safe reactor operations. PWR1 reactors have been involved in a number of incidents around the time when the reactor was being made critical. When the reactor is shut down at Faslane electricity is supplied from the shore, both AC and DC supplies are needed. On several occasions there have been fires and other incidents when supplies were switched from shore to submarine.
When at sea, a sudden loss of power could result in the submarine going into an uncontrolled dive. For this reason the Captain has a switch which carries out a "battleshort". This overrides reactor safety mechanisms and prevents an automatic shutdown. If the "battleshort" is used when there is a reactor problem, it could lead to a major accident.
When a reactor has shut down it cannot be immediately restarted. At the time of shut down there is a build up of xenon135 which inhibits attempts to restart the reactor. Xenon135 has a half life of 9.2 hours and there can be a delay of up to 3 days before the reactor will start up again. The start up procedure requires considerable power for the pressuriser and coolant pumps. If the shut down occurs at sea then the submarine becomes dependent on auxiliary power supplies both to maintain submarine systems and to restart the reactor.
The second main concern about Trident submarines is the nuclear armed missiles which they carry. On 3rd October 1986 a liquid fuelled SS-N-8 missile exploded on a Soviet Yankee I class nuclear powered submarine near Bermuda. The vessel was severely damaged and sank under tow on 6th October. The explosion had killed 3 sailors. Actual experience indicates that a missile explosion might occur more than once in 5,000 reactor years (estimate of total nuclear powered ballistic missile submarine reactor years worldwide to date).
Each Trident submarine will carry 16 solid fuel missiles with a total of around 800 tonnes of high explosive in close proximity to the nuclear reactor, except when they are on initial trials or in refit. No nuclear safety regulator would allow a large amount of explosives to be placed near a land based reactor or to the amounts of plutonium in the warheads. The explosives in the missile are designated by the US Department of Transport as Class A which means that in an accident the explosives can detonate. The Trident D5 is a high performance solid fuel rocket and the performance is probably achieved by the use of an explosives formula which is sensitive to temperature and shock. There are a number of factors which could lead to an explosion of a missile:
Heat. The safe temperature limits for the rocket are defined in transportation arrangements. The temperature within box cars within which Trident rocket motors are transported must be kept between -29o C and +49o C. The box cars have an environmental control system to maintain the temperature within these limits and a warning light goes on outside the box car if the environmental control system fails. It is likely that the same temperature limits have to be maintained within the launch tubes of a Trident submarine and within the RIMs at Coulport. Fire on a submarine could pose a serious risk to missiles. Polaris submarines have a system where a missile tube can be filled with nitrogen and it is assumed the same will be available with Trident. While this will reduce the possibility of an explosion it does not eliminate it. Intense heat could still cause a missile to explode.
Explosive components. In addition to the main rocket motors the missile compartment contains gas generators, rocket separators and rocket motor igniters which are all explosives. There is also explosive in the nuclear warheads. The detonation of any one of these components could trigger the detonation of the rocket motors. The detonation of 0.3 g of explosives can cause the missile to explode.
Pressure. Prior to launch or jettison the missile compartment is pressurised. An accident during pressurisation could result in missile detonation. A failure in the hydraulic system which is used to raise and lower the missiles could also cause an accident. Pressure of 30 kilobars can cause the missile to detonate.
Shock. If a missile is dropped or if an object collides with it, then it could explode. A missile accident could occur during missile test firing, in particular when the 1st stage motor is ignited on the surface. There are also procedures to jettison a missile to prevent a missile accident. Jettisoning a missile could result in an impact between a missile and the hull. In the case of Polaris the submarine should be tilted 7 degrees before a jettison to reduce this risk. In a complex accident situation there may not be sufficient control over the vessel to tilt it to one side.
Electromagnetic radiation. The electromagnetic hazard to rocket fuel is a recognised hazard. An explosion of a rocket motor at the Morton Thiokol factory where Trident rocket motors are made has been attributed to this phenomenon. Given the large amount of electrical and electronic equipment on a submarine there is the potential for this to initiate an accident. The effect of a Trident D5 missile explosion can be gauged by the arrangements which would be made in the event of an accident during the rail transport of rocket motors. If a fire reaches the cargo compartment then everyone, including fire fighters should be evacuated to at least one mile from the scene. Further indication of the force of the blast is evident in procedures surrounding Trident D5 tests at Cape Canaveral. These tests only took place under certain atmospheric conditions because of the fear that a rocket motor explosion could damage the nearby town and only essential personnel were allowed to remain within the test area.
The potential for a sophisticated rocket system to go wrong was shown when the space shuttle Challenger exploded in mid air. The explosion was initiated by a failure in a solid fuelled booster.
Relationship between missile and reactor systems
The two concerns, reactor and missiles, should not be considered as unconnected. The safety of a submarine should be considered as a whole and the relationship between reactor and missiles is particularly important.
The explosion of one or more missiles would have an effect on the reactor. The integrity of the reactor primary coolant circuit could be affected directly or indirectly from blast damage to the reactor compartment bulkhead, or from impacts on the hull. There could also be damage to the secondary steam circuit or to other systems related to the reactor. Fire resulting from an explosion could be the cause of a reactor accident.
A steam-zirconium or hydrogen explosion within the reactor compartment which produced sufficient pressure to breach the reactor compartment bulkhead could have sufficient force to cause a missile accident or explosion. More likely a reactor accident could result in a fire which would endanger missiles. The reactor also provides electrical power which supports missile handling and safety systems. An interruption in the regular power supply during a major reactor accident could endanger missile safety.
Both missile and reactor systems could be affected by an incident initiated elsewhere on the submarine, particularly a fire. Both also rely on some common support systems. The safe operation of reactor and missiles depends on the cooling system working properly. Operation of the diesel generators can also be affected by cooling system failure. On a Polaris submarine the environmental control system is located in a compartment several levels below the coning tower. On a Trident systems it is probably located somewhere at the aft of the vessel.
The physical relationship between the reactor and missile compartments is also important. On a Polaris submarine the missile and reactor compartments are separated by the diesel generator compartment which is approximately 6 m wide. The bulkhead between the diesel generator compartment and the missile compartment is not airtight. The bulkhead between the diesel generator compartment and the reactor compartment is part of the reactor containment and is designed to withstand pressure of around 300 psi. A Trident submarine is larger but the basic arrangement may be similar.
The crew of a ballistic missile submarine are in an unusual physical, social and psychological situation. They are living indoors for 3 months in a restricted space. They see no natural daylight throughout that time and are not exposed to the normal cycles of night and day. They are aware that they are on a vessel which is armed with nuclear weapons able to destroy a continent and powered by a nuclear reactor. Regular drills reinforce awareness of what could go wrong. They are cut off from family and friends and in close confinement with other men. Even a large submarine can be cramped with trainees sleeping in corners, having to "hot bunk". The actual number on board may be well in excess of the 130 crew for which the submarine is designed.
In the second half of 1990 and the first half of 1991 the Polaris submarine HMS Resolution carried out two 16 week patrols. The patrols were extended from the normal 10 weeks because no other Polaris submarine was able to go to sea. The MoD's desire to keep one missile boat at sea at all times can increase the likelihood of an accident, both on technical and psychological grounds. A nuclear submariner has said "The worst thing is to tune your mind to a four-month patrol on a Polaris nuclear missile boat only to have it extended for another month or two a week before you are due to open the hatch again". Assuming that the Trident force is operated on the same basis of having one submarine on station at all times then Trident patrols will likewise be extended at the last minute, when the replacement vessel is not ready to go to sea.
In October 1993 a naval doctor said that problems with stress at the hunter killer submarine base at Devonport were on the increase. This was attributed to using these boats on longer and more frequent patrols. The crew of a Trident submarine will spend more than 10 weeks at sea at a time.
The problems of submariners are compounded by the concerns of their families. The naval doctor at Devonport said ".. it is not just the understandable pressures of serving at sea, families become very worried and this adds to it all". Worried relatives can increase the stress felt by submariners. It can also lead to more submariners leaving the job. As a result there may be less experienced personnel in key positions.
The lack of experience of some of the individuals on duty on 26th April 1986 contributed to the accident at Chernobyl. The night shift contained fewer experienced staff. The reactor operator, Leonid Toptunov, had worked as a senior engineer at the reactor control for only 4 months. He died 2 weeks after the disaster from the effects of radiation.
The Captain of a submarine is regarded as "god" on his vessel. He will have completed a Perisher course which requires that he has the capabilities to be able to cope with complicated, critical, time urgent situations and make decisions under pressure. The extent of authority which a Captain has and the Perisher approach might in some ways be an asset in responding to an emergency, however there are also negative aspects to this. The Captain is not a reactor expert and yet he is in a position to override the advice of his reactor officer, the Mechanical Engineering Officer (MEO). The Perisher approach demands an element of aggression which may not be appropriate. Avoidance of an accident is very much dependent on the abilities and judgement of one individual and on his state of mind.
The dangers of operating a nuclear reactor within a strict social regime are evident from Chernobyl. A G Uskov was a reactor operator at Chernobyl and was on duty the day before the accident. When asked what he would have done if he had been given the same instructions that were issued that night, he said: "If I had been working at the control panels, I might perhaps have protested to the Chief Engineer, but I would not have had enough spirit to refuse categorically to carry out his command".
One of the objectives of a nuclear missile submarine patrol is to remain undetected at all times. If there is a incident there will be a reluctance to compromise the vessel's position by sending out radio signals. Until this is done the only expertise which can be brought to bear on the problem is that possessed by those on the submarine. The shore base may only be informed of an incident after it has developed into a serious emergency.
The Captain of a submarine may not always tell his superiors when things go wrong, as was shown in a recent incident. In March 1992 HMS Valiant was sailing 8 miles off course when the vessel collided with an underwater mountain in the Norwegian Trench, damaging the hull. The Captain did not tell his superiors when he returned to base. The Admiralty only discovered what had happened 2 months later. The Captain was subsequently court martialled and dismissed from the service.
In an emergency at a civil power station the management will have a number of concerns - exposure of workers to radiation, danger of fire, hazards to emergency services and the radiation hazards to the general public.
The concerns of the Captain or Officer of the Watch on a Trident submarine are more numerous. The dangers to the crew are not only from exposure to radiation, but also from fire, smoke, explosives and drowning. In addition to this there would be concern about other vessels in the area and about the radiation hazard to the general public.
These complex concerns are liable to add to the stress on men who are already in a very abnormal social, physical and psychological situation. Key personnel are less likely to make the best decision in the event of an accident on a submarine than in the event of a similar problem involving a reactor on land. In both the Chernobyl and Windscale accidents the initial responses had the effect of making the situation more dangerous.
The reliability of computer systems is a much greater factor in the safety of a Trident submarine than in was the case for earlier submarines. This affects not only the operation of the vessel but also the accuracy of safety assessments of key shore support facilities. The potential for safety critical computer systems to go wrong was shown when computer failure caused the collapse of the whole ambulance response service across London.
The design calculations for the shiplift and finger jetty at Faslane and the EHJ at Coulport have been particularly complex. Computer systems have been used to assess whether the likelihood of a major accident falls within certain parameters. Faults within the software could compromise the accuracy of these safety assessments. The potential for computer error could also undermine safety calculations affecting the design of the reactor and other systems on the submarine.
Control of a Trident submarine is carried out using a new Submarine Manoeuvre and Command System (SMCS). This uses 200 32-bit processors with a storage capacity of 2.5 gigabytes. This is 100 times the processing capacity of the system in service on earlier submarines. There have been major delays in developing the software for SMCS. Contractors sea trials were carried out using a basic form of the software and a sequence of further issues of software were planned, with the final version not available for HMS Vanguard until it was well into its navy sea trials, 1993-94. The problem lies with the infrastructure software which should be able "to support the layering of large amounts of Ada software across distributed processors in a time-critical, fault-tolerant environment with a large amount of changing data". The safety of a Trident submarine will depend on this software for SMCS. In the race to meet the inservice date of HMS Vanguard, bugs may be overlooked.
The operation of the control rods in the reactor is controlled by onboard computers. It has been said that there were problems in the operation of these computer controls during the contractors sea trials of HMS Vanguard.
The problems of reliance on complex computer systems for nuclear safety have been highlighted by recent concerns about civil nuclear establishments. There has been an incident at Sellafield when computer error led to radiation doors opening accidentally because of computer error. It was subsequently discovered that BNF had altered software after it had been approved by the NII. 2400 faults were discovered in BNF software for THORP. The software for Sizewell is so large that it cannot be fully tested.
On the basis of recorded incidents involving Polaris and other British nuclear powered submarines it can be projected that Trident submarines are likely to be involved in between 2 and 5 collisions with other vessels (see Note).
Trident submarines will regularly use shipping lanes in the Clyde frequented by tankers visiting the Finnart Oil Terminal as well as other merchant ships. Submarines also operate between the Northern Isles and the Mainland and through the Minches, both areas which are frequented by oil tankers. There is one unconfirmed report that the masts of a Polaris submarine were damaged in a collision with a tanker. A similar incident occurred on 18th August 1993 when the French nuclear powered submarine Rubin collided with a 277,000 ton supertanker in the Mediterranean. The tanker was damaged and oil leaked into the sea.
Submarines regularly cross the path taken by the following ferries: Gourock-Kilcreggan, Gourock - Dunoon, Wemyss Bay - Rothesay, Adrossan - Brodick, Claonaig - Lochranza, Stranraer - Larne, Uig - Lochmaddy-Tarbert, Ullapool - Stornoway, Kennacraig - Portellen-Port Askaig, Oban - Castlebay- Lochboisdale. Frequently submarines are on a path at 90 degrees to the line taken by the ferry and they have been regarded as targets in mock attacks by submarines. Submarines also regularly transit between Mull of Kintyre and N. Ireland and between Mull of Galloway and N. Ireland. When going to Devonport for refits they will transit through the West of the English Channel.
Trident submarines will operate in areas frequented by fishing boats during trials, in transit to patrol areas and possibly while on patrol. Incidents involving submarines and fishing boats happen every year on the West Coast of Scotland. It is likely that Trident submarine will be involved in several such incidents. These incidents will pose a serious hazard to the lives of fishermen and could initiate a submarine accident.
If there is a collision with a ship, on most occasions the damage to the ship will be greater than to the submarine, however it is possible that a collision could result in a reactor or missile accident. If the ship is carrying highly inflammable or explosive cargo there could be an explosion or serious fire.
While the hull of a ship might crumple and absorb some of the force of the impact, this would not apply to the same extent in the case of a collision between two submarines, both with substantial hulls. The chance of a Trident submarine being involved at some time over 30 years in a collision with an other submarine is between 60 % and 120% (see Note).
NATO and Soviet / Russian submarines are known to have collided while submerged on a number of occasions. One incident took place in the Barents Sea in 1982 and involved the HMS Sceptre. In another incident in the Barents Sea the USS Baton Rouge collided with a Russian submarine in 1992. These accidents occur as the result of the way in which submarines operate. By using active sonar they are able to accurately identify other vessels around them. However active sonar gives away the submarine's position. So they rely on passive sonar. This gives less accurate information which is difficult to interpret especially if the vessel is carrying out a serious of manoeuvres. When one submarine is following another, both using passive sonar, there is the danger of a collision. Such an incident could occur during operations or submarine - vs - submarine exercises.
Around 25 % of all collisions recorded involving British and American submarines took place either when a submarine was berthing or in the mouth of a harbour. The most probable location of a Trident submarine collision is in the Clyde area, in particular Gareloch and Loch Long. A collision occurred involving 2 Polaris submarines at Faslane in January 1973 - the diving planes of HMS Repulse were severely damaged. On 15th February 1967, 2 diesel submarines collided at the entrance to Portsmouth harbour.
Submarines do not always have a pilot on board when they approach the Faslane base. To enter and leave Faslane all vessels must navigate a 200 metre wide channel at Rhu Narrows. In September 1992 two submarines were seen approaching the channel from opposite directions at the same time.
By the late 1990s there are due to be 3 Trident and 4 other nuclear powered submarines operating from Faslane. The base is also used regularly by British submarines from Devonport and vessels from foreign navies, including French and American nuclear powered vessels. With as many as 7 submarines berthed at Faslane, arrivals and departures are a daily event, with sometimes several submarine movements on one day. Vessels normally enter the Gareloch under their own power escorted by tugs, but are sometimes towed into and out of the loch.
If a Trident submarine is involved in a collision this could result in a serious reactor and/or missile accident, particularly if the other vessel involved was also a submarine. An impact would be most serious if it involved a collision at an angle of around 90o or if it affected the reactor or missile areas. The reactor compartment and the missile section together take up around half the length of the vessel - it is not unlikely that a collision could be at one of these areas. A collision elsewhere could have effects such as a fire, loss of control, or a torpedo explosion - which could endanger reactor and missile safety.
Fire and fumes
On the basis of the frequency of fires on board Polaris and other British nuclear powered submarines it can be projected that around 6 fires are likely to occur involving Trident submarines during their 30 year lifetime (see Note). The dangers of fire were clearly shown in the accident which occurred on a Soviet submarine on 7th April 1989. There was a fire in the aft compartment of the Komsomolets. After several hours the vessel sank with the loss of 43 lives.
There are two forms of hazard associated with a fire on a submarine. The first is that the fire can directly damage and endanger systems on the submarine, including missiles and the reactor. Missiles, torpedoes and other explosive substances could detonate in a fire. A fire could result in a submarine sinking. A fire could also affect cooling and other systems, leading to a reactor accident.
The second hazard is that fumes from a fire could seriously restrict the ability of key personnel to carry out safety precautions and fire fighting. Toxic fumes are dangerous within the confined space of a submarine. In addition to the fire danger, there are a range of toxic fumes which can be present on a submarine which could be dispersed by accident.
On 2nd May 1976 there was a serious fire onboard HMS Warspite when it was visiting Liverpool. A coupling failed and oil was sprayed in the diesel generator room. The ensuing fire lasted for 5 hours and lagging was still smouldering many hours later. One sailor was seriously injured and four others taken to hospital.
In April 1992 there was a fire on board HMS Turbulent at Devonport. Maintenance work was being carried out on one of the two electrical switchboards when there was a short circuit and a bang followed by a fire. The switchroom is adjacent to the reactor compartment and separated from it by a bulkhead. The Mechanical Engineering Articifer (MEA) of the Watch was not wearing a face mask when he was required to carry out an essential safety task, Petty Officer Christian Checkley removed his face mask and handed it to the MEA. The essential safety task may have been to shut down the reactor. The reactor was producing power at the time of the fire but was quickly shut down. The consequences of the accident might have been much worse if Petty Officer Checkley had not taken this action - for which he received the Queens Commendation for bravery. The incident was officially described as "potentially lethal" and 23 sailors were admitted to hospital suffering from smoke inhalation.
On 19th August 1993 at Devonport toxic diesel exhaust fumes spread through part of HMS Torbay. All the 32 sailors who had been on board were taken to hospital. 13 were kept in over the weekend and some were still suffering from the effects of the accident several weeks later. Commenting on the incident, Captain Richard Sharpe, editor of Janes Fighting Ships said: "We are dealing with an incredibly small hull which is machinery intensive. The smallest amount of smoke spreads with amazing rapidity". Although Trident submarines are significantly larger than Trafalgar class the same basic problem exists.
In the incidents on HMS Turbulent and HMS Torbay it has been said that the submarine venting system did not function properly and that toxic fumes were dispersed around the vessel. In the case of HMS Torbay the submarine ventilation system was left open.
A detailed investigation of naval accidents since the Second World War found that 33 % of all explosions on ships and submarines involved torpedoes and that 15 % of explosions occurred during the loading and unloading of weapons. One of several fatal accidents took place on 17th June 1955 when the diesel powered submarine, HMS Sidon sank in Portland harbour after an explosion in the torpedo compartment. A more recent incident showed how submariners are concerned that torpedoes may explode in a fire - sailors tried to unload torpedoes as quickly as possible from HMS Turbulent while the vessel was on fire in April 1992. The high explosives in the torpedoes may be heat sensitive, one type of explosive used in torpedoes, PETN has a melting point of 140o C.
Trident submarines will carry Spearfish torpedoes. These are particularly hazardous for two reasons. They contain a more powerful high explosive warhead than earlier models of torpedo and instead of battery power, they are propelled by Otto fuel, which is known to be dangerous. During early experiments on the use of this fuel for the Navy, 2 workers were killed. The Otto fuel is an explosive and toxic hazard in a fire.
Loading of Spearfish torpedoes will take place at the Finger Jetty in Faslane. They will be fired at the torpedo range near Applecross and also at a submarine trials area in the Bahamas. Although the torpedoes which are fired have dummy warheads there is the danger of a handling accident resulting in an explosion of the Otto fuel.
The high explosive in a Spearfish torpedo is designed to be sufficiently powerful to sink a modern submarine. An accidental explosion would be likely to lead to the loss of the vessel on which it occurred. USS Scorpion was sunk in 1968 by one of its own torpedoes. The torpedo was jettisoned after it had begun to arm itself. The rogue torpedo then turned and homed in on the USS Scorpion and sunk the submarine with the loss of all her crew.
The Trident submarine contains a large number of new systems which are largely untried. There is a new sonar, new torpedo discharge system, new reactor, new periscopes, new electronic equipment and many other new components. While many of these are based on modifications of earlier models and some have been tried out on other submarines, they were only used together at sea when HMS Vanguard began its contractors sea trials in October 1992. The failure of one component could lead to a major accident. If different components do not interact properly this could also initiate an accident.
Because of the new systems, HMS Vanguard and later submarines will carry out months of trials - some of these trials involve considerable risk. A number of incidents occurred in the early 1990s, during trials on the new diesel powered Upholder Class submarines. The consequences of an accident on a nuclear powered vessel, such as a Trident submarine, may be much more serious.
The reactors at Chernobyl were made operational ahead of their planned date by missing out some time consuming safety tests. The omission of the tests at an early stage was a factor which contributed to the disaster in 1986. There may be very similar forces at work during the sea trials of Trident submarine, especially HMS Vanguard. Safety may be compromised in the rush to meet the in-service date.
Loading and unloading missiles
Each submarine will visit the US Trident facility at Kings Bay in Georgia several times. The first occasion will be to load around 4 missiles, with dummy Re-entry Vehicles (RVs), onto the submarine for test firing. After these have been fired the vessel will return and load up with missiles. HMS Vanguard collected 16 missiles in 1994 and HMS Victorious collected 12 missiles in 1995. Before each major refit all the missiles will be unloaded at Kings Bay. At Coulport there are also facilities for loading, unloading and transporting missiles. If it is necessary to carry out an unscheduled docking of a submarine at Devonport then all missiles would be unloaded and stored at Coulport. There are other undisclosed situations in which a few missiles would be unloaded at Coulport.
There has been one major nuclear missile handling accident in Britain. It took place at the US base in the Holy Loch on 2nd November 1981. A crane operator dropped a Poseidon missile which then collided with the side of the support ship. Fortunately the missile did not explode, if it had there would have been a major nuclear accident.
Fixing and removing warheads
After a submarine is loaded with missiles at Kings Bay it will go to the EHJ at Coulport where the nuclear warheads will be put in place. This operation will be carried out using specially built Missile Service Units (MSUs). These are boxes, 8 m high, which can be placed over a missile hatch on a submarine33. VSEL built 3 MSUs, one of which was dropped when it was being loaded onto a lorry prior to shipping from Barrow. Damage to the handling mechanisms or other parts of the MSU would increase the risk of an accident. Each MSU contains equipment to manoeuvre the 150 kg nuclear warheads. Each warhead will be placed in its position in a circle around the 3rd stage rocket motor. When all the warheads are in position and all connections and fittings have been completed, the nose cone will be replaced. A total of 8 - 10 lifting operations may be required for each missile.
This procedure carries with it the hazard that an object - nuclear warhead, nose cone, lifting or handling gear - could collide with the 3rd stage rocket motor with sufficient force to cause the motor to detonate. A US nuclear weapons safety investigation in 1990 identified this as a major problem - "if the third stage motor were to detonate in a submarine loading accident, for example, a patch of motor fragment could impact on the side of the reentry bodies encasing each warhead. The concern is whether some combination of such off-axis multi-point impacts would detonate the HE surrounding the nuclear pit and lead to plutonium dispersal or possibly a nuclear yield"34.
Fire within the MSU is also a major hazard. A spark could be caused by contact between metal objects, by electrostatic build up or by an electrical malfunction. Cabling between the MSU and the jetty may be a particular concern.
The warheads will be placed on the missiles which are onboard a submarine in the water, inside the floating EHJ. Both the submarine and the jetty will be subject to the forces of tide, current and wind. Placing nuclear warheads on a Trident missile on land is a dangerous operation, carrying this out on the water is even more so.
Assuming there will be 96 nuclear warheads on each submarine, then for the whole Trident programme approximately 2400 operations will be carried out involving the attachment or removal of one warhead. This figure assumes that the warheads remain in place throughout an 8 year commission. If warheads are removed for inspection more frequently then 5000 or more operations would be needed. Each operation carries with it the risk of not only an accident, but also of a nuclear explosion.
The shiplift at Faslane will be used to take submarines which are loaded with missiles and nuclear warheads out of the water for maintenance. If the shiplift failed, a nuclear accident could be initiated in one of the following ways:
a. Shock could affect the reactor, missiles or nuclear warheads.
b. Fire could endanger the reactor, missiles or nuclear warheads.
c. There could be damage to submarine systems which would then endanger the safety of reactor, missiles or nuclear warheads. Connections between the submarine and the shore would be particularly vulnerable.
If a submarine collided with the shiplift during berthing the structure could be weakened. High winds could also weaken it. To resist pressure on the shiplift from the side, 188 diagonal raker piles were placed at an angle in the sea bed. Many of these have been proven to be faulty. When some of the piles were tested, 66 % were found to be defective and had to be replaced. A further 82 piles which were inaccessible could not be tested. It is likely that the concrete in most of these 82 piles has not set. The piles will have lost their tension capability and if the steel degrades this will also reduce their compression capability. In addition, it has been calculated that the shiplift could, under certain circumstances move sideways by 75 mm35.
The shiplift may be vulnerable to earth tremors. On 17th September 1985 there was a tremor which measured 2.5 of the Richter scale centred 12 kms from Faslane36. The design criteria for seismic risks is a horizontal acceleration of 0.2 g with an additional requirement that there be no unacceptable consequences at 40 % more than this. The UKAEA SRD are believed to have expressed concern to the MoD that this might be unattainable. On 27th March 1990 Commander RE Crawford, who worked for the Director General Submarines at Bath wrote that "the safety authorities expressed concern at the ability to meet this 40 per cent margin"37.
The shiplift uses a series of wire ropes which are subject to problems from corrosion. One specialist firm, Hydranautics, had suggested that chains could be safer. However the MoD said that they did not have enough time to fully consider this option.
There have been many accidents involving shiplifts. In 1976 the hull of a 1000 ton trawler was punctured when the ship hit the concrete dock after the deck of the shiplift which it was on broke. The vessel initially dropped by the bow then rolled over. An accident in Iceland in 1972 was attributed to excessive wear on the wire and operator error. The catastrophic failure of a shiftlift in Peru was due to severe corrosion as a result of inadequate lubrication and lack of inspection38. The US Navy continues to use dry docks for submarine maintenance and has not adopted the use of shiplifts for nuclear powered submarines.
Defuelling and refuelling
The most serious accident in the history of nuclear powered submarines occurred during the refuelling of a Soviet submarine in 1985 and is described in Section 4. A total of 12 defuelling operations will be scheduled to take place on Trident submarines at Devonport Dockyard and 3 on the PWR 2 prototype at Dounreay. A gap of at least 6 months is normally left between when the reactor is shut down and when it is defuelled. This is to enable levels of radioactivity from the reactor to fall, however levels are still hazardous when defuelling is carried out.
A major accident could occur when the used fuel core is being moved from the reactor. In the new facilities at 5 Dock in Devonport the fuel core will be lifted 2 - 3 metres and then taken into a building. During the lift the core could be dropped and damaged39. There have been a number of fires reported during submarine refits which have varied in their degrees of seriousness. A fire could trigger off a series of events which could lead to an accident involving either the reactor or fuel cores in storage.
The city of Plymouth is particularly vulnerable to a nuclear accident. A major accident, at the level of Benchmark 6, would result in serious exposure around the base, the evacuation of a large part of Plymouth and sheltering in areas such as Exeter and Taunton, if there was a South Westerly wind.
Initial fuelling of reactors also takes place in a built up area, in the VSEL yard at Barrow in Furness. First power range testing of the reactors also takes place there. This involves the reactor being put through its paces for the first time and could result in a major accident.
NOTE: SUBMARINE ACCIDENT STATISTICS
Not including the first Trident submarine there have been 23 nuclear powered submarines in service in the Royal Navy. From when each was built to the end of 1993, or until scrapped gives a total of around 384 reactor years. This includes hunter killer submarines. The equivalent for Polaris is a total of around 102 reactor years.
Between 1950 and 1988 there were at least 19 fires and 6 collisions, 2 of which involved 2 submarines, on all British nuclear powered submarines. In the same period there were 5 fires and 4 collisions, 1 of which involved 2 submarines, on Polaris submarines.
4 Trident submarines in service for 30 years will be in service for a total of 120 reactor years. The projected number of incidents for the projected lifetime of Trident, based on the figures for Polaris and for all British nuclear powered submarines are as follows:
Based on Polaris
4.7 collisions (all vessels)
1.2 collisions with other submarines
Based on all submarines:
1.9 collisions (all vessels)
0.6 collisions with other submarines
An examination of a total of 63 collisions involving British or US submarines showed 73 % (46) occurred at sea and 27 % (17) when the submarine was berthing or in a harbour area.
Scottish CND     Safety of Trident