On the morning of 30 September 1999, three workers at a uranium conversion plant in Tokai-mura, Japan, poured enriched uranium solution by hand into a tank that was never intended to hold it, and the mixture went critical. Two of the three died. Residents within 350 meters were evacuated, roughly 310,000 people within 10 kilometers were told to stay indoors, and the fission reaction ran intermittently for about twenty hours before anyone could stop it. The accident is the clearest case on record of what happens when a written procedure is the only thing standing between a process and a nuclear chain reaction.

What a criticality excursion is, at awareness level

A criticality accident is an unplanned, self-sustaining nuclear fission chain reaction in material outside a reactor core. Fissile material, meaning uranium-235, plutonium-239 and a few others, will sustain a chain reaction only when several conditions line up at once, and the conditions are the reason these accidents are rare and the reason they are possible at all. The amount of material matters, but so does its shape, its concentration in solution, whether it is surrounded by something that reflects neutrons back into it, and above all whether it is mixed with water or another moderator, because slowing neutrons down makes them far more likely to cause further fissions. A quantity of enriched uranium that is entirely safe as dry powder spread through a long thin pipe can be critical as a solution sitting in a round tank.

What a criticality is not is a nuclear explosion. The energy release is thermal and radiological rather than explosive in the weapons sense, and in the process accidents on record the mechanical damage has generally been limited to splashed or ejected solution, ruptured seals and pressure effects. The hazard that kills people is the radiation field, which consists mainly of neutrons and gamma rays produced while the reaction is running, along with fission products that can be released into the building and, in smaller quantity, to the outside air. Anyone in the room receives an enormous dose in seconds.

An excursion may be a single pulse that shuts itself down when the material heats and expands, or it may oscillate and continue for hours as the solution boils, voids, cools and reassembles. That distinction matters enormously to a responder, because a single-pulse event is over before the alarm finishes sounding, while a continuing excursion means the source is still there and still running when the first units arrive at the gate. Tokaimura was the second kind, and the reaction did not stop until people went in deliberately, in shifts, to change the physical conditions that were keeping it going.

The blue flash, and what the senses actually report

Survivors and witnesses of criticality accidents have repeatedly described a blue flash or a blue glow at the moment of the excursion, and the description is consistent enough across decades and countries that it belongs in any awareness briefing. The physical explanation usually given in the technical literature involves ionization and excitation of air molecules that then emit light as they return to their ground state, together with Cherenkov radiation in aqueous solutions where the medium supports it. Some accounts also raise the possibility that intense radiation stimulates the retina directly, which would mean the observer sees light that is not present in the room at all. Individual survivor descriptions of heat, taste or other sensations are anecdotal and should be treated as such.

The operational point is the one worth carrying away. A blue flash is a report from a witness, not a detector, and its absence proves nothing, because the excursion may have occurred behind a wall, in daylight, in an unoccupied room, or with nobody facing the right direction. Nothing about a criticality is reliably detectable by human senses at a distance, and the radiation field gives no warning, no smell and no sound of its own. That is precisely why facilities handling significant quantities of fissile material install criticality accident alarm systems that detect the radiation burst directly and sound an evacuation signal, rather than relying on anyone noticing anything.

For a fire or EMS officer standing outside a fence, the practical consequence is that you cannot confirm or rule out a criticality by looking at the building or by asking whether anyone saw anything. Confirmation comes from instruments in the hands of people trained to interpret a mixed neutron and gamma field, and from the facility’s own alarm system and health physics staff.

Daghlian, Slotin, and the hands-on era at Los Alamos

The first criticality fatalities came out of wartime and immediately postwar experimental work at Los Alamos, where physicists assembled fissile components by hand to measure how close a given configuration was to critical. On 21 August 1945, Harry Daghlian was working alone at night, stacking tungsten carbide bricks as a neutron reflector around a plutonium sphere, when he dropped a brick onto the assembly. He pulled it off with his hand, which stopped the reaction and also placed his hand in the most intense part of the field. He died on 15 September 1945, twenty-five days later.

On 21 May 1946, Louis Slotin was demonstrating a related experiment to colleagues, lowering a beryllium reflector hemisphere over the same plutonium core while holding the two halves apart with the blade of a screwdriver. The screwdriver slipped, the hemispheres closed, and there was a burst of radiation and a flash of blue light. Slotin separated the assembly with his hands and died nine days later, on 30 May 1946. Seven other people were in the room and received doses that varied widely according to where each of them was standing, and all of them survived the acute phase. Published dose reconstructions for both men vary between sources, which is normal for mixed neutron and gamma exposures reconstructed after the fact, so treat any single number you see as an estimate with real uncertainty attached.

The plutonium core involved in both accidents, later nicknamed the demon core, was eventually melted down and recycled. The institutional response was to stop assembling critical configurations by hand, and Los Alamos moved this class of experiment to remotely operated machines at a separate site where the operators sat behind shielding a quarter mile away. That change is worth noticing, because it is an engineering control that removed the person from the hazard rather than a rule telling the person to be careful.

Solutions, geometry, and the move from the lab to the process line

Criticality stopped being a purely experimental hazard once industrial quantities of enriched uranium and plutonium began moving through chemical processing plants in solution. On 16 June 1958 at the Y-12 plant in Oak Ridge, Tennessee, uranium-bearing solution that was thought to be water accumulated during a leak test in a 55-gallon drum, a geometry that was entirely capable of supporting a chain reaction. Eight workers were exposed, several were hospitalized, and all of them survived. On 30 December 1958 at Los Alamos, Cecil Kelley was operating a mixing tank containing plutonium solution when stirring pulled the material into a configuration that went critical. He died about thirty-five hours later, and the dose reconstructions published for him are in the tens of grays.

Los Alamos National Laboratory compiled the standard reference on this history, a document titled A Review of Criticality Accidents, whose 2000 revision was compiled by Thomas McLaughlin and colleagues. That revision documents 60 criticality accidents worldwide, divided between process facilities and reactor or critical experiment settings, and the associated deaths number in the low twenties across the United States, the Soviet Union and Russia, Japan, Argentina and the former Yugoslavia. Anyone briefing this subject should work from that document rather than from summaries, including mine, because the accident-by-accident narratives are where the useful detail lives.

The process accidents follow a consistent pattern. Fissile material in solution ends up occupying a container or a volume that nobody intended it to occupy, sometimes because liquid leaked or accumulated somewhere outside the approved path and sometimes because the concentration in a batch had changed without the operators knowing it. The reason the industry writes criticality safety around vessel geometry, batch mass limits and concentration limits is that these are the variables that actually move during production, and the accidents happen when one of them moves without anyone noticing.

30 September 1999: sixteen kilograms in the wrong tank

The JCO Company operated a uranium conversion facility at Tokai-mura in Ibaraki Prefecture, northeast of Tokyo, converting uranium oxide into uranyl nitrate solution. Most of its work involved low-enriched material for commercial power reactors, but on that day a small team was preparing a batch enriched to 18.8 percent uranium-235 for the Joyo experimental fast reactor, a product the plant made only occasionally. Rather than using the licensed equipment path, the three workers dissolved uranium oxide in nitric acid in stainless steel buckets and poured the solution by hand into a precipitation tank, which had a stirrer that made it convenient for getting a uniform product. The tank was wide rather than narrow, and it was surrounded by a water cooling jacket that acted as an efficient neutron reflector.

The batch limit for that operation was 2.4 kilograms of uranium. At about 10:35 local time, as roughly the seventh bucket went in and about 16 kilograms had accumulated, the solution went critical. There was a flash of blue light, radiation alarms sounded, and the three men in the room received doses that Japanese authorities later estimated, and the IAEA fact-finding mission reported, as roughly 16 to 20 gray-equivalent for Hisashi Ouchi, 6 to 10 for Masato Shinohara and 1 to 4.5 for Yutaka Yokokawa. Those figures are published as ranges because reconstructing dose in a mixed neutron and gamma field is inherently uncertain. Ouchi died on 21 December 1999 and Shinohara on 27 April 2000, while Yokokawa survived and was discharged.

The reaction did not stop. It oscillated and continued for about twenty hours, because the tank kept losing and regaining the conditions that sustained it, and the field it produced made the building unapproachable. Termination required draining the water from the cooling jacket to remove the neutron reflector, which was done by JCO workers organized into short-duration teams to limit individual exposure, followed by the injection of boric acid solution as a neutron absorber. The reaction was declared over at about 06:15 on 1 October 1999.

Offsite, local officials moved before the national government did. Approximately 161 residents from 39 households within 350 meters were evacuated during the afternoon of 30 September, and roughly 310,000 residents within 10 kilometers were advised to remain indoors, an advisory lifted the following day. Agricultural restrictions were applied nearby as a precaution. Published counts of the number of people who received some measurable dose, including plant workers, emergency responders and residents, run to several hundred, with a figure of about 667 commonly cited from Japanese reporting, and nearly all of those doses were very small. The accident was rated Level 4 on the International Nuclear and Radiological Event Scale.

Three layers of procedure, and the pressure that peeled them back

What makes Tokaimura a case study in the limits of procedure is that there were three different procedures in play and only one of them had been approved by a regulator. The licensed process required dissolving the uranium oxide in a dedicated dissolution vessel and moving the solution through equipment of favorable geometry, meaning shapes physically incapable of holding a critical configuration. JCO’s own internal operating manual, adopted years before the accident and never authorized by the regulator, substituted stainless steel buckets for the dissolution vessel because it was faster. On the day of the accident the crew went a step beyond even the internal manual by pouring the finished solution into the precipitation tank, which was at a convenient height and had a stirrer that solved a product uniformity problem.

None of the three men appears to have understood that the tank’s shape and its water jacket were the whole difference between a routine transfer and a chain reaction. Investigations in Japan found inadequate criticality safety training, an organizational assumption that a criticality was effectively impossible in that building, and a regulatory inspection regime that had not detected the unapproved manual. The building itself had not been designed with the shielding or confinement you would provide if you expected a criticality there, because the licensing basis did not treat one as credible.

Behind the shortcuts sat commercial pressure. JCO was operating in a market where fuel cycle work was under cost pressure, the Joyo product was a rare and awkward campaign that the crew had little recent practice at, and the shortcuts saved real time on a schedule. Diane Vaughan gave this pattern its usual name, normalization of deviance, in her 1996 study of the Challenger launch decision, and the mechanism she described fits here exactly: a deviation from the written process is tried, nothing bad happens, the deviation becomes the local standard, and the next deviation starts from there rather than from the original procedure. The buckets had been used for years without incident, which is the whole problem, because a control that has been violated successfully for years looks to the people doing the work like a control that did not matter.

Japan revoked JCO’s conversion business license, and company officials were prosecuted and convicted of professional negligence in 2003. Tokai-mura had already experienced a fire and explosion at a separate waste facility on the same site complex, operated by a different organization, in March 1997, and the sequence of the two events did substantial damage to public confidence in the industry and its regulator.

The dose gradient problem and the first arriving unit

Radiation intensity from a compact source falls off steeply with distance, and in a criticality that produces a dose gradient sharp enough to separate the outcomes of people who were standing a few feet apart. Slotin died while others in the same room recovered, and at Tokaimura the three workers had dose estimates spanning more than an order of magnitude even though all of them were in the same building. The gradient also exists within a single body, so the side of a patient that faced the tank can receive many times the dose delivered to the far side, producing severe local tissue injury alongside a whole-body average that looks survivable.

That has direct consequences for triage and for the receiving hospital. Time to onset of vomiting is a rough early index of dose, but with a steep gradient and partial-body exposure the clinical picture can mislead, so the physical position of each patient at the moment of the excursion becomes clinical information. Formal dose assessment relies on lymphocyte depletion over the following hours, chromosome aberration analysis, and in neutron fields the measurement of sodium-24 induced in the patient’s own blood. Metal objects the patient was carrying, including belt buckles, coins, jewelry and dental work, can also be activated and measured, which means those items should be bagged and labeled rather than discarded, because they may be the only dosimeter present.

The problem for the first arriving unit is that the dispatch will rarely say what it is. At Tokaimura the ambulance crew who moved the workers, and the staff who received them, were not initially told what had happened, and some of them received small doses as a result. A call to a fuel cycle facility, a research reactor, a national laboratory or a fuel transport incident may be toned out as an industrial accident, workers ill, or a facility alarm, and nothing in the environment will identify the hazard to the crew. A patient who was irradiated is not himself a significant radiation source to caregivers, with the qualifications that neutron activation makes measurable induced activity and that splashed solution is contamination, so decontamination is a real task and neither issue justifies delaying life-saving care.

Where an excursion may still be running, entry decisions belong to the facility’s health physics staff with neutron-capable instruments, supported by state radiation control programs, Department of Energy Radiological Assistance Program teams and National Guard Civil Support Teams. REAC/TS in Oak Ridge provides 24-hour medical consultation on radiation injury, and that number belongs on the same card as your state’s 24-hour radiological notification line.

What changed afterward, and which controls actually hold

The most durable regulatory consequence of Tokaimura in Japan was the Act on Special Measures Concerning Nuclear Emergency Preparedness, enacted at the end of 1999 and in force from June 2000, which clarified national, prefectural and municipal roles, established off-site emergency response centers near nuclear facilities, and set out how national direction reaches local authorities. The accident had exposed a system in which a village mayor issued the first evacuation advisory because the machinery for a coordinated response did not yet exist in usable form. Later events have prompted further revision of Japanese arrangements, and anyone working the current framework should read the current Japanese guidance rather than an account of what changed in 2000.

In the United States, criticality safety at NRC-licensed fuel cycle facilities is built around integrated safety analysis requirements in the Commission’s regulations for special nuclear material, supported by the ANSI/ANS-8 series of standards covering the double contingency principle, criticality accident alarm systems, and criticality safety in operations with fissile material outside reactors. Department of Energy sites run parallel criticality safety programs under DOE orders. The facilities where a criticality is credible are a short and identifiable list: fuel fabrication and conversion plants, enrichment facilities, reprocessing and legacy waste operations, research reactors and critical experiment facilities, and certain laboratory and transport activities.

The lesson I would hand to an emergency manager who has one of those facilities in the county is about the difference between two kinds of control. Engineered controls, which is to say vessels too narrow to hold a critical volume and transfer systems that physically cannot deliver more than the batch limit, keep working when the crew is rushed, undertrained or improvising under schedule pressure. Administrative controls, meaning the written procedure and the training record and the supervisor’s attention, degrade quietly over years of successful violation, and Tokaimura is the demonstration of how far that degradation can run before anybody sees a consequence. When you sit down with a facility for a preplan, the question worth asking is which of their criticality controls survive a bad day with a tired crew, and the answer tells you a great deal about what your agency should expect to be called for.

What to do at your agency

• Have the emergency manager ask the state radiation control program, and the NRC or DOE as applicable, for a current list of facilities in or adjacent to your jurisdiction that handle fissile material, including fuel cycle plants, research reactors and national laboratory operations, and file the answer even if the answer is none.
• If such a facility exists in your area, have the emergency manager request its offsite emergency plan, its criticality alarm evacuation routes and assembly areas, and the name and 24-hour number of its emergency coordinator, then place that information in the EOC and in dispatch.
• Have the officer who maintains radiation instruments document in writing, this month, which of your survey meters and personal dosimeters respond to neutrons and which respond only to gamma, and brief that finding at the next shift or company officer meeting.
• Have the communications or dispatch supervisor add one line to the response protocol for those specific addresses, so that any medical or alarm call from them triggers notification of the facility emergency coordinator and a staging point chosen by the facility rather than by the first arriving officer.
• Ask the EMS medical director to add a paragraph to the existing radiation patient protocol stating that the patient’s personal metal items are retained in a labeled bag for dose reconstruction, that the position of each patient at the time of the event is recorded, and that contamination does not delay life-saving care.
• Put a fifteen-minute item on the next scheduled LEPC agenda for the facility’s criticality safety officer to walk the committee through what their alarm sounds like, where their people go, and what they will and will not be able to tell arriving units in the first ten minutes.
• Verify by daytime phone call that your notification card has working numbers for the state radiation control program, the regional DOE Radiological Assistance Program team and REAC/TS, and post the card in dispatch and in the EOC.

Takeaways

• A criticality accident is an unplanned self-sustaining fission chain reaction that produces an intense neutron and gamma field rather than a nuclear explosion, and it depends on mass, geometry, concentration, moderation and reflection all lining up at once.
• The blue flash reported by survivors is a real and repeated observation, but it is not a detector, since an excursion can occur behind a wall or with nobody watching, which is why facilities install criticality accident alarm systems.
• Criticality fatalities began with hand-assembled experiments at Los Alamos, where Harry Daghlian died on 15 September 1945 and Louis Slotin died on 30 May 1946, and the institutional fix was to operate such experiments remotely from behind shielding.
• Los Alamos National Laboratory’s A Review of Criticality Accidents, in its 2000 revision compiled by Thomas McLaughlin and colleagues, documents 60 accidents worldwide with associated deaths in the low twenties, and it is the reference to use rather than any summary.
• At the JCO plant in Tokai-mura on 30 September 1999, workers poured about 16 kilograms of uranium in solution into a precipitation tank against a batch limit of 2.4 kilograms, and the reaction ran intermittently for roughly twenty hours until the cooling jacket was drained and boric acid was added.
• Two of the three exposed workers died, about 161 residents within 350 meters were evacuated, and roughly 310,000 residents within 10 kilometers were advised to shelter indoors, with dose estimates for the three workers published as ranges because mixed neutron and gamma reconstruction is uncertain.
• The accident was produced by three layers of procedure, only one of which was licensed, and by years of successful deviation under cost and schedule pressure, which is the pattern Diane Vaughan named normalization of deviance in her 1996 study of the Challenger decision.
• The dose gradient is steep enough that people meters apart, and even the two sides of one patient, receive very different doses, so patient position at the time of the event is clinical information and activated personal metal items should be preserved for dose reconstruction.
• Engineered controls such as vessel geometry and physical batch limits survive a rushed shift, while administrative controls degrade quietly, and that distinction is the right question to ask any facility during a preplan visit.