Nuclear gaffe: Oops, wrong button

How a reactor got shut down by accident

If your laptop lets you think twice before it shuts down, should a nuclear reactor not do the same?

Canadian nuclear safety officials have been dealing with a split-second mistake that shut down a reactor at the Pickering nuclear station east of Toronto.

There was no radioactive leak, no injury, no damage to equipment. But there were red faces when someone pushed the wrong button, and a machine that can produce half a billion watts of electricity just stopped.

It happened like this: The reactor had been shut down for planned maintenance. It was starting up again at low power with one of its two control computers still down for maintenance but the other one running. Fine so far.

Then, a nuclear operator pushed the wrong button and shut off the computer that was still running. With both computers now down, staff were required to shut down the entire reactor manually.

That led to this exchange, shown in transcripts of the Nov. 8 meeting of the Canadian Nuclear Safety Commission, between commission vice-president Kathy Penney and Stephanie Smith, director of operations and maintenance at Pickering Nuclear. (The DCC referenced below is a computer.)

“MEMBER PENNEY: I had a question about the Appendix C with respect to the DCC. So in my world if I ask my computer to delete something, it comes back and asks me, do I really want to delete it, and it strikes me that shutting down a nuclear reactor there should be some check, you know. So I’m just asking and it’s maybe a naive question, but you can push a button and it doesn’t come up and say, do you really want to do this, it just does it?

“MS SMITH: Again, Stephanie Smith, for the record. Yes. That would actually be very helpful, but, unfortunately, these computers were designed back probably late ’50s, early ’60s when those types of things were not thought of. So these are just very simple computers. There’s actually a picture in Appendix B that you can see and there’s actually just two push buttons and if you hit the wrong one you do turn off that computer.”

Another Pickering official told the commission that “There is a principle here, though, where we want to keep those machines as simple as possible. As you add layers of protection or layers of software, then there are other opportunities for that software not to do what you expect it to.”

The reactor was running again a few hours later.

Ontario Power Generation said it has undertaken corrective action that focuses on training and mentorship. The nuclear operator was removed from the job temporarily and sent for “remediation.”