Parables that warn about the perils of human hubris are not just confined to religious scriptures, Greek tragedies, or venerated Indigenous myths. For those that pay attention they are inscribed as math equations in our atomic age, as mere mortals blithely torque science to break billion-year-old bonds of physics.
Robert Oppenheimer, who led the American effort to build the bombs detonated over Hiroshima and Nagasaki in 1945, invoked an ancient Sanskrit warning as he watched the first nuclear fireball explode at a remote desert test site only weeks before. “Now I am become Death, Destroyer of Worlds,” he murmured.
Later, he lamented to U.S. President Harry Truman that he had “blood on his hands”. Later still, he confessed that he and his brilliant Manhattan Project team had been driven to success because pursuing such experimental extremes was “technically sweet”.
This was the forbidden apple of Eden parable, written in physics formulas instead of Classical Hebrew script.
But history has largely forgotten that there was another U.S. atomic bomb slated to devastate a third Japanese target in August, 1945. It was shipped back to its secret New Mexico birthplace and disarmed after a stunned, reeling Japan suddenly surrendered. There, the only atomic bomb then in existence was entrusted to Louis Slotin, the lone Canadian given a security clearance to join Oppenheimer’s vaunted brigade of experimental physicists at Los Alamos.
Slotin’s improvisational bent had helped deduce how to keep plutonium or uranium bomb cores sub-critical until the moment of fission detonation, and which machined metal spheres might produce the biggest blast. His intuition and experiments at the red zone of risk proved ingenious—even though the first atomic bombs only fissioned a mass about the weight of butterfly wings.
Before and after Hiroshima, the young Canadian was the acknowledged Los Alamos expert at “tickling the sleeping dragon’s tail”—bringing the bomb assembly to within a second or two of initiating a nuclear reaction while Geiger counters clicked and math wizards calculated neutron surges. Photos attest that Slotin had replicated this for the first atomic test called Trinity, and the Hiroshima and Nagasaki bombs.
He had earlier learned key secrets about critical mass behaviour as part of an elite physics team in Chicago, led by the famed Italian scientist Enrico Fermi. There, they achieved the first ever nuclear chain reaction in late 1942—a civilian success that foreshadowed the means to make terrifying weapons. Fermi and many of his top team members were quickly conscripted into the Manhattan Project and joined Oppenheimer at Los Alamos. After a brief stint at the Oak Ridge nuclear weapons complex in Tennessee, Slotin was welcomed there, too.
Following Japan’s surrender, and despite deep personal misgivings many other Los Alamos physicists shared about the devastation the first two atomic bombs had wrought, Slotin stayed at Los Alamos to conduct further fission testing with the “orphan” atomic bomb components. At least several dozen times, he brought two perfectly machined half-spheres together, almost to the point where escaping neutrons from an inner ball of plutonium would be reflected back and ignite a nuclear spark. Each time, Slotin halted with mere seconds to spare.
But in March 1946, the tickled dragon took its revenge. In a matter of milliseconds, as Slotin’s balancing screwdriver slipped and he briefly lost his grip on the upper sphere, the core went critical and a cobalt blue flash lit up the lab where seven others were observing. Intense beams of gamma radiation raced from the bomb core, penetrating Slotin as he flipped off the upper section and threw himself over the plutonium to shield others.
It had fissioned for perhaps two seconds, but he died nine days later after an excruciating ordeal he knew was inevitable. Virtually every organ had melted to mush. Mercifully, his final hours were in a coma. The Army flew Slotin’s still radioactive body from Los Alamos to his native Winnipeg in a military plane, inside a metal-lined casket, for burial at the Jewish cemetery near his childhood home. He was only 35.
News of Louis Slotin’s tragic accident quickly spread among the burgeoning U.S. atomic weapons labs, and to Canada’s formerly secret Manhattan Project satellite site at Chalk River, 200 kilometres north of Ottawa. During the Second World War, Canadian, British, and French scientists had begun designing and testing a novel reactor prototype unlike any in America.
Using a natural uranium lattice and heavy water to slow down neutrons and sustain chain reactions, it eventually morphed into the Candu. But not before the NRX reactor at Chalk River was covertly used as a chief supplier of plutonium for the American atomic arsenal, and more tickling of the dragon’s tail led to a near catastrophic partial core meltdown.
That occurred in 1952, only this time Canadian scientists were experimenting with an amount of fissionable material many times larger than that which killed Louis Slotin. Though tiny by comparison to Candu reactors now running in Ontario, the latent dangers of the NRX reactor were precisely why it was located far from large populations, and had remotely controlled shutdown mechanisms meant to prevent a runaway chain reaction.
But they failed. And even though the experiment took place with the NRX at a mere fraction of full power, precious coolant flashed into steam in a section of the core—leaving tonnes of nuclear fuel and its protective metal tubing to overheat, sag, and make explosive contact with air. The NRX operators scrambled to avert a runaway chain reaction, but were defeated by a fatal design flaw which still haunts every Candu operating today.
Called a positive void coefficient of reactivity, it means that if a part of any powered-up Candu reactor core loses coolant for more than a few seconds, trillions of neutrons can escape the exposed uranium and cause adjacent nuclear fuel to go critical. That can lead to many more rogue neutrons, more heat, more explosions, blocked coolant pathways, melting fuel, and runaway chain reactions. A later NRX analysis confirmed that only the reactor’s low power status and one million gallons of dousing water averted a far worse catastrophe.
A second-by-second record shows how fast a reactor control room can race from boredom to terror. The NRX power level went from one-tenth of a megawatt to 17 MW in just 10 seconds. Then it accelerated even farther, shooting past the 20-MW maximum safety limit and peaking at 80 MW within 45 seconds. Yet even after the power level fell to zero, uranium fuel fused and melted aluminum tubes, which led to hydrogen explosions and high levels of radiation escaping to the atmosphere. Then the reactor basement became flooded with highly radioactive emergency coolant.
The 62-second surge destroyed the NRX reactor, which was ignominiously buried in sand at the Chalk River site. It took many months for hundreds of conscripted Canadian and American soldiers to clean up the reactor complex and contaminated areas. But this did not stop a duplicate NRX reactor from being built at Chalk River, with the cost to be eventually recouped through future plutonium sales to the U.S. military.
Nor did the NRX accident compel Canadian nuclear engineers to redesign the reactor to eliminate the neutron surge flaw. Instead, their priority was to vastly scale up each succeeding Candu model—without waiting for any appreciable performance or safety experience first.
The first Candu prototype to connect to a Canadian electric grid, in 1962, was the tiny 20-MW Rolphton reactor, located a few kilometres north of Chalk River. It was essentially an NRX, with boilers, pipes, and turbines bolted on. The chief value was to assess how it might supply and interact with the Ontario grid system, test new core metals and configurations, and train eager utility operating staff. Rolphton is now closed, and its heavily contaminated hulk awaits entombing.
Yet the 200-MW Douglas Point Candu, which was fired up in 1967, was already designed and approved before the Rolphton reactor had barely passed the teething stage. The four 500-MW Pickering A reactors were approved and designed while Douglas Point was under construction. The four 750-MW Bruce A Candus were green-lighted before the Pickering A reactors were completed. In quick succession, four more 500-MW reactors at Pickering B, and four more 750-MW Bruce B Candus, were approved and designed. Finally, four 850-MW Darlington reactors were approved in 1974.
In sum, 21 reactors comprising some 13,400 MW of Candu capacity were committed for construction in Ontario when only the 20-MW Rolphton prototype had a decade of operation. This haste was reckless enough, because each increase in scale changed the reactor neutron flux dynamics, demanded meticulous recalculations and supplier revisions, and required resizing miles of coolant pipes, pumps, steam generators, and turbines.
Each Candu scale-up also meant much larger uranium loads, more heat, more pressure, and relentless, withering internal radiation fields attacking untested core materials meant to last three decades—when none had ever done so. Anywhere. Moreover, the constant neutron bombardment created a witches’ brew of more than 200 radioactive hazards when striking uranium, other exotic metals, coolant impurities, or steel. Even hydrogen atoms in water could be transmuted into radioactive tritium.
This race to scale up exponentially amounted to serializing extreme experiments far more dangerous that Louis Slotin’s single fatal mistake. Taken together, they increased the chance of a key reactor core failure and reduced the timeline for operators to avert a catastrophe, because every single Candu kept the NRX neutron surge danger in the design DNA. If there was a major loss of core coolant, the chain reaction would not stop, but instantly accelerate.
This is precisely what happened at the 500-MW Pickering A Unit 2 at 11 AM on the August 1 holiday of 1983. While operating at full power, one of 380 pressure tubes located near the core centre suddenly split, allowing vital coolant to rush through a two-metre crack. Uranium pellets overheated within seconds, then showered adjacent uranium with neutrons.
For 20 seconds, a later accident analysis [pdf] by Ontario Hydro confirmed, there were “highly unstable and uncontrollable fission events” and “an excessive amount of thermal and mechanical damage was inflicted upon the reactor core.” The report barely mentioned that the Unit 2 operators had failed to deploy two key emergency shutdown systems meant for just such an accident. Only coolant pumped from two adjacent reactors averted a possible core meltdown.
The report also noted that the Pickering reactors were too large and ill-designed to prevent the neutron surge which occurred, and that the coolant backup system was too slow to counteract it. In passing, a “change in reactor design” was suggested as a solution.
Most glaring, the report noted that the G16 pressure tube which failed had sagged under intense radiation and begun fatal blistering (caused by hydrogen deposits) as many as 11 years earlier. This meant there had been no substantial previous inspections of some 3,000 operating pressure tubes at the eight-reactor Pickering complex—despite a pressure tube failure earlier at the Bruce nuclear complex.
This spoke volumes about the provincial utility’s cavalier safety culture, and led to costly two-year shutdowns at Pickering A Units 2 and 3 while “hot” pressure tubes were replaced with new ones made from a more hydrogen-resistant alloy.
The 1983 Pickering accident foreshadowed the horrific 1986 reactor meltdown and explosion at Chernobyl, because the RBMK 1000 reactor that was destroyed there also had the same neutron surge design flaw embedded [pdf] in all Candu reactors. While that accident was magnified by operator errors, an intense core graphite fire, and hydrogen explosions that blew off the reactor building roof, the design flaw meant there was zero time to prevent the runaway reaction.
In the weeks following Chernobyl, Ontario and federal nuclear advocates publicly dismissed any such comparisons and pointed to several additional Candu safety features not present at the Russian-built reactor site. But behind the scenes, Canadian federal nuclear regulators began their own reassessment of the neutron surge issue, because it not only affected 20 Candus in Ontario, but those in Quebec and New Brunswick, and those sold abroad to Argentina, Romania, South Korea, India, Pakistan, and China.
Moreover, the U.S. Nuclear Regulatory Commission did its own Chernobyl accident analysis and let it be quietly known that it would not licence any commercial reactor with the neutron surge design flaw. To this day, none operate there. All licenced civilian nuclear plants in the U.S. have designs meant to instantly trigger a drop in core neutron activity in the event of a coolant loss. This is not to say a serious nuclear accident cannot happen in the U.S. But at least the NRC rule grants nuclear operators there more time to avert a runaway reaction.
None of the operating U.S. commercial reactors use the horizontal pressure tubes distinctive to all Candu reactors, through which heavy water coolant must be relentlessly pumped at great velocity, 24/7. Inside the metal pressure tubes, cylindrical bundles filled with uranium pellets are arranged end to end, like miniature train cars inside a tunnel. As the uranium pellets fission, they and every material around them become both fiercely radioactive and unfathomably hot.
This unique Candu feature has a certain design elegance. The pressure tubes allow 300°C coolant under high pressure (it would boil otherwise, because uranium pellets in the core typically heat up to between 1800 and 2200°C) to flow through and around the hot bundles, and thus transfer heat to make power with higher efficiency. Special machines at both ends of the pressure tube array allow fresh uranium bundles to be injected into selected tunnels while depleted bundles are ejected at the opposite end. This allows a Candu to run continuously, while most other commercial reactors must be shut down to be fully restocked with uranium.
But this Candu operational advantage comes with much magnified risks.
Because the long pressure tubes stretch across the reactor core horizontally, and are always filled with fissioning uranium bundles, they are acutely vulnerable to any major pump failure or pipe break within a high-pressure, super-heated heavy water supply system. Or to a blockage if a fuel bundle breaks or gets jammed.
As the 1983 Pickering accident showed, the integrity of the pressure tube walls is also under relentless assault—over decades—from a combination of intense heat, pressure, and unimaginable gamma radiation. This has led to Candu pressure tubes stretching, sagging, blistering, and cracking at random times and locations. But because they are placed deep inside the areas of highest neutron flux, where no human could survive even minutes, they are impossible to inspect carefully without shutting down the entire reactor for weeks or months.
This, of course, would defeat the performance boost promised by the Candu pressure tube designers. Worse, the exponential upscaling of reactor size in Ontario in the 1970s meant the larger reactors had many more pressure tubes to inspect, and related shutdowns would leave ever larger gaps in power supplied to the grid. For example, the 500-MW Pickering reactors have 390 pressure tubes each, while each of four turbocharged 850-MW Darlington reactors has 490 pressure tubes.
Simply put, any one of some 8,000 pressure tubes contained in Ontario’s reactor fleet could suddenly fail without notice unless the strictest culture of vigilance prevails. This is all the more urgent because the Candu neutron surge flaw—which magnifies the coefficient of danger—is also lurking 24/7.
So not taking every safety precaution amounts to tickling the dragon’s tail 24/7. Yet even today, Canada’s biggest nuclear utility brazenly continues to choose performance and cost metrics over safety.
The Globe and Mail reported this spring that our national nuclear regulator, the Canadian Nuclear Safety Commission, had granted a 10-year licence extension for the Pickering complex after secretly waiving safety codes which would have required its owner, Ontario Power Generation, to replace its aging pressure tubes.
That approval came in 2018, after a previous licence extension was granted. Both defied the norms of atomic safety regulators. In all but a few cases, commercial nuclear plants in the U.S., Europe, and Japan must be retired at the end of their original design life. This is safety 101—and an obligation nuclear plant owners accept as a condition of their original licence.
But it is orders of magnitude more irresponsible for a regulator to allow nuclear plants to operate past their safety margins without replacing the component most likely to fail, especially when a pressure tube crack or rupture can lead to an always lurking, uncontrollable neutron surge. And when just that had already occurred at the Pickering complex in 1983.
Moreover, the CNSC has apparently withdrawn technical concerns it had about the integrity of 2,280 current Pickering pressure tubes after stiff resistance from OPG, and a promise to redo flawed testing the utility delegated to an undisclosed third party.
This is typical of the half-century-old pattern of regulatory capture that has dominated safety debates between Canada’s largest nuclear plant owner and its compliant federal regulator. Past examples abound—including post-Chernobyl battles over whether to install extra emergency shutdown equipment precisely because of the combined pressure tube + neutron surge double danger intrinsic to every Candu.
Ever obsessed with plant performance and escalating debt, OPG appears to have learned nothing after decades of close calls and “tickling the sleeping dragon’s tail”. With its no bark and no bite attitude, Canada’s federal watchdog has agreed to let six Pickering reactors run flat out until 2024, with the flimsy caveat that meanwhile OPG must conduct credible pressure tube inspections. This deal met the approval of the current CNSC president, formerly a senior official in OPG’s nuclear division.
Yet now the provincially-owned utility is refusing to provide pressure tube scrape samples, as a physical way of measuring their integrity—on the grounds that it would risk radiation exposure for plant workers, and be too costly, for results of dubious value. Meanwhile, desperate for revenue, OPG is exporting much of the Pickering power output to the U.S.—at a loss.
No nuclear regulator, and no Ontario citizen, should tolerate such serial arrogance. Age has cut the margins of safety at Pickering to less than that which killed Louis Slotin, placing a nearby population of 2.5 million under a perilous shadow [pdf]. It is long past time for all its reactors to be shut down forever. If Canada’s atomic watchdog won’t do it, Canada’s Parliament should.
Paul McKay is an award-winning investigative reporter and author of two books about the perils of nuclear technology.