Surrounded by several other large, industrial-looking buildings, two domed concrete cylinders rose above a countryside otherwise dotted with fields, orchards, and a few small villages and midsize towns. Sited on a canal that fed into the Danube River, the Cernavodă Nuclear Station’s twin seven-hundred-megawatt heavy-water reactors supplied 20 percent of Romania’s electricity.
First ordered during the Ceauşescu regime, Unit Two only came on line eighteen years after the brutal communist dictator’s overthrow and execution. Three more planned reactors had been mothballed at the earliest stages of construction.
Like all Canadian CANDU-6 designs, both operational Cernavodă reactors relied heavily on automated computer control systems, first to maintain safe and efficient power production and then to shut the reactors down in an emergency. The plant’s operators stressed the advantages these advanced digital systems offered over the less sophisticated, manpower-intensive control measures used in competing reactor designs. From a purely technical standpoint, their claims had merit. Increased automation meant fewer human-induced errors, lower costs, and safer day-to-day operation.
Unfortunately, those same computer systems also created a path — a hidden breach in all the defenses and barriers intended to protect Unit Two from accident or attack. A breach that ran straight into the reactor’s hellishly radioactive, high-pressure, high-temperature core.
In a peaceful world, this overlooked vulnerability would never have mattered.
But the world was not at peace.
Control room supervisor Marku Proca yawned once and then again. “Isus. Jesus,” he muttered, fighting down a third jaw-cracking yawn. He blinked rapidly, distractedly running a hand through his thick mane of white hair. Night shifts were always a bitch.
One of the two younger men stationed in the control room glanced away from the computer displays on the operator’s desk. “Want another coffee, boss?”
Wryly, Proca shook his head. “No thanks. My kidneys are already floating.” He nodded toward the displays. “So? Any problems?”
The third man, a senior plant operator named Nicolae Diaconu, shrugged. “No. As usual, everything’s nominal.” He pulled a safety logbook closer and jotted down a few notes, checking the time as he signed it with a flourish. “There, you see! Twenty-two thirty hours and all’s well.”
At that moment, unnoticed by Proca or his two subordinates, preset logic bombs detonated inside the computers tasked with monitoring Unit Two’s independent automated emergency shutdown systems. Malicious code covertly embedded in their operating software suddenly went live, surreptitiously taking control while leaving routine operations seemingly undisturbed. Within milliseconds, the hijacked computers began sending precisely tailored viruses through fiber-optic links connecting them to other machines.
Down and down the linked hierarchy of computers these pieces of malware rippled — methodically seizing every system in their path as they moved closer to their primary targets. There, at the very heart of each of Cernovadă’s two emergency shutdown mechanisms, lay three very small, very simple digital machines.
These “trip” computers had one function: they constantly cycled through data sent from sensors embedded in the reactor core, coolant systems, and the containment building. When any two out of three of these tiny computers sensed temperatures or pressures or other anomalies beyond parameters set in their simple programming, they were expected to “trip” the reactor — safely shutting it down in seconds.
But now viruses latched on to their very basic code and went to work, swiftly cutting away those parts of each program that “read” incoming sensor data. Stitched in their place were endlessly repeating loops of false data — all showing a range of perfectly safe temperatures, pressures, coolant flow levels, and neutron power.
In a matter of seconds, both of the elaborate automated systems designed to shut down Cernavodă’s Unit Two were out of action, securely cocooned in an illusory digital world where nothing would ever go wrong.
Now a small subroutine in the rogue program controlling one of the commandeered computers activated.
Beep. Beep. Beep.
Nicolae Diaconu closed the logbook he’d just finished signing and glanced at his display. “I’ve got a minor flag from one of the test and display computers,” he told Proca. “Says it’s getting an error reading from a neutron flux detector in Zone 11.”
“Just one?” Proca asked. There were nearly two hundred separate vanadium and platinum-clad flux sensors set throughout the reactor core.
Diaconu took a closer look. “Only one detector,” he confirmed. “NFS-11A.”
Proca shrugged. “Follow normal procedure. Have the DCC test the same sensor. Let’s see if we’ve got a genuine equipment failure or just a programming glitch.”
“Already on it,” Diaconu said, keying in a command to the plant’s main “X” Digital Control Computer.
Neither man ever realized that this routine request for a diagnostic check on sensor NFS-11A was the detonation trigger for yet another logic bomb, this one buried deep inside the control computer’s core operating software. Line after line of malicious code spooled through the computer, rapidly taking command over specific programs used to manage the reactor and its associated systems. Another virus flashed through a link into the identical “Y” DCC running in standby mode, turning it into a slave clone of the hijacked master computer.
In a perfectly timed, sequenced, and calibrated digital assault taking less than thirty seconds from start to finish, Unit Two’s human operators lost control over their seven-hundred-megawatt heavy-water nuclear power reactor — and all without the slightest warning.
Now fully in command, the sabotage programs running in the reactor’s digital control system kicked into high gear. Over the course of the next few minutes, dozens of valves and actuators opened and closed in a carefully orchestrated sequence. Thousands of gallons of deuterium-laced “heavy” water and ordinary light water used to cool and control the reactor drained away. Steel-encased cadmium rods used to adjust the fission reaction slid out of the core and locked.
More valves opened. Pressurized helium gas reserves set aside to force emergency supplies of cooling water and gadolinium nitrate — a chemical that could poison and stop the fission reaction — into the core in a crisis vented uselessly into the cold night air outside the containment building.
As its control mechanisms were ruthlessly and systematically stripped away, power levels inside the reactor started spiking. Temperatures inside thousands of uranium fuel bundles rose fast, heating the heavy water still surrounding them to the boiling point. This, in turn, caused the fission reaction to climb even faster.
As minutes ticked by without human intervention or even awareness, temperatures and pressures inside Cernavodă Unit Two’s core climbed dangerously. Fuel bundles melted, sagging closer and closer together. Hydrogen gas began boiling off the superheated zirconium alloy cladding around each bundle.