Command and Control (24 page)

Within weeks of the briefings for Quarles at Sandia, the Armed Forces Special Weapons Project created a safety board to scrutinize the design of every sealed-pit weapon in development. The Air Force soon commissioned wide-ranging studies of whether a nuclear weapon could be detonated by accident. And in July 1957,
Quarles asked the Atomic Energy Commission to conduct the nation's first comprehensive inquiry into the possibilities for
increasing the safety of nuclear weapons. The AEC agreed to do it, and a team of Sandia engineers was given the lead role.

One of the inquiry's first tasks was to compile a list of the accidents that had already occurred with nuclear weapons. The list would be useful for predicting not only what might happen to the new sealed-pit designs in the field but also the frequency of mishaps. The Department of Defense didn't always notify the AEC about nuclear weapon accidents—and a thorough accounting of them proved difficult to obtain. The Air Force eventually submitted
a list of eighty-seven accidents and incidents that had occurred between 1950 and the end of 1957.
Sandia found an additional seven that the Air Force had somehow neglected to include. Neither the Army nor the Navy submitted a list; they'd failed to keep track of their nuclear accidents.
More than one third of those on the Air Force list involved “war reserve” atomic or hydrogen bombs—weapons that could be used in battle.
The rest involved training weapons. And all of the accidents shed light on the many unforeseeable ways that things could go wrong.

An accident might be caused by a mechanical problem.
On February 13, 1950,
a B-36 bomber took off from Eielson Air Force Base, about thirty miles south of Fairbanks, Alaska. The crew was on a training mission, learning how to operate from a forward base near the Arctic. The weather at Eielson was windy and snowy, and the ground temperature had risen in the previous few hours. It was about –27 degrees Fahrenheit. Captain Harold L. Barry and sixteen crew members had been fully briefed on the mission: fly to Montana, turn around, go to Southern California, turn again, head north to San Francisco, simulate the release of a Mark 4 atomic bomb above the city, and then land at a SAC base in Fort Worth, Texas. The mission would take about twenty hours.

In the middle of the night, as the B-36 reached an altitude of fifteen thousand feet, it started to lose power. Ice had accumulated on the engines, as well as on the wings and propellers. The crew couldn't see the ice—visibility was poor, due to the darkness, cloud cover, and frost on the windows. But they could hear chunks of ice hitting the plane. It sounded like a hailstorm.

Ice clogged the carburetors, three of the six engines caught fire, and the
bomber rapidly lost altitude. Captain Barry managed to guide the plane over the ocean not far from Princess Royal Island, in British Columbia, Canada. He ordered a copilot to open the bomb bay doors and dump the Mark 4. The doors were stuck and wouldn't open. The copilot tried again, the doors opened, and the Mark 4 fell from the plane. Its high explosives detonated three thousand feet above the water, and a bright flash lit the night sky. The bomb did not contain a nuclear core.

Navigating solely by radar, Captain Barry steered the plane back toward land and ordered the crew to bail out. One of the copilots, Captain Theodore Schreier, mistakenly put on a life jacket over his parachute. He was never seen again. The first four men to jump from the plane also vanished, perhaps carried by the wind into the ocean. Captain Barry, the last to go, parachuted safely onto a frozen lake, hiked for miles through deep snow to the coast, and survived, along with the rest of his crew. The abandoned B-36 somehow flew another two hundred miles before crashing on Vancouver Island.

An accident could occur during the loading, unloading, or movement of weapons.
On at least four occasions, the bridgewire detonators of Mark 6 atomic bombs fired when the weapons were improperly removed from aircraft. They were training weapons, and nobody got hurt. But with the new sealed-pit weapons, that sort of mistake would cause a full-scale nuclear detonation.
At least half a dozen times, the carts used to carry Mark 6 bombs broke away from the vehicles towing them. During one incident, the cart rolled into a ditch; had it rolled in another direction, a classified report noted, “a live Mk6 weapon” would have “plunged over a steep embankment.”
Dropping a nuclear weapon was never a good idea. Impact tests revealed that
when the Genie was armed, it didn't need a firing signal to detonate. The Genie could produce a nuclear explosion just by hitting the ground.

An accident could be made worse by the response.
In the early days of the Korean War, amid fears that Japan and Taiwan might be attacked,
a B-29 bomber prepared to take off from Fairfield-Suisun Air Force Base in California. It was ten o'clock at night. The mission was considered urgent, its cargo top secret—one of the nine Mark 4 atomic bombs being transferred
to Guam, at President Truman's request. The cores would be airlifted separately. Brigadier General Robert F. Travis sat in the cockpit as a high-level escort for the weapon. Travis had displayed great courage during the Second World War, leading thirty-five bombing missions for the Eighth Air Force. As the B-29 gained speed, one of its engines failed near the end of the runway. The bomber lifted off the ground, and then a second engine failed.

The pilot, Captain Eugene Steffes, tried to retract the landing gear and reduce drag, but the wheels were stuck, and the plane was heading straight toward a hill. He put the B-29 into a steep 180-degree turn, hoping to land at the base. The plane began to stall, with a trailer park directly in its path. Steffes banked to the left, narrowly missing the mobile homes. The B-29 hit the ground, slid through a field, caught on fire, and broke into pieces. When it came to a stop, the crew struggled to get out, but the escape hatches were jammed.

Sergeant Paul Ramoneda, a twenty-eight-year-old baker with the Ninth Food Service Squadron, was one of the first to reach the bomber. He helped to pull Steffes from the cockpit. General Travis was found nearby, unconscious on the ground. Ambulances, fire trucks, and police cars soon arrived at the field, along with hundreds of enlisted men and civilians, many of them awakened by the crash, now eager to help out or just curious to see what was going on. The squadron commander, Ray Holsey, told everyone to get away from the plane and ordered the firefighters to let it burn. Flares and .50 caliber ammunition had begun to go off in the wreckage, and Holsey was afraid that the five thousand pounds of high explosives in the atomic bomb would soon detonate. The crowd and the firefighters ignored him. Holsey, the highest-ranking officer on the scene, ran away as fast as he could.

Sergeant Ramoneda wrapped his baker's apron around his head for protection from the flames and returned to the burning plane, searching for more survivors. Moments later, the high explosives in the Mark 4 detonated. The blast could be heard thirty miles away. It killed Ramoneda and five firefighters, wounded almost two hundred people, destroyed all of the base's fire trucks, set nearby buildings on fire, and scattered burning fuel and pieces of molten fuselage across an area of about two square miles.
Captain Steffes and seven others on the plane escaped with minor injuries. Twelve crew members and passengers died, including General Travis, in whose honor the base was soon renamed. The Air Force told the press that the B-29 had been on “
a long training mission,” without mentioning that an atomic bomb had caused the explosion.

An accident could involve more than one weapon
. On July 27, 1956,
an American B-47 bomber took off from Lakenheath Air Base in Suffolk, England. It was, in fact, on a routine training flight. The plane did not carry a nuclear weapon. Captain Russell Bowling and his crew were scheduled to perform an aerial refueling, a series of touch-and-go landings, and a test of the B-47's radar system. The first three touch-and-go landings at Lakenheath went smoothly. The plane veered off the runway during the fourth and slammed into a storage igloo containing Mark 6 atomic bombs. A SAC officer described the accident to LeMay in a classified telegram:

The B-47 tore apart the igloo and knocked about 3 Mark Sixes. A/C [aircraft] then exploded showering burning fuel overall. Crew perished. Most of A/C wreckage pivoted on igloo and came to rest with A/C nose just beyond igloo bank which kept main fuel fire outside smashed igloo. Preliminary exam by bomb disposal officer says a miracle that one Mark Six with exposed detonators sheared didn't go. Fire fighters extinguished fire around Mark Sixes fast.

The cores were stored in a different igloo. If the B-47 had struck that igloo instead, tearing it open and igniting it, a cloud of plutonium could have floated across the English countryside.

•   •   •

T
HE
ENGINEERS
AT
S
ANDIA
knew that nuclear weapons could never be made perfectly safe. Oskar Morgenstern—an eminent Princeton economist, military strategist, and Pentagon adviser—noted the futility of seeking that goal. “
Some day there will be an accidental explosion of a nuclear weapon,” Morgenstern wrote. “The human mind cannot construct something that is infallible . . . the laws of probability virtually guarantee such
an accident.” Every nation that possessed nuclear weapons had to confront the inherent risk. “
Maintaining a nuclear capability in some state of readiness is fundamentally a matter of playing percentages,” a Sandia report acknowledged. In order to reduce the danger, weapon designers and military officials wrestled with two difficult but interconnected questions: What was the “acceptable” probability of an accidental nuclear explosion? And what were the technical means to keep the odds as low as possible?

The Army's Office of Special Weapons Developments had addressed the first question in a 1955 report, “
Acceptable Military Risks from Accidental Detonation of Atomic Weapons.” It looked at the frequency of natural disasters in the United States during the previous fifty years, quantified their harmful effects according to property damage and loss of life—and then argued that accidental nuclear explosions should be permitted on American soil at the same rate as similarly devastating earthquakes, floods, and tornadoes. According to that formula, the Army suggested that
the acceptable probability of a hydrogen bomb detonating within the United States should be 1 in 100,000 during the course of a year.
The acceptable risk of an atomic bomb going off was set at 1 in 125.

After Secretary of the Air Force Quarles expressed concern about the safety of sealed-pit weapons, the Armed Forces Special Weapons Project began its own research on acceptable probabilities. The Army had assumed that the American people would regard a nuclear accident no differently from an act of God. An AFSWP study questioned the assumption, warning that
the “psychological impact of a nuclear detonation might well be disastrous” and that “
there will likely be a tendency to blame the ‘irresponsible' military and scientists.” Moreover, the study pointed out that the safety of nuclear weapons already in the American stockpile had been measured solely by the risk of a technical malfunction.
Human error had been excluded as a possible cause of accidents; it was thought too complex to quantify. The AFSWP study criticized that omission: “
The unpredictable behavior of human beings is a grave problem when dealing with nuclear weapons.”

In 1957 the Armed Forces Special Weapons Project offered a new set of acceptable probabilities. For example, it proposed that
the odds of a
hydrogen bomb exploding accidentally—from all causes, while in storage, during the entire life of the weapon—should be one in ten million. And the lifespan of a typical weapon was assumed to be ten years. At first glance, those odds made the possibility of a nuclear disaster seem remote. But if the United States kept ten thousand hydrogen bombs in storage for ten years, the odds of an accidental detonation became much higher—one in a thousand. And if those weapons were removed from storage and loaded onto airplanes, the AFSWP study proposed some acceptable probabilities that the American public, had it been informed, might not have found so acceptable. The
odds of a hydrogen bomb detonating by accident, every decade, would be one in five. And during that same period,
the odds of an atomic bomb detonating by accident in the United States would be about 100 percent.

All of those probabilities, acceptable or unacceptable, were merely design goals. They were based on educated guesses, not hard evidence, especially when human behavior was involved. The one-point safety of a nuclear weapon seemed like a more straightforward issue. It would be determined by phenomena that were quantifiable: the velocity of high explosives, the mass and geometry of a nuclear core, the number of fissions that could occur during an asymmetrical implosion. But even those things were haunted by mathematical uncertainty. The one-point safety tests at Nevada Test Site had provided encouraging results, and yet the behavior of a nuclear weapon in an “abnormal environment”—like that of a fuel fire ignited by a plane crash—was still poorly understood.
During a fire, the high explosives of a weapon might burn; they might detonate; or they might burn and then detonate. And different weapons might respond differently to the same fire, based on the type, weight, and configuration of their high explosives. For firefighting purposes, each weapon was assigned a “time factor”—the amount of time you had, once a weapon was engulfed in flames, either to put out the fire or to get at least a thousand feet away from it.
The time factor for the Genie was three minutes.

Even if a weapon could be made fully one-point safe, it might still detonate by accident. A glitch in the electrical system could potentially arm a bomb and trigger all its detonators.
Carl Carlson, a young physicist at
Sandia, came to believe that the design of a nuclear weapon's electrical system was
the “real key” to preventing accidental detonations. The heat of a fire might start the thermal batteries, release high-voltage electricity into the X-unit, and then set off the bomb. To eliminate that risk, heat-sensitive fuses were added to every sealed-pit weapon. At a temperature of 300 degrees Fahrenheit, the fuses would blow, melting the connections between the batteries and the arming system. It was a straightforward, time-honored way to interrupt an electrical circuit, and it promised to ensure that a high temperature wouldn't trigger the detonators. But Carlson was still worried that in other situations a firing signal could still be sent to a nuclear weapon by accident or by mistake.