Command and Control (46 page)

A few months later, William L. Stevens was chosen to head Sandia's new Nuclear Safety Department. Stevens had earned a degree in electrical engineering at Virginia Polytechnic Institute, served as an officer in the Army, and spent a few years in Baton Rouge, Louisiana, working for an oil company. He joined Sandia in 1957, at the age of twenty-eight. Bob Peurifoy had hired him, and the two worked together on the electrical system of the W-49 warhead, the first one to contain a trajectory-sensing switch as a safety device. When Stevens was assigned to lead the new safety department, he wasn't convinced that nuclear weapon accidents posed a grave threat to the United States. But he'd been closer to a nuclear detonation than most scientific observers—and seen firsthand how unpredictable one could be.

While serving in the Army, Stevens had been trained to assemble the warheads of tactical weapon systems. In May 1953 members of his battalion participated in
the test of an atomic cannon. Its shells could travel twenty miles and produce a yield equivalent to that of the bomb that destroyed Hiroshima. For the test in the Nevada desert, all sorts of things were placed near ground zero to study the weapon's effects:
trucks, tanks, railroad cars, aircraft panels, oil drums and cans of gasoline, household goods and materials—denim, flannel, rayon curtains, mops and brooms—a one-story brick structure, steel bridges, buildings that resembled motels, one hundred tall pine trees, field crops, flowers, insects, cages full of rats and mice, fifty-six dogs tethered inside aluminum tubes, forty-two pigs dressed in U.S. Army uniforms whose skin would respond to thermal radiation in a manner similar to that of human skin, and
more than three thousand soldiers, including Bill Stevens, who huddled in a trench about three miles from ground zero.

The troops were part of an ongoing study of the psychological effects of nuclear warfare. They'd been ordered to climb out of their trenches and
march toward the mushroom cloud after the blast. The Army Field Forces Human Research Unit hoped to discover how well they would follow the order, whether they'd obey it or come unglued at the sight of a large nuclear explosion. The atomic shell would fly directly over the heads of Stevens and the other soldiers. They were told to crouch in their trenches until the weapon detonated, then rise in time to brace against the blast wave and watch the explosion. At eight thirty in the morning, a great fireball lit up the desert, about ninety miles from Las Vegas.

As the troops stood, a powerful shock wave blew past, catching them by surprise. It was a “precursor wave,” a weapon effect that hadn't been predicted. Highly compressed air had come down from the fireball, hit the ground, and spread outward, traveling faster than the blast wave. When Stevens and his unit climbed from the trenches to march toward ground zero, they were engulfed by a cloud of dirt and dust. Their lead officer couldn't read the radiation dosage markers and led them closer to ground zero than planned. After returning to their base in Albuquerque, Stevens shook the dirt out of his uniform and saved some of it in a can. Twenty years later, he had the dirt tested at Sandia—and it was still radioactive.

After becoming the head of the nuclear safety department at the lab, Stevens looked through the accident reports kept by the Defense Atomic Support Agency, the Pentagon group that had replaced the Armed Forces Special Weapons Project. The military now used Native American terminology to categorize nuclear weapon accidents. The loss, theft, or seizure of a weapon was an Empty Quiver. Damage to a weapon, without any harm to the public or risk of detonation, was a Bent Spear. And an accident that caused the unauthorized launch or jettison of a weapon, a fire, an explosion, a release of radioactivity, or a full-scale detonation was a Broken Arrow.
The official list of nuclear accidents, compiled by the Department of Defense and the AEC, included thirteen Broken Arrows. Bill Stevens read reports that secretly described a much larger number of unusual events with nuclear weapons. And a study of abnormal environments commissioned by Sandia soon found that
at least 1,200 nuclear weapons had been involved in “significant” incidents and accidents between 1950 and March 1968.

The armed services had done a poor job of reporting nuclear weapon accidents until 1959—and subsequently reported about 130 a year. Many of the accidents were minor: “
During loading of a Mk 25 Mod O WR Warhead onto a 6X6 truck, a handler lost his balance . . . the unit tipped and fell approximately four feet from the truck to the pavement.” And some were not: “
A C-124 Aircraft carrying eight Mk 28 War reserve Warheads and one Mk 49 Y2 Mod 3 War Reserve Warhead was struck by lightning. . . . Observers noted a large ball of fire pass through the aircraft from nose to tail. . . . The ball of fire was accompanied by a loud noise.”

Reading these accident reports persuaded Stevens that the safety of America's nuclear weapons couldn't be assumed. The available data was insufficient for making accurate predictions about the future; a thousand weapon accidents were not enough for any reliable calculation of the odds.
Twenty-three weapons had been directly exposed to fires during an accident, without detonating. Did that prove a fire couldn't detonate a nuclear weapon? Or would the twenty-fourth exposure produce a
blinding white flash and a mushroom cloud? The one-in-a-million assurances that Sandia had made for years now seemed questionable. They'd been made without much empirical evidence.

Instead of basing weapon safety on probabilistic estimates, Stevens wanted to ground it in a thorough understanding of abnormal environments—and how the components of a nuclear weapon would behave in them. During a single accident a weapon might be crushed, burned, and struck by debris, at a wide range of temperatures and velocities. The interplay among those factors was almost impossible to quantify or predict, and no two accidents would ever be exactly the same. But he thought that good engineering could invent safety devices that would always respond predictably.

Bill Stevens hired half a dozen staff members to explore how to make nuclear weapons safer. Stan Spray was one of the first Sandia engineers to be recruited, and he soon led the research on abnormal environments. Spray had been concerned about weapon safety for years. While visiting the Naval Ordnance Test Station near Cape Canaveral, Florida,
he'd watched a bent pin nearly detonate an atomic bomb during a routine test. The accident could have obliterated a large stretch of the Florida coast. In the early
1960s Spray investigated a series of electrical faults in nuclear weapons, analyzing more than a dozen anomalous events prompted by crashes, handling mistakes, and design errors. He had a rare ability to focus intently on a problem for hours, to the exclusion of almost everything around him, until it was solved.

Spray and his team began to gather components from existing weapons and subject them to every kind of abuse that might be encountered in an abnormal environment. It helped that Sandia had the world's largest lightning simulator. Ever since Donald Hornig babysat the first nuclear device during a lightning storm, the night before the Trinity test, various forms of electromagnetic radiation had been considered a potential trigger of accidental detonations.
The Navy tested many of its weapons by placing them, unarmed, on the deck of an aircraft carrier, turning on all the ship's radars and communications equipment, and waiting to see if anything happened. The electroexplosive squibs of a Navy missile detonated during one of those shipboard tests—and similar squibs were used in some nuclear weapons. By 1968 at least seventy missiles with nuclear warheads had already been involved in lightning accidents.
Lightning had struck a fence at a Mace medium-range missile complex, traveled more than a hundred yards along the fence, damaged three of the eight missiles, and knocked out the power to the site. Each missile carried a Mark 28 thermonuclear warhead.

Four Jupiter missiles in Italy had also been hit by lightning. Some of their thermal batteries fired, and in two of the warheads, tritium gas was released into their cores, ready to boost a nuclear detonation. The weapons weren't designed to sit atop missiles, exposed to the elements, for days at a time. They lacked safety mechanisms to protect against lightning strikes. Instead of removing the warheads or putting safety devices inside them, the Air Force surrounded its Jupiter sites with tall metal towers to draw lightning away from the missiles.

Stan Spray's group ruthlessly burned, scorched, baked, crushed, and tortured weapon components to find their potential flaws. And in the process Spray helped to overturn the traditional thinking about electrical circuits at Sandia. It had always been taken for granted that if two circuits were kept physically apart, if they weren't mated or connected in any way—like
separate power lines running beside a highway—current couldn't travel from one to the other. In a normal environment, that might be true. But strange things began to happen when extreme heat and stress were applied.

When circuit boards were bent or crushed, circuits that were supposed to be kept far apart might suddenly meet. The charring of a circuit board could transform its fiberglass from an insulator into a conductor of electricity. The solder of a heat-sensitive fuse was supposed to melt when it reached a certain temperature, blocking the passage of current during a fire. But Spray discovered that solder behaved oddly once it melted. As a liquid it could prevent an electrical connection—or flow back into its original place, reconnect wires, and allow current to travel between them.

The unpredictable behavior of materials and electrical circuits during an accident was compounded by the design of most nuclear weapons. Although fission and fusion were radically new and destructive forces in warfare, the interior layout of bombs hadn't changed a great deal since the Second World War. The wires from different components still met in a single junction box. Wiring that armed the bomb and wiring that prevented it from being armed often passed through the same junction—making it possible for current to jump from one to the other. And the safety devices were often located far from the bomb's firing set. The greater the distance between them, Spray realized, the greater the risk that stray electricity could somehow enter an arming line, set off the detonators, and cause a nuclear explosion.

By 1970 the Nuclear Safety Department had come up with an entirely new approach to preventing accidental nuclear detonations. Three basic safety principles had been derived from its research—and each would be assured by a different mechanism or component inside a weapon. The first principle was incompatibility: there had to be a unique arming signal that couldn't be sent by a short circuit or a stray wire. The second principle was isolation: the firing set and the detonators had to be protected behind a physical barrier that would exclude fire, electricity, and electromagnetic energy, that couldn't be easily breached, and that would allow only the unique arming signal to enter it. The third principle was inoperability: the firing set had to contain a part that would predictably and irreversibly fail in an
abnormal environment. That part was called a “weak link.” The hardened barrier was called a “strong link,” and combined with a unique arming signal, they promised a level of nuclear weapon safety that would meet or exceed Walske's one-in-a-million standard.

Another Sandia safety effort was being concluded at roughly the same time. Project Crescent had set out to design
a “supersafe” bomb—one that wouldn't detonate “
under any conceivable set of accident conditions” or spread plutonium, even after being
mistakenly dropped from an altitude of forty thousand feet. At first, the Air Force was “
less than enthusiastic about requiring more safety in nuclear weapons,” according to a classified memo on the project. But the Air Force eventually warmed to the idea; a supersafe bomb might permit the resumption of the Strategic Air Command's airborne alert. After more than two years of research, Project Crescent proposed a weapon design that—like a concept car at an automobile show—was innovative but impractical. To prevent the high explosives from detonating and scattering plutonium after a plane crash, the bomb would have a thick casing and a lot of interior padding. Those features would make it three to four times heavier than most hydrogen bombs. The additional weight would reduce the number of nuclear weapons that a B-52 could carry—and that's why the supersafe bomb was never built.

•   •   •

B
OB
P
EURIFOY
BECAME
THE
DIRECTOR
of weapon development at Sandia-Albuquerque in September 1973. He'd closely followed the work of engineers in the safety department and shared many of their frustrations with the bureaucratic mind-set at the lab. Nothing had been done about the problems that they'd discovered. Bill Stevens had traveled to Washington, D.C., three years earlier, briefed the Military Liaison Committee to the AEC on the dangers of abnormal environments, and described the weak link/strong link technology that could minimize them. The committee took no action. The Department of Defense was preoccupied with the war in Vietnam, a Broken Arrow hadn't occurred since Thule, and a familiar complacency once again settled upon the whole issue of nuclear weapon safety.

After taking the new job, Peurifoy made a point of reading the classified reports on every Broken Arrow and major weapon accident, a lengthy catalog of fires, crashes, and explosions, of near misses and disasters narrowly averted. The fact that an accidental detonation had not yet happened, that a major city had not yet been blanketed with plutonium, offered little comfort. The probabilities remained unknown. What were the odds of a screwdriver, used to repair an alarm system, launching the warhead off a missile, the odds of a rubber seat cushion bringing down a B-52? After reading through the accident reports, Peurifoy reached his own conclusion about the safety of America's nuclear weapons: “
We are living on borrowed time.”