Command and Control (5 page)

Saunders and Lay were escorted from the complex and taken by ambulance to the hospital in Searcy, where preparations were hastily being made to treat dozens of injured workers. Hours passed, but none arrived. The flash fire in the equipment area on level 2 had filled the silo with
smoke, then sucked the oxygen out. The exit to the cableway from level 2 offered the only possibility of escape. Some workers had mistakenly climbed down the ladder toward the bottom of the silo. Others were blocked trying to climb up. One was trapped in the elevator when the power went out. Workers weren't killed by the flames. They were asphyxiated by the smoke. Of the fifty-five men who'd returned to the silo after lunch, only Saunders and Lay left there alive.

Helicopters brought firemen from Little Rock Air Force Base to 373-4, but their work was hampered by the poor visibility. They managed to extinguish a few small fires on level 2, but fire was no longer the real danger. Without power, the site lacked air-conditioning, and as the temperature in the silo rose, so did the pressure in the missile's oxidizer tanks. Nitrogen tetroxide expanded in the heat; its boiling point was only 70 degrees Fahrenheit. By five o'clock that evening, the temperature in the silo was 78 degrees and rising. Opening the silo door would help cool the missile and vent the smoke—but the door couldn't be opened without electrical power. Smoke had seeped into the control center as well, complicating efforts to manage the crisis. All four blast doors had been propped open so workers could freely move within the complex. The pins on blast door 8, at the entrance to the control center, had deliberately been left extended so the door wouldn't shut. And without power, the pins couldn't be retracted. At seven o'clock, SAC headquarters in Omaha warned that if the temperature in the silo wasn't reduced, the missile's stage 2 oxidizer tank was likely to reach
an “explosive situation” around midnight.

Firemen and PTS teams worked in the hot, smoke-filled complex to recover bodies, restore power, and prevent an explosion. At ten o'clock, the temperature in the silo reached 80 degrees, then started to fall. Portable lighting units, generators, and industrial air-conditioners were hooked up, and by early morning an even greater disaster had been averted. The fifty-third body was carried from the silo at daybreak.

An Air Force Accident Investigation Board later concluded that a worker who'd been welding on level 2 inadvertently struck a temporary hydraulics line. When the spray of hydraulic fluid hit the arc of the electric welder, it caught fire. The Air Force attributed the accident to human error. But
Gary Lay insisted that nobody had been welding on level 2 and that a mechanical fault had started the fire. He thought that a hydraulics line must have ruptured, spraying flammable oil onto electrical equipment. The missile in the silo wasn't damaged, and the equipment areas were repaired. About one year after the accident, launch crews were back at the complex near Searcy to pull alerts. It looked just like any other complex, except for a few blackened walls in the silo that someone had forgotten to paint.

•   •   •

C
HILDERS
AND
HIS
CREW
PASSED
through blast door 8, walked down the short cableway, and entered the launch control center. The room was round and about thirty-five feet in diameter. It was on the second level of a three-story steel structure, suspended on enormous springs, within a buried concrete cylinder. The walls were two feet thick. The ceiling was covered with a maze of ducts and pipes. The color scheme was a mix of pale turquoise, light gray, the dull silver of unpainted steel. The room had the strong, confident vibe of Eisenhower-era science and technology. It was full of intricately wired machinery and electronics—but did not have a computer. To the right stood a series of steel cabinets that displayed the status and housed the controls of the guidance system, the power and electrical systems, the topside alarm. The cabinets were about seven feet tall and covered with all sorts of switches, gauges, dials, and small round lights. In the center of the room was the commander's console, a small steel desk, turquoise and gray, with rows of square buttons and warning lights. It monitored and controlled the most important functions of the complex. The commander could open the front gate from there, change the warhead's target, enable or abort a launch. In the middle of the console was the launch switch. It was unmarked, blocked by a security seal, and activated by a key. On top of the console was a digital gauge that showed the pressure in the missile's fuel and oxidizer tanks. Two small speakers were bolted to the side of the desk. Throughout the day they broadcast test messages from SAC headquarters and, during wartime, would give the order to launch.

To the left of the commander's console was another small turquoise and gray desk, where the deputy commander sat. It operated the site's communications systems. Directly above the desk was a large, round clock with numbers from 00 through 23 on the face and a thick black casing. The clock was set to Greenwich mean time, so launches at the Titan II sites in Arkansas, Kansas, and Arizona could be synchronized. The deputy commander's launch switch was on the upper left side of the desk. It was round, silver, unmarked, and resembled the ignition switch of an old car. The launch codes and keys were kept in a bright red safe with two brass combination locks, one belonging to the commander, the other to the deputy. It was nicknamed the “go-to-war safe.”

If a launch order came over the speakers, the officers were supposed to unlock their locks, open the safe, grab their codes and keys, then return to their consoles. The keys looked unexceptional, like the kind used to unlock millions of American front doors. The codes were hidden inside flat plastic disks called “cookies.” The disks were broken open by hand, like fortune cookies, and the codes were read aloud. And if the codes authenticated the emergency war order from SAC headquarters,
the launch checklist went something like this:

SURFACE WARNING CONTROL 
. . . Lighted red.

Remove security seals and insert keys into switches.

Launch keys . . . Inserted.

Circuit breaker 103 on . . . Set.

BVLC
–
OPERATE
Code Word . . . Entered.

Simultaneously (within 2 seconds) turn keys for 5 seconds or until sequence starts.

LAUNCH ENABLE 
. . . Lighted.

BATTERIES ACTIVATED
 . . . Lighted.

APS POWER
 . . . Lighted.

SILO SOFT
 . . . Lighted.

GUIDANCE GO
 . . . Lighted.

FIRE ENGINE
 . . . Lighted.

LIFTOFF
 . . . Lighted.

Assuming that everything worked as planned, the Titan II would be gone within seconds. Its warhead would strike the target in about half an hour. Once the missile left the silo, the crew's job was done. They couldn't destroy a missile midflight or launch another. The complex was designed to be used once.

The Titan II would not launch, however, unless the two keys were turned at the same time; the launch switches were too far apart for one person to activate them both. SAC's “two-man policy” had been adopted to prevent a deranged or fanatic crew member from starting a nuclear war. The butterfly valve lock on the stage 1 rocket engine offered some additional control over who could launch the missile. Oxidizer wouldn't flow into that engine until the correct butterfly valve lock code (BVLC) was used during the launch checklist—and without the oxidizer, the missile would stay in the silo. This code wasn't kept in the safe or anywhere else on the complex. It was transmitted with the emergency war order from SAC. And the valve lock contained a small explosive device. Any attempt to tamper with the lock set off the explosive and sealed the oxidizer line shut.

The SAC two-man rule governed not only how the missile was launched but also how the complex was run. At least two authorized personnel always had to be present and within visual range of each other in the control center. You couldn't allow the other person out of your sight. The same rule applied in the silo, whenever the missile had a warhead. At entrances to the control center and the silo, a warning stenciled in bold red letters said: “NO LONE ZONE, SAC TWO MAN POLICY MANDATORY.”

•   •   •

T
HE
COMMANDER
AND
the deputy commander at every Titan II site were issued .38 caliber revolvers, in case an intruder penetrated the underground complex or a crew member disobeyed orders. Transferring the weapons was part of the turnover checklist, when a new crew arrived for duty. In addition to the handguns and their holsters, Mazzaro and Childers received some bad news from the crew preparing to leave 4-7. Pressure in the stage 2 oxidizer tank was low. A PTS team would have to visit the site, and most of the day would have to be devoted to major maintenance.
Before the other crew departed, Mazzaro and Childers opened the safe, made sure the cookies and launch keys were inside, shut it, and installed their own locks.

For the next hour or so Mazzaro, Childers, Holder, and Fuller went through the daily shift verification (DSV) checklist in the control center. They checked every piece of equipment on all three levels of the center, every gauge, switch, and warning light. Level 3 was the basement. It housed the DC power supplies and battery backups, switching equipment for the communications systems, the air-conditioning and ventilation systems. Fresh air was pulled into the control center from outdoors, filtered, cooled, and then sent throughout the rest of the complex. The positive air flow helped to protect the crew from toxic vapors that might drift from the silo. The go-to-war safe, the tall steel cabinets, and the launch consoles were on level 2. The top floor, level 1, had a kitchen, a small round table, four chairs, a toilet, and four beds. The complex had enough food to last for a month, but its emergency diesel generator had enough fuel for only two weeks. During wartime, the crew might find itself eating canned and dehydrated military rations in the dark.

PTS Team A was scheduled to pressurize the stage 2 oxidizer tank at the complex. The eight-man team was led by Senior Airman Charles T. Heineman, who would direct its work from the control center. Airmen David W. Aderhold, Eric Ayala, and Richard D. Willinghurst would remain topside to operate the nitrogen tank. Aderhold and Ayala would be in RFHCO suits. Airmen Roger A. Hamm and Gregory W. Lester would stay in the blast lock as backup to the men working in the silo, ready to put on their RFHCOs in an emergency. And Airmen David Powell and Jeffrey Plumb would enter the silo in RFHCOs, remove the pressure cap, and attach the nitrogen line.

Powell and Plumb hoped to get started on the missile early in the afternoon. But the work platforms wouldn't descend from the silo walls. They were stuck in the upright position. A repair crew was working on them. Something was wrong with the hydraulics system, and troubleshooting with help from the tech manuals couldn't fix it. The hassles continued to mount. The hydropneumatic accumulator was broken, and without it the
platforms couldn't be lowered—and the repair crew didn't have the right parts. If pressure in the stage 2 oxidizer tank dropped any further, the missile would have to be taken off alert. SAC headquarters was never pleased when a missile went off alert. And so a helicopter was sent from Little Rock Air Force Base with the parts.

Meanwhile, Rodney Holder and Ron Fuller continued to go through the daily shift verification checklist, walking down the long corridor to the silo. The cableway was essentially a big steel pipe, braced with girders and springs, that stretched almost fifty yards from the blast lock to the silo. The floor was painted gray, the walls and ceilings turquoise. Bundles of pipes and cables snaked overhead and along both sides. It looked like the interior of a submarine that was somehow underground, not underwater. The silo's nine levels were crammed with equipment, and the checklist there took about two hours to complete. It had hundreds of steps. Sometimes crews would cut corners to speed things up. They'd divide the labor—you check this air compressor, I'll check that one—and violate the SAC two-man rule, roaming separately through the silo and comparing notes later. It was faster that way, the violation seemed trivial, and officers in the control center had no way of knowing what the enlisted men were doing in the silo. The television camera in the access portal, aimed at the entrapment area, was the only one in the complex. From the control center you couldn't see what was happening in the cableways, the blast lock, the silo, or topside. There was no periscope. And one officer could not leave the other alone in the control center to check on what crew members were doing elsewhere. That would be a serious violation of the two-man rule.

Holder and Fuller did everything by the book that day. As members of an instructor crew, they took pride in being considered among the best at the job. A standardization-evaluation team was soon going to be judging their work, and Holder wanted a high score. Doing things properly added only fifteen minutes or so to the job. Before joining the Air Force he'd been a construction worker, building highway bridges in rural Arkansas. A career in the military hadn't appealed to him, at first. His father was a former NFL player who joined the Naval Reserve during the Korean War and wound up spending more than two decades as a naval officer. Holder
had attended grade schools in three different countries and high schools in four different states. At the age of nineteen, he liked doing construction work but worried about the future. The military promised a more interesting and rewarding life. Joining the Navy wasn't an option; Holder got seasick too easily. So he joined the Air Force, eager to learn about missiles. Working on the Titan II had revealed that, deep down, he was a techno geek. Holder knew his way around the complex better than any of the other crew members. He not only knew what everything was, he could explain how it worked. On September 18, 1980, he was twenty-four years old and had been married for ten months.