Eric Schlosser - Command and Control

The two airmen ran out of the launch duct and called the control center. Half an hour later, a Missile Potential Hazard Team ordered them to reenter the silo. They found it full of thick, gray smoke. One of the retrorockets atop the Minuteman had fired. The reentry vehicle, containing a W-56 thermonuclear weapon, had lifted a few inches into the air, flipped over, fallen nose first from the missile, bounced off the wall, hit the second-stage engine, and landed at the bottom of the silo. The warhead wasn’t damaged, although its arming and fuzing package was torn off during the seventy-five-foot drop. An investigation later found that the retrorocket had been set off by a fault in an electrical connector — and by Dodson’s screwdriver.

The weapon accidents often felt sudden and surreal. On December 5, 1965, a group of sailors were pushing an A-4E Skyhawk fighter plane onto an elevator aboard the USS Ticonderoga , an aircraft carrier about seventy miles off the coast of Japan. The plane’s canopy was open; Lieutenant Douglas M. Webster, its pilot, strapped into his seat. The deck rose as the ship passed over a wave, and one of the sailors blew a whistle, signaling that Webster should apply his brakes. Webster didn’t hear the whistle. The plane started to roll backward. The sailor kept blowing the whistle; other sailors yelled, “Brakes, brakes,” and held onto the plane. They let go as it rolled off the elevator into the sea. In an instant, it was gone. The pilot, his plane, and a Mark 43 hydrogen bomb vanished. No trace of them was ever found; the ocean there was about three miles deep. The canopy may have closed after the plane fell, trapping Webster in his seat. He had recently graduated from Ohio State University, gotten married, and completed his first tour of duty over Vietnam.

BY THE MID-1960s, sealed-pit nuclear weapons had burned, melted, sunk, blown apart, smashed into the ground. But none had detonated accidentally. The B-52 crash in Goldsboro, North Carolina, had been an awfully close call, gaining the attention of engineers at Sandia. Nobody wanted that sort of thing to happen again — and yet during the Goldsboro crash, the weapons had failed safe. Now that nuclear testing had resumed, Los Alamos, Lawrence Livermore, and Sandia were busy designing new warheads and bombs for every branch of the armed services. The need for new safety devices was not apparent. Again and again, the existing ones worked.

President Kennedy and Secretary of Defense McNamara had taken a personal interest in nuclear weapon safety. A few months after Goldsboro, Kennedy gave the Department of Defense “responsibility for identifying and resolving health and safety problems connected with the custody and storage of nuclear weapons.” The Atomic Energy Commission was to play an important, though subsidiary, role. Kennedy’s decision empowered McNamara to do whatever seemed necessary. But it also reinforced military, not civilian, control of the system. At Los Alamos, Livermore, and Sandia, the reliability of nuclear weapons continued to receive far greater attention than their safety. And a dangerous way of thinking, a form of complacency later known as the Titanic Effect took hold among weapon designers: the more impossible an accidental detonation seemed to be, the more likely it became.

The military’s distrust of use control and safety devices was encouraged by some of the early models. The first permissive action links — Category A PALs — did not always operate flawlessly. The batteries in their decoders had a tendency to run down without warning. When that happened, the weapons couldn’t be unlocked. And the gears in the Category A PALs were too loud. During a black hat exercise at Sandia, an engineer listened carefully to the sounds of a PAL, deciphered its code, and picked the lock.

The W-47 warhead had a far more serious problem. Designed at Lawrence Livermore in the late 1950s and rushed into production amid the anxiety about Sputnik, the warhead sat atop every missile in Polaris submarines. Its primary had a revolutionary new core — small and egg shaped, with only two detonators — that could generate a large yield for a weapon so compact. But the W-47 wasn’t one-point safe, by a significant margin. And the moratorium on nuclear testing, during Eisenhower’s last two years in office, prevented the sort of tests that could make it one-point safe. Edward Teller, now the director of Lawrence Livermore, considered using a more traditional core designed at Los Alamos, even though the two labs had competed fiercely for this contract with the Navy. Each Polaris submarine would have sixteen missiles, aligned closely together in two rows. An unsafe warhead could threaten the sub’s 150 crew members — and the port cities where it docked.

To avoid the embarrassment of relying on a Los Alamos design, Teller used Livermore’s new core but added a mechanical safing device to it. A strip of cadmium tape coated with boron was placed in the center of the core. Cadmium and boron absorb neutrons, and the presence of the tape would stop a chain reaction, making a nuclear detonation impossible. During the warhead’s arming sequence, the tape would be pulled out by a little motor before the core imploded. It seemed like a clever solution to the one-point safety problem — until a routine examination of the warheads in 1963 found that the tape corroded inside the cores. When the tape corroded, it got stuck. And the little motor didn’t have enough torque to pull the tape out. Livermore’s mechanical safing device had made the warheads too safe. A former director of the Navy’s Strategic Systems Project Office Reentry Body Coordinating Committee explained the problem: there was “almost zero confidence that the warhead would work as intended.” A large proportion of W-47 warheads, perhaps 75 percent or more, wouldn’t detonate after being launched. The Polaris submarine, the weapon system that McNamara and Kennedy considered the cornerstone of the American arsenal, the ultimate deterrent, the guarantor of nuclear retaliation and controlled escalation and assured destruction, was full of duds. For the next four years, Livermore tried to fix the safety mechanism of the W-47, without success. The Navy was furious, and all the warheads had to be replaced. The new cores were inherently one-point safe.

The Strategic Air Command’s safety procedures had become so effective that the risks of its airborne alert were easily overlooked. During the first five years of the program, SAC conducted tens of thousands aerial refuelings — with only one fatal accident. But the laws of probability couldn’t be escaped. On January 17, 1966, at about ten fifteen in the morning, a B-52 on a Chrome Dome mission prepared for its second refueling, a couple of miles inland from the southern coast of Spain. It had left Goldsboro, North Carolina, the previous evening and needed more fuel, after seventeen hours of flight, for the trip home. The B-52 approached the tanker too quickly, flew into the fuel boom, and started to break apart. Flames traveled straight through the boom. The tanker exploded, incinerating its four-man crew.

Major Larry G. Messinger, a copilot who was flying the B-52 at the time, bailed out first. His ejection seat cleared the plane, his parachute opened, and high winds carried him out to sea. The morning sky was clear enough for him to watch the coast of Spain receding in the distance. Messinger landed in the ocean, eight miles from shore, and inflated a life raft. Captain Ivans Buchanan, the radar navigator, left the plane, passed through a fireball, couldn’t get out of his ejection seat — and couldn’t get his parachute to open. Stuck in the chair as it plummeted and spun, Buchanan removed the parachute from the pack by hand. The chute finally opened, but the weight of the seat caused a hard landing. It hurt his back, broke his shoulder, and knocked him unconscious. Captain Charles J. Wendorf, the pilot, broke an arm ejecting from the plane. Although his parachute caught on fire, it deposited him safely in the ocean, about three miles out.