Eric Schlosser - Command and Control

Four Jupiter missiles in Italy had also been hit by lightning. Some of their thermal batteries fired, and in two of the warheads, tritium gas was released into their cores, ready to boost a nuclear detonation. The weapons weren’t designed to sit atop missiles, exposed to the elements, for days at a time. They lacked safety mechanisms to protect against lightning strikes. Instead of removing the warheads or putting safety devices inside them, the Air Force surrounded its Jupiter sites with tall metal towers to draw lightning away from the missiles.

Stan Spray’s group ruthlessly burned, scorched, baked, crushed, and tortured weapon components to find their potential flaws. And in the process Spray helped to overturn the traditional thinking about electrical circuits at Sandia. It had always been taken for granted that if two circuits were kept physically apart, if they weren’t mated or connected in any way — like separate power lines running beside a highway — current couldn’t travel from one to the other. In a normal environment, that might be true. But strange things began to happen when extreme heat and stress were applied.

When circuit boards were bent or crushed, circuits that were supposed to be kept far apart might suddenly meet. The charring of a circuit board could transform its fiberglass from an insulator into a conductor of electricity. The solder of a heat-sensitive fuse was supposed to melt when it reached a certain temperature, blocking the passage of current during a fire. But Spray discovered that solder behaved oddly once it melted. As a liquid it could prevent an electrical connection — or flow back into its original place, reconnect wires, and allow current to travel between them.

The unpredictable behavior of materials and electrical circuits during an accident was compounded by the design of most nuclear weapons. Although fission and fusion were radically new and destructive forces in warfare, the interior layout of bombs hadn’t changed a great deal since the Second World War. The wires from different components still met in a single junction box. Wiring that armed the bomb and wiring that prevented it from being armed often passed through the same junction — making it possible for current to jump from one to the other. And the safety devices were often located far from the bomb’s firing set. The greater the distance between them, Spray realized, the greater the risk that stray electricity could somehow enter an arming line, set off the detonators, and cause a nuclear explosion.

By 1970 the Nuclear Safety Department had come up with an entirely new approach to preventing accidental nuclear detonations. Three basic safety principles had been derived from its research — and each would be assured by a different mechanism or component inside a weapon. The first principle was incompatibility: there had to be a unique arming signal that couldn’t be sent by a short circuit or a stray wire. The second principle was isolation: the firing set and the detonators had to be protected behind a physical barrier that would exclude fire, electricity, and electromagnetic energy, that couldn’t be easily breached, and that would allow only the unique arming signal to enter it. The third principle was inoperability: the firing set had to contain a part that would predictably and irreversibly fail in an abnormal environment. That part was called a “weak link.” The hardened barrier was called a “strong link,” and combined with a unique arming signal, they promised a level of nuclear weapon safety that would meet or exceed Walske’s one-in-a-million standard.

Another Sandia safety effort was being concluded at roughly the same time. Project Crescent had set out to design a “supersafe” bomb — one that wouldn’t detonate “under any conceivable set of accident conditions” or spread plutonium, even after being mistakenly dropped from an altitude of forty thousand feet. At first, the Air Force was “less than enthusiastic about requiring more safety in nuclear weapons,” according to a classified memo on the project. But the Air Force eventually warmed to the idea; a supersafe bomb might permit the resumption of the Strategic Air Command’s airborne alert. After more than two years of research, Project Crescent proposed a weapon design that — like a concept car at an automobile show — was innovative but impractical. To prevent the high explosives from detonating and scattering plutonium after a plane crash, the bomb would have a thick casing and a lot of interior padding. Those features would make it three to four times heavier than most hydrogen bombs. The additional weight would reduce the number of nuclear weapons that a B-52 could carry — and that’s why the supersafe bomb was never built.

BOB PEURIFOY BECAME THE DIRECTOR of weapon development at Sandia-Albuquerque in September 1973. He’d closely followed the work of engineers in the safety department and shared many of their frustrations with the bureaucratic mind-set at the lab. Nothing had been done about the problems that they’d discovered. Bill Stevens had traveled to Washington, D.C., three years earlier, briefed the Military Liaison Committee to the AEC on the dangers of abnormal environments, and described the weak link/strong link technology that could minimize them. The committee took no action. The Department of Defense was preoccupied with the war in Vietnam, a Broken Arrow hadn’t occurred since Thule, and a familiar complacency once again settled upon the whole issue of nuclear weapon safety.

After taking the new job, Peurifoy made a point of reading the classified reports on every Broken Arrow and major weapon accident, a lengthy catalog of fires, crashes, and explosions, of near misses and disasters narrowly averted. The fact that an accidental detonation had not yet happened, that a major city had not yet been blanketed with plutonium, offered little comfort. The probabilities remained unknown. What were the odds of a screwdriver, used to repair an alarm system, launching the warhead off a missile, the odds of a rubber seat cushion bringing down a B-52? After reading through the accident reports, Peurifoy reached his own conclusion about the safety of America’s nuclear weapons: “We are living on borrowed time.”

Peurifoy had recently heard about an explosive called 1,3,5-triamino-2,4,6-trinitrobenzene (TATB). It had been invented in 1888 but had been rarely used since then — because TATB was so hard to detonate. Under federal law, it wasn’t even classified as an explosive; it was considered a flammable solid. With the right detonators, however, it could produce a shock wave almost as strong as the high explosives that surrounded the core of a nuclear weapon. TATB soon became known as an “insensitive high explosive.” You could drop it, hammer it, set it on fire, smash it into the ground at a speed of 1,500 feet per second, and it still wouldn’t detonate. The explosives being used in America’s nuclear weapons would go off from an impact one tenth as strong. Harold Agnew was now the director of Los Alamos, and he thought using TATB in hydrogen bombs made a lot more sense — as a means of preventing plutonium dispersal during an accident — than adding two or three thousand extra pounds of steel and padding.

All the necessary elements for nuclear weapon safety were now available: a unique signal, weak link/strong link technology, insensitive high explosives. The only thing missing was the willingness to fight a bureaucratic war on their behalf — and Bob Peurifoy had that quality in abundance. He was no longer a low-level employee, toiling away on the electrical system of a bomb, without a sense of the bigger picture. As the head of weapon development, he now had some authority to make policy at Sandia. And he planned to take advantage of it. Three months into the new job, Peurifoy told his superior, Glenn Fowler, a vice president at the lab, that all the nuclear weapons carried by aircraft had to be retrofitted with new safety devices. Peurifoy didn’t claim that the weapons were unsafe; he said their safety could no longer be presumed. Fowler listened carefully to his arguments and agreed. A briefing for Sandia’s upper management was scheduled for February 1974.