President Kennedy and Secretary of Defense McNamara had taken a personal interest in nuclear weapon safety. A few months after Goldsboro, Kennedy gave the Department of Defense “responsibility for identifying and resolving health and safety problems connected with the custody and storage of nuclear weapons.” The Atomic Energy Commission was to play an important, though subsidiary, role. Kennedy’s decision empowered McNamara to do whatever seemed necessary. But it also reinforced military, not civilian, control of the system. At Los Alamos, Livermore, and Sandia, the reliability of nuclear weapons continued to receive far greater attention than their safety. And a dangerous way of thinking, a form of complacency later known as the Titanic Effect took hold among weapon designers: the more impossible an accidental detonation seemed to be, the more likely it became.
And:
Twenty-three years after Sandia became a separate laboratory, it created a nuclear weapon safety department. An assistant to the secretary of defense for atomic energy, Carl Walske, was concerned about the risks of nuclear accidents. He had traveled to Denmark, dealt with the aftermath of the Thule accident, and come to believe that the safety standards of the weapons labs were based on a questionable use of statistics. Before a nuclear weapon could enter the stockpile, the odds of its accidental detonation had to be specified, along with its other “military characteristics.” Those odds were usually said to be one in a million during storage, transportation, and handling. But the dimensions of that probability were rarely defined. Was the risk one in a million for a single weapon — or for an entire weapon system? Was it one in a million per year — or throughout the operational life of a weapon? How the risk was defined made a big difference, at a time when the United States had about thirty thousand nuclear weapons. The permissible risk of an American nuclear weapon detonating inadvertently could range from one in a million to one in twenty thousand, depending on when the statistical parameters were set.
Walske issued new safety standards in March 1968. They said that the “probability of a premature nuclear detonation” should be no greater than one in a billion, amid “normal storage and operational environments,” during the lifetime of a single weapon. And the probability of a detonation amid “abnormal environments” should be no greater than one in a million. An abnormal environment could be anything from the heat of a burning airplane to the water pressure inside a sinking submarine. Walske’s safety standards applied to every nuclear weapon in the American stockpile. They demanded a high level of certainty that an accidental detonation could never occur. But they offered no guidelines on how these strict criteria could be met. And in the memo announcing the new policy, Walske expressed confidence that “the adoption of the attached standards will not result in any increase in weapon development times or costs.”
A few months later, William L. Stevens was chosen to head Sandia’s new Nuclear Safety Department… Stevens looked through the accident reports kept by the Defense Atomic Support Agency, the Pentagon group that had replaced the Armed Forces Special Weapons Project. The military now used Native American terminology to categorize nuclear weapon accidents. The loss, theft, or seizure of a weapon was an Empty Quiver. Damage to a weapon, without any harm to the public or risk of detonation, was a Bent Spear. And an accident that caused the unauthorized launch or jettison of a weapon, a fire, an explosion, a release of radioactivity, or a full-scale detonation was a Broken Arrow. The official list of nuclear accidents, compiled by the Department of Defense and the AEC, included thirteen Broken Arrows. Bill Stevens read reports that secretly described a much larger number of unusual events with nuclear weapons. And a study of abnormal environments commissioned by Sandia soon found that at least 1,200 nuclear weapons had been involved in “significant” incidents and accidents between 1950 and March 1968.
The armed services had done a poor job of reporting nuclear weapon accidents until 1959— and subsequently reported about 130 a year. Many of the accidents were minor: “During loading of a Mk 25 Mod O WR Warhead onto a 6X6 truck, a handler lost his balance . . . the unit tipped and fell approximately four feet from the truck to the pavement.” And some were not: “A C-124 Aircraft carrying eight Mk 28 War reserve Warheads and one Mk 49 Y2 Mod 3 War Reserve Warhead was struck by lightning… Observers noted a large ball of fire pass through the aircraft from nose to tail… The ball of fire was accompanied by a loud noise.”
Reading these accident reports persuaded Stevens that the safety of America’s nuclear weapons couldn’t be assumed. The available data was insufficient for making accurate predictions about the future; a thousand weapon accidents were not enough for any reliable calculation of the odds. Twenty-three weapons had been directly exposed to fires during an accident, without detonating. Did that prove a fire couldn’t detonate a nuclear weapon? Or would the twenty-fourth exposure produce a blinding white flash and a mushroom cloud? The one-in-a-million assurances that Sandia had made for years now seemed questionable. They’d been made without much empirical evidence.
And:
Four Jupiter missiles in Italy had also been hit by lightning. Some of their thermal batteries fired, and in two of the warheads, tritium gas was released into their cores, ready to boost a nuclear detonation. The weapons weren’t designed to sit atop missiles, exposed to the elements, for days at a time. They lacked safety mechanisms to protect against lightning strikes. Instead of removing the warheads or putting safety devices inside them, the Air Force surrounded its Jupiter sites with tall metal towers to draw lightning away from the missiles.
Stan Spray’s group ruthlessly burned, scorched, baked, crushed, and tortured weapon components to find their potential flaws. And in the process Spray helped to overturn the traditional thinking about electrical circuits at Sandia. It had always been taken for granted that if two circuits were kept physically apart, if they weren’t mated or connected in any way— like separate power lines running beside a highway— current couldn’t travel from one to the other. In a normal environment, that might be true. But strange things began to happen when extreme heat and stress were applied.
When circuit boards were bent or crushed, circuits that were supposed to be kept far apart might suddenly meet. The charring of a circuit board could transform its fiberglass from an insulator into a conductor of electricity. The solder of a heat-sensitive fuse was supposed to melt when it reached a certain temperature, blocking the passage of current during a fire. But Spray discovered that solder behaved oddly once it melted. As a liquid it could prevent an electrical connection— or flow back into its original place, reconnect wires, and allow current to travel between them.
The unpredictable behavior of materials and electrical circuits during an accident was compounded by the design of most nuclear weapons. Although fission and fusion were radically new and destructive forces in warfare, the interior layout of bombs hadn’t changed a great deal since the Second World War. The wires from different components still met in a single junction box. Wiring that armed the bomb and wiring that prevented it from being armed often passed through the same junction— making it possible for current to jump from one to the other. And the safety devices were often located far from the bomb’s firing set. The greater the distance between them, Spray realized, the greater the risk that stray electricity could somehow enter an arming line, set off the detonators, and cause a nuclear explosion.
And:
Another Sandia safety effort was being concluded at roughly the same time. Project Crescent had set out to design a “supersafe” bomb — one that wouldn’t detonate “under any conceivable set of accident conditions” or spread plutonium, even after being mistakenly dropped from an altitude of forty thousand feet. At first, the Air Force was “less than enthusiastic about requiring more safety in nuclear weapons,” according to a classified memo on the project. But the Air Force eventually warmed to the idea; a supersafe bomb might permit the resumption of the Strategic Air Command’s airborne alert. After more than two years of research, Project Crescent proposed a weapon design that — like a concept car at an automobile show — was innovative but impractical. To prevent the high explosives from detonating and scattering plutonium after a plane crash, the bomb would have a thick casing and a lot of interior padding. Those features would make it three to four times heavier than most hydrogen bombs. The additional weight would reduce the number of nuclear weapons that a B-52 could carry— and that’s why the supersafe bomb was never built.
More (#3) from Command and Control:
And:
And:
And: