Command and Control

In 1957 the Armed Forces Special Weapons Project offered a new set of acceptable probabilities. For example, it proposed that the odds of a hydrogen bomb exploding accidentally — from all causes, while in storage, during the entire life of the weapon — should be one in ten million. And the lifespan of a typical weapon was assumed to be ten years. At first glance, those odds made the possibility of a nuclear disaster seem remote. But if the United States kept ten thousand hydrogen bombs in storage for ten years, the odds of an accidental detonation became much higher — one in a thousand. And if those weapons were removed from storage and loaded onto airplanes, the AFSWP study proposed some acceptable probabilities that the American public, had it been informed, might not have found so acceptable. The odds of a hydrogen bomb detonating by accident, every decade, would be one in five. And during that same period, the odds of an atomic bomb detonating by accident in the United States would be about 100 percent.

All of those probabilities, acceptable or unacceptable, were merely design goals. They were based on educated guesses, not hard evidence, especially when human behavior was involved. The one-point safety of a nuclear weapon seemed like a more straightforward issue. It would be determined by phenomena that were quantifiable: the velocity of high explosives, the mass and geometry of a nuclear core, the number of fissions that could occur during an asymmetrical implosion. But even those things were haunted by mathematical uncertainty. The one-point safety tests at Nevada Test Site had provided encouraging results, and yet the behavior of a nuclear weapon in an “abnormal environment”—like that of a fuel fire ignited by a plane crash — was still poorly understood. During a fire, the high explosives of a weapon might burn; they might detonate; or they might burn and then detonate. And different weapons might respond differently to the same fire, based on the type, weight, and configuration of their high explosives. For firefighting purposes, each weapon was assigned a “time factor”—the amount of time you had, once a weapon was engulfed in flames, either to put out the fire or to get at least a thousand feet away from it. The time factor for the Genie was three minutes.

Even if a weapon could be made fully one-point safe, it might still detonate by accident. A glitch in the electrical system could potentially arm a bomb and trigger all its detonators. Carl Carlson, a young physicist at Sandia, came to believe that the design of a nuclear weapon’s electrical system was the “real key” to preventing accidental detonations. The heat of a fire might start the thermal batteries, release high-voltage electricity into the X-unit, and then set off the bomb. To eliminate that risk, heat-sensitive fuses were added to every sealed-pit weapon. At a temperature of 300 degrees Fahrenheit, the fuses would blow, melting the connections between the batteries and the arming system. It was a straightforward, time-honored way to interrupt an electrical circuit, and it promised to ensure that a high temperature wouldn’t trigger the detonators. But Carlson was still worried that in other situations a firing signal could still be sent to a nuclear weapon by accident or by mistake.

A strong believer in systems analysis and the use of multiple disciplines to solve complex questions, Carlson thought that adding heat-sensitive fuses to nuclear weapons wasn’t enough. The real safety problem was more easily stated than solved: bombs were dumb. They responded to simple electrical inputs, and they had no means of knowing whether a signal had been sent deliberately. In the cockpit of a SAC bomber, the T-249 control box made it easy to arm a weapon. First you flicked a toggle switch to ON, allowing power to flow from the aircraft to the bomb. Then you turned a knob from the SAFE position either to GROUND or to AIR, setting the height at which the bomb would detonate. That was all it took — and if somebody forgot to return the knob to SAFE, the bomb would remain armed, even after the power switch was turned off. Writing on behalf of Sandia and the other weapon labs, Carlson warned that an overly simplistic electrical system increased the risk of a full-scale detonation during an accident: “a weapon which requires only the receipt of intelligence from the delivery system for arming will accept and respond to such intelligence whether the signals are intentional or not.”