Command and Control: Nuclear Weapons, the Damascus Accident, and the Illusion of Safety

Fred Iklé’s reports on nuclear weapon safety were circulated at the highest levels of the Air Force and the Department of Defense. But his work remained unknown to most weapon designers and midlevel officers. In 1958, Bob Peurifoy was a section supervisor at Sandia, working on the electrical system of the W-49 warhead. Development of the W-49 was considered urgent; lightweight and thermonuclear, the warhead would be mounted atop Atlas, Thor, and Jupiter ballistic missiles. During the rush to bring it into production, Peurifoy was surprised to read some of the language in a preliminary safety study of the W-49. “This warhead, like all other warheads investigated, can be sabotaged, i.e., detonated full-scale,” the Air Force study mentioned, in passing. “Any person with knowledge of the warhead electrical circuits, a handful of equipment, a little time, and the intent, can detonate the warhead.” Peurifoy hadn’t spent much time thinking about nuclear weapon safety; his job at Sandia was making sure that bombs would explode. But the ease with which someone could intentionally set off a W-49 seemed incredible to him. It was unacceptable. And so was the Air Force’s willingness to rely on physical security — armed guards, perimeter fences, etc. — as the only means of preventing an unauthorized detonation.

Peurifoy decided that the warhead should have an internal mechanism to prevent sabotage or human error from detonating it. Plans were already being made to incorporate a trajectory-sensing switch into the new Mark 28 bomb, and Peurifoy thought that the W-49 should contain one, too. The switch responded to changes in gravitational force. It contained an accelerometer — a small weight atop a spring, enclosed in a cylinder. As g-forces increased, the weight pushed against the spring, like a passenger pushed back against the seat of an accelerating car. When the spring fully compressed, an electrical circuit closed, allowing the weapon to be detonated. In the Mark 28 bomb, the switch would be triggered by the sudden jerk of the parachutes opening. Peurifoy wanted to use the strong g-forces of the warhead’s descent to close the circuit. A trajectory-sensing switch would prevent the weapon from going off while airmen handled or serviced it, since the necessary g-forces wouldn’t be present on the ground. A skilled technician could circumvent the switch, but its placement deep within the warhead would make an act of sabotage trickier and more time consuming.

The Army didn’t like Peurifoy’s idea. A switch that operated as the W-49 warhead fell to earth, the Army contended, might somehow make the weapon less reliable. The Army also didn’t like what Sandia engineers called the switch: a “handling safety device” or a “goof-proofer.” Both terms implied that Army personnel were capable of making mistakes. Peurifoy thought that sort of thinking was sheer stupidity. But the Army ran the Jupiter missile program and had the final say on its fuzing and firing system. Under enormous pressure to complete the design of the warhead’s electrical system, Peurifoy said “to hell with it” and simply reversed the direction of the tiny springs. Now the switch would respond to the g-forces of the missile soaring upward — not those of the warhead coming down — and the Army couldn’t complain that its control of the fuzing and firing system was being challenged. To avoid any hurt feelings, Sandia renamed the switch, calling it an “environmental sensing device.”

At Los Alamos, the issue of one-point safety gained renewed attention as SAC began to fly planes with fully assembled weapons. A young physicist, Robert K. Osborne, began to worry that a number of the bombs carried during airborne alerts might not be one-point safe. Among those raising the greatest concern was the Mark 28, a hydrogen bomb with a yield of about 1 megaton. Any problem with the Mark 28 would be a big problem. The Air Force had chosen it not only to become the most widely deployed bomb in the Strategic Air Command, but also to serve as a “tactical” weapon for NATO fighter planes. In December 1957 the Fission Weapon Committee at Los Alamos had struggled to define what “one-point safe” should mean, as a design goal. If the high explosives of a weapon detonated at a single point, some fission was bound to occur in the core before it blew apart — and so “zero yield” was considered unattainable.