Command and Control

Helicopters brought firemen from Little Rock Air Force Base to 373-4, but their work was hampered by the poor visibility. They managed to extinguish a few small fires on level 2, but fire was no longer the real danger. Without power, the site lacked air-conditioning, and as the temperature in the silo rose, so did the pressure in the missile’s oxidizer tanks. Nitrogen tetroxide expanded in the heat; its boiling point was only 70 degrees Fahrenheit. By five o’clock that evening, the temperature in the silo was 78 degrees and rising. Opening the silo door would help cool the missile and vent the smoke — but the door couldn’t be opened without electrical power. Smoke had seeped into the control center as well, complicating efforts to manage the crisis. All four blast doors had been propped open so workers could freely move within the complex. The pins on blast door 8, at the entrance to the control center, had deliberately been left extended so the door wouldn’t shut. And without power, the pins couldn’t be retracted. At seven o’clock, SAC headquarters in Omaha warned that if the temperature in the silo wasn’t reduced, the missile’s stage 2 oxidizer tank was likely to reach an “explosive situation” around midnight.

Firemen and PTS teams worked in the hot, smoke-filled complex to recover bodies, restore power, and prevent an explosion. At ten o’clock, the temperature in the silo reached 80 degrees, then started to fall. Portable lighting units, generators, and industrial air-conditioners were hooked up, and by early morning an even greater disaster had been averted. The fifty-third body was carried from the silo at daybreak.

An Air Force Accident Investigation Board later concluded that a worker who’d been welding on level 2 inadvertently struck a temporary hydraulics line. When the spray of hydraulic fluid hit the arc of the electric welder, it caught fire. The Air Force attributed the accident to human error. But Gary Lay insisted that nobody had been welding on level 2 and that a mechanical fault had started the fire. He thought that a hydraulics line must have ruptured, spraying flammable oil onto electrical equipment. The missile in the silo wasn’t damaged, and the equipment areas were repaired. About one year after the accident, launch crews were back at the complex near Searcy to pull alerts. It looked just like any other complex, except for a few blackened walls in the silo that someone had forgotten to paint.

* * *

Childers and his crew passed through blast door 8, walked down the short cableway, and entered the launch control center. The room was round and about thirty-five feet in diameter. It was on the second level of a three-story steel structure, suspended on enormous springs, within a buried concrete cylinder. The walls were two feet thick. The ceiling was covered with a maze of ducts and pipes. The color scheme was a mix of pale turquoise, light gray, the dull silver of unpainted steel. The room had the strong, confident vibe of Eisenhower-era science and technology. It was full of intricately wired machinery and electronics — but did not have a computer. To the right stood a series of steel cabinets that displayed the status and housed the controls of the guidance system, the power and electrical systems, the topside alarm. The cabinets were about seven feet tall and covered with all sorts of switches, gauges, dials, and small round lights. In the center of the room was the commander’s console, a small steel desk, turquoise and gray, with rows of square buttons and warning lights. It monitored and controlled the most important functions of the complex. The commander could open the front gate from there, change the warhead’s target, enable or abort a launch. In the middle of the console was the launch switch. It was unmarked, blocked by a security seal, and activated by a key. On top of the console was a digital gauge that showed the pressure in the missile’s fuel and oxidizer tanks. Two small speakers were bolted to the side of the desk. Throughout the day they broadcast test messages from SAC headquarters and, during wartime, would give the order to launch.

To the left of the commander’s console was another small turquoise and gray desk, where the deputy commander sat. It operated the site’s communications systems. Directly above the desk was a large, round clock with numbers from 00 through 23 on the face and a thick black casing. The clock was set to Greenwich mean time, so launches at the Titan II sites in Arkansas, Kansas, and Arizona could be synchronized. The deputy commander’s launch switch was on the upper left side of the desk. It was round, silver, unmarked, and resembled the ignition switch of an old car. The launch codes and keys were kept in a bright red safe with two brass combination locks, one belonging to the commander, the other to the deputy. It was nicknamed the “go-to-war safe.”