Command and Control

A new set of problems soon emerged. Every five minutes Holder had been recording the stage 1 tank pressures from the PTPMU. The ideal pressure for both the fuel and the oxidizer tanks was 11.5 pounds per square inch (psi). About half an hour after the accident, the fuel pressure had dropped to 5.5, while the oxidizer pressure had risen to 18.6. The combination of water and fuel in the silo created heat, increasing the pressure in the oxidizer tank. If the pressure became too great, the tank would rupture and the oxidizer would pour out. It would mix with the fuel in the silo, causing an explosion.

Meanwhile, the leak was lowering the pressure in the stage 1 fuel tank. The small hole allowed fuel to leave the tank but didn’t let air enter it. The stage 1 fuel tank sat at the bottom of the missile and supported much of its weight. The Titan II’s aluminum skin was about the width of a nickel. In much the same way that a car is supported by the air in its tires, not the rubber, the huge missile was bolstered by the 85,000 pounds of rocket fuel in its stage 1 tank. That tank wasn’t supposed to be empty when the others were full — unless the missile was flying hundreds of miles off the ground. If the fuel tank on the bottom collapsed, the oxidizer tank directly above it would tumble and burst. The two propellants would mix, and the missile would explode.

The pressure levels in both of the stage 1 tanks were now moving in opposite directions: one was rising, due to the heat; the other was falling, due to the leak. The oxidizer tank was likely to rupture when its pressure rose to about 25 or 30 psi. And the fuel tank was likely to collapse when its pressure fell to somewhere between –2 and –3 psi.

At half past seven, about an hour after the accident, the pressure in the fuel tank was 2.6, and the pressure in the oxidizer tank was 18.8.

Holder suggested shutting down the power to the missile. The socket might have struck an electrical panel and started a fire. But even if it hadn’t, having power in the silo might somehow give off a spark that would ignite the fuel vapor. Although the suggestion felt like grasping at straws, Holder thought it was something they could actually do, instead of just sitting there. A checklist was composed with help from the Missile Potential Hazard Team. Everyone agreed that circuit breaker 13, which supplied power to the PTPMU, should be left on so that tank pressure readings could still be obtained.

As Holder read the first sentence of the checklist and prepared to turn off circuit breakers, a light on the commander’s console indicated that the sprays had stopped. The hard water tank in the silo had run out of water. It was supposed to be refilled automatically by the soft water tank topside. But the faulty switch on the hard water tank that Holder and Fuller noticed during the morning inspection had prompted someone, months or even years earlier, to close the pipe linking the two tanks. About a hundred thousand gallons of water had sprayed into the silo, and an additional hundred thousand were still available topside. The crew, however, had no way of getting that extra water. The indicator said the pump in the silo was still pumping, and yet nothing was coming out of it. Childers tried to turn off the pump, concerned that its electric motor might produce a spark. He kept pushing the button but the pump wouldn’t stop.

At about five past eight, the LAUNCH DUCT TEMP HIGH HIGH warning light flashed red. The temperature in the silo had reached 80 degrees, and without the sprays of cold water, it would keep climbing. The pressure in the fuel tank was down to 0.4 psi. The pressure in the oxidizer tank was 19.5 and rising fast.

Captain Mazzaro asked for permission to evacuate the control center. Permission was denied.

The Missile Potential Hazard Team in Little Rock had a plan. The RFHCOs that Powell and Plumb had worn still held about forty minutes of air. The suits in the blast lock hadn’t been used. They were good for at least an hour. According to Little Rock’s plan, the PTS crew would retrieve the RFHCOs from the blast lock, put them on, check the MSA, and report the vapor levels in the equipment area of the silo. If the levels were low enough, the men would proceed to the equipment area and turn on the purge fan. That might clear some of the fuel vapors out of the silo.

It was worth a try. Fuller, Lester, and Powell stood beside blast door 8. Powell kept his hand on the button. He unlocked the door, and Lester slowly cracked it open. The blast lock was filled with a white, hazy mist that smelled like fuel and smoke. Lester slammed the door, and Powell locked it.

The RFHCOs in the blast lock were now useless, contaminated, and the control center didn’t have enough suits for the job. The safety rules required at least two people with RFHCOs as backup, whenever a team went Category I. The PTS crew topside had four RFHCOs on their truck, but nobody could reach them on the radio.