Читаем Command and Control полностью

The unpredictable behavior of materials and electrical circuits during an accident was compounded by the design of most nuclear weapons. Although fission and fusion were radically new and destructive forces in warfare, the interior layout of bombs hadn’t changed a great deal since the Second World War. The wires from different components still met in a single junction box. Wiring that armed the bomb and wiring that prevented it from being armed often passed through the same junction — making it possible for current to jump from one to the other. And the safety devices were often located far from the bomb’s firing set. The greater the distance between them, Spray realized, the greater the risk that stray electricity could somehow enter an arming line, set off the detonators, and cause a nuclear explosion.

By 1970 the Nuclear Safety Department had come up with an entirely new approach to preventing accidental nuclear detonations. Three basic safety principles had been derived from its research — and each would be assured by a different mechanism or component inside a weapon. The first principle was incompatibility: there had to be a unique arming signal that couldn’t be sent by a short circuit or a stray wire. The second principle was isolation: the firing set and the detonators had to be protected behind a physical barrier that would exclude fire, electricity, and electromagnetic energy, that couldn’t be easily breached, and that would allow only the unique arming signal to enter it. The third principle was inoperability: the firing set had to contain a part that would predictably and irreversibly fail in an abnormal environment. That part was called a “weak link.” The hardened barrier was called a “strong link,” and combined with a unique arming signal, they promised a level of nuclear weapon safety that would meet or exceed Walske’s one-in-a-million standard.

Another Sandia safety effort was being concluded at roughly the same time. Project Crescent had set out to design a “supersafe” bomb — one that wouldn’t detonate “under any conceivable set of accident conditions” or spread plutonium, even after being mistakenly dropped from an altitude of forty thousand feet. At first, the Air Force was “less than enthusiastic about requiring more safety in nuclear weapons,” according to a classified memo on the project. But the Air Force eventually warmed to the idea; a supersafe bomb might permit the resumption of the Strategic Air Command’s airborne alert. After more than two years of research, Project Crescent proposed a weapon design that — like a concept car at an automobile show — was innovative but impractical. To prevent the high explosives from detonating and scattering plutonium after a plane crash, the bomb would have a thick casing and a lot of interior padding. Those features would make it three to four times heavier than most hydrogen bombs. The additional weight would reduce the number of nuclear weapons that a B-52 could carry — and that’s why the supersafe bomb was never built.

* * *

Bob Peurifoy became the director of weapon development at Sandia-Albuquerque in September 1973. He’d closely followed the work of engineers in the safety department and shared many of their frustrations with the bureaucratic mind-set at the lab. Nothing had been done about the problems that they’d discovered. Bill Stevens had traveled to Washington, D.C., three years earlier, briefed the Military Liaison Committee to the AEC on the dangers of abnormal environments, and described the weak link/strong link technology that could minimize them. The committee took no action. The Department of Defense was preoccupied with the war in Vietnam, a Broken Arrow hadn’t occurred since Thule, and a familiar complacency once again settled upon the whole issue of nuclear weapon safety.

After taking the new job, Peurifoy made a point of reading the classified reports on every Broken Arrow and major weapon accident, a lengthy catalog of fires, crashes, and explosions, of near misses and disasters narrowly averted. The fact that an accidental detonation had not yet happened, that a major city had not yet been blanketed with plutonium, offered little comfort. The probabilities remained unknown. What were the odds of a screwdriver, used to repair an alarm system, launching the warhead off a missile, the odds of a rubber seat cushion bringing down a B-52? After reading through the accident reports, Peurifoy reached his own conclusion about the safety of America’s nuclear weapons: “We are living on borrowed time.”