These materials are reproduced from www.nsarchive.org with the permission of the National Security Archive
Multi-Megaton Bomb Was Virtually "Armed" When It Crashed to Earth in North Carolina, Sandia Lab Report Concluded
Nuclear Stockpile Safety Review from the Mid-1970s Identified Four Weapons Systems that Needed "Time Urgent" Evaluation Because of "Nuclear Detonation Safety Concerns"
1986 Sandia Lab Study Found that, with Respect to "Fully Assembled" and "Combat-Ready" Nuclear Weapons, U.S. Could Not Claim "in an Absolute Sense, that We Take Every Action to Ensure their Safety"
National Security Archive Electronic Briefing Book No. 475 William Burr
Washington, D.C., June 9, 2014 – A recently declassified report by Sandia National Laboratory, published today by the National Security Archive, provides new details on the 1961 Goldsboro, North Carolina, nuclear weapons accident. Both multi-megaton Mk 39 bombs involved in the mishap were in the "safe" position. Yet the force of the crash initiated mechanical actions that normally required human intervention. In both cases, the "fuzing sequence" had begun: an important step toward arming a nuclear bomb. Weapon 1, the one that came closest to detonation, landed intact, but by the time Weapon 2 hit the ground, it was in the "armed" setting because of the impact of the crash. The arming switch that had prevented Weapon 1 from detonating was in itself highly vulnerable. The Goldsboro incident is an alarming example of the great danger inherent in nuclear accidents.
Since the advent of the nuclear age, the nightmarish possibility of an accidental detonation has made weapons safety a boiler-plate item in the U.S. nuclear weapons program — yet potentially serious errors continue to occur. A series of 2013 reports on the Goldsboro accident provided a fresh reminder of the role of luck in preventing nuclear disaster: the same switch involved in the 1961 event had failed in other incidents.[1]
Eric Schlosser's extraordinary book Command and Control Nuclear Weapons, the Damascus Accident, and the Illusion of Safety, raises important questions about the record of nuclear weapons safety in the United States during and after the Cold War. Two major studies by Sandia National Laboratory, cited by Schlosser in his book, have been recently released by the Department of Energy in response to National Security Archive Mandatory Declassification Review requests and are included in this publication. Both are demanding studies which require attentive readers. One is a 1959 study of nuclear weapons safety when experts at the national nuclear laboratories were beginning to review the problem more comprehensively. The other is an overview of safety history published in 1987 which reviews the impact of changing weapons design on safety policy, the impact of accidents on policy, and initiatives taken by experts at Sandia to improve safety.
Also included in today's posting are recently declassified Joint Chiefs of Staff documents from early 1958 which address a problem that increased apprehensions about safety: the introduction of sealed-pit nuclear weapons into the arsenal. Embedding plutonium pits or highly-enriched uranium in the bombs or warheads themselves, unlike previous nuclear weapons where fissile material capsules were kept separate until arming occurred, this development made the weapons ready for use but created new vulnerabilities, including greater contamination risk. While the Joint Chiefs of Staff dismissed the risk of an accidental detonation — special features on the weapons allegedly made the probability a "negligible factor" — sealed-pit weapons would figure in the major accidents of the following years, including Jonesboro (1961), Palomares, Spain (1966) and Thule, Greenland (1968), where they would do considerable environmental damage.
Some of the highlights of the documents:
- A memorandum of conversation involving President Dwight D. Eisenhower, JCS Chairman Nathan Twining, and British Prime Minister Harold Macmillan in which the two Americans made optimistic statements about weapons safety. Atomic Energy Commission chairman Lewis Strauss soon asserted that those statements did not address the conditions that would emerge when sealed-pit weapons entered the stockpile. He presciently observed that "In case of [high explosives/HE] detonation on crash there would be plutonium scattered outside of the HE danger area, and this might necessitate evacuation of personnel and even clean-up operations."
- A statement in one of the JCS papers laid out the requirement that made future accidents possible by SAC bomber aircraft flying sealed-pit weapons: "A portion of SAC must be kept on continual alert status fully armed and ready for instant implementation of emergency war plans."
- A declassified State Department letter from early 1958 indicating a growing risk of accidents in the European Command area because of the eventual "saturation" of nuclear stockpiles.
- According to a Sandia Laboratory 1959 study, the Cold War goal of keeping nuclear weapons in a high state of readiness meant that safety was "fundamentally a matter of playing percentages." This meant that "absolute" nuclear safety was illusory and that giving ground "safety-wise" was necessary in order to have "useful" weapons.
- According to the same report, one of the dangers of an accidental nuclear detonation was that it could produce "public and diplomatic reactions leading to disastrous curtailment of military readiness and nuclear capability." Even worse, "an accident might be mistaken for the opening round of an unannounced nuclear war."
- A safety policy review performed in the late 1960s developed risk criteria for accidental nuclear detonations: in either "normal" or "abnormal" environments (where an accident had occurred) the annual risk of such an accident would be no greater than one in a million for an arsenal of ten thousand weapons or more.
- Studies at Sandia Laboratory of stockpile safety in the mid-1970s identified four nuclear weapons systems which needed review on a "time-urgent basis because of nuclear detonation safety concerns."
- The author of the 1986 safety policy history asserted that "the perceived need to keep weapons fully assembled and deployed on combat-ready systems … prevents us from claiming, in an absolute sense, that we take every action…. to ensure their safety."
THE DOCUMENTS
Documents 1A -C: Introduction of Sealed-Pit WeaponsA: Note by the Secretaries to the Joint Chiefs of Staff on the Exercising of Special Munitions, 5 March 1958, J.C.S. 2019/287, with letters, memoranda, and memorandum of conversation attached, Top Secret, Excised Copy
B: Report by the Joint Strategic Plans Committee to the Joint Chiefs of Staff on Custody, Maneuver, and Exercise of Special Munitions, 21 March 1958, J.C.S. 2019/290, Top Secret, Excised Copy
C: "Briefing for the President on SAC Operations with Sealed-Pit Weapons," [29 August 1958], Top Secret, Excised copy
Sources: A and B: National Archives, College Park, Md, Records of the Joint Chiefs of Staff, Record Group 218, Files of Chairman Admiral Arthur Radford, box 16, file 471.6 (8-15-45) ; C: Dwight D. Eisenhower Library, Office of White House Staff Secretary, Defense Department Series, box 1, Defense Department, Vol. II (9), also available on Digital National Security Archive
These reports show how civilian and military officials began to focus on the safety problems raised by sealed-pit weapons. When President Eisenhower and JCS Chairman Twining spoke with British Prime Minister Macmillan about nuclear safety they were not aware that a new nuclear weapons design was being introduced into the arsenal that raised new safety concerns. AEC director Lewis Strauss raised them, including the risk of contamination caused by the detonation of high explosives (HE), which were already being discussed in the military. The Strategic Air Command had plans for routine nuclear-armed airborne alert operations in the works which prompted new safety issues over and above those already raised by air and ground transportation of nuclear weapons.
The Joint Chiefs wrote assuring words that the risks of an inadvertent detonation by sealed-pit weapons were reduced to a "negligible factor" because of the existence of various safety controls and the "four separate control mechanisms" needed to detonate a weapon. Some months later, when President Eisenhower received a briefing on sealed-pit weapons, the briefing officer asserted with great confidence that "the probability of an inadvertent nuclear detonation of a sealed-pit weapon with proper safety controls is extremely remote-in fact, it approaches zero."
The two JCS documents (as well as the sealed-pit briefing) have numerous excisions, some of them describing the safety arrangements (spelled out in detail in documents 2 and 3 below), but also technical terms describing types of nuclear weapons. Some of the excisions are probably references to "two-stage" thermonuclear weapons (the detonation of an atomic bomb "primary" [stage one] ignites the "secondary" [stage two] producing a thermonuclear reaction). For example, document 1A at page 6 of the PDF cites the Mark 39 Mod 1 thermonuclear weapon (hydrogen bomb) as being in the "[excised] configuration." The two-stage Mark 39, which contained highly-enriched uranium in its primary, came dangerously close to detonation during the 1961 Goldsboro incident. A number of the excisions, such as document 1B at page 9 of the PDF, read like, and have enough characters to be, "sealed-pit", but this is a puzzle because the term sealed-pit appears elsewhere in these documents.
Document 2: Letter from George S. Vest, Office of the Political Adviser, U.S. European Command, to B. E. L. Timmons, Bureau of European Affairs, 12 March 1958, Secret
Source: National Archives, College Park, Record Group 59, Department of State Records, Office of European Regional Affairs. Politico-Military Numeric Files, 1953-1962, box 7, Safety
A recent nuclear mishap at the U.S. Air base in Sidi Slimane, Morocco raised consciousness among U.S. officials about the possibility of future incidents. George Vest, a political adviser at the U.S. European Command, noted that as Western Europe "becomes saturated with nuclear stockpiles, the chances of accidents will naturally increase." Most would not occur on U.S. bases but when, for example, an Air Force plane carrying nuclear weapons "overshoots" the base at Rhein-Main. U.S. diplomats must be prepared and so should local officials.
Document 3: Sandia Corporation, with the Advice and Assistance of the Los Alamos Scientific Laboratory and the University of California Ernest O. Lawrence Radiation Laboratory, A Survey of Nuclear Weapon Safety Problems and the Possibilities for Increasing Safety in Bomb and Warhead Design , RS3466/26889, February1959, Secret, Excised copy
Source: Mandatory declassification review request
The problem that concerned George Vest — the growing risk of accidents caused by the eventual saturation of nuclear weapons stockpiles — also worried scientists at U.S. nuclear laboratories. Apparently drafted by Carl Carlson, then a young physicist at Sandia, this demanding and highly technical study is a "summary of studies and investigations" that had been conducted partly in response to a Defense Department request but also because of concern about the introduction of sealed-pit weapons into the arsenal.[2] As the author notes, the sealed-pit weapon was a "new species," which "contributed to increased military concern on the safety question." Also making an appraisal of safety policy essential was the fact that growing absolute numbers of nuclear weapons increased the risk of an accidental detonation. A nuclear weapons disaster could produce "public and diplomatic reactions leading to disastrous curtailment of military readiness and nuclear capability." Even worse, "an accident might be mistaken for the opening round of an unannounced nuclear war." Thus, to minimize the "probability of a nuclear disaster," it was necessary to apply "science, art, and intelligence."
Carlson's report shows how nuclear safety policy began to take shape in the late 1950s, when the growing size of the U.S. nuclear arsenal encouraged senior defense officials and lower-level scientific experts to press for more systematic review of safety issues. Carlson reviewed the problem systematically, collecting accident data from recalcitrant armed services and assessing normal and abnormal hazard risks, which he defined in some detail, from risks of a launch of an armed bomb or missile (normal hazard) to detonation by an "overzealous" officer or accidental spontaneous nuclear detonation, both in the category of abnormal hazards. The risk of spontaneous detonation (exclusive of human error), Carlson rated at 10-8, or one in a hundred million.
At the time of this report the idea of one-point safety was beginning to take hold — nuclear yield would not be produced in the event of an accidental detonation at a given point in the weapons' high explosive components — and it eventually became a requirement.[3] But this study shows how much more there was to the problem than one-point safety. An important chapter focuses on the role of electrical systems in preventing the accidental arming and release of nuclear weapons — for example, the T-249 on-off/arming switch, which was then the "almost universal aircraft monitor and control box." Installed on a panel near the weapon, the T-249 played a key role in the Goldsboro NC incident a few years later.[4] According to Carlson, the Air Force had plans underway to make the T-249 more secure by putting it under lock and key, but other fixes were under consideration, including a "war-peace" switch behind a glass barrier (like a fire alarm) and remote-control arming. Through these and other means, Carlson believed it important to make the weapons resistant to human error or "gross human misconduct, sabotage, and impulsive or psychotic actions." To reduce the opportunity for "human activity" around "critical bomb and weapons assemblies," Carlson favored the concept of a "wooden" bomb that was sealed and tamper-proof. Nevertheless, he believed that military readiness requirements meant that absolute safety was impossible and that it was necessary to "play the percentages," as "uncomfortable" as that was.
Carlson made two basic recommendations. One was the establishment by the Pentagon of a "uniform" policy treating the "safety problem in its entirety, in terms of all hazards, their causes their relative likelihood, and the severity of their consequences." The other was that the Defense Department establish a channel that relayed information on all accidents and incidents to the AEC. Whether and when such a channel was created needs to be learned, but the 1987 Sandia historical overview of nuclear safety suggests that a "uniform" policy remained a work in progress for decades after 1959.
Document 4: Letter from Commander-in-Chief Strategic Air Command General Thomas Power to Air Force Chief of Staff Thomas White, 27 February 1959, Secret
Source: Library of Congress, Manuscript Division, Thomas D. White Papers, box 27, Command-SAC
In this letter, CINCSAC Power found the possibility of an accidental detonation to be "extremely remote," in part because he was confident of the safety arrangements on SAC bombers, including mechanical and electrical controls in the cockpit and the "Two-Man Policy." Nevertheless, Power was dissatisfied with some of the safety controls, such as lanyards used to extract the safing pins (special pins that have to be pulled from the mechanism as part of the arming process) and proposed arrangements that he believed would be more advantageous operationally. Exemplifying Carlson's point about the relationship between safety and military imperatives, Power highlighted the importance of "a point of balance" between safety and "weapon reliability and quick reaction time."
Document 5: J. M. de Montmollin and W. R. Hoagland, Sandia Corporation, "Analysis of the Safety Aspects of the MK 39 MOD 2 Bombs Involved in B-52G Crash Near Greensboro, North Carolina," SCDR 8-81, February 1961, No classification markings, excised copy
Source: FOIA request
The Goldsboro B-52 crash prompted an investigation by experts from Sandia, Los Alamos, and the AEC's Albuquerque Operations Office (ALO). Subsequently, some of the weapons components were taken to Sandia for further analysis, which led to a detailed report on what happened to both MK 39 bombs during the accident. According to the report, the impact of the aircraft breakup initiated the fuzing sequence for both bombs. For example, on Weapon 1, the crash yanked the safing pins from the Bisch generator which provided electric power to the weapon. Moreover, the lanyards (that General Power had proposed scrapping) actually pulled the safing pins from the weapons. Weapon 1, which landed essentially intact, was in the "safe" position when it dropped, preventing detonation. The T-249 Arm/Safe switch worked exactly as it was supposed to, preventing a nuclear explosion. Nevertheless, the incident deeply worried Secretary of Defense Robert McNamara: a few years later, he observed that "by the slightest margin of chance, literally the failure of two wires to cross, a nuclear explosion was averted."[5]
The report provides significant information on Weapon 2. It landed in a free-fall. Without the parachute operating, the timer did not initiate the bomb's high voltage battery ("trajectory arming"), a step in the arming sequence. While the Arm/Safe switch was in the "safe" position, it had become virtually armed because the impact of the crash had rotated the indicator drum to the "armed" position. But the shock also damaged the switch contacts, which had to be intact for the weapon to detonate. While Weapon 2 was not close to detonation, the fact that the physical impact of a crash could activate the same arming mechanism that had kept Weapon 1 safe showed the danger of such accidents.
The faulty operation of the lanyards worried the analysts. A modification program, ALT 197, was already underway to remove them and the analysts recommended rapid implementation of this change to all weapons in the "MK 15/39 family" involved in the airborne alert program.
Document 6: R. N. Brodie, A Review of the U.S. Nuclear Weapons Safety Program- 1945 to 1986, Sandia National Laboratories, SAND86-2955, February 1987, Secret/Restricted Data, Excised copy
Source: Mandatory declassification review request
This demanding and technical Sandia nuclear safety study focused on the impact of changing weapons design, major accidents, and the weapons systems safety organization at Sandia Laboratory. Before the introduction of sealed-pit weapons, safety was achieved in a "visible and almost absolute manner by ensuring that the fissile material was kept physically separate" from the high explosives. But when sealed-pit weapons entered the arsenal, safety policy did not adequately or immediately address the problems they raised, leading government officials to take "frantic" efforts to remedy some of them.
Several accidents later — Brodie provides an overview of the major episodes of the 1960s, including the Jonesboro accident — a "new" approach was taken and basic criteria for nuclear safety were reconsidered. That review established a new standard: that in either normal or abnormal environments (in the event of an accident), the annual risk of detonation would be no greater than one in a million for an arsenal of ten thousand weapons or more. To mitigate risks, safety experts developed new design safety concepts and techniques to reduce the danger of contamination by using "insensitive high explosives."
Whatever was done after 1968 was not enough because in the mid-1970s Sandia experts identified new problems, notably that some weapons on continuous alert might be unsafe in "abnormal" environments. A formal review of stockpile safety found that for all weapons it was not possible to predict the "probability threshold for a nuclear detonation" in certain "abnormal environments." It was not even possible analytically to show "how 'unsafe' a weapon was." That level of uncertainty could lead to the conclusion that the whole stockpile had to be replaced, but senior officials concluded that because an accidental detonation had not occurred it was acceptable to "do more studies" and gradually improve the situation as better weapons became available. Experts at Sandia found this "laissez-faire" approach disturbing and prepared new studies identifying which weapons should be retired or retrofit and modified because of "nuclear detonation safety concerns." Four weapons — the B-28 bomb, Nike-Hercules, Genie, and the B53 — needed to be addressed on a "time urgent" basis. The Defense Department accepted the recommendations in principle in 1979, which led to changes that put the stockpile in an "improved safety position." Nevertheless, the same four weapons remained a concern.
Among Brodie's conclusions was that as long as the Pentagon found it necessary to deploy nuclear weapons "fully assembled and deployed on combat-ready systems" it could not be claimed that "in an absolute sense, that we take every action… to ensure their safety." Indeed, the existence of assembled nuclear weapons meant the existence of a "nonzero probability that it could be unintentionally detonated." Thus as long as nuclear weapons were "deployed on ready-alert systems," the burden of preventing accidents and incidents would mainly fall on safe weapons design. "Constant vigilance" was essential to prevent nuclear weapons accidents.
Document 7: James Miller, U.S. Department of State, Office of the Historian, Nuclear Accidents at Palomares, Spain in 1966 and Thule, Greenland in 1968, Historical Research Project No. 1421, April 1985, Secret, Excised Copy [originally posted on Unredacted]
Source: FOIA request
This study covers two major nuclear accidents and their consequences: the B-52 crash near Palomares, Spain and Thule, Greenland in 1966 and 1968 respectively, which cumulatively triggered the safety review described in Document 6, above. Both involved nuclear armed B-52 bombers on routine airborne alert patrols.[6] In the former accident, a bomber crashed into a KC-135 refueling tanker midair over the coastal village of Palomares. Seven crew members were killed and HE in three of the weapons exploded, causing plutonium contamination. One of weapons went missing in the Mediterranean until divers recovered it. In the Greenland accident, where a B-52 crashed on an ice-covered bay near Thule air base, four nuclear weapons broke up, scattering radioactive debris widely. One crew member was killed while others ejected safely.
Both accidents posed difficult public relations challenges for the U.S. government which followed a strict "neither confirm nor deny" policy on its overseas nuclear deployments. Thus, goaded by inquisitive journalists, but complying with Spanish government requests to avoid the nuclear aspect, Air Force press officers went through contortions to acknowledge that "the thing that is not a bomb" had still not been found.[7]
Prepared in 1985 by James Miller, then with the Office of the Historian at the State Department, this report was commissioned by the Department's Bureau of Politico-Military Affairs, which wanted to know if any lessons could be learned from the accidents. According to Colonel Michael Barrett Seaton, a Bureau official who wrote the foreword, overseas U.S. nuclear deployments were a "fact of life," and the risk of accident was always present. Thus, U.S. officials believed that "the degree of damage to U.S. national security from any future nuclear accident or incident would depend in large part on the quality of U.S. Government and host government management of the emergency." In this connection, Seaton found Miller's study helpful because it provided "insight" into the demands that an accident could make on U.S. embassy staffs.
After a FOIA appeal, a State Department panel declassified most of the previously withheld information, as indicated by gray areas on the document. This included substantial portions of the foreword, information on the post-accident cleanup at Palomares, diplomatic negotiations over U.S. nuclear access, and the supporting documents appended to the history.[8] The appeals review panel left two excisions; both relate to the Thule incident (see PDF page 21). One is of a statement made by a U.S. official to a Danish diplomat a few days after the crash; the other concerns the search and clean-up efforts afterwards. The second deletion may relate to a missing piece of one of the H-bombs — what Danish scholar Svend Aage Christensen calls the bomb's "spark plug," the uranium-235 in the weapon's second stage or "secondary." Despite strenuous underwater search efforts, the "spark plug," around the size of a "marshal's baton," was never found. A BBC story suggested that only three of the four bombs were destroyed and that an entire H-bomb may have gone missing, but Christensten's fascinating study for the Danish Institute of International Affairs convincingly argues otherwise.[9]
NOTES
[1] For an earlier account of the Goldsboro accident, see Chuck Hansen, Swords of Armageddon at pages 274-276 of PDF, For a useful discussion, see "The Full Story Behind the Goldsboro Incident."
[2] Eric Schlosser, Command and Control: Nuclear Weapons, the Damascus Accident, and the Illusion of Safety (Penguin, 2013), 172-173 (and sources cited on page 527).
[3] For origins of one-point safety concept and early problems, see Schlosser, Command and Contro, 163-164 and 197-198. See also Alex Wellerstein's blog posting, "Accidents and the Bomb," Restricted Data.
[4] Schlosser, Command and Control, 245-246.
[5] See second page of image. McNamara is quoted by Schlosser at 301, but see also, Wellerstein, "The Final Switch: Goldsboro, 1961," Thanks to Alex Wellerstein for advice on interpreting of the Sandia report.
[6] For useful background on SAC airborne alert and the Palomares and Thule accidents, see Scott Sagan, The Limits of Safety: Organizations, Accidents, and Nuclear Weapons (Princeton, 1993), 156-198. The reason an accident took place at Thule was that SAC had a standing arrangement to fly a B-52 every hour of the day over the ballistic missile early warning station at Thule. In case the station went off-line because of an attack, the bomber could warn headquarters what had happened.
[7] See endnote 17 at pages 21-22.
[8] Apparently, the State Department could not find some of the documents because several items described as appendices in the endnotes do not show up in the attached material.
[9] Svend Aage Christensen, The Marshal's Baton: There Is No bomb, There Was No bomb, They Were Not Looking For A Bomb, (Copenhagen, DIIS, 2009).
This posting has been modified in light of information received from Eric Schlosser. The editor had interpreted the 1961 Sandia report on the Goldsboro incident as implying that "Weapon No. 2" was closest to detonation. In fact, it was "Weapon No. 1" that was the truly close call.
