Sandia Official: Risk of Nuclear Accident “Cannot be Zero”
Dept. of Energy Restricted Distribution of Safety History; Reclassified as Secret
Air Force Resented Implications of “Goofproof” Nukes
Washington, D.C., November 18, 2022 - A top safety official at a U.S. nuclear weapons lab wrote that “the public must be encouraged to realize that risks [of an unintentional nuclear detonation] cannot be zero and cannot ever be really known,” according to a newly released 2001 history of U.S. efforts to mitigate the dangers of accidental or unsanctioned weapons detonations. Declassified in response to a Freedom of Information Act (FOIA) request by the National Security Archive, the history, written by former Sandia National Laboratories official William L. Stevens, describes years of efforts to remedy problems associated with the “sealed-pit” nuclear devices that were central to the U.S. stockpile and the possibility that “severe environmental insults” to such a weapon could induce a detonation.
The possibility of a mistaken or unauthorized detonation, like the risk of unintentional or accidental war, is inherent in the nuclear weapons enterprise. So far, the world has been lucky that such an incident has not occurred, even during the years when the U.S. and the Soviet Union had large stockpiles of nuclear weapons and the U.S. had many deployed overseas. In that context, the risk of seizure and the possibility of unauthorized or accidental use influenced systematic efforts to tighten controls over the U.S. nuclear arsenal, which Stevens recounts in revealing detail.
Stevens’ history sheds light on the many episodes where flaws in the design of weapons, from Pershing II to Short-Range Attack Missiles (SRAM), impelled safety experts to try to reduce risks. His analysis includes some well-known events that illuminate the dangers of nuclear weapons accidents and the need for safety programs, such as the crashes of B-52 bombers in North Carolina, Spain and Greenland during the 1960s, where weapons variously went missing, were destroyed (scattering plutonium about) or were at risk of detonating. Those bombers carried sealed-pit thermonuclear weapons in which the fissile material, surrounded by a shell of high explosives, was built into the weapon, meaning that an accident could cause deadly plutonium dispersal.
Today’s posting includes five documents recently declassified by the U.S. Department of Energy’s National Nuclear Security Administration. One is an October 1961 report from the Sandia Corporation, which managed Sandia Laboratory, on the challenges associated with the safety and control of the new sealed-pit weapons that were then being deployed, often on a high-alert status. In that context, Sandia and other labs were concerned about equipment malfunctions (“never assumed to be negligible”), environmentally induced equipment failures, accidental human actions, and the deliberate unauthorized use of the weapons.
The second document is a lengthy study prepared by former Sandia official Stevens on the history of Sandia’s role in nuclear weapons safety, security and “use control” (“collectively called S2C”), and the long-term effort to discover and mitigate the risks of accidental and unauthorized detonations. In Eric Schlosser’s groundbreaking book, Command and Control, Stevens is a critically important figure, and Schlosser calls the Stevens report “the best and most thorough history of nuclear weapons safety.” The NNSA released this and the previous report in response to a FOIA request submitted by the Archive in March 2014.
Three additional documents in this posting were released by NNSA in 2021 in response to a FOIA request by Government Attic. Documents 3 and 4 are Sandia reports on a notorious nuclear weapons accident in January 1961, the Goldsboro, N.C., incident, while Document 5 describes a December 1964 incident at a Minuteman missile site in South Dakota. Originally published in a large PDF file by Government Attic, the reports deserve wider circulation due to their significant interest.
The February 1961 reports on the Goldsboro incident provide far more detail than in earlier releases, detailing the sequence of events during this famous near-miss episode. The information in both reports confirm the subsequent Sandia evaluation that the only thing that “stood between the United States and a major catastrophe” was the fact that one of the main control switches was set to a “safe” setting.
The January 1965 report on the Minuteman accident includes new detail on an event in which a reentry vehicle containing a nuclear warhead “was dislodged and fell approximately 75 feet to the floor of the silo.” As dangerous as the initial accident was, there was also concern that “improper removal” of the warhead could have had “serious consequences.”
To assure its widest possible distribution among government nuclear weapons specialists, Stevens intended his study of S2C activities to be classified at the lowest possible level (Official Use Only). As it turned out, however, what he wrote was so detailed that Sandia distributed it at a higher level of classification. To ensure wider distribution, Stevens prepared a “pared down” version of the report (again classified as Official Use Only), but his efforts were thwarted by the Department of Energy (DOE), which upgraded the classification to Secret/RD (Restricted Data) or FRD (Formerly Restricted Data, concerning military applications of nuclear weapons). While DOE does have the authority to change the classification of the report, the fact that it was originally classified at a far lower level raises questions as to whether the excised portions are truly sensitive and whether the reclassification was an appropriate use of DOE’s authority.
One nuclear risk illuminated by Stevens’ history is the “POPCORN” phenomenon—a recuring concern during the 1960s and 1970s that some weapons were vulnerable to accidental detonation that could, like popcorn, trigger the detonations of other nearby weapons, such as multiple weapons carried on a bomber or weapons kept together during transport or while in storage. The “initiating events [would be] either accidents or the intentional detonation of the HE [high explosive]” in an “Emergency Destruction” situation, during which special procedures would be initiated to destroy weapons before adversaries could seize them. Scientists at Los Alamos Laboratories considered the POPCORN problem in 1960 and again in 1975, when a letter to the Atomic Energy Commission declared that “there may be a problem.” The POPCORN issue has been discussed with reference to British weapons, but the U.S. debate is little known.
Stevens’ history also recounts the complex, sometimes difficult, relationships between and within military and civilian organizations and their conflicting priorities. For example, engineers at Sandia developed the concept of Environmental Sensing Devices (ESDs) that would perform the final steps necessary to arm a nuclear weapon, such as the closing of electrical circuits. In ballistic missiles the ESDs would close circuits during the launch phase in order to reduce the risk that an accidental move could arm the weapon. Stevens noted that when Sandia officials explained ESDs to the military they showed some insensitivity by labeling ESDs as “goofproofers” for protection against “procedural errors on the part of weapon handlers.” According to Stevens, Air Force officers “bluntly informed” Sandia managers that they “had no ‘goof off’ personnel despite [the] apparent accusations.”
Stevens also narrates how some senior officials dodged safety concerns about specific weapons and how intervention by Congress and leaks to the press eventually forced the agencies to confront the issue. By the 1980s, according to a DOE panel, “attention to safety [had] waned.” Illustrating the problem were “evasive actions” taken by senior Pentagon and Energy Department officials to sidestep questions raised about the safety of the W69 nuclear weapons installed in SRAMs carried on B-52 bombers. By 1989-1990, however, with Senator John Glenn (D-OH) becoming interested and Sandia Lab directors testifying before Congress, barriers to information flow started to break, especially after the Washington Post exposed the issue. By the end of 1990, Secretary of Defense Richard Cheney addressed the problem by ordering a permanent ban on the peacetime loading of the W69/SRAM on alert B-52s.[1]
As part of their work routine, Sandia staff participated in investigations and post-mortems on nuclear weapons accidents. The third document in today’s posting is a new release, acquired in 2021 by Government Attic, of a February 1961 Sandia report on the crash of a B-52 in Goldsboro, N.C., during which two high-yield nuclear weapons were dropped in the surrounding countryside. While a previously released version of the report was massively excised, this release includes newly declassified details about one of the most famous close calls in the history of nuclear weapons accidents. The fourth document published today is another Sandia report on Goldsboro, by H. D. Bickelman, which was not previously available before Government Attic published it last year.
Both reports provide significant new details on the circumstances surrounding the two MK 39 bombs that fell from the B-52 as it broke apart. Both make a similar point: that what prevented the detonation of one of the weapons was the fact that the “Arm/Safe Switch” was “in the safe condition at time of release.” Apart from that, the weapon went through the normal arming sequence as it fell to earth.
The fifth document is a Sandia report, also requested by Government Attic, on an accident that occurred in a Minuteman I silo on December 5, 1964. While much has been learned about the incident from previous declassifications, this report reveals that Sandia staff also saw great potential for risk in a poorly executed post-accident recovery procedure. According to the report, a “serious” mishap, if not an actual detonation, could have occurred during the recovery process if technicians had not taken special care to ensure that the reentry vehicle and the warhead were isolated from static and other electricity.
Problems with nuclear weapons security have continued to bedevil U.S. civilian and military authorities. In 2007, the U.S. Air Force accidentally shipped six nuclear-armed cruise missiles from Minot Air Force Base to Barksdale Air Force base where they sat unguarded for hours, an incident that eventually led to a major shakeup in Air Force leadership. In 2014, lax security at a NATO nuclear weapons depot was disclosed when anti-nuclear activists easily breached the perimeter of Vokel Air Base in the Netherlands. While not a nuclear event as such, the accidental firing of an Indian supersonic missile into Pakistan on March 9, 2022, showed the grave risk that such incidents could spark a wider conflict. Whether Sandia or the other DOE laboratories have continued to update older studies and review risks associated with specific nuclear weapons systems, such as those that Stevens identified, may someday be learned through additional declassifications.
Note: Thanks to Eric Schlosser for his counsel during the preparation of this posting and to Government Attic for securing the release of crucial documents on nuclear weapons accidents.
Document 1
Department of Energy FOIA release (under appeal)
In 1959, Sandia, with the cooperation of Los Alamos and Lawrence Radiation Laboratory, produced a report that Williams L. Stevens called the Atomic Energy Commission’s “first manifesto” on nuclear safety. That report looked closely at the issues raised by sealed-pit nuclear weapons, their implications for nuclear safety, the terrible risk of an accidental detonation, and the need for improvements in electrical systems to maximize safety. The risks associated with sealed-pit weapons were compounded as growing numbers of them were deployed overseas and put on high alert, especially Strategic Air Command airborne alert. With allied forces about to receive training on how to use U.S. nuclear weapons deployed in their countries, a new risk was getting attention: that of “deliberate, unauthorized human actions” that could lead to nuclear detonations.
Those problems provided the stimulus for what Stevens called the “second nuclear safety manifesto,” published in October 1961. The report was drafted by Delfred “Del” Olson, Sandia’s chief manager on nuclear safety, but William L. Stevens took the lead in finishing the document after Olson was “loaned” to Atomic Energy Commission (AEC) headquarters. The report reviews the problem of unauthorized actions but also covers the possibility of spontaneous equipment malfunctions (“never assumed to be negligible”), environmentally induced equipment failures and accidental human actions. Among other things, the report recommends the implementation of a “two-man rule” (“no single individual allowed access to a weapon”) and the introduction of coded control systems to prevent unauthorized use. It also spells out “principles” for ensuring “adequate nuclear safety,” such as maintaining the “isolation” of detonators from energy sources and other “critical components.”
In his history of nuclear safety at Sandia, Stevens wrote, perhaps overmodestly, that his “personal technical contribution” to this report was “limited to recognizing an Achilles heel in protection against deliberate, unauthorized human actions.” The manuals and technical training provided to military personnel were so comprehensive Stevens feared they could give a bad actor too much insight on how the weapons worked, leading him to recommend a more restricted distribution of manuals with fewer unnecessary details.
Document 2
Department of Energy FOIA release (under appeal)
Organization of the Stevens Report:
PDF pages 2-15: Front Matter Including Table of Contents
PDF pages 16-21: Part I: Introduction
PDF pages 22-45: Part II: The Early Years (1945-1960)
PDF pages 46-69: Part III: The Worldwide Deployments Years, 1960-1963
PDF pages 70-81: Part IV: The Level-of-Effort Years, 1964-1968
PDF pages 82-109: Part V: Advent of Enhanced Nuclear Safety Designs, 1968-1972
PDF pages 110-149: Part VI: The Decade of Exercise of Dual Agency Responsibilities, 1973-1983
PDF pages 150-181: Part VII: The Challenge to Dual Agency Responsibilities Agreements, 1983-1994
PDF pages 182-197: List of References
PDF pages 198-275: Appendices A-M
PDF pages 276-283: Index
PDF pages 284-286: Distribution
After some 30 years working on nuclear weapons safety and control problems, William L. Stevens retired from Sandia in 1985 at which time he received the Energy Department’s Weapons Program Award for Excellence for his contributions. As a consultant he prepared a long and detailed study on the lab’s role in these issues since the 1950s, with an emphasis on the policy and management areas in which he was actively involved. As Stevens puts it, “The style of presentation is personal, informal and candid, citing specific contributions of named persons.” Stevens also identifies individuals with whom he had running conflicts on weapons safety issues or who otherwise evaded safety responsibilities.
The narrative includes over a hundred short chapters with documentary appendices and a list of over 200 Sandia and other reports cited as references. This list is of special interest as it includes many important, although still classified, reports on a range of issues, from the invention of Permissive Action Links to tensions with the military over weapons safety.
Owing to the great variety of work performed by Stevens at Sandia, this history is not easily summarized. Its wide range notwithstanding, a complete history would require more detail on the roles and perspectives of other organizations, such as AEC/DOE headquarters, the Office of Secretary of Defense, and the military commands, among others. Nevertheless, given Stevens’ central role at Sandia for many years, and his dedication to safety concerns, his perspective is a valuable and illuminating one.
In the abstract to his report, Stevens writes that “The focus is on the cultures that existed at the time, so current observers can better understand origins and evolutions.” Stevens does not explain what he had in mind by “cultures,” but his detailed portrait of Sandia’s role in nuclear weapons S2C illustrates the norms underlying why managers and staff did “certain things the way they did.” For example, what Stevens saw as Sandia’s commitment to civilian control of nuclear weapons could be seen as a central element of the culture. Another facet of the culture was Stevens’ view that the nuclear weapons mission was a “moral equivalent of war” and that it was “national policy ... to substitute nuclear weapons systems for massive deployments of conventional forces.”
Stevens does not elaborate on what he means by “moral equivalent of war,” but an implication is that war could not be fought with nuclear weapons. As he writes a few pages down, nuclear weapons were “special” weapons that were not an “alternative” to conventional forces because “the risks inherent in their existence are apart from the common.” Given that premise, rigorous arrangements for the safety, security, and control of nuclear weapons was an absolute necessity.
Stevens’ review of the spate of B-52 accidents during the 1960s—Goldsboro (1961), Palomares (1966) and Thule (1968)—makes few new revelations, although much of the section on Goldsboro has been excised. But it is the information on less well-known episodes and developments, some of them mentioned earlier, that makes this history especially valuable. For example, Stevens recounts the early history of Permissive Action Links (PALs). Initially called Prescribed Permission Links, the special technology was developed to prevent unauthorized use of nuclear weapons deployed overseas. Stevens also provides insight into the story of the Nuclear Emergency Search Team (NEST), identifying the officials who played lead roles in creating it and revealing the name of the Team’s first “major” field exercise: Giller I (1974). The author provocatively observes that, by 1975, NEST had experienced “two real-life partial responses,” not identified further, but perhaps discussed in the classified version of this history.
Also of interest is a discussion of changes in Aircraft Monitor and Control (AMAC) technology, the switches used in Strategic Air Command (SAC) bombers to arm nuclear weapons before their use. Stevens includes information about the origins of the “T-380 Readiness Switch” or “War-Peace Switch” (erroneously designated as T-280) designed to prevent “inadvertent release” of bombs from SAC aircraft. The bombers already had the T-249 switch (and its replacement, the T-249A), which controlled arming and delivery mode (airburst, ground burst), but safety experts wanted additional security because they thought it was “too easy to arm a bomb.” The T-380 switch was a “new bomb arming control feature” that would be mounted in the cockpit separately from the T-249A. In a practical application of the two-person rule, the new switch made it necessary for “a second responsible crew member to affirm intent to release a nuclear bomb from an aircraft.” The January 1961 B-52 accident in Goldsboro, N.C., demonstrated how important such switches could be [See documents 3 and 4].
In an account of the early electrical subsystems used to initiate nuclear detonations, Stevens discusses special procedures developed by the Navy to maintain control over nuclear weapons on ships [PDF pages 25-26]. According to Stevens, “until relatively recently,” the Navy insisted on a “physically removable component” for weapons that a “local commander” would hold until a decision was made to fire the weapons. Perhaps this was a detonator that could be plugged into the weapon. As Stevens implies, this was not a one-size fits all solution: such a mechanical procedure was “intolerable” for submarine launched ballistic missiles because of the “penalty to readiness of the weapon system.”
In connection with SLBMs, Stevens recounts how a safety review of the Polaris A-3 missile, which carried three separate warheads, brought to light a technical capability for an unauthorized launch [see PDF p. 109]. The risk was that a “knowledgeable crew member [could] tamper with certain metallic shields protecting sensitive missile launch circuits to cause a powered flight of a Polaris missile.” While the Navy proposed changes to correct the problem, AEC official Richard M. Shay did not believe that they were enough, and Carl Walske, the Assistant to the Secretary of Defense for Atomic Energy, agreed. The Navy was eventually “required to make hardware and procedural changes to the fleet involving millions of dollars.” For his safety contributions, Shay received a “High Quality increase in salary.”
Another indicator of tensions with defense officials was the 1974 “Fowler letter,” signed by Sandia vice president Glenn Fowler, which made the case that seven air-delivered weapons systems had safety problems that made it necessary to retire or retrofit them [PDF pages 116-117]. When Sandia brought up these problems, the response at the Pentagon and the AEC was “mostly delaying actions.” Sandia staffers supported their case by displaying on a board “weapon hardware that had been subjected to severe abnormal environments (e.g., fire and crushing).” According to Stevens, when defense officials such as Military Liaison Committee chair Donald Cotter heard the “Burned-Board Briefing” they “reacted so angrily … that their comments defied reason.” They saw the Sandia presentation as a challenge to their management of the weapons stockpile.[2]
Stevens also recounts the debates over launch control for the Pershing II, the missile that figured in the Euromissiles controversies of the 1980s [PDF pages 148-149]. Stevens believed that the Army deployment plan for the Pershing II risked the possibility of a “deliberate uncontrolled launch” [DUL] in part because arrangements for Pershing II computerized launch exercises involved a countdown that stopped at one second before takeoff. The exercises were designed to prevent human error, but Stevens’ perception of a DUL caused him to officially dissent from the Army plan. Nevertheless, Army Captain John C. Wagner, who had Sandia experience and participated in the Pershing II project, found a solution to preclude risks of an unauthorized launch: the Pershing’s first stage would carry a “Safe and Arm” device operated by a coded signal.[3]
Document 3
Thanks to a FOIA request by Government Attic, in 2021 the DOE released new versions of reports concerning the Goldsboro accident along with other documents on safety issues. Among them is a far more complete version of Sandia’s February 1961 report, which includes a detailed analysis of what happened to the two bombs—each with an explosive yield of 4 megatons—that fell from a U.S. B-52 bomber as it broke up near Goldsboro, N.C., on January 24, 1961. Charts on PDF pages 7, 11, and 14 show the sequence of events for the “normal trajectory sequence” of a MK 39 bomb detonation and the actual sequences for the two weapons dislodged from the bomber during the accident. One bomb (“Weapon 1”) nearly became armed as centrifugal forces pulled the lanyards that connected the cockpit to the weapons. Several other devices, including the thermal battery, were activated when the weapon’s 100-foot parachute deployed. The fact that the device’s T-249 safety switch was at the “safe” setting prevented the detonation of a weapon that landed essentially intact. In contrast, the parachute did not open for the other bomb, “Weapon 2,” which meant that the bomb did not move further along in the arming process.[4]
Document 4
This Sandia report provides additional details on the Goldsboro accident, including a chart showing the layout at the crash site. In its analysis of the first weapon, the report finds that “The appearance here is that the tearing apart of the aircraft removed the safing pins from the Bisch generator arming rods and, from the point onward, the weapon went through a normal sequence of events in which detonation was prevented by the Arm/Safe Switch being in the ‘safe’ position.”
Document 5
This report looks at an accident that occurred on December 5, 1964, at the Lima II site near Vale, S.D., in the silo of a Minuteman I ICBM that was on high alert.[5] During a security check of the Minuteman’s electronics, the repeated removal and reinsertion of a fuse triggered one of the retrorockets, which are fired during flight to increase the distance between the reentry vehicle (RV) and the third stage. The RV and its 1.2 megaton W-56 nuclear warhead were dislodged in the explosion and fell 75 feet to the floor. Though damaged, a preliminary post-mortem later found there was “no reason to suspect that any of the warhead electrical components were actuated.” There was concern, however, about the “fractured” high explosives, which could have resulted in an explosion inside the silo, although later investigation “indicated no cracked HE and no deformation of the pit."
Officials at Sandia and Lawrence Radiation Laboratory (LRL) soon heard about the accident and arrived at the site the next day. The Air Force had requested their services but was ready to move the RV from the silo even without outside advice. An official from LRL advised the Air Force not to move the RV or the warhead until experts familiar with its design had arrived. Of particular concern to Sandia’s R. K. Petersen was that the RV be moved in such a way that it was “isolated electronically from the hoisting crane.” Rocket engineers were “alarmed” by the “possibility of static discharge” that could trigger a detonation. Technical measures ensured a safer procedure, and the RV was lifted to the surface in a nylon cargo net and then taken in a van to Ellsworth Air Force Base.
Among the report’s major conclusions was the danger of an “improper recovery procedure,” which could have had “serious consequences” given the warhead’s condition: “If not actually leading to a detonation, an improper procedure could perhaps have placed the nuclear system in a more critical state.” Accordingly, the report recommended that “the AEC laboratories respond, whether requested or not, at the first indication of trouble.”
The Minuteman accident has been the source of considerable interest, not least in South Dakota, where local media have followed the story over the years. After this report was declassified, it received publicity in the Rapid City area in September 2022 (and was also picked up in Australia).
[1]. The SRAM story is also recounted in Eric Schlosser, Command and Control: Nuclear Weapons, the Damascus Incident, and the Illusion of Safety (New York: Penguin Press, 2013), 453-455.
[2]. Schlosser, Command and Control, 369-370.
[3]. Ibid., 450-451.
[4]. Ibid., 246. For the critical importance of the ready-safe switch, see Sandia safety director Parker F. Jones’s 1969 report, “Goldsboro Revisited,” published by the Guardian in 2013 on the basis of a FOIA release to Eric Schlosser.
[5]. Schlosser, Command and Control, 310-311.