 |
|
 |
|
Charlie Simpson
© «AAFM», September 2006.
Our address: en@rvsn.info |
See also:
LOX and RP-1 - Fire Waiting to Happen «AAFM», September 2006. Newsletter of «Association of Air Force Missileers» .
Our early missiles, especially the first intermediate range and intercontinental ballistic missiles, used a cryogenic propellant for the oxidizer, a practice still used today for many space launch vehicles. For space launch, it is merely a matter of filling up the tanks with the propellants before launch while the missile sits on the launch pad and conducting the launch. For IRBMs and ICBMs, it was a much more complex situation. Reaction time, vulnerability, safety and maintenance were all concerns. Now the entire force of alert missiles consist of solid fueled missiles. The cryogenic oxydizer could not be loaded until immediately before launch. While the Atlas F and Titan I could sit in the silo with the kerosene based rocket propellant-1 (RP-1) on board the missile, oxygen in a liquid state (LOX) is at a temperature of minus 297 degrees Fahrenheit, so it must be stored in special insulated tanks - basically really big Thermos bottles. Once the LOX is loaded into the oxidizer tank of the missile, the missile had to be launched in a fairly short time because the liquid begins boil off - returning to the gaseous state. As you might expect, this combination is also extremely hazardous, so everything involved with the missile systems must be kept “LOX-clean” go prevent non-compatible materials from coming in contact with the extremely high oxygen content and causing a fire or explosion. However, in the late 1940s development of solid rocket motors was in its earliest stage, so liquid was the only way to go for large payloads. The Thor, Jupiter, Atlas and Titan I were all developed in the early to mid-1950s, and all were cryogenic systems. For the Thor, Jupiter and early Atlas (D and E models) the problem was a little less complicated because all of these systems sat - or laid - on alert in a horizontal position. When launch was directed, the missiles were raised to vertical launch position, filled with LOX and RP-1 and launched. The systems were a lot simpler than later silo based systems, but from the time the missile was raised until it was launched, the missile was sitting in the open unprotected from enemy attack. That period was usually several minutes - fifteen or more in most cases.
The Atlas F and Titan I both sat on alert in hardened silos, with the fuel (RP-1) stored on board the missile. When launch was directed, the first step of the launch process was to fill the missile with LOX, a process that could take up to eight or ten minutes. Then, the fully loaded missile, on its launch platform, was raised above ground - well over a one hundred foot lift of the missile - locked in place and launched. The loaded missile and elevator platform weighted over 550,000 pounds. Cryogenic missiles could not sit on alert with the oxidizer on board because of the boiloff of the extremely cold fluid. The missile could be topped off for a short time while still in the silo but once raised above ground, no more LOX could be added, and the missile had to be launched or lowered back to the silo and downloaded in a fairly short period.
All of the new Atlas and Titan missiles were exercised by the contractor at turnover with a dual propellant loading. It was an impressive sight to see all three Titan I missiles at a single site up and locked, full of RP- 1 and LOX, in the final demonstration of the system before the Air Force took control. Shortly after the turnover of the new systems, we began exercising them ourselves to develop reliability histories for the new missiles. Most units had just begun what we called a PLX - a propellant loading exercise - on Air Force owned missiles when the Cuban Missile Crisis of 1962 occurred. We quickly got every Atlas and Titan possible on alert and kept them there throughout the crisis. By the end of 1962, we had returned to the test program. Initially, SAC directed that we run ten consecutive PLXs on each missile, with the last two successful. When someone realized how long this would take with the force the size we now had, the program changed to just the second part, two consecutive successes on each missile. A PLX could be a single or a double propellant loading exercise depending on the system. Nuclear safety concerns meant we could not have RP-1, LOX and the reentry vehicle RV) all on board during an exercise. In Atlas, that meant removing the RV, because the missile had to be in stretch or pressurized if not full of propellants, For Titan I we normally removed the RP-1 and kept the reentry vehicle on the missile, loading LOX for the PLX. Preparation for each exercise took some time. Besides removing the fuel or RV, all of the explosive ordnance had to be removed - igniters, explosive bolts, staging rockets and other devices. Television cameras were placed in several silo locations to observe system function. Recovery after a PLX took as long - everything had to be returned to normal alert configuration.. We went through major modifications to the systems shortly after activation - the Red Heat program for Atlas and the Top Banana program for Titan. These mod programs were designed to fix some of the earlier shortcomings in the new missile systems. For example, in Titan I, there was a major change to the LOX loading systems designed to improve the safety and effectiveness of the fill and drain valves and connections. Working around LOX required a lot of care - safety and cleanliness were both prime concerns at all times. We thought we had what we called “hospital clean” silos until a major LOX spill at Mountain Home - everyone was amazed at how much dust was stirred up in the silo by the rapid expansion of the liquid into gas. We had breathing apparatus, sensors and a myriad of other safety equipment, and were careful in every task. We still made mistakes - some resulted in some serious accidents. Some were mistakes in design, some in judgement and some in procedure. We were working with a brand new, very complex and very dangerous system - and were the first to do it. Amazingly, none of the serious accidents resulted in death or injury. There were deaths and injuries during the construction phase, but once the Air Force began to operate the Atlas and Titan, none of these major events caused any.
One of the first big booms was one we have documented before in the AAFM Newsletter, with articles in the January 1996 issue. The Titan I Operational System Test Facility at Vandenberg was undergoing a dual propellant loading before a test launch. When the missile was being lowered back into the silo after the test, the braking unit failed, allowing the missile to rapidly fall to the bottom of the silo and explode, destroying the missile and silo but causing no injuries. There were other accidents in Titan I, including the loss of a missile at Mountain Home (see the January 1994 issue). We fired staging rockets in error, collapsed a few Atlas missiles, spilled LOX and RP-1 and other mistakes, but none were as serious as the accidents in Atlas F described later. During 1963 and early 1964, four serious accidents occurred involving Atlas F missiles, three at Walker AFB, NM and one at Altus AFB, OK. Each of these accidents destroyed the missile and made the silo unusable, and some said at the time that the accidents were a factor in the early phaseout of the Atlas F system. This article was put together using several sources, with much of the information taken from the congressional record of hearings on the accidents, titled “Series of Explosions of Air Force’s Atlas F Intercontinental Ballistic Missiles”, before the Senate Preparedness Investigating Committee in July and August 1964. Those testifying included BGen William Bacon, the commander of the 22nd Strategic Aerospace Division with some of his staff, BGen William Campbell, commander of the 816th Strategic Aerospace Division with some of his staff, BGen Harry Goldsworthy, Director of Production and Planning, USAF Headquarters, with Col Milo Secomb, William Van Horn, General Dynamics- Astronautics with some of his staff, and LtCol Miles Wiley, Chief, Missile Systems Branch, Headquarters, SAC. with Maj A. P. Samuels. LtCol Wiley provided the detailed briefings on the accidents, with all participants taking part in the question and answer sessions. The first accident was at Walker AFB, NM on 1 June 1963, at site 1 with Crew R-22 on duty. The crew was conducting a PLX on the missile. For a PLX on an Atlas F, the warhead and pyrotechnics were removed, and missile hold-down locks installed on the launcher. The airborne battery was removed and four television cameras used to monitor critical operations. During the countdown process, 18,600 gallons of LOX is loaded onto the missile, which already has 12,000 gallons of fuel, RP-1 on board. After LOX is loaded, the missile is raised topside on the silo elevator and goes through a simulated launch and flight, At the end of the flight sequence, the crew lowers the missile back to the bottom of the silo and the LOX is off-loaded. By June 1963, Atlas had been operational for less than one year, and all the missiles were undergoing PLXs to determine the reliability of the system. This PLX on site 1 was the first conducted by the unit - the only previous exercises were the ones conducted at turnover by the contractor, where the requirement was that the final PLX before turnover was successful. This site had been turned over to the Air Force shortly before the Cuban Missile Crisis, so had not been exercised since that date. Later in 1963, SAC began requiring a PLX on each missile at least every 90 days.
Crew R-22 had been combat ready since April, and had conducted three PLXs before the one on 1 June. The exercise at site 1 was a successful PLX, and the crew initiated the “Abort Sequence.” Interestingly, Senator John Stennis keyed on the phrase “abort” and was told that this was not a malfunction situation - that the term “abort” in this case meant the start of the recovery sequence after a successful exercise. The missile lowered successfully and at about 1805, the automatic LOX drain operation to remove the LOX from the missile began. About twelve minutes later, the crew noted that the drain valve indicator changed from “full” to “intermediate”, or not fully open or closed. This valve normally stayed open for 45 minutes to ensure that all LOX was drained from the missile. Because of the indication, technicians were directed to enter the silo, but at 1822, before they could enter, the indication changed back to normal open. Two minutes later, the indication changed back to intermediate and the technicians were dispatched again. At 1927, they attempted to enter through the final door to the silo, door three, and found resistance, indicating the door was being held by an overpressure in the silo. At about the same time, sparks and flashes were seen on the level 8 television monitor and the fire alarm sounded, and the technicians were recalled from the silo. The fog system was activated to extinguish the fire. At 1828, electrical power failed followed by an explosion in the silo. An orderly evacuation was made, no one was injured, but the silo and missile were destroyed. The investigation of the accident indicated one of two possible causes - either contaminated LOX or broken bolts in the liquid oxygen filter. The investigating board determined that it was possible that hydrocarbon contaminants could have caused the fire and resulting explosion. Before this accident, there was no requirement to run a sample of the LOX at the site to determine if there was any contamination. After the investigation, procedures were changed requiring sampling before a PLX. The board also found broken J-bolts in the filter and speculated that with a broken bolt, the opening and closing of the filter that occurred could have caused the filter element to move enough to create enough friction to start the fire. The next accident, also at Walker, was at Site 5 on 13 February 1964, during a SAC Operational Readiness Inspection. Crew R-60 conducted the PLX, as part of a recurring evaluation of the crew by Standardization Crew S-03. This PLX was the fifth and last required during the ORI. Crew S-03 had participated in ten PLXs and crew R-60 three.
At about 1010, the PLX was started and at about 1014 a low oxygen indication occurred. This was considered noncritical and the countdown was continued. As the launcher rose off the disconnects, the crew noted liquid spillage of about 5 to 50 gallons on the level 8 camera, in the area of the launcher platform. AT 1021, the missile was fully up and locked and one minute later the PLX was declared successful for the ORI. The Abort Sequence was delayed to investigate the spill as a possible fuel spill. At 1024, a team proceeded to the silo cap to check for a fuel leak and found no indication. The team returned to the LCC and the ORI inspectors departed the site. At 1031, the squadron commander, after advice from the standboard crew, directed the “nonessential bus” to be shut down. This bus provided power for pumps that circulate cooling water to the diesel generators, the main silo exhaust fan and the fire fog system pump. The primary diesel engine overheated and the alternate diesel was started. Since the missile was still topside, pressure in the fuel and LOX tanks could not be controlled unless a pneumatics test set was connected to the missile. The test operator in the fall-back area moved the test set and began connecting it until he heard a popping sound and noticed gaseous oxygen in the test-set cab and on the ground. He saw LOX spraying out the main fill-line disconnect on the launch platform. The television cameras on levels 2, 6 and 8 were obscured by gaseous oxygen vapors and at 1100, loss of power occurred, followed by an explosion in the silo. The missile and silo were destroyed but no personnel were injured.
The investigating board determined that the liquid spill that occurred when the launcher raised was fuel, When the nonessential bus was shut down, the fuel vapors mixed with the hot exhaust vapors from the overheated diesel and ignited. The resulting fire burned wires in the logic set on level 3, causing the LOX fill and drain valve to open. The LOX draining from this valve called what LtCol Wiley called a “terrific explosion” It was determined that the squadron commander made an error when he direct the nonessential bus to be shut down, and that a design deficiency existed in the wiring panel, as well as in the fuel drain line. Changes were made to manually drain the fuel line for 20 minutes prior to a PLX, and a poppet valve was designed to prevent leaks from the line. The next explosion of an Atlas F happened on 9 March 1964 at Site 2 at Walker. Standardization crew S- 02 was evaluating crew R-27 . Crew S-02 had conducted 13 PLXs and R-27 had done 2. Site 2 had undergone seven previous PLXs, all failures. Countdown started on a schedule PLX at 1300 and was normal until the launcher platform stopped after about 3 feet of upward travel, at 1312. A 25 percent silo oxygen alarm sounded indicating a possible LOX spill, so the abort sequence was initiated. The launcher did not begin to lower as it should have, so at 1326, the crew began the emergency procedure checklist. The standboard crew commander determined that the boiloff valve on the missile should be left closed because of the high oxygen content in the silo, so the emergency boiloff pushbutton was not depressed. Personnel were dispatched to the silo to troubleshoot the launcher lift system so the missile could be returned to the normal down position. By 1439, pressure built up in the LOX tank of the missile to over 30 pounds per square inch, resulting in the automatic opening of the boiloff valve, resulting in a rapid expulsion of liquid and gaseous oxygen. The safety technician on the team in the silo detected increasing oxygen concentration and the silo was evacuated. At 1447, the pressure in the LOX tank had dropped to normal pressure so the pressurization system was returned to automatic. Shortly after, white smoke was seen coming out of the silo exhaust system both by topside personnel and on the television monitor. This smoke turned from white to grey and then black and the fog spray was activated. At 1452, electrical power was lost and at 1453 the first of two explosions occurred. Again, all personnel were evacuated with no injuries. When the standboard crew decided to keep the boiloff valve closed, pressure built up in the missile lox tank, causing the boiloff to open by itself when the pressure exceeded 30 psi. The LOX that was ejected when the valve suddenly opened, at -297 degrees, struck the wire rope cables that support the launcher platform, which was about three feet above the bottom of the launcher. The cables fractured, allowing the loaded missile and launch platform to suddenly drop these three feet, rupturing the bulkhead between the LOX and RP-1 tanks and causing the explosion. The investigating board attributed the basic cause to be an error in judgement on the part of the crew - if the boiloff had been opened, pressure would have stabilized at a safe level and maintenance could have repaired the lift system. Altus AFB, OK, site 6 was the location of the fourth explosion, on 14 May 1964. The site had just completed the major update modification called Red Heat and was being checked by the contractor to return to SAC control. Site 6 was the fourth site to have the update modification completed at Altus. Squadron crew R-20 was manning the console for the PLX under contractor supervision. R-20 had conducted three previous PLXs. Countdown began at 1104 and rapid LOX loading commenced at 1105. At 1109 a high oxygen concentration was detected by the silo sensors. Rapid LOX load was almost complete at this point. The crew initiated the abort sequence, automatically starting LOX off-load from the missile. The silo fire alarm sounded and the crew activated the fire fog system. This system did not function - it was later determined that a valve controlling the water failed to open. A safety technician and crewmember entered the silo and found very high oxygen concentration. As they evacuated, they observed a fire in the exhaust ducting on level 2. At 1138, manual silo door opening was begun to utilize a truck mounted purge fan. The television monitors showed fire and smoke as the doors became partially open, and the control center began getting indications of system deterioration. Power was lost and at 1148 the first of three explosions occurred. At 1150, the personnel in the control center evacuated to the fall-back area. There were no injuries. While the cause could not be definitely determined, the most probable cause was the result of a misalignment of the liquid oxygen disconnects where the large line comes up to the base of the launcher platform to mate with line down from the missile. This line disconnects when the launcher raises. The contractor had noted alignment problems during completion of the modification but corrective action had been completed and cleared in the records. The misalignment caused a substantial LOX leak during the LOX loading process, resulting in the fire. A contributing factor was the failure of the fire fog system, since a successful activation may have prevented a fire. The Senate committee that looked into these accidents talked to a number of Air Force and contractor witnesses about the accidents, system operation and system performance. There was much discussion about discipline, housekeeping and daily operation at the two bases involved, as well as discussion on the future of the Atlas F. At the time of the hearings, Atlas D and E and Titan I were being scheduled of phaseout, but Atlas F was expected to be around for some time. Shortly after the hearing, when the phaseout schedule was announced, all three Atlas systems and Titan I were all scheduled to be gone by the middle of the following year, 1965.
More Information about Missile Accidents There are a lot of sources for more about the history of both the development and the problems encountered during the early days of our ICBM force. A number of AAFM members have provided the association with documents and reports, including the congressional record extracts used as one of the major sources for the article above. AAFM has a large library of early contractor documents, and some have been scanned and included on our “History CD.” There is, as one might expect, even more on the internet. During research for the article, I searched for such things as “the Walker Atlas accidents”, “Beale Ttan accidents” and more. Some of the pages only have limited information, but a lot of folks have collected a lot of information about ICBMs and put them on the web. For example, one source lists every missile manufactured by “tail number”, sorted by year, and tells the current location or what happened to it. Siloman even has an interview with one of the enlisted crew members from one of the Walker accidents. If you want to learn more, contact AAFM and we can provide details on some of the sources or loan some of our documents to you. 
|
