The switch that held
In the early hours of January 24, 1961, a B-52 came apart in the sky over Goldsboro, North Carolina. It was carrying two Mark 39 hydrogen bombs. Each held a yield measured in megatons. As the aircraft broke up, one of the bombs began to arm itself.
The breakup did the work a crew normally does. It yanked the safing pins and pulled the arming lanyards. The parachute deployed. The fuzing sequence started and ran step after step, exactly as designed. By the time the weapon settled into a field near the town of Faro it had completed nearly the full arming sequence. One component stood between it and detonation. A ready/safe switch called the T-249, still resting on SAFE. The declassified Sandia analysis of the accident is blunt about it. The switch worked exactly as it was supposed to, and it was the only thing left working.
The second bomb was worse. The force of the crash rotated its indicator drum to ARMED, and only damaged switch contacts kept it quiet. Secretary of Defense Robert McNamara later said disaster was averted "by the slightest margin of chance, literally the failure of two wires to cross."
Nobody broke a rule that night. The crew followed procedure. The policies governing nuclear weapons were sound and everyone obeyed them. The weapon nearly detonated anyway. The people who ran the nuclear enterprise drew a hard conclusion from that. Trust that has to survive a disintegrating aircraft cannot live in a document. It has to live in the hardware.