console, a small steel desk, turquoise and gray, with rows of square buttons and warning lights. It monitored and controlled the most important functions of the complex. The commander could open the front gate from there, change the warheadâs target, enable or abort a launch. In the middle of the console was the launch switch. It was unmarked, blocked by a security seal, and activated by a key. On top of the console was a digital gauge that showed the pressure in the missileâs fuel and oxidizer tanks. Two small speakers were bolted to the side of the desk. Throughout the day they broadcast test messages from SAC headquarters and, during wartime, would give the order to launch.
To the left of the commanderâs console was another small turquoise and gray desk, where the deputy commander sat. It operated the siteâs communications systems. Directly above the desk was a large, round clock with numbers from 00 through 23 on the face and a thick black casing. The clock was set to Greenwich mean time, so launches at the Titan II sites in Arkansas, Kansas, and Arizona could be synchronized. The deputy commanderâs launch switch was on the upper left side of the desk. It was round, silver, unmarked, and resembled the ignition switch of an old car. The launch codes and keys were kept in a bright red safe with two brass combination locks, one belonging to the commander, the other to the deputy. It was nicknamed the âgo-to-war safe.â
If a launch order came over the speakers, the officers were supposed to unlock their locks, open the safe, grab their codes and keys, then return to their consoles. The keys looked unexceptional, like the kind used to unlock millions of American front doors. The codes were hidden inside flat plastic disks called âcookies.â The disks were broken open by hand, like fortune cookies, and the codes were read aloud. And if the codes authenticated the emergency war order from SAC headquarters,the launch checklist went something like this:
SURFACE WARNING CONTROL . . . Lighted red.
Remove security seals and insert keys into switches.
Launch keys . . . Inserted.
Circuit breaker 103 on . . . Set.
BVLC â OPERATE Code Word . . . Entered.
Simultaneously (within 2 seconds) turn keys for 5 seconds or until sequence starts.
LAUNCH ENABLE . . . Lighted.
BATTERIES ACTIVATED  . . . Lighted.
APS POWER  . . . Lighted.
SILO SOFT  . . . Lighted.
GUIDANCE GO  . . . Lighted.
FIRE ENGINE  . . . Lighted.
LIFTOFF  . . . Lighted.
Assuming that everything worked as planned, the Titan II would be gone within seconds. Its warhead would strike the target in about half an hour. Once the missile left the silo, the crewâs job was done. They couldnât destroy a missile midflight or launch another. The complex was designed to be used once.
The Titan II would not launch, however, unless the two keys were turned at the same time; the launch switches were too far apart for one person to activate them both. SACâs âtwo-man policyâ had been adopted to prevent a deranged or fanatic crew member from starting a nuclear war. The butterfly valve lock on the stage 1 rocket engine offered some additional control over who could launch the missile. Oxidizer wouldnât flow into that engine until the correct butterfly valve lock code (BVLC) was used during the launch checklistâand without the oxidizer, the missile would stay in the silo. This code wasnât kept in the safe or anywhere else on the complex. It was transmitted with the emergency war order from SAC. And the valve lock contained a small explosive device. Any attempt to tamper with the lock set off the explosive and sealed the oxidizer line shut.
The SAC two-man rule governed not only how the missile was launched but also how the complex was run. At least two authorized personnel always had to be present