On April 19, 1989, northeast of the island of Puerto Rico, 500 pounds of high explosive propellant charge exploded in the open-breech of the center 16” gun in USS Iowa’s turret II.
The resulting blast overpressures, secondary explosions and fires killed 47 crewmen within the turret structure. The robustness of the turret assembly, which extended from the main deck to the keel, fortunately withstood the blast and prevented more widespread damage throughout the ship. The explosion was a major embarrassment for the Navy. Its battleships had been reactivated for service in the Middle East, the third time since their launching late in WWII. They were widely touted as invulnerable to enemy attack. Much to the Navy’s chagrin it appeared that self-destruction might be a more realistic alternative.
Dr. Schwoebel is an applied physicist with more than 30 years’ background directing programs associated with “high consequence operations” at the Sandia Corporation. When the GAO enlisted Sandia to reexamine the Iowa explosion in the aftermath of congressional incredulity at the Navy’s report, he was assigned to lead its investigation team. He brought a purely scientific approach to the investigation which is reflected in his account of the task, the procedures which his team followed, and the candid austerity of his writing. Schwoebel succeeds in establishing the two investigations — the Navy’s and Sandia’s — as the principal characters of his book, personifying them as adversaries in a zero-sum battle for truth. The Iowa explosion, its etiology, subsequent investigations and ultimate conclusion hold object lessons for system safety realists.
It is immediately apparent that the Navy neglected to subject the historic battleship weapons-system even to cursory examination for hazards which might reasonably be expected to become potential operational risks. The fifty-year-old WWII-era technology incorporated into battleship gun systems possessed few of the risk controls common to then-current high risk-consequence systems. Naval gun systems from their invention relied on large numbers of semi-skilled troops to perform tasks in which the need for brawn far exceeded that for intellect. Indeed, aboard Iowa the 100-pound powder bags and the 2,700-pound projectiles were still man-handled from magazine stowage to the loading machinery. The hoists, transfer mechanisms and rammers were still operated by imprecise hand-eye coordination in a cramped, crowded, noisy environment which lacked effective mechanical limiting devices. In a world of micro-accuracy, battleship gun systems still measured variances in inches.
The traditional primary system safety alternative — designing hazards out — is rarely a viable option in dealing with existing, and often obsolescent systems. When presented with systems-in-being possessed of decades-old technology and equally archaic operating methods, system safety’s utility lies in verifying and validating existing policies, practices and procedures to identify potential risks, and updating operational customs to minimize them. Navy planners seem to have relied on a conclusion that “If it hasn’t happened, it can’t happen.” Unfortunately, their historical research was deficient. The origins of Iowa’s explosion might indeed have derived from circumstances similar to three prior open-breech explosions in Navy men-of-war. However, since those explosions did not occur specifically in 16” gun systems, Navy planners seem to have rejected them as sources for lessons-to-be-learned. The Sandia team was unable to examine this potential connection because the Navy refused to release any reports of the historic mishaps, presumably on grounds of “national security”.
In cavalier dismissal of deviation from accepted operational norms, Navy investigators concluded that an unauthorized (and prohibited) propellant/projectile load, untrained and unqualified personnel, 44-year-old propellant, and excessive operational pressures had no bearing on the explosion. In fact, the Navy’s investigators had apparently exhausted their “proof” of what hadn’t occurred when allegations of sabotage/suicide by a gun crew member arose to provide fortuitous distraction from any performance deficiencies by Navy managers or line commanders. (See Opinions 54 through 56 cited above.)
The second major object lesson for system safety practitioners lies in the investigative methodology employed by Navy investigators and the Sandia team, respectively. In the absence of any definitive investigative methodology, the Navy’s investigators focused on trying to determine what hadn’t happened. Although that approach worked quite neatly for the fictional Sherlock Holmes, proving a negative in real life is, unfortunately, logically impossible. Not that logical analysis impeded Navy investigators from their efforts to divert scrutiny from the Fleet’s failings. Sheer investigative incompetence identified elements of an “electronic igniter” (later changed to a “chemical igniter” when inconsistencies arose amidst the evidence), despite neglecting to normalize background levels for the suspect materials. (It turned out that all could be accounted for in normal shipboard usage.) When the FBI laboratory’s analyses conflicted with what Navy investigators wanted to hear, they fired the FBI and assigned the analyses to a Navy laboratory formerly commanded by the Navy’s principal Technical Investigator.
Dr. Schwoebel scrupulously avoids insinuating judgment into his exposition of the facts surrounding the Sandia team’s investigation. He needn’t; res ipsa loquitur. The Navy’s lack of formal investigative methodology and flawed analyses generated substantial Congressional disbelief in its capability for objectivity, and cast doubt on its investigators’ credibility. It becomes readily apparent even to the unsophisticated reader that the Navy’s intransigence derived from more than mere ignorance of accepted standards of investigative competence and scientific integrity. They were so sure that the explosion couldn’t have happened as a result of a mischance during routine operations that they acceded to the Sandia team’s request to verify sub-scale modeling experiments in a full-scale gun-barrel overram simulation. After all, they knew it couldn’t happen. Schwoebel’s description vies with any laboratory notebook for dispassion, yet would be worthy of a Tom Clancy novel: Test eighteen was finally readied and dropped. Five aligned propellant bags, just like those involved in the explosion aboard the USS Iowa , fell a short distance onto the unyielding concrete surface of the test site. A weight on top of the upper-most bag simulated the added energy of the rammer mechanism in a high-speed overram. The trim layer pellets in the lower bags were compressed not only by the weight at the top but also the upper bags, each weighing nearly one hundred pounds. Some of the trim layer pellets in the lower bags began to fracture because of the high loads. Fracture of these trim layer pellets caused them to emit burning particles, just as in Cooper’s [sub-scale] experiments.
Sensors between the two lowest bags picked up the light emitted by burning particles from the fractured pellets in the first few milliseconds after impact. The level of energy release was very low and would not be detected by simply looking at the bags during the impact. Some of the burning particles passed through the layers of silk surrounding the black powder patch in the adjacent (lower) bag and ignited the powder.
The energy release increased dramatically as the black powder rapidly burned and ignited the propellant. The multiplication continued swiftly and developed into an all-encompassing fire ball that enlarged and totally filled the video monitors aimed at the test site. To the human eye, it appeared as a sudden and violent explosion at the site of the drop. The explosion was fueled by nearly five hundred pounds of propellant, and in a fraction of a second the shock wave reached the bunker where the Navy crew and two Sandians sat transfixed before the remote video monitors.
In several seconds the flames began to subside, showing that the test site had been swept clean of surrounding apparatus. After a few more moments of silence, someone murmured, “Holy shit....” The implication of the explosion began to register: the explosion aboard the Iowa could have been initiated simply by overramming the propellant bags into the breech.
Had the explosion not occurred, had the Navy’s investigators been vindicated, the battleships would have returned to the Fleet with their archaic guns and procedures still poised to booby trap the unwary. Yet the experiment merely demonstrated that the explosion could occur. What achieved the occurrence aboard Iowa was a confluence of deficiencies in human behavior: normalization of deviance, uncritical acceptance of easily verifiable erroneous assumptions, denial, willing suspension of disbelief, rejection of scientific proof, and unalterable commitment to a belief that “it can’t happen here.” The syndrome has been elegantly described by Diane Vaughan in her book The Challenger Launch Decision: Risky technology, Culture and Deviance at NASA (University of Chicago Press, 1996. ISBN 0-226-85275-3).
Sophisticated weapon systems, complex computer applications, and elegant software all may be more chic than the brute strength and awkwardness of long gun systems. Nevertheless, the likelihood of operator risk and mission failure is no less acute for geriatric systems which have never been subjected to system safety analyses than it is in state-of-the-art, cutting edge technological application. Failure is failure, damage is damage, injury is injury and death is death. Operational system safety analyses are the key to minimizing operational risks. Post-mishap investigations must prioritize identifying what happened and why the failure and its effects were not identified by earlier scrutiny. It’s the only way we can improve system safety’s quest for hazard and risk prevention.
- - - - - - - - - - - - - - - - - - - - - - - -
Ira J. Rimson, P.E., joined the predecessor of the System Safety Society in 1966. During his 22-year career as a Naval Aviator he served as Weapons Officer in USS Saratoga (CV-60), the last U.S. aircraft carrier fitted with 5”/54 gun mounts. Since 1977 he has been a consulting forensic engineer, and devotes much of his current involvement to improving quality controls for investigation methodologies.