| Date: | 24 January 1961 |
| Type: | Structural failure |
| Occurrence Type: | Accident |
| Site: | Faro, Nahunta Township, Wayne County, 12miles north of Goldsboro, North Carolina |
| Coordinates: | 35.4928°N -77.8587°W |
| Aircraft Type: | B-52G |
| Operator: | Strategic Air Command, United States Air Force |
| Tail Number: | 58-0187 |
| Crew: | 8 |
| Origin: | Seymour Johnson Air Force Base |
| Destination: | Seymour Johnson Air Force Base |
| Fatalities: | 3 |
| Survivors: | 5 |
The 1961 Goldsboro B-52 crash was an accident that occurred near Goldsboro, North Carolina, United States, on 24 January 1961. A Boeing B-52 Stratofortress carrying two 3.8-megaton Mark 39 nuclear bombs broke up in mid-air, dropping its nuclear payload in the process. The pilot in command, Walter Scott Tulloch, ordered the crew to eject at . Five crewmen successfully ejected or bailed out of the aircraft and landed safely; another ejected, but did not survive the landing, and two died in the crash. Information declassified since 2013 has shown that one of the bombs was judged by nuclear weapons engineers at the time to have been only one safety switch away from detonation, and that it was "credible" to imagine conditions under which it could have detonated.[1] [2]
The aircraft, a B-52G, was based at Seymour Johnson Air Force Base in Goldsboro, and part of the Strategic Air Command's airborne alert mission known as "Cover All" (a predecessor to Operation Chrome Dome), which involved a continuous flow of staggered, nuclear-armed bombers on a "ladder" route into the Canadian Arctic and back.[3]
Around midnight on 23–24 January 1961, the bomber had a rendezvous with a tanker for aerial refueling. During the hook-up, the tanker crew advised the B-52 aircraft commander, Major Walter Scott Tulloch (grandfather of actress Elizabeth Tulloch), that his B-52 had a fuel leak in the right wing. The refueling was aborted, and ground control was notified of the problem. The B-52 was directed to assume a holding pattern off the coast until the majority of fuel was consumed. However, when it reached its assigned position, the pilot reported that the leak had worsened and that 37000lbs of fuel had been lost in three minutes. The aircraft was immediately directed to return and land at Seymour Johnson Air Force Base.
As the aircraft descended through 10000feet on its approach to the airfield, the pilots were no longer able to keep it in stable descent and lost control. An entire wing of the aircraft apparently was lost. The pilot in command ordered the crew to abandon the aircraft, which they did at 9000feet. Five men landed safely after ejecting or bailing out through a hatch, one did not survive his parachute landing, and two died in the crash. The third pilot of the bomber, Lt. Adam Mattocks, is the only person known to have successfully bailed out of the top hatch of a B-52 without an ejection seat. The crew's final view of the aircraft was in an intact state with its payload of two Mark 39 thermonuclear bombs still on board, each with yields of 3.8 megatons. Sometime between the crew ejecting and the aircraft crashing, the two bombs separated from the aircraft.
The pilotless aircraft broke up in the air shortly after the crew ejected. Witnesses reported seeing two flashes of red light, suggesting that fuel explosions contributed to the breakup of the plane. At 12:35 a.m. EST on January 24, the remaining pieces of the B-52 impacted with the ground. The aircraft wreckage covered a 2adj=onNaNadj=on area of tobacco and cotton farmland at Faro, about 12miles north of Goldsboro. The arrangement of the aircraft pieces suggested that several pieces of the B-52 were upside down when they struck the ground.[4]
Explosive ordnance disposal (EOD) teams from Seymour Johnson and other bases arrived on the scene quickly, disarming the one bomb that was easily accessible. Representatives from the Albuquerque Operations Office of the U.S. Atomic Energy Commission were alerted to the accident on the morning of January 24. A team of scientists and engineers from the AEC, Sandia National Laboratories, and Los Alamos National Laboratory assembled at Kirtland Air Force Base in New Mexico. They were joined by representatives from the Department of Defense Nuclear Safety Research Directorate. They flew to Seymour Johnson AFB on a C-47 cargo plane, arriving at approximately 10:15 p.m. EST on the night of January 24.
The two bombs involved in the Goldsboro accident were Mark 39 Mod 2 thermonuclear weapons with a maximum predicted yield of 3.8 megatons of TNT equivalent. Like all Teller-Ulam design thermonuclear weapons, its warhead consisted of two distinct parts ("stages"), the "primary" (a mostly-fission weapon which initiates the detonation) and the "secondary" (the portion of the weapon that, under the influence of the energy released by the "primary," undergoes a nuclear fusion reaction and also produces additional nuclear fission reactions). In the case of the Mark 39 Mod 2, the "primary" was also boosted, meaning that at the moment of detonation a gaseous mix of deuterium and tritium was injected into its core, which would generate fusion reactions at the moment of detonation, producing neutrons that would increase the efficiency of the "primary". The pit of the primary was entirely composed of enriched uranium ("all-oralloy"), with no plutonium, and was a sealed-pit, meaning that it was fully-assembled at all times. The Mark 39 Mod 2 warhead was itself enclosed in a gravity bomb casing which had a compartment containing a drogue parachute that both allowed the aircraft dropping it to move to a safe distance, and allowed it to be detonated on the surface by a contact fuze without risk of the weapon breaking on contact with the ground. The weight of the assembled bomb was between 9000lb10000lb.[5]
Immediately after the Goldsboro accident, technicians from Sandia National Laboratories, the national laboratory which had the primary responsibility of nuclear warhead safety engineering, subjected the recovered weapons to careful analysis to determine how close they were to a possible nuclear detonation. Various accounts of their conclusions have circulated over the years, with some emphasizing the closeness of the detonation, and some emphasizing the success of the various safety features of the nuclear warheads. To make sense of their analysis and the controversies, it is first necessary to understand what the normal firing sequence of a Mark 39 Mod 2 used in combat conditions would be.
The Mark 39 bombs would be suspended in the two bomb bays of the B-52 plane carrying it, one in front of other. "Arming rods" were extended out of each weapon, and held in place with "safing pins." Prior to normal use, the "safing pins" would need to be pulled out of the bomb, which could be done by the crew by means of a lanyard that was connected to them. Additionally, prior to dropping the bomb, the pilot would need to operate a switch inside the cockpit (the T-380 Readiness Switch) that would operate the MC-722 Arm/Safe Switch inside the Mark 39 bomb itself. The Arm/Safe Switch was a low-voltage, solenoid-operated electro-mechanical switch that was kept in the "Safe" position until a deliberate choice was made to cause a nuclear detonation, but could be switched from "Safe" to "Arm" by a 28-volt electrical signal.[6] The Mark 39 Mod 2 could only be detonated as a "contact" burst (and not an airburst).[7] The bomb bay had a solenoid-operated lock system which would deploy the parachute automatically upon release if operated, using an MC-834 Explosive Actuator, as opposed to a free-fall release.
Once the bomb cleared the bomb bay and the arming rods were retracted, they would trigger the MC-845 Bisch generator they were connected to. This was a single-pulse generator that began the overall firing sequence. The Bisch generator would send an initiation signal to the MC-640 low-voltage thermal battery pack, as well as the MC-543 Timer. The timer would begin to count down. The retraction of the arming rods would also close valves sealing a reference chamber in the MC-832 Differential Pressure Switch, a barometric fuze for detecting the bomb's altitude.
After the weapon had fallen a required vertical distance, the differential pressure switch would close contacts which passed battery current through the MC-772 Arm/Safe Switch and from there to the MC-788 High Voltage Safing System, which is armed by continual current being applied to it. Upon receiving this current, the MC-788 would then connect the (not yet-charged) high-voltage thermal battery to the X-Unit, the electrical device that provides a high voltage signal to the detonators used in the "primary" stage of the weapon. After the timing circuit completed its countdown of 42 seconds, it would then deliver initiation power to the MC-641 High Voltage Thermal Battery pack. This would begin to generate its full voltage of 2500 volts within one to two seconds, which would be applied directly to the trigger circuit and, through the MC-788 High Voltage Safing System, to the capacitor bank of the X-Unit. Once the bomb impacted the ground, a crush switch on the nose of the bomb (the MC-787 Trigger Circuit) would be closed and trigger the X-Unit to discharge its capacitors and initiate the high-explosive system in the "primary" stage of the weapon.
At some point in the above sequence, not indicated in declassified documents (possibly because of its classified nature), "squibs" on the Los Alamos Laboratory 1A Valve Mechanism would fire and cause the gas from the boost reservoir to be injected into the "primary" of the bomb.
By the time of the Goldsboro accident, the MC-722 Arm/Safe switch had been replaced in some Mark 39 Mod 2 units with another switch, the MC-1288 Arm/Safe switch, which also restricted the charging of the low-voltage thermal battery if the switch was in the "Safe" position. This was done to ensure additional safety for the weapons, and would remove the need for safing pins in the pullout rods. This modification (designated as Alt 197) had been approved in January 1960, but had not been performed on either of the bombs involved in the Goldsboro accident.
For a parachute delivery, the Mark 39 would need to be released between and above the target. For a free-fall delivery, it would need to be released at least above the target, or else it would hit the ground prior to the timer circuit completing its countdown and the X-Unit being charged.
The two Mark 39 Mod 2 nuclear bombs involved in the Goldsboro crash had distinctly different outcomes. Official reports identified them as weapon no. 1 (or bomb no. 1) and weapon no. 2 (or bomb no. 2), with the first's parachute having deployed and the second having crashed into the ground in free-fall without any decrease in its speed. Weapon no. 2 was kept in the forward bomb bay of the aircraft, while weapon no. 1 was in the aft bomb bay.
Weapon no. 1, identified as serial number 434909 (and kept in the aft bomb bay), was flung out of the aircraft at an altitude of around above the ground. It apparently twisted from its rack in a way that caused the "safing pins" on its arming rods to pull out longitudinally and without any sign of damage, despite not having been pulled from the crew compartment. Once it left its rack, the bomb dropped in such a way that its arming rods were pulled out in much the same manner as an intentional drop sequence would be. This caused its MC-845 Bisch generator to be actuated, initiating the MC-640 low-voltage thermal battery pack and the MC-543 timer. The explosive actuators triggered the deployment of the bomb's parachute as in normal functioning.
The MC-832 Differential Pressure Switch operated as normal, and passed the battery current to the MC-722 Arm/Safe switch. This switch was found by the initial explosive ordnance disposal (EOD) team on the scene to be in the "Safe" position,[8] and did not pass its current on further. The MC-543 safe-separation timer ran its full length (42 seconds), and initiated the MC-641 High-Voltage Thermal Battery Pack. Upon impact with the ground, the crush-switch closed, which would under normal circumstances fire the weapon. But as the MC-722 Arm/Safe Switch had not activated the MC-788 High-Voltage Safing Switch, the X-Unit was not charged, and no detonation occurred. The "squibs" that would inject the boost gas into the weapon did not release and the tritium reservoir was found intact.
The weapon was found in an upright position, with its parachute hanging on adjacent trees, about 1mile behind where the main wreckage of the aircraft impacted. On January 24, the EOD team from Wright-Patterson Air Force Base disassembled and "safed" the weapon (by disconnecting the tritium reservoir from the primary), and returned it to Seymour Johnson AFB. The weapon was described as having only sustained "negligible damage", with only a broken nose plate, and its nose buried about in the dirt. Approximately one pint of JP-4 jet fuel was found in the bomb case.
There have been differing interpretations offered as to how close this particular weapon was to having a nuclear detonation. An initial report by Sandia in February 1961 concluded that weapon no. 1 "underwent a normal release sequence in which the parachute opened and the components of the weapon which were given an opportunity to actuate by the pulling of the Bisch rods did behave in the manner expected. Full operation of this weapon was prevented by the MC-772 Arm/Safe Switch, the primary safing device." Other measures meant to provide additional safing, such as the "safing pins," failed.
Parker F. Jones, a supervisor at Sandia, concluded in a reassessment of the accident in 1969 that "one simple, dynamo-technology, low voltage switch stood between the United States and a major catastrophe" He further suggested that it would be "credible" to imagine that in the process of such an accident, an electrical short could cause the Arm/Safe Switch to switch into the "Arm" mode, which, had it happened during the Goldsboro accident, could have resulted in a multi-megaton detonation. A Sandia study on the US nuclear weapons safety program by R.N. Brodie written in 1987 noted that the ready/safe switches of the sort used in this era of weapon design, which required only a 28-volt direct current to operate, had been observed many times to inadvertently be set to "arm" when a stray current was applied to the system. "Since any 28-volt DC source could cause the motor to run, how could one argue that in severe environments 28 volts DC would never be applied to that wire, which might be tens of feet long?" He concluded that "if [weapon no. 1] in the Goldsboro accident had experienced inadvertent operation of its ready-safe switch prior to breakup of the aircraft, a nuclear detonation would have resulted."
Bill Stevens, a nuclear weapon safety engineer at Sandia, gave the following assessment in an internal documentary film produced by Sandia in 2010: "Some people can say, 'hey, the bomb worked exactly like designed.' Others can say, 'all but one switch operated, and that one switch prevented the nuclear detonation.'"
Charlie Burks, another nuclear weapons systems engineer for Sandia, also added: "Unfortunately, there have been thirty-some incidents where the ready/safe switch was operated inadvertently. We're fortunate that the weapons involved at Goldsboro were not suffering from that same malady."
Weapon no. 2 (kept in the forward bomb bay) separated from the B-52 later than weapon no. 1, when it was between and above the ground. It was discovered about away from the crew compartment and wing sections of the aircraft wreckage, along the line of flight. As with weapon no. 1, its "safing pins" were pulled, allowing its arming rods to withdraw. As before, this initiated the MC-845 Bisch generator, which activated the low-voltage thermal batteries and started the MC-543 Timer. However, because the weapon had been released at such a low altitude, and its parachute had not opened, it collided with the ground at high speed. Its timer circuit had run only 12 to 15 seconds when it impacted, and consequently, the high-voltage thermal battery did not activate. For unknown reasons, its parachute did not deploy, despite the parachute deployment mechanism having been activated. As the impact of the weapon had resulted in a crater of significant size – 5feet deep and 9feet in diameter – it was initially assumed that the high-explosives in the weapon's "primary" stage had detonated. However, it was later confirmed that there had not been any HE detonation of this or the other weapon, and there had been no contamination of the site with fissile material.
The EOD team found that the bomb had apparently left the airplane still attached to its rack, and that its timer circuit could not start until it had left its rack. (The rack was found a mile east of the bomb itself.) The bomb had become deeply buried in mud, and it required three days of excavation to recover its MC-772 Arm/Safe Switch. In 2013, Lt. Jack ReVelle, an EOD officer on the scene, recalled the moment: "Until my death I will never forget hearing my sergeant say, 'Lieutenant, we found the arm/safe switch.' And I said, 'Great.' He said, 'Not great. It's on arm.'" Another EOD officer recalled: "The arm safety switch was on, armed and functioning."
A representative of the Atomic Energy Commission noted that after the discovery of the Arm/Safe Switch in the "Armed" position, and the arming rods having been pulled out, he and his colleagues "wondered why bomb No. 2 had been a dud." An immediate analysis showed that the Arm/Safe Switch was "electrically... neither in armed nor safe position." The switch and other components were shipped to Sandia for further "post-mortem" analysis, and it was determined that while the switch's indicator drum had rotated to the "Arm" position, it had disconnected from its contacts, and was never electrically "armed." They concluded that this was damage caused by the impact shock of the bomb hitting the ground, which also damaged the switch to such an extent that the circuit could not have closed even if it were in the "Arm" position.
As with weapon no. 1, the tritium reservoir in weapon no. 2 was recovered intact and without any loss of tritium. The MC-788 High Voltage Safety Switch was destroyed on impact.
Weapon no. 2 had broken into pieces on its impact, and the EOD technicians spent several days attempting to recover its pieces from the deep mud. The "primary" of the weapon was recovered on January 30, six days after the accident, at a depth of some in the mud. Its high-explosives had not detonated, and some had crumbled out of the warhead sphere. By February 16, the excavation had gotten down to, and had not located the "secondary" component of the weapon.
Excavation of the second bomb was complicated by the freezing cold, a high water table, and the extreme muddiness. Pumps were used to remove water, and the sides of the crater were reinforced with plywood, but it was decided after digging down to to abandon the effort. The fusion "secondary" of the second weapon was never recovered. The University of North Carolina at Chapel Hill subsequently determined the buried depth of the secondary component to be 180±.
An analysis by Sandia in February 1961 concluded that:
Another analysis by Sandia engineers in 1961 concluded that while in both weapons the MC-772 Arm/Safe Switch operated "as it was designed to do," the lanyard-controlled safing-pins "cannot be relied upon to prevent initiation of the fuzing sequence" in this kind of accident, and recommended implementing a modification to the weapons be implemented "as rapidly as possible" that would prevent the fuze power supply from activating except when live release was intended.
A 1969 analysis by Sandia supervisor Parker F. Jones concluded that the Goldsboro accident illustrated that "the Mk 39 Mod 2 bomb did not possess adequate safety for the airborne alert role in the B-52."
The "Official Observer's Report" of the accident summarized the condition of the two weapons' firing systems with the following table:
| Part No. | Component | Bomb #434909 [No. 1] | Bomb #359943 [No. 2] | |
|---|---|---|---|---|
| Arming Wires [Arming/Pullout rods] | Pulled | Pulled | ||
| MC-845 | Pulse Generator [Bisch generator] | Actuated | Actuated | |
| MC-834 | Explosive Actuator | Fired | Fired | |
| MC-543 | Timer | Run down (42 sec.) | Run (12-15 sec.) | |
| MC-832 | Differential Pressure Switch [barometric altitude fuze] | All contacts closed | 2 contacts closed | |
| MC-640 | Low Voltage Thermal Battery | Actuated | Actuated | |
| MC-772 | Arm-Safe Switch | Safe | Safe [but visually appeared to look armed] | |
| 1-A | Tritium Reservoir | Full [i.e. unfired] | Full [i.e. unfired] | |
| MC-641 | High Voltage Thermal Battery | Actuated | Not actuated | |
| MC-788 | Rotary Safing Switch [High-Voltage Safing System] | Not operated | Destroyed | |
| MC-730 | X-Unit [Primary firing set] | Not charged | Not charged | |
| MC-616 | Nose crystals [Contact fuze] | Crushed | Crushed |
To summarize the Sandia post-mortem described in detail above, for Bomb No. 1, had the Arm-Safe Switch been set to "Arm," or malfunctioned in a way that enabled the firing circuit to act as if it was armed, the bomb would have detonated with a full nuclear yield upon the contact fuze closing when it hit the ground. For Bomb No. 2, because its timer had not run out by the time it impacted the ground, it could not have detonated even if its Arm-Safe Switch had been set to "Arm", as its thermal batteries had not charged, and they would be needed to fire the weapon.
Secretary of Defense Robert S. McNamara, in a Top Secret January 1963 meeting with representatives from the Departments of Defense and State, as well as the White House, used the Goldsboro accident to argue against the delegation of authority to use nuclear weapons to SACEUR, citing the possibility of accidental nuclear war. According to declassified meeting notes, McNamara "went on to describe crashes of US aircraft, one in North Carolina and one in Texas, where, by the slightest margin of chance, literally the failure of two wires to cross, a nuclear explosion was averted. He concluded that despite our best efforts, the possibility of an accidental nuclear explosion still existed."[9]
A safety modification to Mark 39 Mod 2 weapons known as Alt 197 had been approved in January 1960, but not yet applied to all deployed weapons prior to the Goldsboro accident, and was not applied to the weapons involved in the accident. Alt 197 replaced the MC-722 Arm/Safe switch with the MC-1288 Arm/Safe switch, with the main change being that the latter would prevent the charging of the low-voltage thermal battery when the Arm/Safe switch was in the "Safe" position, and as such would make sure that no electrical current was available anywhere within the bomb to power additional switches or hardware, legitimately or not. After the accident, all other Mark 39 Mod 2 weapons without the modification were taken off of deployment status ("red-lined") until the modification could be applied to the remaining inventory of the weapons.[10]
Wet wings with integral fuel tanks considerably increased the fuel capacity of B-52G and H models, but were found to be experiencing 60% more stress during flight than did the wings of older models. Wings and other areas susceptible to fatigue were modified in 1964 under Boeing engineering change proposal ECP 1050. This was followed by a fuselage skin and longeron replacement (ECP 1185) in 1966, and the B-52 Stability Augmentation and Flight Control program (ECP 1195) in 1967.
In 1962, The United States Army Corps of Engineers purchased a 400feet diameter circular easement over the buried second bomb.[11] [12] The site of the easement, at 35.4928°N -77.8586°W, is clearly visible as a circle of trees in the middle of a plowed field on Google Earth.
In July 2012, the State of North Carolina erected a historical road marker in the town of Eureka, north of the crash site, commemorating the crash under the title "Nuclear Mishap".
"And that one safety device was the pre-arming switch which was operated normally by a 28 volt signal."