The Space Shuttle Challenger disaster occurred on January 28, 1986, when Space Shuttle Challenger (mission STS-51-L) broke apart 73 seconds into its flight, leading to the deaths of its seven crew members.
The disaster resulted in a 32-month hiatus in the shuttle program and the formation of the Rogers Commission, a special commission appointed by United States President Ronald Reagan to investigate the accident. The Rogers Commission found NASA‘sorganizational culture and decision-making processes had been key contributing factors to the accident. NASA managers had known contractor Morton Thiokol‘s design of the SRBs contained a potentially catastrophic flaw in the O-rings since 1977, but failed to address it properly. They also disregarded warnings (an example of “go fever“) from engineers about the dangers of launching posed by the low temperatures of that morning and had failed in adequately reporting these technical concerns to their superiors.
What Rogers did not highlight was that the vehicle was never certified to operate in temperatures that low. The O-rings, as well as many other critical components, had no test data to support any expectation of a successful launch in such conditions. Bob Ebeling from Thiokol delivered a biting analysis: “[W]e’re only qualified to 40 degrees …’what business does anyone even have thinking about 18 degrees, we’re in no man’s land.'”
The Challenger accident has frequently been used as a case study in the study of subjects such as engineering safety, the ethics of whistle-blowing, communications, group decision-making, and the dangers of groupthink. It is part of the required readings for engineers seeking a professional license in Canada and other countries. Roger Boisjoly, the engineer who had warned about the effect of cold weather on the O-rings, left his job at Morton Thiokol and became a speaker on workplace ethics. He argues that thecaucus called by Morton Thiokol managers, which resulted in a recommendation to launch, “constituted the unethical decision-making forum resulting from intense customer intimidation.” For his honesty and integrity leading up to and directly following the shuttle disaster, Roger Boisjoly was awarded the Prize for Scientific Freedom and Responsibility from the American Association for the Advancement of Science. Many colleges and universities have also used the accident in classes on the ethics of engineering.
Information designer Edward Tufte has claimed that the Challenger accident is an example of the problems that can occur from the lack of clarity in the presentation of information.
However, Robison, a Rochester Institute of Technology professor, and Boisjoly vigorously repudiated Tufte’s conclusions about the Morton Thiokol engineers’ role in the loss ofChallenger. First they say that the engineers didn’t have the information available as Tufte claimed: “But they did not know the temperatures even though they did try to obtain that information. Tufte has not gotten the facts right even though the information was available to him had he looked for it.” They further argue that Tufte “misunderstands thoroughly the argument and evidence the engineers gave”. They also criticized Tufte’s diagram as “fatally flawed by Tufte’s own criteria. The vertical axis tracks the wrong effect, and the horizontal axis cites temperatures not available to the engineers and, in addition, mixes O-ring temperatures and ambient air temperature as though the two were the same.”
Author(s): Roger M. Boisjoly
The evening telecon meeting between MTI, MSFC and KSC on January 27,1986, was the final event preceding the Challenger disaster. The major activity that day focused upon the predicted 18 °F (-8 °C) overnight low and meetings with Engineering Management to persuade them not to launch below 53 °F (12 °C). My whole being was driven to action for this cause because of my memory of my January, 1985, participation in the inspection of the hardware from the previous coldest launch which had massive hot gas blow-by. The discussion activity concluded with the hurried preparation of fourteen Viewgraphs by various engineering groups which had less then an hour to respond for the scheduled evening telecon.
The following discussion is summarized to show the content of the engineering presentation. Figures labeled as Viewgraphs show the major thrust of the telecon and contain the actual content of the originals as presented, with Sl units added, while others are summarized to give general content for brevity.
The first Viewgraph was a title page. The second Viewgraph showed a table of post history of O-ring damage on SRM field joints. The third, fourth and fifth Viewgraphs are shown as Figures 4., 5., and 6., respectively.
|– field joint – highest concern|
|– erosion penetration of primary seal requires reliable secondary seal for pressure integrity|
|– ignition transient – (0-600 ms)|
|– (0-170 ms) high probability of reliable secondary seal|
|– (170-330ms) reduced probability of reliable secondary seal|
|– (330-600 ms) high probability of no secondary seal capability|
|– steady state – (600 ms – 2 minutes)|
|– if erosion penetrates primary o-ring seal – high probability of no secondary seal capability|
|– bench testing showed o-ring not capable of maintaining contact with metal parts gap opening rate to meop|
|– bench testing showed capability to maintain o-ring contact during initial phase (0- 170 ms) of transient|
Figure 4. – primary concerns
Figure 4. was taken directly from the August 19, 1985 presentation to NASA headquarters. The last two statements show the reasons for both the high concern and for having a high probability of a secondary seal during the first portion of the transient time zone. The last statement was produced from testing at 50 °F (10 °C) which showed that a seal could maintain contact with its mating surfaces when compressed 0.040 inches (1.02 mm) and only 0.010 inch (0.25 mm) of compression was removed from the seal.
|– a temperature lower than current data base results in changing primary o-ring sealing timing function|
|– srm 15a – 800 arc black grease between o-rings srm 15b – i 100 arc black grease between o-rings|
|– lower o-ring squeeze due to lower temp|
|– higher o-ring shore hardness|
|– thicker grease viscosity|
|– higher o-ring pressure actuation time|
|– if actuation time increases, threshold of secondary seal pressurization capability is approached|
|– if threshold is reached, then secondary seal may not be capable of being pressurized|
Figure 5. – Field Joint Primary Concerns SRM 25
Figure 5. was the heart of the discussion at the telecon. The engineering issue was “Would the seals even actuate and seal due to changing their timing function?” This would place us in the category of having a high probability of no secondary seal capability while the primary seal would be experiencing massive blow-by erosion due to its inability to respond to the gap opening of the metal parts. The last two statements summarized the fear of loss of redundancy based upon my remembrance of the January, 1985 post-launch hardware inspection.
Figure 6. SRM Field Joint
Figure 6. shows the field joint in the “as assembled” configuration, plus the pressurized configuration which shows the gap opening parameter due to outboard radial deflection of the case membrane. The differential deflection between the membrane and the stiffer joint causes the inboard clevis leg to deflect inboard opposite the rotation of the tong, which causes the gap at the seals to open. This results in the secondary seal lifting off its seat at full pressurization without considering seal resiliency parameters.
The sixth Viewgraph showed a comparison of hot gas blow-by by comparing ARC lengths of blackened grease and some descriptive phases for various flights at different launch temperatures. The seventh Viewgraph was a table of O-ring shore hardness versus temperature. The eighth Viewgraph contained the preliminary O-ring resiliency data in a tabular form. Up to this point in the telecon, I was asked several times by NASA to quantify my concerns, but I said that I could not since the only data I had was already presented and that I had been trying to get more data since last October (1985). At this comment, the General Manager of MTI gave me a scolding look as if to say, “Why did you tell them that?” The presentation continued with Viewgraph nine which showed sub-scale test results of cold gas blow-by tests at 75 °F (24 °C) and 30 °F (-1 °C) which showed no leakage. This data was used as an argument by management to say that the joint sealed at 30 °F (-1 °C) but in fact, the tests were not seal tests at all, since the test ring was a solid block of metal which did not have the deflection characteristics of the full-scale joint and was never intended to test anything but incipient blow-by before any joint deflection occurred. Viewgraph ten contained a table of compression set data to aid in the visualization of seal permanent set characteristics. Viewgraph eleven is shown as Figure 7., It provided a comparison of O-ring squeeze for the Challenger joints (SRM 25) versus the previous coldest flight at 53 °F (12 °C) (SRM 15).
* 0.010 in. (0.25mm) erosion
** 0.038 in. (0.97mm) erosion
Figure 7. Field Joint O-Ring Squeeze (Primary Seal)
Viewgraph twelve is shown as Figure 8. The DM designates development motors, QM is qualification motors and SRM is flight motors. This chart showed the current data base versus the predicted Challenger seal temperature of 27 to 29 °F (-3 to -2 °C).
* 1-D Thermal Analysis
** Propellant Mean Bulk Temperature
Figure 8. History of O-ring temperatures
Viewgraph thirteen is shown as Figure 9. The third and fourth statements under the first bullet are actually disclaimers for the development and qualification test data because the joint putty had been altered after assembly and prior to horizontal test firings. Observed holes in the joint putty were repaired since it was thought that the horizontal assembly was very severe on the joints and is what caused the holes in the putty and that vertical assembly would not cause such holes to occur. The reasoning was generally okay but that reasoning was never tested until sometime in 1985 when it was found that vertical assembly could indeed cause holes in the putty. The major faulty thinking lies in the fact that no specific vertical assembly testing was performed to verify the original assumption and that made the original horizontal test firings a series of successful tests without any sea] erosion.
|– temperature of o-ring not only parameter controlling blow-by srm 15 with blow-by had an o-ring temp at 53 °F (11.7 °C) four development motors with no blow-by were tested at o-ring temp of 47 to 52 °F (8.3 to 11.1 °C) development motors had putty packing which resulted in better performance|
|– at about 50 °F (10 °C) blow-by could be experienced in case joints|
|– temp for srm 25 on 1-28-86 launch will be 29 °F (-1.7 °C) 9 a.m. 38 °F (3.3 °C) 2 p.m.|
|– have no data that would indicate SRM 25 is different than SRM 15 other than temp|
Figure 9. – conclusions
Viewgraph fourteen is shown as Figure 10.
|– O-ring temp must be & mac179; 53 °F (11.7 °C) at launch development motors at 47 to 52 °F (8.3 to 11.1 °C) with putty packing had no blow-by SRM 15 (the best simulation) worked at 53 °F|
|– project ambient conditions (temp & wind) to determine launch time|
This concluded the engineering presentation. Then Joe Kilminster of MTI was asked by Larry Mulloy of NASA for his launch decision. Joe responded the he did not recommend launching based upon the engineering position just presented. Then Larry Mulloy asked George Hardy of NASA for his launch decision. George responded that he was appalled at Thiokol’s recommendation but said he would not launch over the contractor’s objection. Then Larry Mulloy spent some time giving his views and interpretation of the data that was presented with his conclusion that the data presented was inconclusive.
Now I must make a very important point. NASA’S very nature since early space flight was to force contractors and themselves to prove that it was safe to fly. The statement by Larry Mulloy about our data being inconclusive should have been enough all by itself to stop the launch according to NASA’S own rules, but we all know that was not the case. Just as Larry Mulloy gave his conclusion, Joe Kilminster asked for a five-minute, off-line caucus to re-evaluate the data and as soon as the mute button was pushed, our General Manager, Jerry Mason, said in a soft voice, “We have to make a management decision.” I became furious when I heard this, because I sensed that an attempt would be made by executive-level management to reverse the no-launch decision.
Some discussion had started between only the managers when Arnie Thompson moved from his position down the table to a position in front of the managers and once again, tried to explain our position by sketching the joint and discussing the problem with the seals at low temperature. Arnie stopped when he saw the unfriendly look in Mason’s eyes and also realized that no one was listening to him. I then grabbed the photographic evidence showing the hot gas blow-by comparisons from previous flights and placed it on the table in view of the managers and somewhat angered, admonished them to look at the photos and not ignore what they were telling us; namely, that low temperature indeed caused significantly more hot gas blow-by to occur in the joints. I, too, received the some cold stares as Arnie, with looks as if to say, “Go away and don’t bother us with the facts.” No one in management wanted to discuss the facts; they just would not respond verbally to either Arnie or me. I felt totally helpless at that moment and that further argument was fruitless, so I, too, stopped pressing my case.
What followed made me both sad and angry. The managers were struggling to make a list of data that would support a launch decision, but unfortunately for them, the data actually supported a no-launch decision. During the closed manager’s discussion, Jerry Mason asked the other managers in a low voice if he was the only one who wanted to fly and no one answered him. At the end of the discussion, Mason turned to Bob Lund, Vice President of Engineering at MTI, and told him to take off his engineering hat and to put on his management hat. The vote poll was taken by only the four senior executives present since the engineers were excluded from both the final discussion with management and the vote poll. The telecon resumed and Joe Kilminster read the launch support rationale from a handwritten list and recommended that the launch proceed as scheduled. NASA promptly accepted the launch recommendation without any discussion or any probing questions as they had done previously. NASA then asked for a signed copy of the launch rationale chart.
Once again, I must make a strong comment about the turn of events. I must emphasize that MTI Management fully supported the original decision to not launch below 53 °F ( 12 °C) prior to the caucus. The caucus constituted the unethical decision-making forum resulting from intense customer intimidation. NASA placed MTI in the position of proving that it was not safe to fly instead of proving that it was safe to fly. Also, note that NASA immediately accepted the new decision to launch because it was consistent with their desires and please note that no probing questions were asked.
The change in the launch decision upset me so much that I left the room immediately after the telecon was disconnected and felt badly defeated and angry when I wrote the following entry in my notebook. “I sincerely hope that this launch does not result in a catastrophe. I personally do not agree with some of the statements made in Joe Kilminster’s summary stating that SRM- 25 (Challenger) is okay to fly.”
After I had a chance to review a copy of Joe’s chart, I realized that I didn’t agree with any of his statements made to support a launch decision. I believe that anyone who has normal powers of reason will question the validity of Figure 11 as a document to support the Challenger launch.
|1. calculations show that SRM-25 O-rings will be 20 °F colder than SRM-15 rings|
|2. temperature data not conclusive on predicting primary o-ring blow-by|
|3. engineering assessment is that: colder o-rings will have increased effective durometer (“harder’)|
|4. “harder” O-rings will take longer to “seat”|
|5. more gas may pass primary O-ring before the primary seal seats (relative to SRM 15)|
|6. demonstrated sealing threshold is 3 times greater than 0.038″ Erosion experienced on SRM-15.|
|7. if the primary seal does not seat, the secondary seal will seat|
|8. pressure will get to secondary seal before the metal parts rotate|
|9. O-ring pressure leak check places secondary seal in outboard position which minimizes sealing time|
|10. MTI recommends STS-51l launch proceed on 28 January1986|
|11. SRM-25 will not be significantly different from srm-15.|
Signed by Joe C. Kilminster, Vice President Space Booster Programs
Figure 11. MTI assessment of temperature concern on SRM-25 (51l) launch
The chart lists twelve separate statements. Statements 1, 2, 4, 5, 6, 8 and 9 actually support a no-launch decision. Statement 3 is actually a lie. There was no engineering assessment made during the caucus. Arnie and I continued to press for retaining the original decision of not launching below 53 °F (12 °C). Statement 7 addresses the erosion margin but erosion was not the primary topic of discussion that evening. We were all discussing whether the seals would even seal before hot gas blow-by would destroy them, this statement is the only one to support a launch but it was not part of the concern that night. Statement 10 neither supports nor is against a launch decision. It is simply a statement of engineering fact which states that when pressure is applied to an O-ring seal, it will move away from the pressure to the opposite side of the groove containing it. Statement 12 is a contradiction of statement 1 because everyone knew that 20 °F (-7 °C) colder seals were very significant as our preliminary test data had shown.
Therefore, MTI senior management reversed a sound technical recommendation without one shred of supporting data and without any re-evaluation of the data they had promised when they requested the caucus.
The next morning I paused outside Arnie Thompson’s office and told him and my boss that I hoped the launch was safe, but I also hoped that when the booster joints were inspected that we would find all the seals burned almost all the way through the joint, and then maybe we could get someone with authority to take a stand and stop the flights until we fixed the joints.
Later, I was walking post the room normally used to watch the launches when Bob Ebeling stepped out to invite me to watch the launch. At first I refused because I didn’t want to watch the launch, but he encouraged me to enter. The room was filled so I seated myself on the floor close to the screen and leaned against Bob’s legs as he was seated in a chair. The boosters ignited and as the vehicle cleared the support tower, Bob whispered to me that we had just dodged a bullet. The reason Bob made this statement was that the propellant experts had told us that the boosters would explode at ignition if we developed a leak in the case. At approximately T+60 seconds, Bob again whispered to me that he had just completed a prayer of thanks to the Lord for a successful launch. Just 13 seconds later we both saw the horror of destruction as the vehicle exploded. We all sat in stunned silence for a short time; then I left the room and went directly to my office where I remained in shock for the remainder of the day. Two of my seal task team colleagues inquired about my condition at my office, but I was unable to speak to them and hold back my emotions, so I just nodded yes I was okay and they left after a short silent stay.
Within a day of the launch, one of my colleagues on the seal task force team told me that he was reviewing the video tape and thought he could see a plume of flame coming from a booster as it exited the explosion. My first thought was that one of the joints had failed, so I postulated several scenarios to fit the observations and one of them turned out to be what was found to cause the disaster. A failure investigation team was formed at MTI on January 31, 1986, which included Arnie Thompson and myself. The team was immediately sent to MSFC in Huntsville, Alabama.
This essay provides a summary of important events leading to the Challenger disaster. Plus, a detailed account will show why the off-line telecon caucus by Morton Thiokol Management constituted the unethical decision-making forum which ultimately produced the management decision to launch Challenger without any restrictions.
Background on the events, meetings, and SRM testing leading up to the Morton Thiokol Space Shuttle Challenger Disaster.
This testimony outlines the post challenger disaster treatment, and the separation of engineers and management. Details the isolation and hostile work environment in the redesign effort at MTI”
Engineering and responsibility and ethics that must be followed in the work place, pertaining to lessons learned from the Morton Thiokol and the space shuttle Challenger disaster.
Who is accountable and at what costs in the Morton Thiokol Space Shuttle Challenger Disaster.
Closing remarks regarding Robert Boisjoly’s attempts to divert the Challenger disaster.
The Appendix providing references for regarding Robert Boisjoly’s attempts to divert the Challenger disaster.