Space Shuttle Challenger Case

(From The Knowing Organization, Chapter 5)

Morton-Thiokol Inc. had engineered the space shuttle's solid rocket booster (SRB) based on the Air Force's Titan III design because of its reliability. The SRB's steel case was divided into segments that were joined and sealed by rubber O-rings. Although the Titan's O-rings had occasionally been eroded by hot gases, the erosion was not regarded as significant. A second, redundant O-ring was added to each joint to act as back-up should the primary O-ring failed. As early as 1977, a test of the SRB case showed an unexpected rotation of the joints which decompressed the O-rings making it more difficult for them to seal the joints. In 1980, a review committee concluded that safety was not jeopardized and the joints were classified as Criticality 1R, denoting that joint failure could cause loss of life or shuttle (the 1 in the rating); and that secondary O-rings provided redundancy (the R in the rating). During 1983, the SRBs were modified to use thinner walls, narrower nozzles, and more powerful fuel, which worsened the joint rotation. Tests showed that the rotation could be so large that a secondary O-ring could not seal a joint and provide redundancy. The R rating was consequently removed from the joints' Criticality classification. Nevertheless, many NASA and Thiokol documents produced over the next three years continued to list the Criticality as 1R, and seemed to suggest that neither management thought that a secondary O-ring could really fail to seal a joint.

In a flight readiness review of March 1984, NASA's top managers discussed and accepted the idea that some O-ring erosion was 'acceptable' because the rings embodied a safety factor. The incidence of heat damage at the SRB joints was growing -- three of the five 1984 flights showed heat damage, eight of the nine 1985 flights, and the flight on January 12, 1986, just two weeks before Challenger. In spite of these signals, the management of the SRB project at Marshall Space Flight Centre and at Thiokol remained confident that the erosion was 'allowable' and an 'acceptable risk.' The April 1985 flight showed significant damage at one primary O-ring, with a substantial amount of hot gas blowing by this ring, which in turn eroded the secondary O-ring (Bell and Esch 1987). This led Lawrence Mulloy, SRB project manager at Marshall, to place a 'launch constraint' on all subsequent flights, acknowledging that a problem of Criticality 1, 1R, 2, or 2R might occur. However, Mulloy 'waived' the launch constraint for all subsequent flights up to the last one. In early December 1985, Thiokol was told to 'close out' long outstanding problems, including O-ring erosion problems, and the relevant problem reports were subsequently marked as 'contractor closure received.' O-rings were no longer listed as a launch constraint for the flight readiness review of January 15, 1986, and O-rings were not mentioned in the Flight Readiness Review documentation of the Challenger.

On the afternoon of January 27, 1986, the eve of the launch, the weather forecast predicted unusually cold weather for Florida, with temperatures at low 20s in the early hours of January 28. Thiokol engineers expressed concern that at such cold temperatures, the O-rings would harden and not seal the joints against the hot ignition gases.

Two telephone conferences were held at three sites (Thiokol, Marshall SFC, and Kennedy Space Center) on the evening of January 27 to discuss whether the launch should be delayed. Thirty four engineers and managers participated in the second conference, where Thiokol engineers warned that at the forecast temperatures, the O-rings would seal more slowly than on the coldest launch to date, a January 1985 mission when the temperature was 53 deg. F, at which a primary O-ring was eroded so that it failed to seal, allowing hot gases to 'blow by' to the secondary ring. Although the secondary ring did seal the joint then, the engineers argued that a more extensive blow-by could damage the secondary ring so that it does not seal. Someone then pointed out that one of the Thiokol data points showed blow-by at 75 deg. F, suggesting that temperature was not the only factor.

Roger Boisjoly, a Thiokol staff engineer was asked what evidence existed to show that O-ring damage was the result of cold temperatures. Boisjoly replied that he could not quantify his concerns, that he had no data to quantify it, but that he knew "it was away from goodness in the current database." Lawrence Mulloy, Manager SRB Project at Marshall, asked Thiokol management for a recommendation. Thiokol's Joseph Kilminster, Vice President Space Booster Programs, replied that he could not recommend a launch at any temperature below 53 deg. F. Mulloy said that since booster joint temperatures had never been set as launch criteria, Thiokol was effectively trying to create new Launch Commit Criteria on the eve of the launch. He then exclaimed, "My God, Thiokol, when do you want me to launch, next April?"

George Hardy, Marshall's Deputy Director of Science and Engineering, added that he was "appalled" at the Thiokol recommendation, that the data presented did not conclusively support a correlation between temperature and O-ring erosion, but that he will not agree to a launch against Thiokol's recommendation. The challenges from both Mulloy and Hardy, worded in strong language, put pressure on the Thiokol engineers. Kilminster then asked for permission for Thiokol engineers and managers to go off-line for a few minutes. All participants who were asked why the caucus was called thought that it was because Thiokol's engineering analysis was weak.

During the off-line caucus, which lasted for about half an hour, Thiokol's Senior Vice President Jerry Mason stated that the possibility of blow-by and erosion had always been present in the earlier flights, and had been considered as acceptable risks. They should therefore consider the temperature issue separately on its own. Mason reaffirmed the belief in redundancy, that the primary O-ring would perform properly, but if it sealed slowly and blow-by occured, then the secondary O-ring would be in position and would seal. Boisjoly and another engineer (Arnold Thompson) defended the engineering position that based on the data they had, they did not know what the secondary O-ring would do in these cold temperatures.

After several minutes of discussion Mason noted that they were starting to go over the same ground over and over again and said that "Well, it's time to make a management decision." Mason, Kilminster, Wiggins (VP & GM Space Division), and Lund (VP Engineering) then conferred among themselves, effectively excluding the engineers from the decision making. Mason, Kilminster, Wiggins supported a launch recommendation, but Lund hesitated. Mason said to Lund, "It's time to take off your engineering hat and put on your management hat." Lund then voted with the rest. When they were later asked why they had reversed their initial recommendation and changed their minds about the danger of a low-temperature launch, "all said that they were influenced by facts not taken into account before their initial recommendation. These facts supported redundancy: thus, they believed that the secondary would seal the joint."

When the teleconference resumed, Kilminster summarized Thiokol's position. Although temperature effects were a concern, the data predicting blow-by were inconclusive. Erosion tests had indicated that the primary O-ring could sustain three times more erosion than that experienced in the previous worst case. Furthermore, even if the primary failed, the secondary as back-up would still seal the joint.

Stanley Reinartz, Manager Shuttle Projects Office at Marshall, then asked all participants of the teleconference whether there were disagreements or comments about Thiokol's recommendation. No one said anything. As part of normal NASA procedures, Mulloy asked Kilminster to fax a copy of the flight-readiness rationale and recommendation to Marshall and Kennedy. The teleconference ended. At 11.38 am the following morning the Challenger was launched. The ambient temperature was 36 deg. F. Seconds later, the shuttle exploded, killing all on board.