‹ Mark ở vũ trụ khácVIMark học AI
Mark ở vũ trụ khác · Another Universe Anatomy of a Disaster · Space · Decision-making

Space Shuttle Challenger

2°C 73 sec

STS-51-L · 28 January 1986 · Kennedy Space Center, Florida

What happenedthe shuttle broke apart 73 seconds after launch
Loss7 astronauts, one of them a schoolteacher
Root causean O-ring in a booster joint failed in the cold
Main sourceRogers Commission report, June 1986
Reread in 1 minute

Essence

A rubber ringThe O-ring in the right booster's joint stiffened in the cold, and hot gas burned through.
Known since 1977The joint flaw had been on file for 9 years. 7 of the 23 earlier flights had damaged O-rings.
The burden of proof flippedThe night before, engineers had to prove it was "not safe" instead of being asked "is it safe yet?"
Drift into normalEvery flight that came home safely made the damage look a little more "acceptable".
No villainPeople followed the process. It was the process itself that had drifted, without anyone noticing.

Sources: Rogers Commission report (1986), chapters 4–6; flight counts from Dalal, Fowlkes and Hoadley (1989), table 1.

Part 1

The question of the case

An organisation full of good engineers, aware of the weak point for 9 years, with engineers objecting the very night before: why did it still press the launch button? The answer lies not in one person, but in how a whole organisation slowly got used to risk.

1977–1985Knowing the flawTests showed the joint opening up. O-rings eroded on many flights.
→
27 Jan 1986The night of the argumentThiokol engineers advised against launching below 53°F. Three hours later, management reversed.
→
28 Jan 198673 seconds2°C outside. Black smoke at the joint in the first second. Breakup at second 73.
Part 2

What happened

Every time stamp below comes from chapter 3 of the Rogers Commission report.

The 73-second timeline. At 0.678 s: grey smoke puffs from the aft joint of the right booster. By 2.5 s: eight more puffs of black smoke. Then aluminum oxide slag temporarily plugs the gap. From 37 to 64 s: several strong wind-shear events. At 58.8 s: a flame appears at the joint. At 64.7 s: the flame breaches the external fuel tank. At 72.2 s: a strut breaks. At about 73 s: the vehicle breaks apart. strong wind shear · 37–64 s 0.678 sgrey smoke ~3 saluminum oxideplugs the gap 58.8 s · flame 64.7 sfuel tank breached ~73 s breakup time scale: seconds after liftoff · air temperature 36°F (2°C), joint below 0°C
The shuttle almost made it. Burnt slag plugged the gap for nearly a minute. The Commission believed the wind-shear events may have broken that temporary seal.Source: Rogers Commission report, chapter 3 (timeline) and chapter 4 (joint temperature).
1977 · Pressure testThe two halves of the joint moved apart instead of pressing together. Thiokol considered it insignificant.
1978–1979 · NASA engineers object in writingEngineers at Marshall called the design "unacceptable". The memos never reached Thiokol.
1982 · No backup seal any moreThe joint was put in the highest criticality class (failure means loss of the vehicle), then granted a waiver in 1983.
Jan 1985 · Flight 51-C, 53°F (12°C)The coldest launch up to then. Hot gas got past the primary O-ring.
31 Jul 1985 · Roger Boisjoly's memo"The result would be a catastrophe of the highest order — loss of human life."
27 Jan 1986, evening · The teleconferenceEngineers advised against launch. After a 30-minute private caucus, Thiokol's leadership changed its recommendation.
28 Jan 1986, 11:38 · LaunchIce covered the launch pad. There was no rule on surface temperature.

Source: Rogers Commission report, chapter 5 (the teleconference, pad ice), chapter 6 (1977 test, the memo, flight 51-C) and chapter 7.

Episode 1

What happened

73 seconds2°C7 peoplethe night before
Episode 2

Why

O-ringa chart missing the zerosdrift into normalmyths
Episode 3

Work lessons

who has to prove itengineering hat, management hatgo/no-go meetings
Part 3

Why: five layers of cause

The technical layer: the field joint and the O-ring

field joint · O-ringRogers, chapters 4 and 6
Cross-section of the field joint between two booster segments. The upper segment has a tang that fits into the clevis of the lower segment. Two O-rings, primary and secondary, seal the gap. At ignition, pressure makes the joint rotate and the gap widens. The O-ring must expand to fill the gap within milliseconds. At low temperature the rubber stiffens and expands slowly, and hot gas leaks past. hot gas from the motor ← primary O-ring← secondary O-ring 1 · ignition: joint "rotates", gap opens 1977 test: gap opened up to 1.3 mm 2 · O-ring must expand to seal at once 3 · cold: rubber stiff, slow → leak
The O-rings were not designed to erode. Feynman wrote: "Erosion was a clue that something was wrong". The Commission called the root cause "a faulty design unacceptably sensitive to a number of factors": temperature, dimensions, materials and reuse.Sources: Rogers Commission report, chapters 4 and 6 (0.052-inch ≈ 1.3 mm gap in the 1977 test); Feynman, Appendix F.

The data layer: a chart missing the zeros

missing denominatorsRogers, chapter 6, figures 6 and 7
A chart of only the 7 flights with damaged O-rings, arranged by temperature from 53 to 75 degrees F. Looking at it, no pattern with temperature is visible. 1 2 3 0 30°-1°C 40°4°C 50°10°C 60°16°C 70°21°C 80°27°C joint temperature at launch (°F) damaged O-rings damaged flights only
The view the night before: only the flights with problems. The Commission wrote that, seen this way, there "is nothing irregular" in the distribution over temperature.Sources: Rogers Commission report, chapter 6, figure 6; per-flight data: Dalal, Fowlkes and Hoadley (1989), table 1.
A chart of all 23 flights. All four flights below 65 degrees F had damaged O-rings. Of the 19 flights at 66 degrees F and above, only 3 had damage. On Challenger's launch day the joint was at about 31 degrees F, far to the left, outside all existing data. 1 2 3 0 30°-1°C 40°4°C 50°10°C 60°16°C 70°21°C 80°27°C joint temperature at launch (°F) damaged O-rings below 65°F: 4 of 4 flights damaged 66°F and up: 3 of 19 damaged 28 Jan 1986~31°F (−0.5°C)outside all data
Add the flights without damage, and the pattern appears. Data: Dalal, Fowlkes and Hoadley (1989), table 1. Their model estimated at least a 13% chance of catastrophic O-ring failure at 31°F; postponing to 60°F cut it to about 2%. This is an analysis done after the accident, not something on the table that night.Sources: Dalal, Fowlkes and Hoadley, JASA 84(408), 1989, table 1 and p. 957; Rogers Commission report, chapter 6, figure 7. The 4 of 4 and 3 of 19 counts come from Dalal's table; the Rogers Commission says "three … out of twenty" flights at 66°F or above. Launch-day joint temperature: 31°F per Dalal, 28 ± 5°F per the Rogers Commission.

The decision layer: the night the burden of proof flipped

burden of proofRogers, chapter 5
The night of 27 January 1986. 8:45 p.m.: Thiokol presents, recommending no launch below 53 degrees F. NASA's Lawrence Mulloy: "My God, Thiokol, when do you want me to launch, next April?". 10:30 p.m.: Thiokol asks for a 30-minute private caucus. Senior Vice President Jerald Mason asks Bob Lund "to take off his engineering hat and put on his management hat". 11:00 p.m.: Thiokol reads a new recommendation, agreeing to launch and calling the data "inconclusive". 20:45 · Thiokol presents "no launch below 53°F" coldest ever flown NASA: "when do you want me to launch, next April?" 22:30 · 30-min caucus "take off his engineering hat put on his management hat" engineers had no vote on the final call 23:00 · new recommendation "go for launch" data "inconclusive" no one objected when asked Boisjoly: "it was up to us to prove beyond a shadow of a doubt that it was not safe to do so. This is in total reverse to what the position usually is."
No one invited a safety representative to the meeting (Rogers, chapter 7). The Commission concluded that Thiokol's management reversed its position, contrary to its own engineers, "to accommodate a major customer".Source: Rogers Commission report, chapter 5 (times, quotes, Boisjoly testimony) and chapter 7.

The culture layer: the normalization of deviance

normalization of devianceDiane Vaughan, 1996
The staircase of getting used to it. 1977: the joint opening is "unacceptable". 1981: first in-flight O-ring erosion, an anomaly. 1983: an erosion limit of 0.090 inch is set and called a safety margin. 1985: hot gas blows by, "undesirable but acceptable". 1985: the primary O-ring fails to seal; a launch constraint is imposed but waived for every flight. December 1985: the file marks the problem "closed". 1986: launch at 2 degrees C. 1977"unacceptable" 1981first erosion 1983"safety margin" Jan 1985"acceptable" Apr 1985constraint, waived Dec 1985"closed" Jan 1986launch at 2°C
Each step is only slightly higher than the one before. Vaughan's definition: "Behaviour that outsiders see as objectively deviant can become normal and acceptable to people inside the organisation." She rejects the reading that managers knowingly traded lives for the flight schedule.Sources: milestones and the 0.090-inch erosion limit from the Rogers Commission report, chapter 6; the concept from Vaughan (1996, 2005).

Normalization

Every safe return was taken as evidence of safety. Feynman: when playing Russian roulette, the fact that the first shot got off safely is little comfort for the next.

Culture of production

NASA planned 24 flights a year. 1986 had 15 flights on the schedule; Challenger had to borrow 45 parts from other orbiters (Rogers, chapter 8).

Structural secrecy

No one was hiding anything. Information was filtered at every level, so the top could not see how serious it was.

The numbers layer: engineers and managers 1,000 times apart

risk perception gapFeynman, appendix F
Estimated probability of losing the vehicle per flight, log scale. Historical solid-rocket data: 1 in 25. Engineers: about 1 in 100. NASA management: 1 in 100,000. The actual record of the whole shuttle program: 2 vehicles lost in 135 flights, about 1 in 68. 1/101/1001/1,0001/10,0001/100,000 solid rockets, history1/25 actual shuttle record~1/68 engineers~1/100 NASA management1/100,000
"What is the cause of management's fantastic faith in the machinery?" Feynman asked. A figure of 1/100,000 means launching every day for 300 years before losing one vehicle. In reality: Challenger lost in 1986 and Columbia in 2003, in 135 flights.Sources: Feynman, Appendix F, Rogers Commission report (the 1/25, 1/100 and 1/100,000 estimates and the 300-year example); 2 vehicles lost in 135 flights, 1981–2011: NASA.
Part 4

Fact check: what is true and what is myth

13 things often said about Challenger, checked against the primary record. Click each row to see why.

SOLIDA failed seal in the lower joint of the right booster was the direct cause

The consensus finding of the Rogers Commission (chapter 4), backed by images of smoke at 0.678 s and flame at 58.8 s at exactly that spot.

SOLIDThe joint flaw was known years in advance

The 1977 test, the 1978–1979 memos calling the design "unacceptable", and damaged O-rings on 7 of the 23 flights whose boosters were recovered (Rogers, chapter 6).

SOLIDThiokol engineers advised against launching below 53°F

Recorded in chapter 5, along with Boisjoly's testimony: "we should not fly outside of our data base, which was 53 degrees".

SOLIDThere was schedule pressure from inside NASA

A plan of 24 flights a year, parts taken from other orbiters, squeezed training time (Rogers, chapter 8). Vaughan calls it the "culture of production".

CAUTIONThe engineers were ignored, nobody listened

They were heard for hours, and NASA's side said it would not launch over Thiokol's objection. What happened is that Thiokol's own leadership reversed after the private caucus, and the burden of proof was flipped. Engineer Bob Ebeling later said, "I could have done more".

CAUTIONA good chart would certainly have stopped the launch

Edward Tufte (1997) says yes. A 2002 rebuttal co-authored by Boisjoly himself says the engineers did not have the temperature data despite asking for it, that Tufte's temperature axis mixes O-ring temperature with air temperature, and that the core issue was the burden of proof, not the graphics. The dispute is unresolved.

CAUTIONMillions of schoolchildren watched it live

The major broadcast networks had cut away before launch; CNN carried it live, and NASA sent a satellite feed to schools for the "Teacher in Space" program. Many pupils really did watch live, but most Americans saw replays. No original survey was found for the percentages often quoted.

CAUTIONChallenger "exploded"

There was no explosion in the sense of a detonation or shock wave. The external tank failed, the vehicle was torn apart by aerodynamic forces, and the propellants burned in a fireball. "Broke apart" is more accurate.

CAUTIONThe crew were conscious until they hit the ocean

Dr Kerwin's report (July 1986): 3 of the 4 recovered emergency air packs had been activated by hand, so at least some of the crew were alive and acting after the breakup. But they "possibly, but not certainly" lost consciousness in the seconds that followed. Whether the cabin lost pressure could not be established.

CAUTIONFeynman found the cause on his own

The televised demonstration of dropping the O-ring into ice water was his. But the initial hint came from General Donald Kutyna, and after Sally Ride died (2012), Kutyna said it was she who had given him the NASA documents on O-rings stiffening in the cold. (Secondary source: Kutyna's account.)

FALSEThe crew died instantly

The crew cabin separated nearly intact, with accelerations at breakup of about 12–20 G, which are "survivable". The cabin fell for about 2 minutes 45 seconds before hitting the sea. The cause of death "cannot be positively determined" (Kerwin).

FALSEThe White House pushed for a launch in time for the State of the Union

The Commission investigated this rumor. Those involved stated there was no plan for a live hookup, and the launch decision was made by NASA officials "without any outside intervention or pressure" (Rogers, chapter 8).

FALSEAn asbestos ban ruined the joint putty

A long-running online myth. Space journalist James Oberg, who compiled the myths about Challenger, calls the putty change "unrelated to the disaster".

Part 5

Assessing the case

Scores are Mark's assessment based on the sources in Part 8, not figures from a study.

Avoidable
5/5
Prior warnings
5/5
Transparent inquiry
4/5
Lessons retained
2/5
Done right after the disaster
  • A public report that named the decision failures plainly
  • The joint was redesigned, with a third O-ring and heaters
  • A safety office reporting directly to NASA leadership
Not done right
  • Boisjoly was isolated and taken off space work
  • The design was fixed faster than the culture
  • 17 years later, Columbia repeated the same kind of mistake

The most avoidable disaster of the US space program, because every piece of information needed was already in the meeting room the night before.

More: why the lessons were forgotten

In 2003, Columbia broke apart on re-entry because a piece of foam insulation struck its wing at launch. Foam shedding, too, had happened many times and had slowly come to be seen as normal. The Columbia Accident Investigation Board wrote that "the history of engineering decisions on foam and O-ring incidents had identical trajectories", and engineers were again asked to prove the flight was "unsafe".

Vaughan worked with the Columbia investigation board. She concluded that "from Challenger NASA learned incomplete lessons": it fixed the O-ring, but not the pressures and structure that dulled the danger signals.

Part 6

Work lessons: don't let small deviations become normal

Applies to any "go or no-go" meeting: a product launch, pushing code to production, signing a contract.

Four steps for a decision meeting: write the criteria before the meeting, state clearly who has to prove what, plot the runs without incidents too, and record objections in the minutes. 1 · set criteria first"below 53°F: postpone"fixed before the pressure 2 · who must prove it"is it proven safe?"not "is it dangerous?" 3 · plot the zerosevery run, failed or notand mark where you are 4 · record dissentname, reason, datein the minutes "It worked last time" is not evidence of safety.
Each step matches one failure point on the night of 27 January. The criterion was argued over mid-meeting, the burden of proof was flipped, the data lacked the zeros, and the engineers had no voice in the final decision.
Track small incidents as a trendThe Commission found "little or no trend analysis" of O-ring erosion. Build a table; don't handle each case on its own.
Separate the engineering hat from the management hatRecord the technical recommendation and the business decision separately. Whoever changes the recommendation signs their name.
Ask for risk numbers independentlyAsk the people doing the work before you ask the boss. A big gap is a signal.
Compare with the original design, not with last timeThe erosion limit went from "no erosion allowed" to "0.090 inch of erosion is fine". Go back to the original baseline regularly.
For a successful technology, reality must take precedence over public relations, for nature cannot be fooled.Richard Feynman, closing line of appendix F, Rogers Commission report (1986).
Part 7

Further reading

Richard Feynman, What Do You Care What Other People Think? (1988)The second half of the book is Feynman's memoir of the Rogers Commission, as easy to read as a story.
Diane Vaughan, The Challenger Launch Decision (1996)The book that coined "normalization of deviance". Long, but it is the original work.
Edward Tufte, Visual Explanations (1997), and the rebuttal by Robison, Boisjoly et al. (2002)Read both to see a real debate about data.
Anatomy of a Disaster #02: Mars Climate Orbiter (1999)A spacecraft of about US$125 million (per NASA) lost because two teams used two different units of measurement.
Part 8

Sources

Primary documents first. Wherever only a secondary source exists, it is flagged in the Fact check section.

  1. Rogers Commission, Report of the Presidential Commission on the Space Shuttle Challenger Accident, volume I, June 1986, chapters 3–8 and recommendations. nasa.gov/history/rogersrep
  2. R. P. Feynman, "Personal Observations on the Reliability of the Shuttle", appendix F, volume II. nasa.gov
  3. J. P. Kerwin, letter to R. H. Truly on the crew, 28 July 1986. nasa.gov
  4. Dalal, Fowlkes and Hoadley, "Risk Analysis of the Space Shuttle: Pre-Challenger Prediction of Failure", JASA 84(408), 1989.
  5. Robison, Boisjoly, Hoeker and Young, "Representation and Misrepresentation: Tufte and the Morton Thiokol Engineers on the Challenger", Science and Engineering Ethics 8(1), 2002. onlineethics.org
  6. D. Vaughan, The Challenger Launch Decision, University of Chicago Press, 1996; and "System Effects", in Organization at the Limit, 2005.
  7. Columbia Accident Investigation Board, report volume I, chapter 8 "History as Cause", August 2003.
  8. J. Oberg, "7 myths about the Challenger shuttle disaster", NBC News. nbcnews.com