The entry says that the joint which failed on 28 January 1986 had been known to rotate since 1977, known to be a single seal since 1982, and known to burn since 1984. This piece sets out what the record shows, in the order the Commission reconstructed it from the files of Marshall and Thiokol, with the dates and the words. It is a history of a warning that was written down at nearly every stage and acted on, in the sense of stopping a flight, at none.

The contract, 1973

NASA chose Morton Thiokol to build the Shuttle’s solid rocket motors on 20 November 1973. The Source Evaluation Board had rated the company fourth of four on “design, development and verification”, second on manufacturing and first on management; its overall mission-suitability score was second, tied. The selection officials wrote on 12 December that “Thiokol’s cost advantages were substantial and consistent throughout all areas evaluated”, that “any selection other than Thiokol would give rise to an additional cost of appreciable size”, and that the technical criticisms “were readily correctable, and the costs to correct did not negate the sizable Thiokol cost advantage.” They praised the joint: “The Thiokol motor case joints utilized dual O-rings and test ports between seals, enabling a simple leak check without pressurizing the entire motor. This innovative design feature increased reliability and decreased operations at the launch site.”

The design was borrowed from the Air Force’s Titan III, with differences the Commission listed. Titan’s joint had one O-ring and a tight overlap of insulation that took most of the pressure; Thiokol’s had two rings and nothing but putty between them and the flame, and its tang was longer, to take two rings, and bent more. The rings were spliced from up to five pieces of rubber, and the cases were to be fished out of the sea and used up to twenty times.

The test of 1977

Thiokol pressurised a case with water to about 1,500 pounds per square inch in 1977, to prove the steel, and put instruments on the leak-check port of a joint. The joint opened. Arnold Thompson told the Commission: “We discovered that the joint was opening rather than closing as our original analysis had indicated, and in fact it was quite a bit. I think it was up to 52 one-thousandths of an inch at that time, to the primary O-ring.” Thiokol “did not believe the test results really proved that ‘joint rotation’ would cause significant problems”, and scheduled no further test to find out.

Marshall’s engineers did believe it. On 2 September 1977 Glenn Eudy, chief engineer of the motor division, wrote that “I personally believe that our first choice should be to correct the design in a way that eliminates the possibility of O-ring clearance.” Leon Ray’s “Solid Rocket Motor Joint Leakage Study” of 21 October 1977 called “no change” to the design “unacceptable” and recommended “redesign of the tang and reduce tolerance on the clevis” as “the best option for a long-term fix.” A memorandum signed by John Miller, chief of the motor branch, on 9 January 1978 said that “we see no valid reason for not designing to accepted standards” and that proper sealing by shims was “mandatory to prevent hot gas leaks and resulting catastrophic failure.” A year later, with no answer, Miller signed a second, dated 19 January 1979, which opened: “We find the Thiokol position regarding design adequacy of the clevis joint to be completely unacceptable”, and said that the rotation forced the primary ring “to function in a way which violates industry and government O-ring application practices”, that it let the secondary “become completely disengaged from its sealing surface on the tang”, and that “the clevis joint secondary O-ring seal has been verified by tests to be unsatisfactory.” A copy went to George Hardy, then the booster project manager. The Commission learned that Ray had written both memoranda and Miller had signed them; it found no reply from Eudy, and no record that Thiokol ever received them. In February 1979 Ray took the test data to two O-ring makers, who “voiced concern for the design, stating that the Solid Rocket Motor O-ring extrusion gap was larger than that covered by their experience”, and whose “first thought was that the O-ring was being asked to perform beyond its intended design and that a different type of seal should be considered.” No record shows Thiokol was told of the visits. The design was not changed.

The letter R, 1980 to 1983

In 1980 a Verification/Certification Committee reviewed the whole Shuttle. Its propulsion panel noted that the leak check pushed the primary ring the wrong way, that the putty’s effect was uncertain, and that redundancy was a concern, and asked for a burst test with one ring removed and for full-scale firings across a propellant temperature range of 40 to 90 degrees. NASA’s programme office answered in September 1980 that the joint “has been sufficiently verified with the testing accomplished to date”. On 24 November 1980 the joint went on the Critical Items List as “1R”: failure could lose the vehicle, but there was a redundant part. The entry itself said that “it is not known if the secondary O-ring would successfully reseal if the primary O-ring should fail after motor case pressure reaches or exceeds 40 percent of maximum expected operating pressure.” Arnold Aldrich, shown that language in 1986, said: “I would call it [criticality] 1.”

The Shuttle first flew on 12 April 1981. After the second flight, in November, the primary ring of the right booster’s aft field joint was found eroded 0.053 inches, the worst erosion a field-joint primary would show until Challenger. It was not reported at the next readiness review and was not entered in Marshall’s problem assessment system. In May 1982 high-pressure tests of the rings and of the new lightweight case made Marshall’s management accept at last what Ray had said: once the joint rotated, the secondary ring was no longer a seal. On 17 December 1982 the R was removed. The new entry read: “Criticality Category 1. Failure Mode and Causes: Leakage at case assembly joints due to redundant O-ring seal failures or primary seal and leak check port O-ring failure. Note. Leakage of the primary O-ring seal is classified as a single-failure point due to possibility of loss of sealing at the secondary O-ring because of joint rotation after motor pressurization. Failure Effect Summary: Actual Loss. Loss of mission, vehicle and crew due to metal erosion, burn through, and probable case burst resulting in fire and deflagration.” Its rationale for retention, written at Thiokol on 1 December, said the design was like Titan’s, that full redundancy existed “at the moment of initial pressurization”, and that “a rationale for retention is provided for the simplex mode where only one O-ring is acting.”

The change needed a waiver of the Shuttle’s requirement that every subsystem be fail-safe. The waiver was processed outside the formal control board and signed at Level I by L. Michael Weeks on 28 March 1983, a week before the sixth flight; Weeks told the Commission that “all of the people in the program I think felt that this Solid Rocket Motor in particular or the Solid Rocket Booster was probably one of the least worrisome things we had in the program.” The Commission found that Mulloy, Hardy and Judson Lovingood all went on believing the secondary ring redundant “in all but situations of worst case tolerances”, that nothing in the list said so, and that documents at both Marshall and Thiokol went on calling the joint 1R “long after the status was changed to Criticality 1.”

The leak check, 1983 to 1984

The thing the selection board had liked best was the leak check: air put in through a port between the rings to prove them seated. The air pushed the secondary ring outward into its seat and the primary ring inward, away from its seat, so that at ignition the primary had to cross its groove before it could seal. And the check was found to be unreliable at low pressure, because the putty could hold 50 pounds per square inch and mask a primary ring that was not sealing. The pressure was raised to 100, and for the tenth flight, in February 1984, to 200. At 200 pounds the air blew holes in the putty, and through those holes the hot gas at ignition found the ring. Before the change, one field joint in nine flights had shown damage. After it, more than half the flights did. The nozzle joint followed the same path from 12 per cent of flights to 56 to 88. Brian Russell of Thiokol worked this out in a letter of 9 April 1984; the Commission put it to him in May 1986 and he said: “We realized that.” Mulloy agreed that blow holes in the putty were the primary cause of the erosion and that his leak check was one cause of the blow holes.

The tenth flight, 41-B, was the first with erosion in a field joint and a nozzle joint at once, and the first for which Thiokol filed a problem report. The Level I review on 30 March 1984 approved the next flight “accepting the possibility of some O-ring erosion due to the hot gas impingement”, on the arithmetic that the worst erosion possible was 0.090 inches and a ring with 0.095 cut out had sealed in the laboratory at 3,000 pounds per square inch. An action item from NASA’s deputy administrator on 5 April 1984 asked Mulloy for a formal review of the sealing procedures. Thiokol’s reply of 4 May was a plan. Its final answer was the briefing of 19 August 1985, fifteen months later.

The cold, 1985

Flight 51-C went up on 24 January 1985 with its joints at a calculated 53 degrees. Both boosters came back with erosion and blow-by; the right centre field joint had hot gas past its primary ring and heat on its secondary, the first time a secondary had been touched. Mulloy sent an urgent message on 31 January ordering that the next review “recap all incidents of O-ring erosion, whether nozzle or case joint, and all incidents where there is evidence of flow past the primary O-ring.” Thiokol’s eighteen-page analysis of 8 February 1985 was the first document in the programme to name temperature: “Low temperature enhanced probability of blow-by. STS 51-C experienced worst case temperature change in Florida history. STS 51-E could exhibit the same behavior. Condition is acceptable.” Its resolution of the right centre joint was two words: “accept risk”. At Level I on 21 February this became a single chart: “acceptable risk because of limited exposure and redundancy (Ref. STS 41-C FRR)”. The Commission found “no mention of temperature” in the Level I report.

The resiliency tests of that spring were reported on 3 June and described by Russell to Marshall on 9 August 1985: “At 100°F, the O-ring maintained contact. At 75°F the O-ring lost contact for 2.4 seconds. At 50°F, the O-ring did not reestablish contact in ten minutes at which time the test was terminated.” Russell’s letter also gave the timing that Boisjoly later put on his first chart of 27 January: a high probability that the secondary would hold if the primary failed in the first 170 milliseconds, a reduced probability from 170 to 330, and from 330 to 600 only a slight chance. An unsigned Marshall draft of August 1985 drew the conclusion: “secondary sealing capability in the SRM field joint cannot be guaranteed.”

On 25 June 1985 the left nozzle joint of 51-B was opened at Thiokol. Its primary ring had eroded 0.171 inches, against a model that said 0.090 was the most possible if the ring sealed, and so it had never sealed; its secondary had eroded 0.032. Mulloy and the problem assessment committee at Marshall put a launch constraint on the problem. A 1980 Marshall letter defined the term: all open problems of criticality 1 or 2 “will be considered launch constraints until resolved”. It applied to 51-F and to every flight after. Mulloy waived it each time. Asked by Rogers what a constraint meant, he said it meant the observations had to be “addressed” at each readiness review; asked whether that meant “think about it?”, he said no, it meant presenting the data and arguing that the earlier rationale still held. Sally Ride asked why no constraint had been put on the field joint at the same time. “I will react to that question in real time, because I haven’t really thought about it,” Mulloy said. Thiokol’s witnesses said they had not known there was a launch constraint at all, though their own letters cited the Marshall record that carried it. The Commission found no mention of the constraint or its waivers in any readiness review document, and that Levels I and II “apparently did not realize Marshall had assigned a launch constraint.”

Three days after the 51-B inspection a headquarters engineer wrote to Weeks reporting the burn-through and reminding him that Thiokol had still not answered the action item of April 1984. On 22 July Boisjoly wrote that the company might lose the contract, or a flight, if it did not find a solution. On 31 July he wrote to Lund the memorandum the entry quotes, headed “O-ring Erosion/Potential Failure Criticality”, with its “jump ball” and its “catastrophe of the highest order”; a manager countersigned it as concurring. On 19 August Thiokol and Marshall briefed headquarters. The paper’s conclusions included: “The primary O-ring in the field joint should not erode through but if it leaks due to erosion or lack of sealing the secondary seal may not seal the motor”; “The lack of a good secondary seal in the field joint is most critical and ways to reduce joint rotation should be incorporated as soon as possible to reduce criticality”; and, last, “Analysis of existing data indicates that it is safe to continue flying existing design as long as all joints are leak checked with a 200 psig stabilization pressure, are free of contamination in the seal areas and meet O-ring squeeze requirements. Efforts need to continue at an accelerated pace to eliminate SRM seal erosion.” The Commission’s finding was that the history presented that day “was sufficiently detailed to require corrective action prior to the next flight.”

The task force, August 1985 to January 1986

Lund announced the task force on 20 August 1985, noting that “the result of a leak at any of the joints would be catastrophic.” Two days later Thompson wrote that the problem “has lately become acute”, proposed thicker shims and a larger O-ring as short-term measures, and said “the simple short-term measures should be taken to reduce flight risks.” The larger ring was not adopted. Thiokol’s list of 43 possible field-joint designs that month said the field joint “poses the greatest potential risk in that its secondary seal may not maintain metal contact throughout motor operation.” Its presentation of 10 September to Marshall did not mention temperature. On 5 September Kingsbury had written to Mulloy that the ongoing work did “not appear to carry the priority which I attach to this situation.”

On 1 October Ebeling’s activity report to McDonald began “HELP!” The task force was “constantly being delayed by every possible means”; Marshall “is correct in stating that we do not know how to run a development program”; “We are creating more instructional paper than engineering data … This is a red flag.” On 4 October Boisjoly reported that “even NASA perceives that the team is being blocked in its engineering efforts to accomplish its task”, and that NASA was sending an engineer to sit with them from the 14th. On 30 October flight 61-A came back with blow-by on two field joints and erosion on a nozzle; the next Level I review did not mention it. Ebeling told colleagues on the task force that the company should ship no more motors until the problem was fixed. Asked whether he had voiced that concern, he told the Commission: “Unfortunately, not to the right people.”

On 6 December Russell wrote to McDonald asking for “closure of the Solid Rocket Motor O-ring erosion critical problems”, with seventeen reasons; Marshall’s director of engineering, he understood, wanted the long-open problems off the board. On 10 December McDonald wrote to Marshall asking that they be closed, the problem carrying the launch constraint among them. Mulloy said he rejected the request, because “the problem is not resolved and it has to be dealt with on a flight-by-flight basis”, but the people who ran the problem assessment system entered “contractor closure received” on 18 December and, on 23 January 1986, “problem is considered closed.” Mulloy and Wear called the entries “in error”. Rogers asked Russell why, when the task force was still trying to fix the joint, anyone would close it out. “Because I was asked to do it.” “I see. Well, that explains it.” Commissioner Robert Rummel added: “It explains it, but really doesn’t make any sense.”

Because the system showed the problem closed, nobody gave the quality representative at the 51-L readiness reviews the “heads up” that would have put the constraint on the agenda. The company’s certificate of flight readiness, signed by Kilminster on 9 January 1986, said nothing of the O-rings, and neither did the endorsement Kilminster and Mulloy signed on 15 January, nor “several inches of paper comprising the entire chain of readiness reviews for 51-L.” Flight 61-C went up on 12 January at 58 degrees and came back with damage in three joints. At the Level I review on 15 January, “Solid Rocket Booster joints were not discussed.” Twelve days later the forecast came in.

Sources

• Presidential Commission on the Space Shuttle Challenger Accident, Report to the President, volume 1, June 1986, Chapter VI, “An Accident Rooted in History”, from which every document and quotation above is taken, and Chapter V for the certificates of January 1986 and the readiness review; Chapter II for the review of 15 January. chapter 6, chapter 5, chapter 2
• Presidential Commission, Hearings, volume 5, session of 2 May 1986: Mulloy and Wear on the launch constraint and the closure; Russell, Ebeling, McDonald, Kilminster and Boisjoly on the task force; Ray and Miller on the memoranda of 1978 and 1979; Lunney and Weeks on the waiver. history.nasa.gov
• US House of Representatives, Committee on Science and Technology, Investigation of the Challenger Accident, House Report 99-1016, October 1986, section VIII, for the Marshall draft of August 1985 and the headquarters briefing of 11 July 1985. govinfo.gov