At a quarter to midnight on Monday 27 January 1986, a telefax machine in a trailer across from the Vehicle Assembly Building at the Kennedy Space Center in Florida printed a single page from Utah. It was headed “MTI Assessment of Temperature Concern on SRM-25 (51L) Launch”. Its first line said that calculations showed the O-rings of the motor on the pad would be 20 degrees colder than the O-rings of the coldest motor ever flown. Its second line said: “Temperature data not conclusive on predicting primary O-ring blow-by.” Its last line but one said: “MTI recommends STS-51L launch proceed on 28 January 1986.” It was signed by Joe C. Kilminster, Vice President, Space Booster Programs, Morton Thiokol, Inc., Wasatch Division. Allan McDonald, the company’s senior man at the Cape, took it off the machine. An hour earlier he had refused to be the one to sign it.

The data the page called not conclusive had been on a table in Utah since the afternoon: thirteen charts, most of them written out by hand because there had been no time to type them. Two flights’ temperatures were on them. One motor had flown with its seals at 53 degrees Fahrenheit and come back with grease blown black round a hundred and ten degrees of one joint; the other had flown at 75 and come back with a little grey soot. Twenty-four Shuttles had flown. Seventeen of them had come back with their field joints clean, and none of the seventeen was on any chart, because nobody had thought that a flight with nothing wrong had anything to say.

Eleven hours and fifty-three minutes after the page printed, at 11:38 in the morning, Challenger lifted off Pad 39B into air at 36 degrees. Sixty-eight hundredths of a second after the boosters lit, a camera recorded a puff of grey smoke from the joint between the two lower segments of the right-hand booster. At 73 seconds the Shuttle came apart at 46,000 feet, and the seven people in it were killed.

Who ran it

The Space Shuttle’s solid rocket boosters belonged, inside NASA, to the Marshall Space Flight Center at Huntsville, Alabama, whose director was William Lucas. Under him the Shuttle Projects Office was run by Stanley Reinartz, and the Solid Rocket Booster Project by Lawrence Mulloy, who had joined NASA in 1960 and taken over the boosters in November 1982. Marshall’s engineering judgement came from its Science and Engineering Directorate, under James Kingsbury, with George Hardy as his deputy. Above Marshall in the chain that approved a launch were “Level II”, the Shuttle programme office at the Johnson Space Center in Houston under Arnold Aldrich, and “Level I”, the Associate Administrator for Space Flight in Washington, Jesse Moore. Marshall kept a resident manager at Kennedy, Cecil Houston, whose office had a four-wire telephone conference system.

The boosters were built by Morton Thiokol, Inc., at its Wasatch Division near Brigham City, Utah, under a contract awarded on 20 November 1973 and then estimated at $800 million. The selection officials wrote that its “cost advantages were substantial and consistent throughout all areas evaluated”, and singled out one feature: “The Thiokol motor case joints utilized dual O-rings and test ports between seals, enabling a simple leak check without pressurizing the entire motor.” In 1986 the division’s senior vice president was Jerald Mason, the general manager of its space division Calvin Wiggins, its vice president for space booster programmes, who signed the company’s flight-readiness papers, Joe Kilminster, and its vice president of engineering Robert Lund. Under them were the engineers who knew the joints: Arnold Thompson, supervisor of structures design for the rocket motor cases, twenty-one years with the company; Roger Boisjoly, a senior scientist in applied mechanics, who inspected the boosters as they came back from the sea; and Robert Ebeling, who managed the ignition system and final assembly and had run the seal task force. Allan McDonald directed the solid rocket motor project and was at the Cape for the launch.

The crew of mission 51-L were Francis Scobee, the commander; Michael Smith, the pilot; Ellison Onizuka, Judith Resnik and Ronald McNair, mission specialists; Gregory Jarvis, an engineer from the Hughes Aircraft Company; and Christa McAuliffe, a schoolteacher from New Hampshire chosen as the Teacher in Space. The record was made by two bodies: the Presidential Commission under William Rogers, a former Secretary of State, with Neil Armstrong as vice chairman and Richard Feynman, Sally Ride and General Donald Kutyna among its members, which took testimony from 6 February 1986 and reported on 6 June; and the House Committee on Science and Technology, which held its own hearings that summer and reported on 29 October.

What they were trying to find out

A solid rocket motor is a steel tube full of propellant that burns from the inside out. The Shuttle’s was the largest ever made in the United States, cast in segments in Utah and stacked at the Cape. The three joints made at the Cape were the “field joints”. Each was a tang and clevis, as on the Air Force’s Titan III: the lower end of one segment slid into a U-shaped groove in the top of the next and was pinned. The gas was kept in by two rubber O-rings of Viton, 0.280 inches thick, lying in grooves in the inner leg of the clevis, with a bead of asbestos-filled putty inside them to keep the flame off.

The hypothesis of the design had two parts. The first was that when the motor lit, the pressure would push the putty like a piston, compress the air ahead of the primary O-ring and drive the ring into the gap between tang and clevis before the joint had time to move. The engineers called it pressure actuation, and it had to happen in the first tenths of a second, because the gap it sealed was not fixed: under 900 pounds per square inch the steel walls flexed, and the tang and the inner clevis leg bent away from each other. The second part was that if the primary ring did not seal, the secondary would. NASA’s selection board had bought the second claim as redundancy, and it was the one that failed first.

In 1977 Thiokol pressurised a case with water to one and a half times its working pressure, with instruments at a joint. “We discovered that the joint was opening rather than closing as our original analysis had indicated,” Thompson told the Commission, “and in fact it was quite a bit.” Marshall’s engineers read the numbers and said so; one memorandum of January 1979 called Thiokol’s position “completely unacceptable”. The rings were made bigger and the shims thicker, and the joint flew. On 17 December 1982, after tests had confirmed what the engineers said in 1977, the joint lost its “R” for redundancy on the Critical Items List: “Leakage of the primary O-ring seal is classified as a single-failure point … Failure Effect Summary: Actual Loss. Loss of mission, vehicle and crew.” A waiver signed in Washington on 28 March 1983 let the Shuttle fly with the part, and the Commission found that Marshall’s managers went on believing the joint redundant “in all but situations of worst case tolerances”.

So the second claim was gone on paper by 1983, and the first was left carrying the vehicle. What nobody had tested was whether the first claim held in the cold: the Commission wrote that in 1982 and 1983 the secondary ring’s redundancy “was analyzed in terms of joint or hardware geometry, with no consideration being given to the resiliency of the ring as affected by temperatures.” The question that mattered on 27 January 1986 had not been asked.

What they built

What they built, flight by flight, was an experience base. The seals were not supposed to be touched by gas at all. On the second flight, in November 1981, a field-joint primary came back eroded 0.053 inches, and the erosion was not reported at the next readiness review. In February 1984 two joints came back eroded and the problem was at last written up; Thiokol calculated that the worst erosion possible was 0.090 inches, showed that a ring with 0.095 cut out of it would still seal in the laboratory, and Level I approved the next flight “accepting possibility of some O-ring gas impingement”. Each flight after that was certified by the same arithmetic. The company’s own leak check made things worse: the air pressure put between the rings before flight to prove them seated was raised to 200 pounds per square inch, and the air blew holes in the putty through which the hot gas found the ring.

The cold came in on 24 January 1985. Flight 51-C went up after what Thiokol called the “worst case temperature change in Florida history”, with its joints at a calculated 53 degrees, and came back with erosion and blow-by on both boosters. Boisjoly was at the Cape and took the joint apart: “that was the first time we had actually penetrated a primary O-ring on a field joint with hot gas, and we had a witness of that event because the grease between the O-rings was blackened just like coal.” The next review, on 8 February, named temperature for the first time: “Low temperature enhanced probability of blow-by. STS 51-C experienced worst case temperature change in Florida history. STS 51-E could exhibit the same behavior. Condition is acceptable.” By the time that reached Level I it was one page, “acceptable risk because of limited exposure and redundancy”, with no temperature on it.

That spring Thompson devised a bench test. A piece of O-ring was squeezed between plates and the plates drawn apart at the rate the joint opened. At 100 degrees the ring kept up with the metal. At 75 degrees it lost contact for 2.4 seconds. At 50 degrees it had not touched the metal again after ten minutes, when the test was stopped. Then on 25 June the nozzle joint of flight 51-B was opened in Utah: its primary ring had eroded 0.171 inches and never sealed, and the secondary, the backup that was supposed never to see gas, had eroded 0.032. Mulloy put a formal “launch constraint” on the problem on 10 July, and waived it, as the project manager could, for every one of the six flights that followed. On 31 July Boisjoly wrote to Lund: “If the same scenario should occur in a field joint (and it could) then it is a jump ball as to the success or failure of the joint because the secondary O-ring cannot respond to the clevis opening rate and may not be capable of pressurization. The result would be a catastrophe of the highest order - loss of human life.”

On 19 August Thiokol and Marshall briefed NASA headquarters and concluded that “it is safe to continue flying existing design as long as all joints are leak checked with a 200 psig stabilization pressure, are free of contamination in the seal areas and meet O-ring squeeze requirements.” A task force was set up the next day. On 1 October Ebeling wrote to McDonald a report that began with the word “HELP!” In December Thiokol, at Marshall’s request, asked that the O-ring problems be closed on the tracking system; Mulloy said he refused, but the closure was entered, and on 23 January 1986, five days before Challenger flew, the record said “problem is considered closed”. The readiness review for 51-L on 15 January did not mention the seals. The whole record, from the first test in 1977 to that entry, is in The paper trail.

Fifty-three degrees

Challenger had been meant to fly on 22 January. The date slipped four times, to the 27th, and on the 27th a stuck hatch handle held the count until a crosswind at the abort runway was too strong, and at 12:36 pm the launch was scrubbed for the day. At 2:00 pm the mission management team met again. A cold front was coming through; the forecast was for temperatures in the low twenties for about eleven hours. They talked about the pad’s water systems and decided to start the count again. Nobody mentioned the seals.

At about one o’clock, at Marshall’s booster office at Kennedy, Lawrence Wear had asked Thiokol’s Boyd Brinton whether the company had any concern about the cold, and what it had said after 51-C. Brinton telephoned Utah. At about 2:30 Eastern time Ebeling called the engineers together. “Engineering,” he said afterwards, “especially Arnie, Roger Boisjoly, Brian Russell, myself, Jerry Burns, they come to mind, were very adamant about their concerns on this lower temperature, because we were way below our data base and we were way below what we qualified for.” Late in the afternoon Ebeling reached McDonald at the house of a colleague near the Cape: the weatherman was saying 18 degrees, and could he get the real forecast? McDonald’s host called the launch operations centre. It would be freezing before midnight, 22 degrees at about six in the morning, and about 26 at the planned launch time of 9:38. McDonald passed it to Utah, told Ebeling that “this decision should be an engineering decision, not a program management decision”, and asked for charts recommending a launch temperature. Then, having failed to reach Mulloy at his motel, he called Houston, who set up the four-wire telephone.

The first conference began at 5:45 pm. Thiokol said that in its opinion the launch should be delayed until noon or the afternoon, when it would be warmer. It was agreed to send the charts to both centres and reconvene at 8:15 with more people on the line; Judson Lovingood, Reinartz’s deputy in Huntsville, proposed that Lucas and Kingsbury join, and that if Thiokol held to its position the matter go up to Level II. At about seven Reinartz and Mulloy went to Lucas’s motel room and told him that Thiokol had raised a concern about the seals in the cold and that a conference was being arranged. Lucas said: fine, keep me informed. Nobody called Aldrich.

The second conference began at 8:45 pm Eastern time, 6:45 in Utah. The charts had gone down the fax as they were finished. Boisjoly presented the first of them, his Chart 2-1, taken unchanged from the August briefing: if erosion penetrated the primary seal there was a “high probability of no secondary seal capability” once the motor was at pressure, and bench testing had shown the ring could keep up with the metal only in the first 170 milliseconds. Then his Chart 2-2, handwritten, headed “Joint Primary Concerns, SRM 25”: “A Temperature Lower Than Current Data Base Results in Changing Primary O-Ring Sealing Timing Function”; “SRM 15A 80° ARC Black Grease Between O-Rings, SRM 15B 110° ARC Black Grease Between O-Rings”; harder O-rings, thicker grease, longer actuation time; and at the end: “If threshold is reached then secondary seal may not be capable of being pressurized.” There was a chart headed Blow-by History with two entries on it, SRM 15 and SRM 22, the coldest flight and a warm one, the worst blow-by and a lighter one. And there was a chart headed History of O-ring Temperatures: four development motors fired on their sides in Utah at 47 to 52 degrees without blow-by, flight 15 at 53, flight 22 at 75, and the prediction for the motor on the pad, 29 degrees at nine in the morning.

Boisjoly was asked to quantify his concern and said he could not; he had no data to quantify it, “but I did say I knew that it was away from goodness in the current data base.” Someone on the net said that SRM 22 had blown by at 75 degrees. Boisjoly answered that SRM 15 had blown by far worse, that he had seen both joints, and that it was telling them temperature was a factor. He was asked again for data and said he had none beyond what was being shown, and that he and Thompson had been trying to get resiliency data since October. Lund read the conclusions he had written on the board: “Temperature of O-ring is not only parameter controlling blow-by”; “At about 50 deg. F blow-by could be experienced in case joints”; “Have no data that would indicate SRM 25 is different than SRM 15 other than temperature.” And the recommendation: “O-ring temperature must be greater than or equal to 53 deg. F at launch.” Mulloy asked Kilminster for the company’s position, and Kilminster said that on the engineering recommendation he could not recommend launch.

What Mulloy said next has been quoted in two forms, and he accepted both. He said there was no launch commit criterion for joint temperature, that Thiokol was proposing to invent one on the eve of a launch after flying twenty-four times without it, and, by his own later account of his words, “with this LCC, i.e., do not launch with a temperature greater [sic] than 53 degrees, we may not be able to launch until next April.” The form everyone remembered was shorter: “My God, Thiokol, when do you want me to launch, next April?” Hardy, in Huntsville, was asked what he thought and said he was “appalled” at the recommendation, and then that he would not recommend launching over the contractor’s objection. Kilminster asked for five minutes off the net to caucus. Lund later described the state he was in: “We had to prove to them that we weren’t ready, and so we got ourselves in the thought process that we were trying to find some way to prove to them it wouldn’t work, and we were unable to do that. We couldn’t prove absolutely that that motor wouldn’t work.”

The caucus in Utah lasted about thirty minutes, with all three sites on mute. Mason opened it by saying a management decision was necessary. Boisjoly and Thompson argued against the launch again. Thompson got up from his seat down the table, walked up to the managers, put a pad of paper down in front of them and began to sketch the joint, “and when he realized he wasn’t getting through, he just stopped.” Boisjoly took the photographs of the blackened grease up the table and made his point once more, “and I also stopped when it was apparent that I couldn’t get anybody to listen.” Mason turned to Lund and asked him to take off his engineering hat and put on his management hat. The four managers, Mason, Wiggins, Kilminster and Lund, then settled it among themselves. Their agreement was that the primary ring had a margin to erode three times the worst case yet seen, and that if it did not seal the secondary was in position and would. Boisjoly was not asked for a view. At about 11 pm Eastern time Thiokol came back on the net and Kilminster read the new position from a notepad. Reinartz asked if anyone had anything to add. Nobody did. Hardy asked for it in writing, and the fax went at 9:45 Utah time.

While Utah was on mute, McDonald had argued on at the Cape: the motor was not qualified to fly in that cold, and NASA should not accept a recommendation to fly it there. “I made the statement that if we’re wrong and something goes wrong on this flight, I wouldn’t want to have to be the person to stand up in front of board of inquiry and say that I went ahead and told them to go ahead and fly this thing outside what the motor was qualified to.” After the fax he told Mulloy and Reinartz that if the seals were not reason enough there were two more, the recovery ships running for shore in fifty-knot winds and the ice on the pad, and was told that it was not his concern. At about 11:30 Mulloy and Reinartz called Aldrich about the ships and, briefly, the ice. They did not mention the O-rings. Mulloy told the Commission why: “that was a Level III issue … There was no violation of Launch Commit Criteria. There was no waiver required in my judgment at that time and still today.”

What it looked like from inside

Boisjoly made notes that night, after the meeting, and more in the morning. He told the Commission, a month later, that the first he had heard of any temperature concern was at about one in the afternoon, that what had struck him was that the weather was going the opposite way from 51-C, which had warmed before its launch, and that by the time the net was set up the overnight low was being given as 18 degrees. A colleague, he said, had summed it up: “This was a meeting where the determination was to launch, and it was up to us to prove beyond a shadow of a doubt that it was not safe to do so. This is in total reverse to what the position usually is in a preflight conversation or a flight readiness review.” Feynman put the same thing to him as a question: “I take it you were trying to find proof that the seal would fail?” “Yes.” “And of course, you didn’t, you couldn’t, because five of them didn’t, and if you had proved that they would have all failed, you would have found yourself incorrect because five of them didn’t fail.” “That is right.”

Ebeling drove home and told his wife, Darlene, “It’s going to blow up.” Mason, asked what effect Hardy’s word and Mulloy’s April had had on him, said: “My personal thinking, I just, you know, it didn’t make that much difference.” Of the caucus he said: “The fact that we couldn’t show direct correlation with the O-ring temperature was discussed, but we still felt that there was some concern about it being colder.” Mulloy said that it had been “suggested, implied, or stated that we directed Thiokol to go reconsider these data. That is not true.” He said he believed nobody outside the Cape had heard the words about April.

At Kennedy the night went on. Because of the cold the water lines on the pad had been left running at a trickle, which had never been done before, and the wind and the frost turned the fixed service structure into a sheet of ice and icicles, including the way to the crew’s emergency escape baskets. The ice team went out at 1:35 am and again after seven, when one of its members read the boosters with an infrared pyrometer: about 25 degrees on the left, about 8 at the aft end of the right. The instrument was later found to be reading low, but the team did not report the figures in any case, because there was no launch commit criterion for a surface temperature. At 5 am Mulloy told Lucas that Thiokol’s concern had been resolved in favour of launch and showed him the fax. At nine the mission management team met on the ice. Rockwell International, which built the orbiter, had worked the problem all night in California and told the meeting, in the words of its vice president, that “Rockwell cannot assure that it is safe to fly”; Aldrich heard that as a qualification, not a no, and the count went on. The crew were briefed on the weather and told about the ice. The Commission found that “neither then nor in earlier weather discussions was the crew told of any concern about the effects of low temperature on the Shuttle System.” They were in their seats at 8:36. The launch was held two hours, the second of them for the ice to melt.

At 11:38:00 the boosters lit. By the Commission’s reconstruction of the films, smoke was first discernible at 0.678 seconds at the aft field joint of the right booster, on the side facing the external tank; eight more puffs, blacker each time, came between 0.836 and 2.5 seconds, at the frequency at which the stack was flexing. Then the joint stopped smoking; the Commission thought it possible that the gap had been plugged by a fragile crust of aluminium oxide and combustion debris. At 37 seconds Challenger ran into wind shear that worked its steering harder than on any previous flight. At 58.788 seconds a flame appeared at the same place. By 60 seconds the pressure in the right booster was falling behind the left; by 64.66 the flame had burned into the hydrogen tank; at about 72.2 the lower strut holding the booster to the tank let go; at 73.124 the bottom of the hydrogen tank fell away. Mission Control had seen nothing wrong. The last voice from the Shuttle, at 65 seconds, had been Scobee’s “Roger. Go at throttle up.”

What happened

The Commission’s report of June 1986 found the cause in the aft field joint of the right booster: “a combustion gas leak … initiated at or shortly after ignition”, through a design “unacceptably sensitive to a number of factors”, among them temperature. The ambient air at launch had been 36 degrees, “15 degrees lower than the next coldest previous launch”; the coldest point on the failed joint, the side away from the sun, was estimated at 28 degrees, give or take five. A ring at 75 degrees, the tests showed, recovered its shape five times faster than one at 30. The Commission concluded that the rings “were not following the opening of the gap between the tang and clevis at time of ignition.” On 11 February, in an open hearing, Feynman had squeezed a piece of the seal’s rubber, put it in ice water, and shown that when he let go it did not spring back: “there is no resilience in this particular material when it is at a temperature of 32 degrees. I believe that has some significance for our problem.”

Then the Commission turned to the night before. Its fifth chapter opens: “The decision to launch the Challenger was flawed.” Those who made it had not known the history of the joint, the contractor’s first recommendation or its engineers’ continuing opposition, and “if the decisionmakers had known all of the facts, it is highly unlikely that they would have decided to launch 51-L on January 28, 1986.” Thomas, the launch director, said: “if we had had that information, we wouldn’t have launched if it hadn’t been 53 degrees.” Kutyna put it to Mulloy as a pilot: “If this were an airplane, an airliner, and I just had a two-hour argument with Boeing on whether the wing was going to fall off or not, I think I would tell the pilot, at least mention it.” The Commission found that Thiokol’s management “reversed its position and recommended the launch of 51-L, at the urging of Marshall and contrary to the views of its engineers in order to accommodate a major customer”.

The finding that belongs to this journal is on page 145. “The record of the fateful series of NASA and Thiokol meetings, telephone conferences, notes, and facsimile transmissions on January 27th, the night before the launch of flight 51-L, shows that only limited consideration was given to the past history of O-ring damage in terms of temperature. The managers compared as a function of temperature the flights for which thermal distress of O-rings had been observed, not the frequency of occurrence based on all flights. In such a comparison, there is nothing irregular in the distribution of O-ring ‘distress’ over the spectrum of joint temperatures at launch between 53 degrees Fahrenheit and 75 degrees Fahrenheit. When the entire history of flight experience is considered, including ‘normal’ flights with no erosion or blow-by, the comparison is substantially different.” The two pictures were printed on the next page. In the first, the seven flights whose field joints had come back damaged are scattered between 53 and 75 degrees in a shape that says nothing. In the second the same seven are there, and so are the seventeen flights with no damage, all of them at 66 degrees or above. “Only three incidents of O-ring thermal distress occurred out of twenty flights with O-ring temperatures at 66 degrees Fahrenheit or above, whereas, all four flights with O-ring temperatures at 63 degrees Fahrenheit or below experienced O-ring thermal distress.” Its sixth finding on the history was this: “A careful analysis of the flight history of O-ring performance would have revealed the correlation of O-ring damage and low temperature. Neither NASA nor Thiokol carried out such an analysis; consequently, they were unprepared to properly evaluate the risks of launching the 51-L mission in conditions more extreme than they had encountered before.”

The House committee, reporting in October, agreed with the cause and disagreed about the night: “the fundamental problem was poor technical decision-making over a period of several years by top NASA and contractor personnel, who failed to act decisively to solve the increasingly serious anomalies in the Solid Rocket Booster joints.” It added something the Commission had not. Flight 61-C, the one before Challenger, had been scrubbed four times in the weeks before it flew on 12 January, at temperatures below 53 degrees on several of those days, and nobody at Thiokol had raised the seals; some of Challenger’s own earlier launch attempts had been below 53 as well. The committee found that Thiokol’s advice to NASA had been “inconsistent”, and that the arguments of 27 January “might not have been as persuasive at the time as they now appear to be in hindsight.” The two reports, and the readings of the data that came after them, are set side by side in Four readings.

After

On 2 May 1986 McDonald and Boisjoly told the Commission what had happened to them since February. McDonald’s people had been taken away and put under another manager, and he had been given, in his words, “a more menial job”. Rogers asked: “So, you were in effect punished for being right?” “I feel I was.” Boisjoly had been “put on the sideline in that loop with relationship to the customer.” Rogers told the company’s men in the room that “Mr. McDonald and Mr. Boisjoly and others, Mr. Thompson and others, were right”, and that “to have something happen to him that seems to be in the nature of punishment is shocking”. Edward Markey, a congressman from Massachusetts, threatened to bar the company from government contracts unless the two men were restored. McDonald was made a vice president and given the redesign; Boisjoly did not come back.

The redesigned joint had a capture latch that held the tang and clevis together “around the circumference” so that the gap could not open, a third O-ring “to seat the primary O-ring in the proper direction”, the insulation sealed with a flap of its own rubber “rather than the putty used in the original configuration”, and external heaters with weather seals to hold the seals “at or above 75°F”. Discovery flew on 29 September 1988, thirty-two months after Challenger, and the joints came back clean. Mulloy left the booster project and NASA for consulting work, and died in Tennessee in October 2020, aged 86. Boisjoly received the American Association for the Advancement of Science’s award for scientific freedom and responsibility in 1988, spent the rest of his working life lecturing engineers on the night of 27 January, and died in Utah on 6 January 2012, aged 73. Ebeling retired soon after the accident. In January 2016, at 89, he told the reporter he had spoken to anonymously in 1986, Howard Berkes of NPR, “I was one of the few that was really close to the situation”, and “I think that was one of the mistakes that God made. He shouldn’t have picked me for the job.” Hundreds of engineers wrote to him; he died at home in Brigham City on 21 March 2016. McDonald wrote a book, Truth, Lies, and O-Rings, in 2009, and died in 2021.

The data became an argument of its own. In 1989 three statisticians in New Jersey did the analysis the Commission had said was possible, from the twenty-three flights before Challenger, and found “strong statistical evidence of a temperature effect”: at 31 degrees, “at least a 13% probability of catastrophic field-joint O-ring failure”. In 1997 Edward Tufte printed the thirteen charts beside a scatterplot of his own and blamed the engineers for not drawing it; in 2002 Boisjoly and three colleagues answered that the engineers had asked for the flights’ temperatures in September 1985 and been given none of them. Diane Vaughan’s The Challenger Launch Decision of 1996 argued that nobody had broken a rule, and her phrase for what had happened, the normalisation of deviance, was applied again when Columbia was lost in 2003.

What it taught

Start with what the night was. It was not a surprise: the joint had been known to rotate since 1977, known to be a single seal since 1982, and known to burn since 1984, and the engineer who knew it best had written “catastrophe of the highest order” to his vice president six months before. It was not a failure of nerve among the people who knew; they were, in the Commission chairman’s phrase, “almost to a man” against it. It was a measurement that nobody made, and then a decision made in its absence by people who, the record shows, honestly thought the absence meant something.

A record of failures only cannot show you what causes them. The Blow-by History chart had two flights on it, one cold and one warm, and from two flights the warm one was a counter-example. The seventeen flights that had come back clean, every one at 66 degrees or above, were the control, and they were not in the room. The complication is real. The joint temperatures on the Commission’s second chart were calculated after the accident; Boisjoly’s group had asked for them in September 1985 and not got them, and the air at a launch and a ring that has stood out through two cold nights are not at the same temperature. But the air temperatures were a matter of record, and the Commission’s count of them says the same thing: of twenty-one launches in air at 61 degrees or warmer, four had shown distress, and every launch below 61 had. What was missing was not the data but the habit of plotting the zeros.

“Within the data base” and “outside the data base” are the same sentence, and the night turned on who got to say it. For two years the experience base had been the reason to fly: erosion of 0.053 was within it, 0.090 was within it, blow-by at 75 degrees was within it. On 27 January the engineers used the same base the other way round, and were told they were inventing a launch commit criterion. Mulloy was right that no rule said 53 degrees, and Lund was right that the roles had switched: “We had to prove to them that we weren’t ready.” A data base is a fence, and it keeps you in or keeps you out depending on which side the burden of proof is standing. Feynman’s remark is the exact statement of why the engineers could not win: they could not prove the seal would fail, “because five of them didn’t.”

A problem that is “addressed” every flight is a problem that has been accepted. The launch constraint of July 1985 was a formal instrument, and its purpose was to stop a flight. It was waived six times by the man who had imposed it, which he was entitled to do, and the waivers reached nobody above him. By 23 January the tracking system said the problem was closed, in error, and so the readiness review for Challenger had nothing to address. Feynman called the readiness reviews “a kind of Russian roulette”, and that is the shape of it: each chamber that was empty became the reason to pull again.

The decision moved off the line. For two hours, with everyone listening, no one at Thiokol said a word for launch. The reversal happened in thirty minutes on mute, among four managers, after the two engineers with the photographs had given up, and it came back as a page without their names on it. The night’s instrument was not only the charts; it was a telephone with a mute button.

Nobody told the pilot. Lucas was told at seven in the evening and again at five in the morning; Aldrich was called at 11:30 and told about the ships; Moore, Thomas and the crew were told nothing. The people who said afterwards that they would have stopped it were all outside the loop, and the loop was correct by its rules: it was “a Level III issue that had been resolved.” An experiment on a living system has a person in it, and the person is owed the argument, not the result.

Check the story before you learn from it. The air at launch was 36 degrees; the Commission’s table puts the joint at 31 and its analysis puts the coldest point at 28, give or take five. The forecast was 18 degrees to Ebeling, 22 and 26 to McDonald, “the low twenties” to the management team. “Next April” went out over the net in McDonald’s account and was heard only at the Cape in Mulloy’s. The Commission said the engineers were right and the committee said they had been inconsistent, having flown and scrubbed below 53 degrees that same month without a word, and both were true. And the whole of the case against the cold, the chart with seventeen zeros on it, was drawn by a commission four months afterwards from temperatures it had to calculate.

Against all of that, the sequence that no witness disputes is enough. A joint that opened when it should have closed; a backup that was a backup only on paper; a bench test in which a cold ring did not move for ten minutes; a letter in July; a constraint waived six times; a forecast of twenty-six degrees; two hours of argument; thirty minutes on mute; a fax; a puff of smoke at 0.678 seconds. The Soviet engineers at Chernobyl, three months later, ran their test on a reactor far from the conditions its programme assumed, and pressed a button they believed was a stop; that story is Thirty-Six Seconds. The Americans had no stop button, because there was no launch commit criterion for the one number that mattered, and they decided, in a trailer in Florida at midnight, that the absence of a rule was the same as the absence of a risk. Feynman ended his appendix with the sentence that covers both: “For a successful technology, reality must take precedence over public relations, for nature cannot be fooled.”

Sources

• Presidential Commission on the Space Shuttle Challenger Accident, Report to the President, volume 1, Washington, 6 June 1986. Chapter II (the crew, the delays, the morning of the launch and the crew’s briefing); Chapter III (the launch at 11:38 and the timeline from 0.678 to 73.124 seconds, the 36 degrees); Chapter IV (the joint, the four-thousandths gap, the 28-degree estimate, the resiliency factor of five, the finding on launches above and below 61 degrees); Chapter V (the whole night of 27 January in the witnesses’ words, the chronology and the list of participants, Lucas’s and Thomas’s and Kutyna’s exchanges, the ice and the Rockwell position, and the findings quoted here); Chapter VI (the contract of 1973, the tests of 1977, the criticality change of 1982 and the waiver of 1983, the flight history table, the leak check, 51-C and 51-B, the resiliency test, the launch constraint, Boisjoly’s memorandum of 31 July 1985, the August briefing, Ebeling’s “HELP!”, the closure entries, the page-145 finding and Figures 6 and 7). history.nasa.gov, chapter 2, chapter 3, chapter 4, chapter 5, chapter 6; the scanned volume, from which the two figures are reproduced and in which the telefax of 27 January is printed on page 97, ntrs.nasa.gov
• Richard P. Feynman, “Personal Observations on the Reliability of the Shuttle”, Appendix F to volume 2 of the Commission’s report, 1986. The Russian roulette passage and the closing sentence. history.nasa.gov
• Presidential Commission, Hearings, volume 4, 6 to 25 February 1986. The session of 11 February for Feynman’s ice-water demonstration and his words to Mulloy; the session of 25 February for McDonald on refusing to sign, and for Boisjoly’s and Thompson’s testimony, including Boisjoly’s reading of his memorandum of 31 July 1985, “away from the direction of goodness”, the arcs of black grease, the charts he presented and the caucus. 11 February, 25 February, McDonald, 25 February, Boisjoly and Thompson
• Presidential Commission, Hearings, volume 5, 26 February to 2 May 1986. The session of 26 February for Mulloy and Hardy on the conference and on “next April”; the sessions of 26 and 27 February for the ice team’s pyrometer readings and their correction, and for Aldrich on the delay for the ice; the session of 2 May for McDonald’s and Boisjoly’s reassignment and Rogers’s remarks, and for Mulloy on the leak check and the launch constraint. 26 February, ice team, 27 February, 2 May
• NASA, Implementation of the Recommendations of the Presidential Commission on the Space Shuttle Challenger Accident, June 1987: the redesigned joint, its capture latch, third O-ring, insulation flap and heaters, and the test programme. nasa.gov
• US House of Representatives, Committee on Science and Technology, Investigation of the Challenger Accident, House Report 99-1016, 29 October 1986. The committee’s disagreement with the Commission, its account of the thirteen charts and Lund’s conclusions and recommendations, the 61-C scrubs and the earlier 51-L attempts below 53 degrees, McDonald’s and Kilminster’s answers, and its finding on Thiokol’s inconsistency. govinfo.gov
• Siddhartha R. Dalal, Edward B. Fowlkes and Bruce Hoadley, “Risk Analysis of the Space Shuttle: Pre-Challenger Prediction of Failure”, Journal of the American Statistical Association 84 (408), December 1989, pages 945 to 957. The 13 per cent at 31 degrees. tandfonline.com
• Wade Robison, Roger Boisjoly, David Hoeker and Stefan Young, “Representation and Misrepresentation: Tufte and the Morton Thiokol Engineers on the Challenger”, Science and Engineering Ethics 8 (1), 2002, pages 59 to 81; the conference text of 1999 is on the Online Ethics Center. The engineers’ request for temperature data in September 1985 and the air and O-ring temperatures of flights 15 and 22; Tufte’s Visual Explanations (1997) is in copyright and is known here through this paper. onlineethics.virginia.edu
• Howard Berkes, “30 Years After Explosion, Challenger Engineer Still Blames Himself”, NPR, 28 January 2016; “Your Letters Helped Challenger Shuttle Engineer Shed 30 Years of Guilt”, NPR, 25 February 2016; and “Challenger Engineer Who Warned of Shuttle Disaster Dies”, NPR, 21 March 2016. Ebeling’s words to his wife and to the reporter, his retirement, the letters, and his death at 89. npr.org, 28 January, npr.org, 25 February, npr.org, 21 March
• Steven T. Corneliussen, “National newspapers remember the late rocket engineer Roger Boisjoly”, Physics Today, February 2012, summarising the New York Times and Washington Post obituaries: his death on 6 January 2012 at 73, the company’s cutting him off from space work, the AAAS award. physicstoday.aip.org; the award’s year from the Association’s list of recipients, aaas.org
• “Allan McDonald dies at 83; tried to stop the Challenger launch”, Boston Globe, 10 March 2021: his demotion and Boisjoly’s leave, Edward Markey’s threat, his promotion to vice president in charge of the redesign, his book of 2009 and his death. bostonglobe.com
• Obituary of Lawrence Benjamin Mulloy, 1934 to 2020, Nashville Funeral and Cremation: his retirement from Marshall as the booster project manager and his consulting work afterwards. nashvillefuneralandcremation.com
• Paul Hond, “How the Challenger Disaster Became a Case Study of the ‘Normalization of Deviance’”, Columbia Magazine, winter 2025 to 2026: Diane Vaughan on her book of 1996 and on the Columbia board. magazine.columbia.edu
• NASA APPEL, “This Month in NASA History: Return to Flight”, 16 September 2021: Discovery’s launch on 29 September 1988 and the condition of its joints. appel.nasa.gov
• Photographs: NASA, GPN-2000-001347 (the liftoff from camera site 39B-2), GPN-2004-00011 (ice on the pad) and GPN-2000-001425 (the plume at 58.8 seconds), all US government works in the public domain, via Wikimedia Commons. liftoff, ice, plume