By Roger M. Boisjoly, Former Morton Thiokol Engineer, Willard, Utah
A background summary of important events leading to the Challenger disaster will be presented starting with January, 1985, plus the specifics of the telecon meeting held the night prior to the launch at which the attempt was made to stop the launch by the Morton Thiokol engineers. A detailed account will show why the off-line telecon caucus by Morton Thiokol Management constituted the unethical decision-making forum which ultimately produced the management decision to launch...
A background summary of important events leading to the Challenger disaster will be presented starting with January, 1985, plus the specifics of the telecon meeting held the night prior to the launch at which the attempt was made to stop the launch by the Morton Thiokol engineers. A detailed account will show why the off-line telecon caucus by Morton Thiokol Management constituted the unethical decision-making forum which ultimately produced the management decision to launch Challenger without any restrictions.
The paper will continue with the post-disaster chronology of my working relationship with Morton Thiokol Management and conclude with a discussion on accountability, professional responsibility and ethical conduct which should be practiced in the work place, plus statements from the academic community about the plight of whistleblowers and my closing remarks.
Back to Top
You may have already concluded that the Challenger disaster was the result of only the decisions made during the evening prior to and the day of launch. As a senior engineer involved with the SRM's since July, 1980, and specifically with the joints since 1981, I can make the following statements from personal observations.
The SRM Program at MTI was suffering from the lack of proper original development work and some may argue that sufficient funds or schedule were not available and that may be so, but MTI contracted for that condition. The Shuttle program was declared operational by NASA after the fourth flight, but the technical problems in producing and maintaining the reusable boosters were escalating rapidly as the program matured, instead of decreasing as one would normally expect. Many opportunities were available to structure the work force for corrective action, but the MTI Management style would not let anything compete or interfere with the production and shipping of boosters. The result was a program which gave the appearance of being controlled while actually collapsing from within due to excessive technical and manufacturing problems as time increased.
This paper starts with January, 1985, which was the period of gross escalation of joint seal problems and continues with specific events that should have signaled either stopping the flights or as a minimum, changing the launch commit criteria to prevent launching below 53 °F (12 °C).
Figure 1 shows the SRM joint configuration for purposes of this discussion.
All dimensions are in inches with SI units for nominals given in the supplementary table. The first O-ring to seal internal hot gases is called the primary seal while the other is termed the secondary seal. There are 177 load carrying pins plus three locating pins for assembly clocking. Pressurization of the motor to 1004 psi (6.92 x 106 pascals) causes the gap dimension to increase 0.042 inches (1.07 mm).
Author(s): Roger M. Boisjoly
The evening telecon meeting between MTI, MSFC and KSC on January 27,1986, was the final event preceding the Challenger disaster. The major activity that day focused upon the predicted 18 °F (-8 °C) overnight low and meetings with Engineering Management to persuade them not to launch below 53 °F (12 °C). My whole being was driven to action for this cause because of my memory of my January, 1985, participation in the inspection of the hardware from the previous coldest launch which had massive hot gas blow-by. The discussion activity concluded with the hurried preparation of fourteen Viewgraphs by various engineering groups which had less then an hour to respond for the scheduled evening telecon.
The following discussion is summarized to show the content of the engineering presentation. Figures labeled as Viewgraphs show the major thrust of the telecon and contain the actual content of the originals as presented, with Sl units added, while others are summarized to give general content for brevity.
The first Viewgraph was a title page. The second Viewgraph showed a table of post history of O-ring damage on SRM field joints. The third, fourth and fifth Viewgraphs are shown as Figures 4., 5., and 6., respectively.
Figure 4. was taken directly from the August 19, 1985 presentation to NASA headquarters. The last two statements show the reasons for both the high concern and for having a high probability of a secondary seal during the first portion of the transient time zone. The last statement was produced from testing at 50 °F (10 °C) which showed that a seal could maintain contact with its mating surfaces when compressed 0.040 inches (1.02 mm) and only 0.010 inch (0.25 mm) of compression was removed from the seal.
Figure 5. was the heart of the discussion at the telecon. The engineering issue was "Would the seals even actuate and seal due to changing their timing function?" This would place us in the category of having a high probability of no secondary seal capability while the primary seal would be experiencing massive blow-by erosion due to its inability to respond to the gap opening of the metal parts. The last two statements summarized the fear of loss of redundancy based upon my remembrance of the January, 1985 post-launch hardware inspection.
Figure 6. shows the field joint in the "as assembled" configuration, plus the pressurized configuration which shows the gap opening parameter due to outboard radial deflection of the case membrane. The differential deflection between the membrane and the stiffer joint causes the inboard clevis leg to deflect inboard opposite the rotation of the tong, which causes the gap at the seals to open. This results in the secondary seal lifting off its seat at full pressurization without considering seal resiliency parameters.
The sixth Viewgraph showed a comparison of hot gas blow-by by comparing ARC lengths of blackened grease and some descriptive phases for various flights at different launch temperatures. The seventh Viewgraph was a table of O-ring shore hardness versus temperature. The eighth Viewgraph contained the preliminary O-ring resiliency data in a tabular form. Up to this point in the telecon, I was asked several times by NASA to quantify my concerns, but I said that I could not since the only data I had was already presented and that I had been trying to get more data since last October (1985). At this comment, the General Manager of MTI gave me a scolding look as if to say, "Why did you tell them that?" The presentation continued with Viewgraph nine which showed sub-scale test results of cold gas blow-by tests at 75 °F (24 °C) and 30 °F (-1 °C) which showed no leakage. This data was used as an argument by management to say that the joint sealed at 30 °F (-1 °C) but in fact, the tests were not seal tests at all, since the test ring was a solid block of metal which did not have the deflection characteristics of the full-scale joint and was never intended to test anything but incipient blow-by before any joint deflection occurred. Viewgraph ten contained a table of compression set data to aid in the visualization of seal permanent set characteristics. Viewgraph eleven is shown as Figure 7., It provided a comparison of O-ring squeeze for the Challenger joints (SRM 25) versus the previous coldest flight at 53 °F (12 °C) (SRM 15).
* 0.010 in. (0.25mm) erosion
** 0.038 in. (0.97mm) erosion
Viewgraph twelve is shown as Figure 8. The DM designates development motors, QM is qualification motors and SRM is flight motors. This chart showed the current data base versus the predicted Challenger seal temperature of 27 to 29 °F (-3 to -2 °C).
* 1-D Thermal Analysis
** Propellant Mean Bulk Temperature
Viewgraph thirteen is shown as Figure 9. The third and fourth statements under the first bullet are actually disclaimers for the development and qualification test data because the joint putty had been altered after assembly and prior to horizontal test firings. Observed holes in the joint putty were repaired since it was thought that the horizontal assembly was very severe on the joints and is what caused the holes in the putty and that vertical assembly would not cause such holes to occur. The reasoning was generally okay but that reasoning was never tested until sometime in 1985 when it was found that vertical assembly could indeed cause holes in the putty. The major faulty thinking lies in the fact that no specific vertical assembly testing was performed to verify the original assumption and that made the original horizontal test firings a series of successful tests without any sea] erosion.
Viewgraph fourteen is shown as Figure 10.
This concluded the engineering presentation. Then Joe Kilminster of MTI was asked by Larry Mulloy of NASA for his launch decision. Joe responded the he did not recommend launching based upon the engineering position just presented. Then Larry Mulloy asked George Hardy of NASA for his launch decision. George responded that he was appalled at Thiokol's recommendation but said he would not launch over the contractor's objection. Then Larry Mulloy spent some time giving his views and interpretation of the data that was presented with his conclusion that the data presented was inconclusive.
Now I must make a very important point. NASA'S very nature since early space flight was to force contractors and themselves to prove that it was safe to fly. The statement by Larry Mulloy about our data being inconclusive should have been enough all by itself to stop the launch according to NASA'S own rules, but we all know that was not the case. Just as Larry Mulloy gave his conclusion, Joe Kilminster asked for a five-minute, off-line caucus to re-evaluate the data and as soon as the mute button was pushed, our General Manager, Jerry Mason, said in a soft voice, "We have to make a management decision." I became furious when I heard this, because I sensed that an attempt would be made by executive-level management to reverse the no-launch decision.
Some discussion had started between only the managers when Arnie Thompson moved from his position down the table to a position in front of the managers and once again, tried to explain our position by sketching the joint and discussing the problem with the seals at low temperature. Arnie stopped when he saw the unfriendly look in Mason's eyes and also realized that no one was listening to him. I then grabbed the photographic evidence showing the hot gas blow-by comparisons from previous flights and placed it on the table in view of the managers and somewhat angered, admonished them to look at the photos and not ignore what they were telling us; namely, that low temperature indeed caused significantly more hot gas blow-by to occur in the joints. I, too, received the some cold stares as Arnie, with looks as if to say, "Go away and don't bother us with the facts." No one in management wanted to discuss the facts; they just would not respond verbally to either Arnie or me. I felt totally helpless at that moment and that further argument was fruitless, so I, too, stopped pressing my case.
What followed made me both sad and angry. The managers were struggling to make a list of data that would support a launch decision, but unfortunately for them, the data actually supported a no-launch decision. During the closed manager's discussion, Jerry Mason asked the other managers in a low voice if he was the only one who wanted to fly and no one answered him. At the end of the discussion, Mason turned to Bob Lund, Vice President of Engineering at MTI, and told him to take off his engineering hat and to put on his management hat. The vote poll was taken by only the four senior executives present since the engineers were excluded from both the final discussion with management and the vote poll. The telecon resumed and Joe Kilminster read the launch support rationale from a handwritten list and recommended that the launch proceed as scheduled. NASA promptly accepted the launch recommendation without any discussion or any probing questions as they had done previously. NASA then asked for a signed copy of the launch rationale chart.
Once again, I must make a strong comment about the turn of events. I must emphasize that MTI Management fully supported the original decision to not launch below 53 °F ( 12 °C) prior to the caucus. The caucus constituted the unethical decision-making forum resulting from intense customer intimidation. NASA placed MTI in the position of proving that it was not safe to fly instead of proving that it was safe to fly. Also, note that NASA immediately accepted the new decision to launch because it was consistent with their desires and please note that no probing questions were asked.
The change in the launch decision upset me so much that I left the room immediately after the telecon was disconnected and felt badly defeated and angry when I wrote the following entry in my notebook. "I sincerely hope that this launch does not result in a catastrophe. I personally do not agree with some of the statements made in Joe Kilminster's summary stating that SRM- 25 (Challenger) is okay to fly."
After I had a chance to review a copy of Joe's chart, I realized that I didn't agree with any of his statements made to support a launch decision. I believe that anyone who has normal powers of reason will question the validity of Figure 11 as a document to support the Challenger launch.
Signed by Joe C. Kilminster, Vice President Space Booster Programs
The chart lists twelve separate statements. Statements 1, 2, 4, 5, 6, 8 and 9 actually support a no-launch decision. Statement 3 is actually a lie. There was no engineering assessment made during the caucus. Arnie and I continued to press for retaining the original decision of not launching below 53 °F (12 °C). Statement 7 addresses the erosion margin but erosion was not the primary topic of discussion that evening. We were all discussing whether the seals would even seal before hot gas blow-by would destroy them, this statement is the only one to support a launch but it was not part of the concern that night. Statement 10 neither supports nor is against a launch decision. It is simply a statement of engineering fact which states that when pressure is applied to an O-ring seal, it will move away from the pressure to the opposite side of the groove containing it. Statement 12 is a contradiction of statement 1 because everyone knew that 20 °F (-7 °C) colder seals were very significant as our preliminary test data had shown.
Therefore, MTI senior management reversed a sound technical recommendation without one shred of supporting data and without any re-evaluation of the data they had promised when they requested the caucus.
The next morning I paused outside Arnie Thompson's office and told him and my boss that I hoped the launch was safe, but I also hoped that when the booster joints were inspected that we would find all the seals burned almost all the way through the joint, and then maybe we could get someone with authority to take a stand and stop the flights until we fixed the joints.
Later, I was walking post the room normally used to watch the launches when Bob Ebeling stepped out to invite me to watch the launch. At first I refused because I didn't want to watch the launch, but he encouraged me to enter. The room was filled so I seated myself on the floor close to the screen and leaned against Bob's legs as he was seated in a chair. The boosters ignited and as the vehicle cleared the support tower, Bob whispered to me that we had just dodged a bullet. The reason Bob made this statement was that the propellant experts had told us that the boosters would explode at ignition if we developed a leak in the case. At approximately T+60 seconds, Bob again whispered to me that he had just completed a prayer of thanks to the Lord for a successful launch. Just 13 seconds later we both saw the horror of destruction as the vehicle exploded. We all sat in stunned silence for a short time; then I left the room and went directly to my office where I remained in shock for the remainder of the day. Two of my seal task team colleagues inquired about my condition at my office, but I was unable to speak to them and hold back my emotions, so I just nodded yes I was okay and they left after a short silent stay.
Within a day of the launch, one of my colleagues on the seal task force team told me that he was reviewing the video tape and thought he could see a plume of flame coming from a booster as it exited the explosion. My first thought was that one of the joints had failed, so I postulated several scenarios to fit the observations and one of them turned out to be what was found to cause the disaster. A failure investigation team was formed at MTI on January 31, 1986, which included Arnie Thompson and myself. The team was immediately sent to MSFC in Huntsville, Alabama.
Roger M. Boisjoly, Former Morton Thiokol Engineer, Willard, Utah