Challenger Disaster: Heeding the Ethical Lessons 30 Years OnWinn Hardin | January 28, 2016
On the evening of Jan. 27, 1986, a group of engineers employed by rocket booster manufacturer Morton Thiokol pleaded against launching the Challenger space shuttle the next morning. The temperature at lift-off was expected to be no more than 26°F. The previous coldest launch, 53°F, occurred one year earlier with the space shuttle Discovery flight, known as STS-51-C.
O-rings from the earlier Discovery mission showed signs of massive hot gas blow-by erosion. An investigation found that the low overnight temperature hardened the rubber O-rings and made them less pliable. This affected the primary O-ring’s ability to form a seal. A launch in much colder weather, the Thiokol engineers determined, would compromise not only the safety of the O-rings but potentially the Challenger flight (officially known as STS-51-L) and its crew.
So on that January night in 1986, the engineers had less than an hour to pull data together and make their case in a teleconference with Thiokol managers and representatives from the NASA Marshall Space Flight Center (MSFC) and Kennedy Space Center. Joe Kilminster, vice president of Thiokol’s space booster program, at first backed the engineers’ no-launch decision.
NASA, however, pushed back, saying the link between temperature and blow-by was inconclusive. After taking the call off-line, Thiokol senior vice president Jerry Mason turned to Kilminster and said, according to several accounts, “We have to make a management decision.”
Thiokol engineer Roger Boisjoly, a staunch opponent of the launch, was angry. His colleagues recognized him as a leading expert on the subject of seals and joints in the booster rocket. Boisjoly felt that managers were ignoring his pleas.
In one final push to make his case, Boisjoly placed in front of his managers photographs of hot gas blow-by comparisons from previous flights. Simultaneously, his colleague Arnie Thompson sketched the joint and explained the problem with the seals at low temperature.
“I stopped when it was apparent that I couldn't get anybody to listen,” Boisjoly later testified.
Boisjoly criticized the off-line discussion because it “constituted the unethical decision-making forum resulting from intense customer intimidation,” he recalled in an essay published by the Online Ethics Center, a resource maintained by the National Academy of Engineering and funded by the National Science Foundation.
Without including engineers, senior management reversed what Boisjoly called “sound technical recommendation without one shred of supporting data” and decided to support the launch.
“I sincerely hope,” a defeated Boisjoly wrote in his notebook after the decision, “that this launch does not result in a catastrophe.”
The next morning, Jan. 28, Boisjoly reluctantly watched the launch from Thiokol’s Utah headquarters and saw the Challenger explode 73 seconds after lift-off. Within days, he and senior engineer Alan McDonald were both praised and condemned for telling the truth.
A Culture of Complacency
The night before Challenger's ill-fated launch wasn’t the first time Boisjoly expressed concerns to his employer. In fact, it wasn’t the first time Morton Thiokol knew of design flaws in its booster rocket joints. Almost a decade before the accident, in 1977, the contractor reported a joint rotation effect to MSFC but believed it was an “acceptable risk.”
O-ring erosion first appeared in flight during the November 1981 shuttle mission. Joint seal problems continued to plague shuttle flights, but neither Thiokol nor NASA sought design changes. Then there was the blow-by erosion discovered by Boisjoly and his colleagues from the cold-temperature January 1985 shuttle flight of the Discovery vehicle. O-ring problems emerged again several months later with flight 51-B, the seventh mission of the Challenger spacecraft. This time, engineers discovered not only that the primary O-ring eroded and never sealed, but that the secondary O-ring also eroded.
The damage prompted Boisjoly to draft two memos. In the first, written July 22, 1985, he speculated that if Thiokol did not come up with a timely solution, “NASA might give the motor contract to a competitor or there might be a flight failure.”
Boisjoly used even more direct wording in a second memo written nine days later. Addressed to Robert Lund, Thiokol's vice president of engineering, Boisjoly criticized the “mistakenly accepted position” on the joint problem prior to the 51-B findings. That position “was to fly without fear of failure and to run a series of design evaluations which would ultimately lead to a solution or at least a significant reduction of the erosion problem.”
Should the same scenario occur in a field joint, the secondary O-ring might not respond to the clevis opening rate and therefore be incapable of pressurization.
“The result would be a catastrophe of the highest order—loss of human life,” Boisjoly wrote. His memo concluded, "It is my honest and very real fear that if we do not take immediate action to dedicate a team to solve the problem, with the field joint having the number one priority, then we stand in jeopardy of losing a flight along with all the launch pad facilities."
Thiokol set up the task force, but Boisjoly later stated that the group lacked resources and management support. By late 1985, he again reminded managers that ignoring the O-ring problem could lead to disaster. Still nothing happened, and the lack of action culminated in disaster a month later on a cold Florida morning in January 1986 when Challenger and its seven-person crew were lost.
Less than two weeks after the Challenger disaster, President Ronald Reagan appointed a task force to investigate the cause of failure. Former Secretary of State William Rogers led the 14-member presidential commission, which included astronauts Sally Ride and Neil Armstrong, and the noted physicist Richard Feynman.
In an informal fact-finding mission held at the Kennedy Space Center on February 14, the commission called together the key players involved in the preflight teleconference. Rogers directed them to provide both their private and official notes related to the meeting.
At a prehearing meeting, Boisjoly reported that Thiokol’s managers and attorneys advised engineers to answer only yes or no, and not to volunteer information. During a closed interview session requested by two presidential commission members at MSFC on February 19, Boisjoly handed over his memos and activity reports in response to one of their questions. “This action upset our company attorney,” he recalled.
But Boisjoly felt ethically obligated to clarify the circumstances that led to the Challenger disaster. Furthermore, he wanted to counteract what he saw as attempts by NASA and Thiokol management to discredit his and his colleagues’ testimony.
In recounting the event, he wrote: “I thought it was unconscionable that [Thiokol] and NASA management wouldn't tell the whole truth so that the program could go forward with proper corrective measures.”
In public testimony on February 25, Boisjoly and Alan McDonald, manager of Thiokol's solid rocket motor program, recalled the preflight teleconference. Boisjoly discussed why he opposed the launch and used the same data he presented during the call.
"We were being put into a position to prove that we should not launch rather than being put into a position to prove that we had enough data to launch," Boisjoly testified.
McDonald, who was the Thiokol liaison at Kennedy Space Center that night, said he refused to sign the launch rationale document NASA had requested from Thiokol managers. "I was absolutely surprised that NASA would accept any recommendation below 40°, especially with a predicted temperature as low as 26°F," McDonald testified.
He told Lawrence Mulloy — who managed the Challenger’s solid rocket booster project — that in addition to his concern about the O-rings, he recommended canceling the launch for two additional reasons: Rough seas would have made it impossible to recover discarded rocket booster hardware, and ice had formed on the launch pad.
“I was told that these weren't really my problems and I really shouldn't concern myself with these,” McDonald recounted.
Back in Utah, Boisjoly was isolated from the main redesign effort. Coworkers and neighbors alike shunned him. McDonald, meanwhile, was demoted. Tensions continued to rise as Thiokol and NASA took heat from congressional lawmakers during hearings that took place on Capitol Hill in Washington, D.C.
When presidential commission chairman Rogers learned that Thiokol had stripped McDonald and Boisjoly of their job responsibilities, he admonished the contractor.
After that, the two engineers took different paths. Thiokol reinstated McDonald and put him in charge of the solid rocket motor redesign. Staying on with the company was better than thinking about “what could’ve and should’ve been…and to make sure it never happens again,” McDonald said in 2012 while promoting his book, "Truth, Lies and O-rings: Inside the Space Shuttle Challenger Disaster."
Boisjoly’s path, at least initially, proved bumpier. By summer 1986, he went on sick leave and then long-term disability after experiencing severe headaches and depression. He resigned from Thiokol, saying that he could never again work on the shuttle program.
His ethical obligation as an engineer didn’t go unnoticed, however. In 1988, Boisjoly received the Award for Scientific Freedom and Responsibility from the American Association for the Advancement of Science, as well as IEEE–USA’s Citation of Honor. For nearly three decades, Boisjoly spoke to engineering students and businesses about ethical decision-making. He died in 2012.
Lessons Resonate Today
In the final Report to the President on the Space Shuttle Challenger Accident in June 1986, the Rogers Commission concluded that failure of the pressure seal in the right solid rocket motor’s aft field joint caused the accident. The failure was the result of a “faulty design unacceptably sensitive” to a number of factors, including the effects of temperature and the reaction of the joint to dynamic loading.
The report stated that neither Thiokol nor NASA responded adequately to internal warnings about the faulty seal design. The organizations didn’t make a “timely attempt” to develop and verify a new seal after engineers deemed the initial design as deficient.
Even though O-ring erosion occurred frequently during shuttle flight history, the commission found that neither organization developed a solution. “Instead, Thiokol and NASA management came to accept these effects as unavoidable and an acceptable flight risk,” the report concluded.
The commission also detailed nine actions it recommended that NASA adopt. Among the recommendations were rocket booster joint and seal redesign, a safety organization, changes in management structure and improved communications.
Although the space shuttle program ended more than five years ago, lessons from the Challenger disaster still resonate. In a recent presentation, for example, NASA reminded program and project managers that they should actively solicit dissenting opinions inside and outside of the agency at decisional meetings.
Thirty years on, engineers across all disciplines can learn lessons from the tragedy. The Challenger incident was fraught with problems similar to those that confront many engineers today, says Brad Allenby, Lincoln professor of engineering and ethics at Arizona State University. Among the issues are a complex decision space, lack of communication, and an unhealthy management structure and institutional culture.
As was the case with Challenger, organizations typically face a range of demands, requirements and constraints that may conflict with the engineer’s perspective. NASA management felt pressure to launch because the flight already had been postponed twice. It was also the era of the space race as NASA tried to outperform the Soviet Union and the European Space Agency.
The evening teleconference on Jan. 27, 1986 between engineers and management brings up two fundamental questions, according to Allenby. First, to what degree is the engineer the holder of ethical absolutes? And, second, when and how does an engineer jump the command structure because of his or her concerns?
The organization itself may hold the answers. “It is a lot easier to be an ethical engineer if you are in an organization where communication is encouraged and clear guidelines about behavior are in place,” Allenby says.
Unfortunately, going outside of the organizational structure could label an engineer a whistleblower, as happened to Thiokol’s Boisjoly and McDonald. Whistleblowing is a complicated process that “more often than we like to admit, does not end well,” Allenby says.
In the long run, however, both Thiokol engineers overcame the stigma and channeled their experiences in profound ways. Their actions during the pre-launch teleconference and in televised commission hearings after the accident offer relevant lessons for today’s engineers: Telling the truth may be professionally risky, but doing so may also keep people out of harm’s way.
Watch a video of the launch from CNN (annotated when uploaded).
Listen to a February 1986 news report from National Public Radio on the disaster.
"Ethical Decisions - Morton Thiokol and the Space Shuttle Challenger Disaster – Index," Online Ethics Center for Engineering 5/15/2006
“Report of the Presidential Commission on the Space Shuttle Challenger Accident”
“Report to the President – Actions to Implement the Recommendations”
“Dissenting Opinions,” Office of Safety & Mission Assurance, NASA
“Engineer Who Opposed Challenger Launch Offers Personal Look at Tragedy,” NASA Langley Research Center
“Engineering Ethics: The Space Shuttle Challenger Disaster,” Texas A&M University