The Space Shuttle Challenger disaster occurred on January 28, 1986, when Space Shuttle Challenger broke apart 73 seconds into its flight, leading to the deaths of its seven crew members. The spacecraft disintegrated over the Atlantic Ocean, off the coast of central Florida, United States, at 11:39 a.m.
Disintegration of the entire vehicle began after an O-ring seal in its right solid rocket booster (SRB) failed at liftoff. The O-ring failure caused a breach in the SRB joint it sealed, allowing pressurized hot gas from within the solid rocket motor to reach the outside and impinge upon the adjacent SRB attachment hardware and external fuel tank. This led to the separation of the right-hand SRB’s aft attachment and the structural failure of the external tank. Aerodynamic forces promptly broke up the orbiter.
The disaster resulted in a 32-month hiatus in the shuttle program and the formation of the Rogers Commission, a special commission appointed by United States President Ronald Reagan to investigate the accident. The Rogers Commission found that NASA’s organizational culture and decision-making processes had been a key contributing factor to the accident. NASA managers had known that contractor Morton Thiokol’s design of the SRBs contained a potentially catastrophic flaw in the O-rings since 1977, but they failed to address it properly. They also disregarded warnings from engineers about the dangers of launching posed by the low temperatures of that morning and had failed to adequately report these technical concerns to their superiors. The Rogers Commission offered NASA nine recommendations that were to be implemented before shuttle flights resumed.
Pre-launch conditions and delay
Challenger was originally set to launch from Kennedy Space Center in Florida at 2:42 p.m. Eastern Standard Time (EST) on January 22. However, delays suffered by the previous mission, STS-61-C, caused the launch date to be pushed back to January 23 and then to January 24. Launch was then rescheduled to January 25 due to bad weather at the Transoceanic Abort Landing (TAL) site in Dakar, Senegal. NASA decided to use Casablanca as the TAL site, but because it was not equipped for night landings, the launch had to be moved to the morning (Florida time). Predictions of unacceptable weather at Kennedy Space Centre caused the launch to be rescheduled for 9:37 a.m. EST on January 27.
The launch was delayed the next day by problems with the exterior access hatch. First, one of the micro switch indicators used to verify that the hatch was safely locked malfunctioned. Then, a stripped bolt prevented the closeout crew from removing a closing fixture from the orbiter’s hatch. When the fixture was finally sawn off, crosswinds at the Shuttle Landing Facility exceeded the limits for a Return to Launch Site (RTLS) abort. The crew waited for the winds to die down until the launch window finally ran out, forcing yet another scrub.
Forecasts for January 28 predicted an unusually cold morning, with temperatures close to 31 °F (−1 °C), the minimum temperature permitted for launch. The low temperature had prompted concern from engineers at Morton Thiokol, the contractor responsible for the construction and maintenance of the shuttle’s SRBs. At a teleconference on the evening of January 27, Thiokol engineers and managers discussed the weather conditions with NASA managers from Kennedy Space Center and Marshall Space Flight Center. Several engineers—most notably Roger Boisjoly, who had voiced similar concerns previously—expressed their concern about the effect of the temperature on the resilience of the rubber O-rings that sealed the joints of the SRBs. Each SRB was constructed of six sections joined in three factory joints and three “field joints”. The factory joints were welded, but the field joints—assembled in the Vehicle Assembly Building at Kennedy Space Center—each used two rubber O-rings, a primary and a secondary (backup), to seal them. The seals of all of the SRB joints were required to contain the hot high-pressure gases produced by the burning solid propellant inside, forcing it out the nozzle at the aft end of each rocket. Thiokol engineers argued that if the O-rings were colder than 53 °F (12 °C), they did not have enough data to determine whether the joint would seal properly. This was an important consideration, since the SRB O-rings had been designated as a “Criticality 1” component—meaning that there was no backup if both the primary and secondary O-rings failed, and their failure would destroy the Orbiter and its crew.
One argument of NASA personnel in contest to Thiokol’s concerns was that if the primary O-ring failed the secondary O-ring would still seal. This was unproven, and was in any case an illegitimate argument for a Criticality 1 component. (As astronaut Sally Ride cited in questioning NASA managers before the Rogers Commission, it is forbidden to rely on a backup for a Criticality 1 component. The backup is there to provide redundancy in case of unforeseen failure, not to replace the primary device, leaving no backup.) The engineers at Thiokol also argued that the low overnight temperatures (18 degrees F the evening prior to launch) would almost certainly result in SRB temperatures below their redline of 40 °F (4 °C). Ice had accumulated all over the launch pad, raising concerns that ice could damage the shuttle upon lift-off.
However, they were overruled by Morton Thiokol management, who recommended that the launch proceed as scheduled. Despite public perceptions that NASA always maintained a “fail-safe” approach, Thiokol management was influenced by demands from NASA managers that they show it was not safe to launch rather than prove conditions were safe. It later emerged in the aftermath of the accident that NASA managers frequently evaded safety regulations to maintain the launch manifest (schedule).
Due to the low temperature, a significant amount of ice built up on the fixed service structure that stood beside the shuttle. The Kennedy Ice Team inadvertently pointed an infrared camera at the aft field joint of the right SRB and found the temperature to be only 8 °F (−13 °C). This was believed to be the result of supercooled air blowing on the joint from the liquid oxygen tank vent. It was much lower than the air temperature and far below the design specifications for the O-rings. However, the 8 °F (−13 °C) reading was later determined to be erroneous, the error caused by not following the temperature probe manufacturer’s instructions. Tests and adjusted calculations later confirmed that the temperature of the joint was not substantially different than the ambient temperature.
Although the Ice Team had worked through the night removing ice, engineers at Rockwell International, the shuttle’s prime contractor, still expressed concern. Rockwell engineers watching the pad from their headquarters in Downey, California, were horrified when they saw the amount of ice. They feared that during launch, ice might be shaken loose and strike the shuttle’s thermal protection tiles, possibly due to the aspiration induced by the jet of exhaust gas from the SRBs. Rocco Petrone, the head of Rockwell’s space transportation division, and his colleagues viewed this situation as a launch constraint, and told Rockwell’s managers at the Cape that Rockwell could not support a launch. However, Rockwell’s managers at the Cape voiced their concerns in a manner that led Houston-based mission manager Arnold Aldrich to go ahead with the launch. Aldrich decided to postpone the shuttle launch by an hour to give the Ice Team time to perform another inspection. After that last inspection, during which the ice appeared to be melting, Challenger was finally cleared to launch at 11:38 a.m. EST.
The accident
Later review of launch film showed that at T+0.678, strong puffs of dark gray smoke were emitted from the right-hand SRB near the aft strut that attaches the booster to the ET. The last smoke puff occurred at about T+2.733. The last view of smoke around the strut was at T+3.375. It was later determined that these smoke puffs were caused by the opening and closing of the aft field joint of the right-hand SRB. The booster’s casing had ballooned under the stress of ignition. As a result of this ballooning, the metal parts of the casing bent away from each other, opening a gap through which hot gases—above 5,000 °F (2,800 °C)—leaked. This had occurred in previous launches, but each time the primary O-ring had shifted out of its groove and formed a seal. Although the SRB was not designed to function this way, it appeared to work well enough, and Morton-Thiokol changed the design specs to accommodate this process, known as extrusion.
Unfortunately, while extrusion was taking place, hot gases would leak past, a process called blow-by, damaging the O-rings until a seal was made. Investigations into the matter by Morton-Thiokol engineers determined that the amount of damage to the O-rings was directly related to the time it took for extrusion to occur, and that cold weather, by causing the O-rings to harden, lengthened the time of extrusion.
On the morning of the disaster, the primary O-ring had become so hard due to the cold that it couldn’t seal in time. The secondary O-ring was not in its seated position due to the metal bending. There was now no barrier to the gases, and both O-rings were vaporized across 70 degrees of arc. However, aluminum oxides from the burned solid propellant sealed the damaged joint, temporarily replacing the O-ring seal before actual flame rushed through the joint.
As the vehicle cleared the tower, the SSMEs were operating at 104% of their rated maximum thrust, and control switched from the Launch Control Center (LCC) at Kennedy to the Mission Control Center (MCC) at Johnson Space Center in Houston, Texas. To prevent aerodynamic forces from structurally overloading the orbiter, at T+28 the SSMEs began throttling down to limit the velocity of the shuttle in the dense lower atmosphere, as per normal operating procedure. At T+35.379, the SSMEs throttled back further to the planned 65%. Five seconds later, at about 5,800 metres (19,000 ft), Challenger passed through Mach 1. At T+51.860, the SSMEs began throttling back up to 104% as the vehicle passed beyond Max Q, the period of maximum aerodynamic pressure on the vehicle.
Beginning at about T+37, the shuttle experienced a series of wind shear events over the next 27 seconds that were the strongest recorded to date in the shuttle program. At T+58.788, a tracking film camera captured the beginnings of a plume near the aft attach strut on the right SRB. Unknown to those on Challenger or in Houston, hot gas had begun to leak through a growing hole in one of the right-hand SRB’s joints. The force of the wind shear shattered the temporary oxide seal that had taken the place of the damaged O-rings, removing the last barrier to flame rushing through the joint. Had it not been for the wind shear, the fortuitous oxide seal might have held through booster burnout.
Within a second, the plume became well defined and intense. Internal pressure in the right SRB began to drop because of the rapidly enlarging hole in the failed joint, and at T+60.238 there was visual evidence of flame coming through the joint and impinging on the external tank.
At T+64.660, the plume suddenly changed shape, indicating that a leak had begun in the liquid hydrogen tank, located in the aft portion of the external tank. The nozzles of the main engines pivoted under computer control to compensate for the unbalanced thrust produced by the booster burn-through. The pressure in the shuttle’s external liquid hydrogen tank began to drop at T+66.764, indicating the effect of the leak.
At this stage the situation still seemed normal both to the astronauts and to flight controllers. At T+68, the CAPCOM Richard Covey informed the crew that they were “go at throttle up”, and Commander Dick Scobee confirmed the call. His response, “Roger, go at throttle up,” was the last communication from Challenger on the air-to-ground loop.
Vehicle breakup
At T+72.284, the right SRB apparently pulled away from the aft strut attaching it to the external tank. Later analysis of telemetry data showed a sudden lateral acceleration to the right at T+72.525, which may have been felt by the crew. The last statement captured by the crew cabin recorder came just half a second after this acceleration, when Pilot Michael J. Smith said “Uh oh.” Smith may also have been responding to onboard indications of main engine performance, or to falling pressures in the external fuel tank.
At T+73.124, the aft dome of the liquid hydrogen tank failed, producing a propulsive force that pushed the hydrogen tank into the liquid oxygen tank in the forward part of the ET. At the same time, the right SRB rotated about the forward attach strut, and struck the intertank structure.
The breakup of the vehicle began at T+73.162 seconds and at an altitude of 48,000 feet (14.6 km). With the external tank disintegrating (and with the semi-detached right SRB contributing its thrust on an anomalous vector), Challenger veered from its correct attitude with respect to the local air flow and was immediately torn apart by abnormal aerodynamic forces, resulting in a load factor of up to 20 (or 20 g), well over its design limit of 5 g. The two SRBs, which can withstand greater aerodynamic loads, separated from the ET and continued in uncontrolled powered flight for another 37 seconds. The SRB casings were made of half-inch (12.7 mm) thick steel and were much stronger than the orbiter and ET; thus, both SRBs survived the breakup of the space shuttle stack, even though the right SRB was still suffering the effects of the joint burn-through that had set the destruction of Challenger in motion.
Investigation by Rogers Commission
The Presidential Commission on the Space Shuttle Challenger Accident, also known as the Rogers Commission (after its chairman), was formed to investigate the disaster. The commission members were Chairman William P. Rogers, Vice Chairman Neil Armstrong, David Acheson, Eugene Covert, Richard Feynman, Robert Hotz, Donald Kutyna, Sally Ride, Robert Rummel, Joseph Sutter, Arthur Walker, Albert Wheelon, and Chuck Yeager. The commission worked for several months and published a report of its findings. It found that the Challenger accident was caused by a failure in the O-rings sealing a joint on the right solid rocket booster, which allowed pressurized hot gases and eventually flame to “blow by” the O-ring and make contact with the adjacent external tank, causing structural failure. The failure of the O-rings was attributed to a faulty design, whose performance could be too easily compromised by factors including the low temperature on the day of launch.
More broadly, the report also considered the contributing causes of the accident. Most salient was the failure of both NASA and Morton Thiokol to respond adequately to the danger posed by the deficient joint design. However, rather than redesigning the joint, they came to define the problem as an acceptable flight risk. The report found that managers at Marshall had known about the flawed design since 1977, but never discussed the problem outside their reporting channels with Thiokol—a flagrant violation of NASA regulations. Even when it became more apparent how serious the flaw was, no one at Marshall considered grounding the shuttles until a fix could be implemented. On the contrary, Marshall managers went as far as to issue and waive six launch constraints related to the O-rings. The report also strongly criticized the decision making process that led to the launch of Challenger, saying that it was seriously flawed.
” …failures in communication… resulted in a decision to launch 51-L based on incomplete and sometimes misleading information, a conflict between engineering data and management judgments, and a NASA management structure that permitted internal flight safety problems to bypass key Shuttle managers.”
One of the commission’s most well-known members was theoretical physicist Richard Feynman. During a televised hearing, he famously demonstrated how the O-rings became less resilient and subject to seal failures at ice-cold temperatures by immersing a sample of the material in a glass of ice water. He was so critical of flaws in NASA’s “safety culture” that he threatened to remove his name from the report unless it included his personal observations on the reliability of the shuttle, which appeared as Appendix F. In the appendix, he argued that the estimates of reliability offered by NASA management were wildly unrealistic, differing as much as a thousand fold from the estimates of working engineers. “For a successful technology,” he concluded, “reality must take precedence over public relations, for nature cannot be fooled.”
The U.S. House Committee on Science and Technology also conducted hearings, and on October 29, 1986 released its own report on the Challenger accident. The committee reviewed the findings of the Rogers Commission as part of its investigation, and agreed with the Rogers Commission as to the technical causes of the accident. However, it differed from the committee in its assessment of the accident’s contributing causes.
” …the Committee feels that the underlying problem which led to the Challenger accident was not poor communication or underlying procedures as implied by the Rogers Commission conclusion. Rather, the fundamental problem was poor technical decision-making over a period of several years by top NASA and contractor personnel, who failed to act decisively to solve the increasingly serious anomalies in the Solid Rocket Booster joints.”
In response to the commission’s recommendation, NASA initiated a total redesign of the space shuttle’s solid rocket boosters, which was watched over by an independent oversight group as stipulated by the commission. NASA’s contract with Morton Thiokol, the contractor responsible for the solid rocket boosters, included a clause stating that in the event of a failure leading to “loss of life or mission,” Thiokol would forfeit $10 million of its incentive fee and formally accept legal liability for the failure. After the Challenger accident, Thiokol agreed to “voluntarily accept” the monetary penalty in exchange for not being forced to accept liability.
Although significant changes were made by NASA after the Challenger accident, many commentators have argued that the changes in its management structure and organizational culture were neither deep nor long-lasting. After the Space Shuttle Columbia disaster in 2003, attention once again focused on the attitude of NASA management towards safety issues. The Columbia Accident Investigation Board (CAIB) concluded that NASA had failed to learn many of the lessons of Challenger. In particular, the agency had not set up a truly independent office for safety oversight; the CAIB felt that in this area, “NASA’s response to the Rogers Commission did not meet the Commission’s intent”. The CAIB believed that “the causes of the institutional failure responsible for Challenger have not been fixed,” saying that the same “flawed decision making process” that had resulted in the Challenger accident was responsible for Columbia’s destruction seventeen years later.
