Challenger: How a Cold-Weather O-Ring Failure Led to the Disaster

Seven astronauts died on January 28, 1986, when the space shuttle Challenger broke apart 73 seconds after launch from Kennedy Space Center. The night before, more than a dozen Morton Thiokol engineers had unanimously recommended against launching below 53°F (11.6°C). Several top executives vetoed that recommendation in an offline caucus, and Challenger lifted off at 38°F (3°C).

The recommendation that was overruled

Challenger had been due to launch on January 22. Bad weather moved it back day by day, and a weather delay plus a technical problem with a door hatch pushed it back another two days. On the 28th, strong winds cancelled the attempt. Alan Macdonald, who represented the Utah-based booster builder Morton Thiokol on site, then heard that a cold front could bring temperatures down to about 18°F by morning. He was worried about whether the O-ring seals would work at all at such temperatures.

The engineers in Utah asked him for more detailed weather reports from NASA. He asked them to prepare a presentation of what was known and unknown and to have the vice president of engineering state the lowest temperature at which launch was safe. A teleconference linked engineers in Utah, Marshall Space Flight Center in Huntsville, Alabama, and NASA management at Cape Canaveral. The vice president recommended against launching below 53°F, citing mainly the experience a year earlier. Macdonald had expected NASA to postpone. Instead, NASA managers immediately questioned the basis of the recommendation.

After the offline caucus, NASA wanted the go-ahead in writing. Macdonald refused to sign it. He also told the teleconference that winds were gusting up to 70 knots and that there was ice everywhere. NASA said it would pass those concerns on in an advisory capacity only.

Ice and cold on the pad

The next day, ice teams knocked icicles off the shuttle and took temperature readings with an infrared pyrometer gun, entering them in NASA log books. A later review of those logs showed the temperature near the failed solid rocket booster was below 28°F (minus 2°C), colder than the ambient 31°F. That spot was shaded from the sun and exposed to westerly winds. Macdonald said NASA managers later claimed the instruments had not been properly calibrated and raised all the temperatures they submitted to the presidential commission. He called it a cover-up of the low-temperature data.

The joint and its O-rings

Each booster was built of segments joined at field joints, a tang and clevis arrangement Macdonald compared to tongue-and-groove flooring. Two O-rings of a fluorocarbon rubber called Viton sealed each joint, with zinc chromate putty protecting them from heat. The second ring was redundancy in case the first failed. At ignition the booster casing flexes and the joints open fractionally, so the rubber must stay resilient enough to keep contact. Macdonald compared cold rubber to a wet sponge from the freezer: it leaves a dent and does not recover until it warms.

Warnings that came earlier

The problem was not new. Engineers found O-ring erosion on the second shuttle flight, STS-2. In January 1985, during a record cold snap, blowby appeared in one field joint on each booster, where hot gas got past the first O-ring but was stopped by the second. The O-ring temperature on that launch was about 53°F. In April 1985, erosion was seen again, that time in a nozzle joint, and an O-ring seal task force was formed. In the summer of 1985 the team redesigned the boosters and proposed funding the changes for all of them, but NASA rejected it. Seven of the nine flights in the year before Challenger showed warning signs that concerned engineers enough to write memos. One engineer recalled a senior NASA administrator telling him: "Our job is to launch on time every time."

The 73 seconds

Macdonald had feared the boosters would fail within the first six or seven tenths of a second. The shuttle cleared the tower. At 73 seconds, as the shuttle was vibrating and flexing at its maximum, a flame broke through the seal and blew a hole in the external tank, aided by wind shear. Film of liftoff, which Macdonald asked to have checked, showed a puff of black smoke from an aft field joint on the right booster.

The delayed failure was explained later. After the O-rings vaporized, hot gas from burning aluminium oxide hit the cold steel and solidified, forming a fragile ceramic seal that held until the order to throttle up. As the bracing strut weakened, the booster pivoted and pushed its nose into the oxygen tank. The result was a convulsive release of energy rather than a bomb-like explosion. It punched the boosters off the tank and ripped apart parts of the orbiter, while the pressurized crew compartment stayed intact. Based on the emergency oxygen supplies used and switches thrown during the descent, the crew were likely alive and perhaps conscious for over two minutes before the compartment hit the Atlantic at 330 km/h.

The dead were commander Dick Scobee, pilot Michael Smith, mission specialists Judy Resnik, Ellison Onizuka and Ronald McNair, and payload specialists Christa McAuliffe and Gregory Jarvis. McAuliffe, a New Hampshire high school teacher, had been scheduled to teach lessons from orbit.

The commission

The Rogers Commission investigated. Commission member Richard Feynman put O-ring material in ice water and found that after pressure was released it did not spring back, with no resilience at 32°F. Macdonald testified about how the decision not to launch had been changed. Sally Ride hugged him afterward, he said, and thanked him for leveling with the commission. Returning to work, he found himself moved from engineering to head of scheduling, a job he called a non-job, and he was taken off the failure team about a day after testifying. After an Air Force general intervened, he joined a task force redesigning the shuttle. It took two years to fix the problem and launch the next shuttle. The shuttle went on to fly more than 100 successful flights after the redesign and was retired in 2011.