On 7 March 1986, six weeks after the loss of Challenger, divers from the U.S.S. Preserver found the remains of the ill-fated shuttle’s crew cabin. It “was disintegrated, with the heaviest fragmentation and crash damage on the left side,” read the Rogers Commission’s final report into the cause of the disaster. “The fractures examined were typical of overload breaks and appeared to be the result of high forces generated by impact with the surface of the water.” U.S. Navy spokesperson Deborah Burnette told a Washington Post journalist that “we’re talking debris, not a crew compartment, and we’re talking remains, not bodies.” The last vestiges of Challenger lay in 100 feet (30 meters) of water, about 16 miles (27 km) northeast of the Kennedy Space Center (KSC), and their discovery would help to unlock many of the mysteries of what happened on the tragic morning of 28 January, when America’s dreams of space exploration were cruelly shattered in the Florida sky and on millions of television screens around the world.

Veteran astronaut Mike Coats—later to serve as Director of the Johnson Space Center from 2005-2012—was among the first to examine the wreckage, and he described it as resembling “aluminum foil that had been crushed into a ball.” It contained the remains of the crew, but their horrific condition could be guessed from pathologists’ difficulty in identifying them: a few strands of Judy Resnik’s hair and a necklace were all that was left of Mission Specialist Two. Indeed, in the months after the disaster all astronauts were required to submit a clip of hair and a footprint to NASA for identification. In the case of the 51L remains, apparently, even dental records were insufficient for positive identification.…

The Crew’s Final Moments

In his 2006 memoir, Riding Rockets, astronaut Mike Mullane expressed fervent hope that the explosive burn of the External Tank’s propellants had been enough to completely destroy Challenger’s crew cabin, or at least breach her flight deck windows, thereby causing a rapid depressurization and a mercifully rapid death. Having said this, when tested to 140 percent of its design strength in Lockheed’s Plant 42 rig almost a decade earlier, that same cabin had proved to be extremely hardy, and certainly its wreckage showed little evidence of having experienced an explosive depressurization. Such an eventuality would have led to an upward “buckling” of the flight deck floor as air from the middeck rapidly expanded; no such buckling was detectable. Additionally, wrote JSC’s head of life sciences, former astronaut Joe Kerwin, in a 28 July letter to NASA Associate Administrator for Space Flight Dick Truly, the “impact damage to the windows [examined after recovery from the Atlantic] was so extreme that the presence or absence of in-flight breakage could not be determined. The estimated breakup forces would not in themselves have broken the windows. A broken window due to flying debris remains a possibility; there was a piece of debris embedded in the frame between two of the forward windows. We could not positively identify the origin of the debris or establish whether the event occurred in flight or at water impact … Impact damage was so severe that no positive evidence for or against in flight pressure loss could be found.”

Astronauts Jim Bagian and Manley “Sonny” Carter, both physicians, speculated that penetrations in the cabin’s aft bulkhead, created by the violently severed payload bay umbilical lines, could have led to a slower depressurization and quick unconsciousness for the seven astronauts, although this was conjectural. More conclusive evidence that at least some of the crew had remained alive and conscious for most of the fall to Earth came in mid-March 1986, when four Personal Egress Air Packs (PEAPs) were recovered. These were to provide each astronaut with a limited amount (about six minutes’ worth) of breathing air for use in emergencies. Analysis of the packs led to an announcement on 21 May that at least one had been activated in the seconds after structural breakup and, later, that this activation was not caused accidentally at water impact. Then, on 9 June, investigators revealed that one of the packs belonged to Pilot Mike Smith.

This raised an interesting scenario. Smith’s PEAP was affixed to the back of his seat, placing it out of his reach, which implied that either Judy Resnik or Ellison Onizuka, seated behind him on the flight deck, had leaned forward and switched it on in a valiant effort to save his life. A second identifiable PEAP belonged to Commander Dick Scobee and had not, apparently, been activated. The owners of the two other packs were never identified. The quantity of air which remained in Smith’s PEAP, in particular, led to a suggestion that apparent “crew inactivity” after breakup could be an indication that they had rapidly lost consciousness. Every scrap of paper from Challenger’s wreckage was analyzed, and it was determined that none of the astronauts had written a note; moreover, Smith’s air pack was depleted by barely two and a half minutes, almost precisely the length of time it took for the cabin to fall from the fireball to the Atlantic, which suggested he had kept his helmet visor closed during the descent. If it had remained open, all six minutes of his PEAP air would have leaked out.

Immediately after breakup, Challenger’s intercom, lights, computers, and electronics went dead. Bagian and Carter postulated that, in order to communicate, the crew’s only option would have been to raise their visors and speak aloud. Unfortunately, the helmets themselves were obliterated, which rendered it almost impossible to determine how, or if, the astronauts communicated during those final frantic minutes. However, Mullane believes from his own experience as a U.S. Air Force navigator, flying in the back seat of F-4 Phantoms in the 1960s and 1970s, that hand signals as a means of communication would have worked perfectly well. Scobee and Smith’s years of experience as fighter and test pilots would have taught them to keep their visors down, rather than risk lifting them and suffocating.

One factor is almost certain: most, if not all, of the astronauts were aware of their dire predicament. Milliseconds before the External Tank disintegrated, at T+73 seconds into the 51L ascent, a bright sheet of white vapor flooded across Challenger’s nose. It was probably visible to Smith, sitting in the right-hand seat, and may have prompted him to utter a brief exclamation (“Uh, oh”), which turned out to be the last vocal communication from the orbiter. It is also quite possible that he saw the top of the right SRB pivot into the side of the External Tank. Despite hoaxed intercom “transcripts” which alleged that the panic-stricken crew screamed and cursed their way down to the Atlantic, Mike Mullane expressed confidence that Scobee and Smith would have fought to the end to regain control of their crippled ship.

Interpreting the Wreckage

In the days after the disaster, most of the astronauts became convinced that a failure or explosion of one or more of the shuttle’s main engines was the most likely cause. Remnants of all three were dredged from the Atlantic on 23 February, each still attached to the thrust structure, and the controllers for the Number Two and Three engines were found, disassembled, flushed with deionized water, dried, vacuum-baked, and their data extracted. All of the engine debris exhibited burn damage caused, according to the Rogers report, “by internal over-temperature typical of oxygen-rich shutdown.”

Thus, the loss of hydrogen fuel after the rupturing of the lower part of the External Tank appeared to have caused all three units to begin shutting themselves down within milliseconds of each other at around T+73.5 seconds. Overall, the performance of the main engines was satisfactory and in line with observations from previous missions. They first exhibited “abnormal” behavior about a second before breakup, when their fuel tank pressures dropped and the controllers responded by opening the fuel flow-rate valves. Next, turbine temperatures increased due to the leaner fuel mixture feeding into the combustion chambers from the External Tank. Otherwise, the Rogers report continued, “engine operation was normal.” They did not contribute to the loss of 51L. Nor did the gigantic tank itself, of which 20 percent was recovered, mostly debris from the inter-tank and the lowermost hydrogen section. Initial speculation that there had been premature detonation of range safety explosives was discounted, partly because the unexploded ordnance was among the debris, as were theories of structural imperfections in the tank’s design or damage incurred at liftoff. The possibility of a liquid hydrogen leak at liftoff was also dismissed, since it would immediately have been ignited by the exhaust from the Solid Rocket Boosters or main engines and would have been evident in the downlinked telemetry data.

In total, around 30 percent of Challenger was found, and inspections revealed that she had disintegrated as a result of massive aerodynamic overloads, with no evidence of internal burn damage or exposure to explosive forces. Chemical analyses indicated that her right side had been sprayed with hot gases from the leaking SRB, but telemetry indicated that all of her systems operated normally until shortly prior to the breakup. No problems were detected with either of her payloads. The Spartan-203 free-flying solar satellite was unpowered during ascent and the deployment ordnance for the Inertial Upper Stage (IUS) and the Tracking and Data Relay Satellite (TDRS-B) showed no indication of having prematurely activated.

O-ring Seal

The finger of blame pointed squarely at the boosters and, in particular, at the leaking right-side booster. Initial suspicion that its range safety explosive charges had been inadvertently fired was dismissed when telemetry data revealed that no such commands were sent to either booster until both were remotely destroyed by the Range Safety Officer at T+110 seconds. For a number of engineers and managers at SRB manufacturer Morton Thiokol and within NASA, however, the cause of the disaster had been identified more than a year before Challenger’s maiden voyage: the primary and secondary O-rings meant to prevent a leakage of hot gases were incapable of properly sealing the gaps between the SRB joints in extremely cold weather. Already, catastrophe had been averted on one previous cold-weather launch in January 1985 and conditions in the hours leading up to 51L’s liftoff were colder still. Moreover, an application of zinc chromate putty, intended as a “thermal barrier” to keep the combustion gas path away from the two O-rings, had been shown as early as 1984 to be susceptible to the formation of “blow holes,” which compromised its effectiveness.

“It was intended,” read the Rogers report, “that the O-rings be actuated and sealed by combustion gas pressure displacing the putty in the space between the motor segments. The displacement of the putty would act like a piston and compress the air ahead of the primary O-ring and force it into the gap between the [field joint’s] tang and clevis. This process is known as ‘pressure actuation’ of the O-ring seal. This pressure-actuated sealing is required to occur very early during the solid rocket motor ignition transient, because the gap between the tang and clevis increases as pressure loads are applied to the joint during ignition. Should pressure actuation be delayed to the extent that the gap has opened considerably, the possibility exists that the rocket’s combustion gases will blow-by the O-rings and damage or destroy the seals. The principal factor influencing the size of the gap opening is motor pressure, but gap opening is also influenced by external loads and other joint dynamics.” One of these external factors was the detrimental impact of low launch temperatures, together with the effect of water and ice, on the O-rings. In the case of 51L, on the night of 27 January 1986, ambient temperatures had dipped to the lowest ever recorded for a shuttle launch: around -13 degrees Celsius (8.6 degrees Fahrenheit). Indeed, at the moment of ignition the following day, the right-hand booster’s aft field joint was the coldest part of the stack at -2.2 degrees Celsius (28 degrees Fahrenheit). Ground tests had already confirmed that reduced temperatures could cause the O-rings’ resiliency to degrade, and during the Rogers investigation it was learned that a small quantity of rainwater had been found in Columbia’s SRB joints during preparations for STS-9 in November 1983. It was theorized that 51L, which had been sitting on Pad 39B for a total of 38 days and been exposed to significantly more rainfall than Columbia, could have suffered from the further disruption, and perhaps even “unseating,” of its O-rings by frozen water.

Warning Signs

The observed problem with the boosters first arose in November 1981, shortly after STS-2. Routine inspections revealed significant erosion of the right-hand SRB’s primary O-ring due to hot combustion gases, yet the secondary seal remained intact and the anomaly went unreported at the Flight Readiness Review for STS-3 in March 1982. Morton Thiokol believed that the erosion had been caused by blow holes in the zinc chromate putty and began tests to alter the method of its application and the assembly of the booster segments. The manufacturer of the original putty, Fuller-O’Brien, discontinued its use and a new putty from the Randolph Products Company was selected in May 1982; however, after more changes, it was substituted for the original putty the following summer, shortly before the launch of STS-8.

Since December 1982, the O-rings had been designated a “Criticality 1″ item by NASA, denoting a component without a backup, whose failure would result in the loss of the shuttle and its crew. Prior to that, they had been labeled by NASA as “Criticality 1R,” meaning that, although “total element failure … could cause loss of life or vehicle,” the presence of primary and secondary O-rings lent “redundancy” to the design: in effect, the secondary seal would expand to fill the joint if its primary counterpart failed. However, in its Critical Items List of November 1980, NASA acquiesced that “redundancy of the secondary field joint seal cannot be verified after motor case pressure reaches approximately 40 percent of maximum expected operating pressure. It is known that joint rotation occurring at this pressure level … causes the secondary O-ring to lose compression as a seal.”

Following a series of high-pressure tests of the O-rings, conducted by Morton Thiokol in May 1982, it became clear that the secondary seal did not provide sufficient redundancy, and NASA changed their criticality listing later that year. According to then-Associate Administrator for Space Flight (Technical) Michael Weeks, who signed a waiver to accept the new criticality level in March 1983, “we felt at the time that the Solid Rocket Booster was probably one of the least worrisome things we had in the program.” This view was shared by managers and astronauts, too. But not by Thiokol structural engineer Roger Boisjoly.

By the time Boisjoly inspected severely damaged field joints from Mission 51C’s boosters in January 1985, a number of other missions had yielded disturbing O-ring erosion. On Mission 41B, almost a year earlier, in February 1984, the left-hand SRB’s forward field joint and the nozzle joint belonging to its right-hand counterpart were found to be badly degraded, to such an extent that NASA requested Thiokol to investigate means of preventing further erosion. A week prior to the launch of the next flight, Mission 41C, the company concluded that blow holes in the zinc chromate putty were one “possible cause,” and NASA’s SRB project office at the Marshall Space Flight Center in Huntsville, Ala., decided that, as long as the secondary O-ring could survive gas impingement, the mission was safe to fly. It was the beginning of a disturbing chain of thought within NASA and Thiokol, explained the Rogers report, that “there was an early acceptance of the problem” and both organizations “continued to rely on the redundancy of the secondary O-ring long after NASA had officially declared that the seal was a non-redundant, single-point [Criticality 1] failure.”

One of the members of the Rogers inquiry was the celebrated physicist Richard Feynman, who judged the cavalier attitude of NASA and Thiokol as representing “a kind of Russian roulette … [the shuttle] flies [with O-ring erosion] and nothing happens. Then it is suggested, therefore, that the risk is no longer so high for the next flights. We can lower our standards a little bit because we got away with it last time. You got away with it, but it shouldn’t be done over and over again like that.” Mike Mullane scornfully called it the “normalization of deviance.”

The damage from Mission 51C was among the most serious yet seen. Launched in freezing conditions of just 11 degrees Celsius (51.8 degrees Fahrenheit) on 24 January 1985, its recovered left and right SRB nozzles showed evidence of “blow-by” between the primary and secondary O-rings, and, moreover, it proved to be the first shuttle mission in which the secondary seal displayed the effects of heat. “SRM [Solid Rocket Motor]-15,” said Boisjoly of one of the 51C boosters, “actually increased concern because that was the first time we had actually penetrated a primary O-ring on a field joint with hot gas, and we had a witness to that event because the grease between the O-rings was blackened, just like coal. That was so much more significant than had ever been seen before on any blow-by on any joint.” When the blackened material was analyzed, Boisjoly told the Rogers hearing, “we found the products of putty in it [and] the products of O-ring in it.” Four days after 51C landed, on 31 January, Lawrence Mulloy, head of the SRB office at the Marshall Space Flight Center, expressed concern over the impact O-ring problems may have on the next scheduled flight, Mission 51E, then projected for launch in late February. One of Thiokol’s conclusions before the Flight Readiness Review was that, while “low temperature enhanced probability of blow-by … the condition is not desirable, but is acceptable.”

It was the first occasion on which a link between cold weather and O-ring damage had been officially acknowledged. Yet far more missed warnings were to come … and in doing so, they would set up the cards for the worst and most public disaster in NASA’s history.

Boisjoly Takes Steps

In late April 1985, three months after the Solid Rocket Boosters (SRBs) of Mission 51C had first drawn the attention of Morton Thiokol structural engineer Roger Boisjoly, another shuttle crew took flight. Mission 51B carried the Spacelab-3 payload, and subsequent examination of its boosters indicated erosion of the secondary O-ring, pointing clearly to a failure of its primary counterpart. As noted, it was the latest in a worrying string of events which highlighted the failings of the shuttle vehicle and the management decisions which would doom Challenger on Mission 51L on 28 January 1986.

The 51B problem was attributed to leak check procedures. So serious was the episode, however, that “a launch constraint was placed on flight 51F and on subsequent launches,” read the Rogers Commission’s report into the Challenger accident. “These constraints had been imposed, and regularly waived, by the Solid Rocket Booster Project Manager at Marshall [Space Flight Center in Huntsville, Ala.], Lawrence B. Mulloy. Neither the launch constraint, the reason for it, or the six consecutive waivers prior to 51L were known to [NASA Associate Administrator for Space Flight, Jesse] Moore or [Launch Director Gene] Thomas at the time of the Flight Readiness Review process for 51L … ”

In fact, as Mission 51B’s commander, Bob Overmyer, would later discover, his own launch had been milliseconds from disaster. Crewmate Don Lind journeyed to Thiokol in Brigham City, Utah, for further explanation. “The first seal on our flight had been totally destroyed,” recalled Lind in his NASA oral history, “and the [other] seal had 24 percent of its diameter burned away. Sixty-one millimeters had been burned away. All of that destruction happened in 600 milliseconds and what was left of that last O-ring, if it had not sealed the crack and stopped that outflow of gases—if it had not done that in the next 200 to 300 milliseconds—it would have gone. You’d never have stopped it and we’d have exploded. That was thought provoking! We thought that was significant in our family. I painted a picture of our liftoff, then two great celestial hands supporting the shuttle, and the title of that picture is Three-Tenths of a Second. Each of [my] children have a copy of that painting, because we wanted the grandchildren to know that we think the Lord really protected Grandpa.”

Shortly after the analysis of the 51B boosters, on 31 July 1985, Roger Boisjoly expressed his growing concerns over the O-ring joint seals in a memorandum to Thiokol’s vice president of engineering, Bob Lund. “The mistakenly accepted position on the joint problem,” he wrote, “was to fly without fear of failure and to run a series of design evaluations which would ultimately lead to a solution or at least a significant reduction of the erosion problem. This position is now changed as a result of the [51B] nozzle joint erosion, which eroded a secondary O-ring with the primary O-ring never sealing. If the same scenario should occur in a field joint—and it could—then it is a jump ball whether as to the success or failure of the joint, because the secondary O-ring…may not be capable of pressurization. The result would be a catastrophe of the highest order: loss of human life.”

Boisjoly recommended the establishment of a Thiokol team to investigate and resolve the problem, and, on 20 August 1985, Lund duly announced the formation of a task force. However, only a day earlier, in a joint Thiokol-Marshall briefing to NASA Headquarters in Washington, D.C., on the issue, program managers concluded that the O-rings were a “critical” issue, but that, so long as all joints were leak checked with a 200 psi stabilization pressure, were free of contamination in the seals, and met O-ring “squeeze” requirements, it was safe to continue flying. As the year wore on, Thiokol’s O-ring team, which had only 8-10 members, found many of their efforts frustrated by senior management. “Even NASA perceives that the team is being blocked in its engineering efforts to accomplish its task,” Boisjoly wrote in a 4 October memo. “NASA is sending an engineering representative to stay with us, starting 14 October. We feel that this is the direct result of their feeling that we [Thiokol] are not responding quickly enough on the seal problem.”

A little over three weeks later, on 30 October 1985, Challenger flew Mission 61A, experiencing nozzle O-ring erosion and blow-by at the SRB field joints; neither of these problems were identified at the Flight Readiness Review for the next mission, 61B, in November. Indeed, that flight also suffered nozzle O-ring erosion and blow-by. By early December, in response to these problems, Thiokol recommended that their testing equipment needed to be redesigned. Only days later, on the 10th, the company requested closure of the O-ring critical problem issue, citing satisfactory test results, future plans, and work carried out thus far by its task force. This closure request was harshly criticized by the Rogers investigators. One panel member pointed out to the Thiokol senior managers: “You close out items that you’ve been reviewing flight by flight—that have obviously critical implications—on the basis that, after you close it out, you’re going to continue to try to fix it. What you’re really saying is [that] you’re closing it out because you don’t want to be bothered.”

Schedule Pressure

Part of the problem was NASA’s desire, since the mid-1970s, to create a reusable transportation system that would provide regular and routine access to low-Earth orbit. Original plans to fly the shuttle once every fortnight, admittedly, were unrealistic with only four operational orbiters—rather than six or seven—but in its December 1985 launch schedule, the agency envisaged staging up to 24 missions per year from 1987 onward. In correspondence with this author, one former shuttle engineer expressed serious doubts that such flight rates were achievable, even with overtime and three shifts working around-the-clock in the Orbiter Processing Facility (OPF). Nine or 10 missions in any 12-month period stretched resources to their limits. Overtime and overwork presented their own problems. Numerous contract employees at the Kennedy Space Center (KSC), the Rogers Commission heard, worked 72-hour weeks and frequently supported 12-hour shifts. “The potential implications of such overtime for safety were made apparent during the attempted launch of Mission 61C on 6 January 1986,” read the report, “when fatigue and shift work were cited as major contributing factors to a serious incident involving a liquid oxygen depletion that occurred less than five minutes before scheduled liftoff.”

Furthermore, the commission discovered disturbing evidence that NASA’s provisions to support the projected 24-flight annual rate were woefully inadequate. Spares for individual orbiters were in short supply (only 65 percent of the required parts inventory was in place by January 1986), leading to an increasingly dangerous practice of “cannibalism” from one vehicle to equip the next, and resources focused primarily on “near-term” problems, rather than longer-term issues. An $83.3 million budget cut in October 1985 necessitated additional major deferrals of spare parts purchases. The cannibalism of parts, said STS-6 veteran Paul Weitz, then deputy chief of the astronaut office, in his Rogers testimony, “increases the exposure of both orbiters to intrusion by people. Every time you get people inside and around the orbiter, you stand a chance of inadvertent damage of whatever type, whether you leave a tool behind or, without knowing it, step on a wire bundle or a tube.”

Prior to the disaster, the shortage of spare parts had no serious impact on flight schedules, noted the Rogers report, but further cannibalism was “possible only so long as orbiters from which to borrow are available. In the spring of 1986, there would have been no orbiters to use for spare parts. Columbia was to fly in March, Discovery was to be sent to Vandenberg [Air Force Base in California] and Atlantis and Challenger were to fly in May.” Indeed, KSC’s shuttle engineering chief, Horace Lamberth, predicted that, had 51L flown successfully, the entire schedule would have been brought to its knees that spring by the spare parts problem alone. “Compounding the problem,” the report explained, “was the fact that NASA had difficulty evolving from its ‘single flight’ focus to a system that could efficiently support the projected flight rate. It was slow in developing a hardware maintenance plan for its reusable fleet and slow in developing the capabilities that would allow it to handle the higher volume of work and training associated with the increased flight frequency.”

With the loss of Challenger, just 73 seconds after liftoff on 28 January 1986, all shuttle missions were suspended until the Rogers Commission—whose panel included former astronauts Neil Armstrong and Sally Ride, under the chairmanship of former Secretary of State William Rogers—had finished its work and made its recommendations. Among its conclusions were that NASA and Thiokol’s operation of the shuttle was seriously flawed. Concerns from individual engineers were not reaching appropriate managers, “critical” items were not given the attention they demanded, and the need to stick to a “schedule” was grossly overriding “safety.” Not only was NASA attempting to accommodate its major customers but, evidenced in a teleconference with managers at the Marshall Space Flight Center and KSC on the evening of 27 January 1986, Thiokol showed that it was prepared to ignore the safety concerns of its engineers in order to accommodate NASA, its own major customer. Worries of potential O-ring failure in the near-freezing weather conditions predicted for the following morning, as expressed by Roger Boisjoly and others, were downplayed, and Thiokol collectively voted that Challenger was fit to fly, unwittingly signing the death warrants of the seven-member 51L crew: Commander Dick Scobee, Pilot Mike Smith, Mission Specialists Ellison Onizuka, Judy Resnik, and Ron McNair, Payload Specialist Greg Jarvis, and the first citizen in space, schoolteacher Christa McAuliffe.

Putting Safety to the Vote

During that fateful teleconference, Bob Lund argued that his team’s “comfort level” was not to fly SRBs at temperatures below 12 degrees Celsius (53 degrees Fahrenheit) for fear of catastrophic “blow-by” of the O-rings and field joints, but he could present no evidence to Marshall that “proved” it was unsafe to do so. In a lengthy debate, Lawrence Mulloy—based in Florida as Marshall’s KSC representative at the time—and other NASA officials challenged Thiokol’s data and questioned its logic. At one stage, Marshall’s head of science and engineering, George Hardy, remarked that he was “appalled” at the company’s decision. So was Mulloy, who scornfully exploded with “For God’s sake, Thiokol, when do you expect me to launch? Next April?”

Neither man, however, was prepared to ignore the recommendation of their major contractor. Lund stood firm and, had he continued to do so, NASA would have had little choice but to postpone the 51L launch. Shortly thereafter, Thiokol requested a five-minute recess from the teleconference to consider the situation. Five minutes ultimately became half an hour. Throughout this recess, Boisjoly and fellow engineer Arnie Thompson continued to argue that it was unsafe to fly outside of their proven field joint temperature range, but the Thiokol senior executives in attendance felt the O-rings should still seat and function properly, despite the cold weather. “Arnie actually got up from his position and walked up the table, put a quarter pad down in front of the management folks and tried to sketch out once again what his concern was with the joint,” Boisjoly told the Rogers Commission, “and when he realized he wasn’t getting through, he stopped. I grabbed the photos and tried to make the point that it was my opinion from actual observations that temperature was indeed a discriminator and we should not ignore the physical evidence that we had observed. I also stopped when it was apparent that I couldn’t get anybody to listen.”

Then, executive Jerry Mason explicitly asked Lund to remove his engineering hat and put on his management hat. When the teleconference resumed, Lund changed his vote and Thiokol changed its position on the issue. The company’s new recommendation was that, although frigid weather conditions remained a problem, their data was indeed inconclusive and the launch of 51L should go ahead the following morning. None of the engineers wrote out the new recommendation—“I was not even asked to participate in giving any input to the final decision charts,” Boisjoly told the Rogers hearing—and only the executive managers signed it. However, when Marshall and KSC managers asked for any additional comments from around the Thiokol table before closing the teleconference, none of them voiced their concerns. Boisjoly, in particular, remained silent—a fact which would later lead some observers to brand him a witness who turned “state’s evidence,” rather than a noble “whistleblower.”

When questioned by a Rogers panel member, he emphasized that “I never [would] take [away] any management right to take the input of an engineer and then make a decision based upon that input, and I truly believe that. There was no point in me doing anything any further than I had already attempted to do … [but] I left the room feeling badly defeated. I personally felt that management was under a lot of pressure to launch and that they made a very tough decision, but I didn’t agree with it.” Having analyzed the results of the teleconference, and interviewed the participants, the Rogers report concluded that “there was a serious flaw in the decision-making process leading up to the launch … A well-structured and managed system, emphasizing safety, would have flagged the rising doubts about the Solid Rocket Booster joint seal.” In fact, when brought to testify before the panel, key officials intimately involved with the decision-making process, including Launch Director Gene Thomas and Associate Administrator for Space Flight Jesse Moore, admitted that they had not been privy to the issues raised at the 27 January teleconference.

The Shuttle after Challenger

Over the years, many observers have commented that, had Challenger not been lost, another unsuspecting shuttle crew would have fallen victim to catastrophe. Astronaut Bob Parker, who would have flown aboard the next flight, Mission 61E, has expressed his fervent belief that disaster may have befallen himself and his crewmates … for the weather conditions in Florida in the early hours of 6 March 1986 were even colder than those on the night before Challenger’s fateful flight. Although it seems unlikely that Columbia could have been ready in time, NASA was still aiming to launch 61E at 5:45 a.m. EST on the 6th, kicking off an ambitious science flight with the ASTRO-1 payload.

Schedule pressure and the need to revise managerial communications channels to enable individual engineers to express concerns more openly were only part of the problem. On the technical side, decreed the National Research Council’s shuttle audit committee, the most important requirement was the redesign of the SRB field joints and O-ring seals to prevent future leakages. In its July 1986 response to President Reagan and the Rogers Commission, NASA announced a $680 million plan: to redesign the joint’s metal components, insulation, and seals, thereby providing “improved structural capability, seal redundancy and thermal protection.” New capture latches would reduce joint movements caused by motor pressure or structural loads, and the O-rings were redesigned to not leak under structural deflection at twice the expected level. Internal insulation was modified with a deflection relief flap, rather than putty, and new bolts, strengtheners, and a third O-ring were added. External heaters with integrated weather seals would ensure that future SRB joint temperatures did not fall below 24 degrees Celsius (75.2 degrees Fahrenheit) and prevent water from entering the seals. “The strength of the improved joint design,” read NASA’s reply to Reagan, “is expected to approach that of the [SRB] case walls.”

By the time the shuttle returned to flight with STS-26 in September 1988, the redesigned vehicle boasted many end-to-end modifications which rendered it perhaps the safest it could possibly be. For more than a decade, crews supported dozens of successful missions and, with a number of exceptions, the SRBs functioned without incident. On the morning of 16 January 2003, an apparently routine flight—STS-107—lifted off to begin a 16-day science mission. Two weeks later, through a disturbing combination of cruel fortune and poor decision-making, Columbia was lost with all hands during re-entry … and the shuttle came to be recognized for what it truly was: a remarkable machine, capable of remarkable things, but an inherently unsafe vehicle. And in July 2011, bowing to presidential recommendation, NASA flew its final shuttle flight and closed out 30 years of astonishing achievement.

By Ben Evans.