Professionalism/Roger Boisjoly, Morton Thiokol, and NASA

This book is a class project until May 17, 2013. Editors who are not students in the class are requested to refrain voluntarily from substantive content edits until then. Comments on the talk pages, as well as formatting edits (especially those that help the book adhere to Wikibooks conventions), are invited, welcome and appreciated. Thank you.


On January 28, 1986, at 11:38 a.m., EST, the space shuttle Challenger lifted off at Kennedy Space Center, Florida. However, it broke apart 73 seconds into its flight, leading to the deaths of its seven crew members. Many people viewed the launch live because of crew member Christa McAuliffe, the first member of the Teacher in Space Project and the (planned) first female teacher in space. After the Challenger disaster, the U.S government established an investigation team called Rogers Commission to examine the causes of the disaster. The disaster was due in part to faulty booster designs and partly due to communication and management failures. The Challenger disaster is to this day used as a case study in engineering safety and workplace ethics.

People and Organizations InvolvedEdit

Marshall Space Flight Center - A rocketry and spacecraft propulsion research center where the booster rocket were developed

Morton Thiokol Inc. (MTI) - The company contracted by NASA to build the Solid Rocket Booster

Larry Mulloy - MTI's Solid Rocket Booster Manager

Alan McDonald - Director of the Solid Rocket Motors Project at Morton Thiokol

Bob Lund - MTI's Engineering Vice President

Roger Boisjoly - A MTI engineer in the Solid Rocket Booster project

Jerald Mason - MTI's Senior Vice President

Rogers Commission - The investigation team established after Challenger disaster by the U.S government to examine the causes of the disaster


August 1972 - Morton Thiokol was awarded contract at $710 million [1] to build solid rocket boosters.

1976 - NASA accepted Morton Thiokol's booster design.

1977 - Morton Thiokol discovers joint rotation problem.

November 1981 - O-ring erosion discovered after second shuttle flight.

April 1983 - The maiden voyage of space shuttle Challenger to deploy a NASA communications satellite

January 1985 - Robert Boisjoly becomes concerned about O-Rings after he realizes the field joint almost completely failed[2].

July 1985 - Thiokol ordered new steel billets for new field joint design.

August 19, 1985 - NASA Level I management briefed on booster problem.

January 27, 1986 - Night teleconference to discuss effects of cold temperature.

January 28, 1986 - Challenger exploded.

The Design Problems and Insufficient TestingEdit

The Rogers Commission found that the Challenger accident was caused by a failure in O-ring sealing the aft field joint on the right solid rocket booster, which allowed the leakage of hot pressurized gases and eventually caused structural failure of the external tank. The failure was a result of the cold temperature which weakened the putty between the hot gases and the O-Rings which sealed the joint. The putty had a blow-by which led to hot gases further eroding the O-rings so that the first O-ring could not make a seal. The second O-ring was rendered useless as the solid rocket booster's field joint bent away, preventing a seal. Therefore hot gases burned through onto the external tank, causing it to explode 73 seconds after the launch.

Solid Rocket Boosters (SRBs) Field JointEdit

In 1974, Thiokol was selected to receive NASA contract at $710 million [3] to design and build the solid rocket boosters(SRBs). Costs were the primary concern of NASA’s selection board, and Thiokol’s low cost advantages overrode other technical objections, resulting in a cost plus award fee of approximately $800 million .[4] The Challenger SRB problems began with the design of the joint between sections of the rocket

Field joint picture from Rogers Commission-Volume 1, p.57

. The sections of the SRBs are connected at what is called the field joint which is composed of 177 pins connecting the clevis and tang to hold the pieces together. The zinc putty is designed to stop the O-Rings, which seal the joints together, from being burned by hot gasses from burning fuel. The two solid rocket boosters attached to a space shuttle orbiter provided 80% of the thrust necessary to propel the shuttle into space. [5]About 2 minutes after a normal launch, the solid rocket boosters would detach and parachute back to the ground to be reused in subsequent missions.[6]

Tests revealed a flaw in the SRB design. A hydroburst test, which uses pressurized water to simulate the pressure from combustion gases, revealed that the joint tang and clevis bend away instead of toward each other. This made the second O-Ring inneffective [7]. Engineers at Marshall Space Flight Center found the problem and wrote to the project manager at that time, however, the manager, George Hardy, did not forward these memos to Thiokol senior decision-making board, and the field joint design was accepted in 1980.[8] By 1985, Marshall and Thiokol both realized that there was a serious problem in the solid rocket booster design, and they began the process of redesigning the joint with three inches of additional steel around the tang to grip the inner face from rotation. However, the senior management at NASA did not call for a halt to shuttle flights, and they kept treating it as an acceptable flight risk and eliminating flight constraints in the subsequent launches.[9]


Each field joint was sealed by a pair of two O-rings which are protected from zinc-putty. The O-Rings were two rubber rings that formed a seal between sections of the solid rocket boosters. By design, pressure from within the booster was to push on a zinc-putty which would transfer the pressure to the air in the joint, forcing the O-Ring into its seat to form an airtight seal. They were added to stop the field joint from flexing further outward (the clavis and tang moving away from the booster at launch from the pressure of lift-off) and to stop the hot exhaust gases from leaving the field joint. In November 1981 after the second shuttle launch, Jack Buchanan found that the primary O-ring was slightly eroded. Thiokol investigated and found that the outward flexing of the field joint delayed the O-ring seating. This lead to blow-by, where as hot exhaust gases traveled through the zinc-putty, and burned the O-ring, eroding it (Diane Vaughn, 1996 book). The cause for the blow-by could not be determined at the time but it was accepted as an acceptable flight risk after engineers determined that the O-ring could seal even when significantly eroded at higher than launch pressures (Diane Vaughn, 1996 book).

Low-temperature testingEdit

In 1985, engineers began to suspect that the blow-by which damaged the O-rings was related to ambient temperatures and were beginning to redesign the field joint. To date, no shuttle had been launched at a temperature lower than 53 degrees Farenheit. On the night before the launch, ambient temperatures were predicted to be below freezing. Ice had accumulated all over the launch pad the night before launch day, raising concerns that ice could damage the shuttle upon liftoff. However, because both Thiokol and NASA did not have sufficient low-temperature testing on the viability of O-ring sealed joints or the zinc putty, they launched the Challenger after their last inspection because the ice appeared to be melting.[10] The insufficient low-temperature testing of the O-ring material failed to show the loss of effectiveness and functionality of O-Ring under cold environment, which became the determining cause of the failure of O-ring on the launch day. Most importantly, all of these technical problems and safety issues had been identified or at least predicated even before the launch day, but NASA did not accept the judgment of some of its engineers that the design was unacceptable. Thiokol’s stated position was that “the condition is not desirable, but is acceptable.” [11] The lack of proper communication between different levels of NASA management even worsens the problem.

Lack of Proper CommunicationEdit

The 1986 explosion that destroyed the space shuttle Challenger and killed seven astronauts shocked the nation, but for one rocket engineer the tragedy became a personal burden and created a lifelong quest to challenge the bureaucratic ethics that had caused the tragedy[12].

Roger Boisjoly (1938-2012) was an Applied Mechanics Engineer at solid rocket booster manufacturer Morton Thiokol and had cautioned as early as 1985 that the joints in the boosters could fail in cold weather, leading to a catastrophic failure of the casing. Boisjoly had noticed that the O-rings eroded as well. NASA and Thiokol, however, decided that, since the O-rings were not completely eroded, there was minimal risk.

In the summer of 1985, six months before the Challenger's fatal launch, Roger Boisjoly sent a memo to the company's Vice President of Engineering. In it, he urged that action be taken to immediately correct the well-known O-ring issue. The memo begins:

"This letter is written to insure that management is fully aware of the seriousness of the current O-ring erosion problem in the SRM joints from an engineering standpoint. If the same scenario should occur in a field joint (and it could), then it is a jump ball as to the success or failure of the joint...The result would be a catastrophe of the loss of human life." [13].

Then the night before the launch, Boisjoly and four other shuttle engineers argued late into the night on a telephone conference. Boisjoly and other engineers were alarmed that freezing temperatures were forecasted. Cold weather could cause the joint design problem to worsen [14]. On the chart the engineers used to communicate with management team, all past testing results were achieved above 65 F, while the temperature predicted at the Challenger launch would be 32 F.

What happened subsequently that evening is the subject of much dispute, but any narrative will contain at least the following[15]:

  • The Morton Thiokol management accepted the recommendation of their engineers not to launch Challenger and sent that recommendation on to the National Aeronautic and Space Administration (NASA).
  • NASA asked for a reconsideration of the recommendation.
  • The burden of proof seemed to shift. The managers at Morton Thiokol caucused among themselves and approved the flight—despite their engineers’ recommendation and sometimes vehement opposition.

Boisjoly was not the only engineer who attempted to stop the launch and suffered for blowing the whistle. Allan J. McDonald was Thiokol's program manager for the solid rocket booster and became the most important critic of the accident afterward. When he was pressed by NASA the night before the liftoff to sign a written recommendation approving the launch, he refused, and later argued late into the night for a launch cancellation. When McDonald later disclosed the secret debate to accident investigators, he was isolated and his career destroyed [16].

Key Issues and Ethical LessonsEdit

NASA’s organizational culture and decision-making processes were the main factors that affected the project and its safety. These were the key contributing factors to the accident. There was a big miscommunication between the levels inside the project. Although NASA managers had known contractor Morton Thiokol design of the SRBs contained problem in O-rings since 1977, they failed to address it properly. It shows that they did not want to take responsibility in an action that results in a change in the project. Also, failing to address the problems properly in the design of SRBs proves the miscommunication within the project group.

NASA managers also disregarded warnings from engineers about low temperatures of the morning of the launch thinking that it was not an important detail to consider. They pretty much did not listen to the engineers and also failed to adequately report these technical concerns to their superiors. If they reported those technical concerns on time, safety precautions could be taken for the launch.

In this case, organizational barriers prevented effective communication of critical safety information and stifled professional differences of opinion. There is lack of integrated management across program elements and informal chain of command and decision-making processes operated outside the organization’s structure.

As the result, engineers should not be coward and should not hesitate pointing out critical safety information to their managers. They should not be seen by their managers as troublemakers because it is their duty to show failures in the project. Managers should take engineers seriously without thinking that there is professional difference between them and engineers. Program should be managed as a whole; every level of the project should communicate and share information to prevent problems during or after the project. If there was a better communication between members of the project and if managers were more responsible about pointing out and solving problems in the project, launch could be postponed to a later time or could be cancelled because safety is the most important thing in critical projects like this one.

After the disaster NASA announced The NASA Safety Reporting System (NSRS). It was established by the NASA Administrator in 1987 after the Challenger Shuttle , the NSRS has since supported all flights and has been expanded to cover all NASA operations. In this system The NSRS contractor removes identifying information and forwards only a summary concerns to the NASA Headquarters Office of Safety and Mission Assurance for immediate analysis and investigation.

The NSRS is an anonymous, voluntary, and responsive reporting channel to notify NASA’s upper management of concerns about hazards. Reports are guaranteed to receive prompt attention. If there was NSRS system before this disaster, Roger Boisjoly would be able to report the problems in the project anonymously and it would easily take attention by the superiors of the project. Since managers could not leave their ego behind and did not take Boisjoly seriously because of his position in the project, they were not successful in taking precautions for the launch. Also, maintaining status quo was the another reason that caused the disaster. Performing the launch was the only goal and cancelling it would be against the status quo. Therefore managers did not want to pay attention to any warnings that would be against the launch even though they were crucial, such as Boisjoly's warning about the problem in the O-ring of the design.


Last modified on 8 April 2014, at 02:29