Professionalism/Roger Boisjoly, Morton Thiokol, and NASA

On January 28, 1986, at 11:38 a.m., EST, the space shuttle Challenger lifted off at Kennedy Space Center, Florida. However, it broke apart 73 seconds into its flight, leading to the deaths of its seven crew members. Only five of the crew members were NASA astronauts, while the other two were civilians acting as payload specialists. The astronauts were the commander Francis R. Scobee, pilot Michael J. Smith, and mission specialists Judith A. Resnik, Ronald E. McNair, and Ellison S. Onizuka. The two civilians were Gregory B. Jarvis and Sharon Christa McAuliffe.

The Challenger Explosion

Many people viewed the launch live because of crew member Christa McAuliffe, the first member of the Teacher in Space Project and the (planned) first female teacher in space. After the Challenger disaster, the U.S government established an investigatory team called Rogers Commission to examine the causes of the disaster. The disaster was due in part to faulty booster designs and partly due to communication and management failures. The Challenger disaster is to this day used as a case study in engineering safety and workplace ethics.

Timeline

August 1972 - NASA contractor Morton Thiokol is awarded the contract to build shuttle solid rocket boosters at $710 million .

1976 - NASA accepts Morton Thiokol's booster design. The booster rocket are to be developed at NASA's Marshall Space Flight Center, a rocketry and spacecraft propulsion research center.

1977 - Morton Thiokol discovers a joint deflection problem.

October 23, 1981 - Challenger Structural Test Article (STA-099) reconstruction finalized as Challenger Orbital Vehicle (OV-099)

November 1981 - Morton Thiokol discovers O-ring erosion after a second shuttle flight (STS-2).

April 4, 1983 - On the maiden voyage of the space shuttle, Challenger deploys a NASA communications satellite (STS-6).

January 24, 1985 - Space Shuttle Discovery's (OV-103) Solid Rocket Boosters (similar design to Challenger's) suffered primary O-ring penetration and heavy charring on the secondary O-ring (STS-51-C found during Rogers Commission investigation).

January 1985 - Roger Boisjoly, a Thiokol engineer in the Solid Rocket Booster project, becomes concerned about O-ring erosion after he realizes the field joint almost completely failed during a shuttle flight (STS-51-C) .

April 29, 1985 - Challenger's 7th launch (STS-51-B) suffered similar O-ring issues as STS-51-C (found by Rogers Commission).

July 31, 1985 - Roger Boisjoly sends memo and recommendation to delay launch to Robert Lund.

July 1985 - Thiokol orders new steel billets for new field joint design.

August 19, 1985 - NASA Level I management is informed of the booster problem.

January 27, 1986 - In a nighttime teleconference, Thiokol managers and NASA personnel discuss effects of cold temperature on O-rings. Freezing temperatures are forecasted for the next morning. George Hardy, Deputy Director of the Marshall Space Flight Center, and Lawrence Mulloy, the Shuttle Program Manager, do not believe the problem to be an extraordinary risk and therefore decide not to delay the launch.

January 28, 1986 - The Challenger explodes (STS-51-L).

June 9, 1986 - The Rogers Commission, an investigatory Presidential Commission, releases its report explaining the Challenger's mode of failure. The report urges NASA to improve shuttle safety features and make organizational changes to mission procedures.

Technical Problems

Field joint picture from Rogers Commission-Volume 1, p.57

Solid Rocket Boosters

Glass Transition Temperature

In 1974, Morton Thiokol was selected to receive a NASA contract at $710 million to design and build the solid rocket boosters (SRBs). The two solid rocket boosters attached to a space shuttle orbiter provided 80% of the thrust necessary to propel the shuttle into space. About 2 minutes after a normal launch, the solid rocket boosters detach and parachute back to the ground to be reused in subsequent missions. Costs were the primary concern of NASA’s selection board, and Thiokol’s low cost advantages overrode other technical objections, resulting in a cost plus award fee of approximately $800 million ..

The Challenger SRB problems began with the design of the joint of the casing referred to as the "field joint". The original design of the field joint was based on the Saturn rockets' and implemented a tang and clevice, 177 pins, a face sealing O-ring, and a bore sealing O-ring. Each motor case was made of 11 individual weld-free high strength steel segments approximately 0.5 inches thick. Static thrust testing constraints at Morton Thiokol required that the boosters be assembled horizontally which had never been done with large boosters. Morton Thiokol Engineer Howard McIntosh commented,“We were concerned very much about the horizontal assembly that we had to do to do the static tests. The Titan had always been assembled vertically, and so there had never been a larger rocket motor to our knowledge that was assembled (horizontally)". In order to accomplish this the booster joints were redesigned. The new design replaced a face seal with an additional bore seal and added zinc putty to prevent the O-rings from thermal degradation.

In 1977 a hydroburst test was conducted to test the strength of the rocket casings. In order to simulate the pressure from combustion gases the casings were filled with water and then pressurized to roughly 1500 PSI. This test revealed that the joint tang and clevis bent away from each other rather than toward each other. This resulted in a loss of O-ring pressure during ignition and resulted in a poor seal, this phenomena was referred to as "joint rotation". Morton Thiokol structural supervisor Arnold Thompson commented,"We discovered that the joint was opening rather than closing as our original analysis had indicated, and in fact it was quite a bit. I think it was up to 52 thousandths of an inch." Engineers at the Marshall Space Flight Center and wrote to the project manager, however, the manager and Deputy Director, George Hardy, did not forward these memos to Thiokol's senior decision-making board, and the field joint design was confirmed. By 1985, Marshall and Thiokol both realized that there was a serious problem in the solid rocket booster design and they began the process of redesigning the joint with three inches of additional steel around the tang to grip the inner face to prevent rotation. However, the senior management at NASA did not call for a halt to shuttle flights and kept treating these problems as an acceptable flight risk.

O-Rings & Low Temperatures

Launch Pad Day of Launch

Each field joint was sealed by a pair of O-rings which were protected by zinc-putty. By design, pressure from within the booster was to push on the zinc putty which would transfer the pressure to the air in the joint, forcing the O-ring into its seat to form an airtight seal. In November 1981 after the second shuttle launch, Jack Buchanan found that the primary O-ring was slightly eroded. Thiokol investigated and found that the outward flexing of the field joint delayed the O-ring seating. This lead to blow-by, where as hot exhaust gases traveled through the zinc-putty, and burned the O-ring. . The cause for the blow-by could not be determined at the time but it was deemed as an acceptable flight risk after engineers determined that the O-ring could seal even when significantly eroded at higher than launch pressures . In 1985, engineers began to suspect that the blow-by which damaged the O-rings was related to ambient temperatures and were beginning to redesign the field joint.

On April 29, 1985, Challenger's launch for mission STS-51-B experienced the lowest temperatures in their launch history at the time, the next lowest would be the day of the explosion during STS-51-L's launch. The launch resulted in the first two O-ring seals completely burned away while a third seal nearly burned away as well. Morton Thiokol engineers, aware of the issues with the solid rocket boosters, grimly informed crew member Don Lind that he "came within three-tenths of one second of dying."

On the night before the launch, ambient temperatures were predicted to be below freezing. Ice had accumulated on the launch pad the night before the launch, raising concerns that ice could damage the shuttle upon liftoff. However, because both Thiokol and NASA did not have sufficient low-temperature testing on the viability of O-ring sealed joints or the zinc putty, they launched the Challenger after their last inspection because the ice appeared to be melting. The insufficient low-temperature testing of the O-ring material failed to show their loss of functionality in a cold environment, resulting in the failure on launch day. To date, no shuttle had been launched at a temperature lower than 53 degrees Fahrenheit.

The glass transition temperature of a polymer is the temperature where a sudden change in modulus occurs. As described in the Rogers Commission the O-rings used in the field joint were five times more resilient at 75 degrees compared to 30 degrees Fahrenheit. DuPont Viton was the material used for the SBM O-rings. Viton is specified to remain non-brittle after a 3 minute exposure at -25 degree Celsius. Deputy Associate Administrator for Space Flight Michael Weeks testified, "It wasn’t until after the disaster of 51-L that I actually saw the resiliency data that showed that Viton, which is the O-ring material that we’ve been using, is so slow to recover at very low temperatures." Most importantly, these technical and safety problems were identified or at least predicted, but NASA did not accept some engineers' judgment that the design was unacceptable. Thiokol’s stated position was that “the condition is not desirable, but is acceptable.”

Lack of Proper Communication

Depiction of the Shuttle Flight Readiness Review Process

The 1986 explosion that destroyed the space shuttle Challenger and killed seven astronauts shocked the nation, but for one rocket engineer the tragedy became a personal burden and created a lifelong quest to challenge the bureaucratic ethics that had caused the tragedy. Roger Boisjoly (1938-2012) was an Applied Mechanics Engineer at Morton Thiokol and cautioned as early as 1985 that the joints in the boosters could fail in cold weather, leading to a catastrophic failure of the casing. Boisjoly had also noticed that the O-rings eroded as well. NASA and Thiokol, however, decided that, since the O-rings were not completely eroded, there was minimal risk. In the summer of 1985, six months before the Challenger's fatal launch, Roger Boisjoly sent a memo to the Thiokols's Vice President of Engineering. In it, he urged that action be taken to immediately correct the O-ring issue. The memo begins with: "This letter is written to insure that management is fully aware of the seriousness of the current O-ring erosion problem in the SRM joints from an engineering standpoint." And later states: "If the same scenario should occur in a field joint (and it could), then it is a jump ball as to the success or failure of the joint...The result would be a catastrophic loss of human life."

Despite his efforts, no mention of O-ring issues ever made it to NASA upper management, even with the extensive Shuttle Flight Readiness Review. This process begins at level IV with the contractors certifying in writing that the parts they are responsible for are ready. Then the level III NASA project managers verify the readiness of launch elements. Next, the level II Johnson program manager certifies the completion, testing, and checkout of relevant elements. The process culminates with the Level I Flight Readiness Review, two weeks before a launch. This conference is chaired by the NASA Associate Administrator for Space Flight and attended by the NASA Chief Engineer, the Program Manager, the center directors and project managers from Johnson, Marshall and Kennedy, and senior contractor representatives. This procedure was followed for the Challenger flight but it failed to address objections of Morton Thiokol Engineers about the effects of cold weather on the O-rings, and the concerns of Thiokol and Marshall Engineers about O-ring erosion in previous flights. The O-ring problems in the Solid Rocket Booster joint were not even mentioned in the Certification of Flight Readiness, signed for Thiokol by Joseph Kilminster.

The final lapse in communication occurred on January 27, 1986, the night before the launch. A series of conference calls were initiated between Thiokol Engineers (including Roger Boisjoly), Thiokol senior project management personnel, and NASA management to discuss the effects of cold temperatures on the O-rings. In this teleconference, Thiokol engineers recommended that the launch be delayed and that Aldrich, Program Manager at Johnson (Level II), be informed of the O-ring concerns. Thiokol presented the recommendation to only launch within the data set within which they had tested the O-rings: 53 degrees or warmer. NASA management was not pleased by the recommendation. George Hardy, Deputy Director of the Marshall Space Flight Center responded, “I am appalled by your recommendation.” Similarly, Lawrence Mulloy, the Shuttle Program Manager, retorted, “My god, Thiokol. When do you want us to launch – next April?” NASA asked that Thiokol reconsider their recommendation not to launch. This caused an apparent shift in the launch paradigm; rather than needing to prove the launch was safe before proceeding, NASA administrators wanted proof that the launch was not safe before agreeing to a delay. This sidestepped engineering concerns that were grounded on the lack of adequate data to prove the safety of a launch. Gerald Mason, the Senior Vice President of Operations at Thiokol, demanded a management decision, telling engineering manager Bob Lund to “take off your engineering hat and put on your management hat.” This led to a management decision to approve the flight despite the engineers’ recommendation and vehement opposition by Boisjoly and others. NASA upper level management was never informed of the potential hazards and the Challenger was launched.

During the Rogers Commission investigation, Richard Feynman requested management's calculated failure rates. They advertised a 1 in 100,000 chance of failure. However, the engineers under these managers estimated a failure rate ranging from 1 in 50 to 1 in 500. As management consistently provided probabilities thousands of times less than their engineers provided, Feynman concludes that management has been "demonstrating an almost incredible lack of communication between themselves and their working engineers."

Rogers Commission & Congressional Hearing

Members of the Rogers Commission Arrive at Kennedy Space Center

The Rogers Commission found that the loss of the Space Shuttle Challenger was caused by a failure in the joint between the two lower segments of the right solid rocket motor. "The specific failure was the destruction of the seals that are intended to prevent hot gases from leaking through the joint during the propellant burn of the rocket motor." Manufacturing, assembly, and quality control nonconformance reports were reviewed and no evidence was found that any flight hardware shipped to the launch site fell outside the limits of design specifications. O-ring resiliency was found to be directly related to temperature and a compressed O-ring at 75 degrees Fahrenheit is five times more responsive than a O-ring at 30 degrees Fahrenheit. The commission cited that the ambient temperature at the time of launch was 36 degrees Fahrenheit, 15 degrees colder than any other launch. Localized temperature estimates for the coldest point of the joint were 28 +/- 5 degrees Fahrenheit.

In October 1986 the Committee on Science and Technology began an investigation of the causes of the space shuttle challenger disaster. The investigation included ten hearings and an extensive review of the Rogers Commission report. The primary goals of the investigation were to identify the cause of the accident, future risks, and what must be done to return the space shuttle to flight status. This congressional hearing identified several other high risk management problems at NASA including communication overload and an over emphasis on cost and time constraints.

Aftermath and Ethical Lessons

NASA’s organizational culture and decision-making processes were the main factors that compromised the project and its safety. Roger Boisjoly's efforts to delay the launch were futile due to the miscommunication between the levels inside the project, a powerful drive to launch, and an increased tolerance of risk. Consequently, although NASA managers had known contractor Morton Thiokol's design of the SRBs contained problems with O-rings since 1978, they failed to address these issues properly and the Challenger exploded, killing all seven crew members.

Asymmetry of Power

The relative sizes of NASA and Morton Thiokol placed pressure on Thiokol to prioritize NASA's goals. The solid rocket booster contract made up $400 million of Thiokol’s $2 billion dollar annual revenue. Losing this contract would have been a significant financial blow to the company. Thiokol received the original contract despite not being the lowest bidder, having bid $710 million to Aerojet’s $655 million. Thiokol therefore may have felt obliged not to protest decisions from NASA, in the hopes of receiving future preferential treatment from NASA. Thiokol may have received the contract due to the influence of Dr. James Fletcher, then NASA Administrator. He had served as president of the University of Utah and owned several companies in the district of Utah in which Thiokol was based. Giving Thiokol the contract was a way to invest in his home district. Having possibly received the contract through favoritism rather than merit no doubt created additional incentive for Thiokol to treat NASA as a customer rather than a client, in the hopes of winning future contracts.

Launch Fever

NASA faced several external pressures that incentivized hurried launch over safety, which are collectively referred to as “launch fever.” President Reagan was due to give his State of the Union Address the day of the launch and had planned on using Christa McAuliffe, a high school teacher in the Challenger crew, as a talking point to underscore his promotion of education. Halley’s Comet, which passes by the Earth every 75 years, was going to appear later in the year and NASA was launching instruments with which to observe the comet on Challenger. The media had increasingly painted a picture of NASA as an inefficient organization unable to keep its deadlines, which dis-incentivized Congress from budgeting public money to NASA. In fact, Congress had recently cut NASA’s budget. However, NASA could regain funds by launching 24 flights per year by 1991. This highly incentivized NASA to launch quickly rather than safely.

NASA Institutional Changes

Following the Challenger disaster, NASA created the Office of Safety, Reliability, and Quality Assurance. This office was headed by a NASA Associate Administrator who reported directly to the ranking NASA Administrator. The Rogers Commission report specifically identified NASA's "launch fever" as a contributing factor to the loss of Challenger. After the release of the report, NASA pledged to reduce their launch rate, but much of the American public was skeptical, and for good reason. NASA's Space Shuttle Program began launches in 1981. In its first five years, the program averaged 4.6 launches per year. After the loss of Challenger, there were no launches in the remainder of 1986 nor in 1987. Launches resumed in 1988, and in the five years from 1988 to 1992 the program average 5.4 launches per year.

Normalization of Deviance

Normalization of deviance was a theory proposed by sociologist Diane Vaughan. Vaughan defined normalization of deviance as "people within the organization become so much accustomed to a deviant behavior that they don't consider it as deviant, despite the fact that they far exceed their own rules for the elementary safety".. There were several incremental deviances among Thiokol and NASA. The first was the issue of the flexing of the field joint and blow-by. When Thiokol designed the field joint, they noticed the joint flexed but rather than change the design to strengthen the walls, they added the two O-rings. The O-rings were deemed a criticality 1 component, meaning that if the component failed it would lead to catastrophic failure of the space shuttle. A criticality 1 component could never be backed up by another criticality 1 component. NASA should not have allowed the criticality 1 primary O-ring to be supported by another criticality 1 component, namely the secondary O-ring. In 1978 and in 1979, John Q. Miller and other engineers at Marshall sent memos to their supervisors, Glenn Eudy (1978) and George Hardy (1979), to tell them that the field joint was not safe, that the O-ring was not properly applied, and that the secondary O-ring sealing was not always guaranteed to work as specified in the contract. During testing, NASA engineers even wrote memos to their manager at Marshall Space Center, George Hardy, who did not send on their concerns to Thiokol.

Further deviation came with STS-2, the second manned shuttle flight which observed some erosion to the primary O-ring. Neither Thiokol nor NASA re-evaluated the designs. Rather, Thiokol created a new putty to help prevent O-ring erosion. The engineers tested the limits of the joint with different levels of erosion and, since it still worked when eroded, determined it was an acceptable flight risk. The O-rings were not replaced. In March 1984 on shuttle flight STS 41-B, erosion had become more common and so Thiokol presented its report on the erosion to Lawrence Mulloy of Marshall Space Center for the Level III Flight Readiness Review for STS 41-C. Mulloy forwarded this information onto Level I Flight Readiness Review as a technical issue, and in response, Mulloy was to conduct a more thorough review of sealing in each joint of each case. Mulloy asked Thiokol to find the limits of O-ring sealing and the consequent flight risk. Flight STS 51-B in April of 1985 had the worst blow-by leading to erosion of the secondary O-ring. NASA implemented a mandatory pre-launch O-ring review. Yet Mr. Mulloy and Mr. Lawrence waived the constraint for each flight after July 10, 1985, up to and including Challenger. These deviances were justified by a culture that incentivized avoiding delays and cost increases instead of addressing technical and safety issues. Normalization of deviance continued up to the point where NASA pressured Thiokol and managers pressured engineers in order to maintain launch schedules, despite the evident danger of cold temperatures.

Solutions

After the disaster NASA announced the NASA Safety Reporting System (NSRS). The NSRS has since supported all flights and has been expanded to cover all NASA operations. In this system the NSRS contractor removes identifying information and forwards only a summary of concerns to the NASA Headquarters Office of Safety and Mission Assurance for immediate analysis and investigation. The NSRS is an anonymous, voluntary, and responsive reporting channel to notify NASA’s upper management of concerns about hazards. Reports are guaranteed to receive prompt attention. If there had been a NSRS system before this disaster, Roger Boisjoly would have been able to report the problems in the project anonymously; thereby avoiding the organizational barriers to his concerns. His position as a NASA contractor would not have mattered in the anonymous submission and thus his concerns would have been heard by upper management and not stifled by NASA level III managers.

Reparations

The Challenger Settlement paid $7,735,000 the families of Francis R. Scobee, Ellison S. Onizuka, Gregory B. Jarvis, and Sharon Christa McAuliffe. Reparations were split 40-60 between Morton Thiokol and the United States Government. Families of Ronald E. McNair and Judith A. Resnik settled with Morton Thiokol privately for an undisclosed amount. Michael J. Smith’s wife Jane Smith, sued Morton Thiokol and the United States government instead of accepting the settlement offered to the other astronauts. Lawyers representing the United States government cited the Feres Doctrine which claims military personnel or their dependents cannot sue the Government over injuries or death that occurred while on active service. Lawyers for Jane J. Smith, argued that her husband was not on regular military assignment and had no military duties at the time of his death. U.S district Judge Patricia Fawsett ruled that Michael Smith's death occurred "during activity incident to his military service" and removed the United States Government as a defendant in the case.

Roger Boisjoly Post-Challenger

Roger Boisjoly was filled with grief following the explosion of the Space Shuttle Challenger. He suffered from severe headaches, depression, and insomnia. Three weeks following the disaster, Boisjoly gave a confidential interview to NPR journalist Daniel Zwerdling that depicted the decision making process at Morton Thiokol and NASA that led to the disaster.. It was only revealed after Boisjoly's death that he was the subject. During this interview, Boisjoly was quoted as saying "I fought like Hell to stop that launch. I'm so torn up inside I can hardly talk about it, even now." In 1987, Boisjoly filed a lawsuit against Morton Thiokol accusing them of fraud, negligence, manslaughter, racketeering, defamatory statements, and untruthful testimony to a Presidential investigating commission and Congress. Boisjoly filed an additional suit against NASA. Both lawsuits were unsuccessful. In the early 1990's, at the urging of his therapist, Boisjoly began traveling to engineering schools around the world speaking about his experiences, ethical decision making, and the importance of trusting your data. When speaking to his wife Roberta he said: "This is what I was meant to do, to have impact on young people's lives." He continued to respond to letters and emails from college students up until his death in 2012.