By peculiar coincidence, Roger Mark Boisjoly, who died last month, aged 73, lived as long in years as Challenger did in seconds. Both achieved remarkable feats in their all-too-short lives. Both pushed boundaries and broke barriers and both were cut down in their prime. Both died in the same month. Both succumbed to forms of cancer: the former Morton Thiokol engineer to a devastating affliction of the colon, kidneys and liver, the former Space Shuttle to an equally devastating disease of mismanagement and poor decision-making which ran through the veins and into the very conscience of NASA. The work of Boisjoly in the months before and after the Challenger disaster would earn him both praise and condemnation: some saw him as a noble whistleblower, who spotlighted a technical and cultural flaw which doomed seven lives, whilst others branded him a man who failed to push his case hard enough; a witness who turned State’s evidence.
Yet Boisjoly’s honourable intentions cannot be overlooked. When the Massachusetts-born mechanical engineer moved to Utah in 1980, his purposes were twofold: professional and spiritual. He was already an experienced fluid dynamicist and aerodynamicist and had worked extensively on the life-support system for the Apollo lunar module and sought employment at Morton Thiokol in Brigham City, prime contractor for the Shuttle’s Solid Rocket Boosters (SRBs). His other aim was “to deepen his involvement in the Mormon religion” and the Beehive State has long been recognised as home to the largest population of Mormons in the United States. Undeniably, the moral grounding offered by Boisjoly’s religious conviction guided his steps as an engineer, as a manager and as a human being, when faced with the most difficult moral decision of his career.
He did not come to popular attention until long after the explosion of Mission 51L on 28 January 1986 which killed astronauts Dick Scobee, Mike Smith, Ellison Onizuka, Judy Resnik, Ron McNair, Greg Jarvis and schoolteacher Christa McAuliffe. In the immediate aftermath of the disaster, most other astronauts were convinced that a failure of one or more of the Shuttle’s three main engines was the most likely cause. Remnants of all three had been dredged from the Atlantic Ocean in late February, still attached to their thrust structures, but investigations would reveal that their performance had been nominal and only began shutting themselves down a few milliseconds before the explosion. Nor was the giant External Tank or a mistaken firing of the range safety explosives to blame. Something else had been responsible for striking down Challenger and her seven brave souls.
Televised images of the launch and data from the recovered wreckage soon pointed the finger of blame squarely at the SRBs – and, in particular, the right-hand booster – which had experienced a burn-through of a pair of rubberised seals, known as O-rings, meant to prevent the escape of hot gases. For a handful of engineers and managers at Morton Thiokol, and within NASA itself, this potential catastrophe had actually been foreseen, more than a year before Challenger’s maiden voyage; for the O-rings had proven themselves incapable of properly sealing the gaps between the four segments of the SRBs in cold weather. Disaster had been narrowly averted on one previous cold-weather launch, Mission 51C in January 1985 and the conditions in the hours preceding Challenger’s final liftoff were colder still. Moreover, an application of zinc chromate putty, intended to act as a ‘thermal barrier’ and keep the combustion gas path away from the two O-rings, had been shown as early as 1984 to be susceptible to the formation of ‘blow holes’, which compromised its effectiveness.
This was very quickly identified by the presidential commission set up to investigate the cause of the disaster. The ‘Rogers Commission’ was chaired by former Secretary of State William Rogers and included on its panel such figures as Neil Armstrong, Sally Ride and Richard Feynman. “It was intended,” read the Rogers report, published in June 1986, “that the O-rings be actuated and sealed by combustion gas pressure displacing the putty in the space between the motor segments. The displacement of the putty would act like a piston and compress the air ahead of the primary O-ring and force it into the gap between the [field joint’s] tang and clevis. This pressure-actuated sealing is required to occur very early during the solid rocket motor ignition transient, because the gap between the tang and clevis increases as pressure loads are applied to the joint during ignition. Should pressure actuation be delayed to the extent that the gap has opened considerably, the possibility exists that the rocket’s combustion gases will blow-by the O-rings and damage or destroy the seals. The principal factor influencing the size of the gap opening is motor pressure, but gap opening is also influenced by external loads and other joint dynamics.”
Consequently, it was not only the pressure of the rocket thrust which had forced open the O-ring breach, but other factors, too. One ‘external load’ which affected Challenger’s O-rings was the impact of low launch temperatures and one of the ‘other joint dynamics’ was the effect of a wind shear – the most severe yet experienced in the Shuttle era – through which the vehicle passed, seconds prior to the explosion. In the case of Challenger, on the night of 27 January 1986, ambient temperatures had dipped to the lowest ever recorded for a Shuttle launch: around -13°C. Indeed, at the moment of ignition the following day, the right-hand booster’s aft field joint was the coldest part of the stack at -2.2°C. Ground tests had already confirmed that reduced temperatures could cause the O-rings’ resiliency to degrade and during the Rogers investigation it was learned that a small quantity of rainwater had been found in Columbia’s SRB joints during preparations for STS-9 in November 1983. It was theorised that Challenger, which had sat on Pad 39B for 38 days and been exposed to more rainfall than Columbia, could have suffered from the further disruption, and perhaps even ‘unseating’, of its O-rings by frozen water.
The observed problem with the boosters first arose in November 1981, shortly after the STS-2 mission. Routine inspections revealed erosion of the right-hand SRB’s primary O-ring due to hot combustion gases, yet the secondary seal remained intact and the anomaly was not reported at the Flight Readiness Review for STS-3 in March of the following year. Morton Thiokol believed that the erosion had been caused by blow holes in the zinc chromate putty and began tests to alter the method of its application and the assembly of the booster segments. The manufacturer of the original putty, Fuller-O’Brien, discontinued its use and a new putty from the Randolph Products Company was selected in May 1982; however, after more changes, it was substituted for the original putty the following summer, shortly before the launch of STS-8.
Since December 1982, the O-rings had been designated a ‘Criticality 1’ item by NASA, denoting a component without a backup, whose failure would result in the loss of the Shuttle and its crew. Prior to that, during the execution of the first five missions, they had been labelled by NASA as ‘Criticality 1R’, meaning that, although “total element failure…could cause loss of life or vehicle”, the presence of primary and secondary O-rings lent ‘redundancy’ to the design: in effect, the secondary seal would expand to fill the joint if its primary counterpart failed. However, in its Critical Items List of November 1980, NASA acquiesced that “redundancy of the secondary field joint seal cannot be verified after motor case pressure reaches approximately 40 percent of maximum expected operating pressure. It is known that joint rotation occurring at this pressure level…causes the secondary O-ring to lose compression as a seal”.
Following a series of high-pressure tests of the O-rings, conducted by Morton Thiokol in May 1982, it became clear that the secondary seal did not provide sufficient redundancy and NASA changed their criticality listing later that year. According to Associate Administrator for Space Flight (Technical) Michael Weeks, who signed a waiver to accept the new criticality level in March 1983, “we felt at the time that the Solid Rocket Booster was probably one of the least worrisome things we had in the programme”. This view was shared by managers and astronauts, too. But not by Roger Boisjoly.
By the time Boisjoly inspected severely damaged field joints from 51C’s boosters in January 1985, a number of other missions had yielded disturbing O-ring erosion. Almost a year earlier, after Mission 41B, the left-hand SRB’s forward field joint and the nozzle of its right-hand counterpart were found to be badly degraded, to such an extent that NASA requested Thiokol to investigate means of preventing further erosion. A week prior to the launch of the next flight, 41C, the company concluded that blow holes in the zinc chromate putty were one “possible cause” and NASA’s SRB project office at the Marshall Space Flight Center in Huntsville, Alabama, decided that, as long as the secondary O-ring could survive gas impingement, the mission was safe to fly.
It was the beginning of a disturbing chain of thought within NASA and Morton Thiokol, explained the Rogers report, that “there was an early acceptance of the problem” and both organisations “continued to rely on the redundancy of the secondary O-ring long after NASA had officially declared that the seal was a non-redundant, single-point [Criticality 1] failure”. Notably, Richard Feynman judged the cavalier attitude of the space agency and the booster manufacturer as representing “a kind of Russian roulette…[the Shuttle] flies [with O-ring erosion] and nothing happens. Then it is suggested, therefore, that the risk is no longer so high for the next flights. We can lower our standards a little bit because we got away with it last time. You got away with it, but it shouldn’t be done over and over again like that.” Astronaut Mike Mullane, who lost several friends aboard Challenger, scornfully called it the “normalisation of deviance”.
The 51C damage was among the most serious yet seen. Launched in freezing conditions of just 11°C on 24 January 1985, its recovered left and right SRB nozzles showed evidence of ‘blow-by’ between the primary and secondary O-rings and, moreover, it proved to be the first Shuttle mission in which the secondary seal displayed the effects of heat. “SRM [Solid Rocket Motor]-15,” said Boisjoly of one of the 51C boosters, “actually increased concern because that was the first time we had actually penetrated a primary O-ring on a field joint with hot gas, and we had a witness to that event because the grease between the O-rings was blackened, just like coal. That was so much more significant than had ever been seen before on any blow-by on any joint.”
When the blackened material was analysed, Boisjoly told the Rogers hearing, “we found the products of putty in it [and] the products of O-ring in it”. Four days after 51C landed, Lawrence Mulloy, head of the SRB office in Huntsville, expressed concern over the impact O-ring problems may have on the next scheduled mission, 51E, then projected for launch in late February. One of Morton Thiokol’s conclusions before the Flight Readiness Review was that, while “low temperature enhanced probability of blow-by…the condition is not desirable, but is acceptable”. It was the first occasion on which a link between cold weather and O-ring damage had been officially acknowledged.
Three months after the worrisome 51C boosters had drawn Boisjoly’s attention, Bob Overmyer’s crew lifted off on Mission 51B, the Spacelab-3 flight. Subsequent examination of their SRBs also indicated erosion of the secondary O-ring, clearly pointing to the failure of its primary counterpart. The problem was attributed to leak check procedures. So serious was the episode, however, that “a launch constraint was placed on flight 51F and on subsequent launches,” read the Rogers report. “These constraints had been imposed, and regularly waived, by the Solid Rocket Booster Project Manager at Marshall [Space Flight Center], Lawrence B. Mulloy. Neither the launch constraint, the reason for it, or the six consecutive waivers prior to 51L were known to NASA Associate Administrator for Space Flight Jesse Moore or Launch Director Gene Thomas at the time of the Flight Readiness Review process for 51L…” In fact, as Overmyer would later discover, his own launch had been milliseconds from disaster.
Crewmate Don Lind journeyed to Morton Thiokol in Utah for further explanation. “The first seal on our flight had been totally destroyed,” recalled Lind, “and the [other] seal had 24 percent of its diameter burned away. Sixty-one mil[limetres] of that [last seal] had been burned away. All of that destruction happened in 600 milliseconds and what was left of that last O-ring, if it had not sealed the crack and stopped that outflow of gases, if it had not done that in the next 200 to 300 milliseconds, it would have gone [all the way]. You’d never have stopped it and we’d have exploded. That was thought provoking! We thought that was significant in our family. I painted a picture of our liftoff, then [added] two great celestial hands supporting the Shuttle and the title of that picture is Three-Tenths of a Second. Each of [my] children have a copy of that painting, because we wanted the grandchildren to know that we think the Lord really protected Grandpa.”
Shortly after the analysis of the 51B boosters, on 31 July 1985, Roger Boisjoly expressed his growing concerns over the O-rings in a memorandum to Morton Thiokol’s vice president of engineering, Bob Lund. “The mistakenly accepted position on the joint problem,” he wrote, “was to fly without fear of failure and to run a series of design evaluations which would ultimately lead to a solution or at least a significant reduction of the erosion problem. This position is now changed as a result of the [51B] nozzle joint erosion, which eroded a secondary O-ring with the primary O-ring never sealing. If the same scenario should occur in a field joint – and it could – then it is a jump ball whether as to the success or failure of the joint, because the secondary O-ring…may not be capable of pressurisation. The result would be a catastrophe of the highest order: loss of human life.”
Boisjoly recommended the establishment of a Morton Thiokol team to investigate and resolve the problem and, on 20 August, Lund announced the formation of a task force. However, only a day earlier, in a joint Morton Thiokol-Marshall briefing to NASA Headquarters on the issue, managers concluded that the O-rings were a ‘critical’ issue, but that, so long as all joints were leak checked with a 200 psi stabilisation pressure, were free of contamination in the seals and met O-ring ‘squeeze’ requirements, it was safe to continue flying. As the year wore on, Morton Thiokol’s O-ring team, which had only eight to ten members, found many of their efforts frustrated by senior management. “Even NASA perceives that the team is being blocked in its engineering efforts to accomplish its task,” Boisjoly wrote in a 4 October memo. “NASA is sending an engineering representative to stay with us, starting 14 October. We feel that this is the direct result of their feeling that we [Thiokol] are not responding quickly enough on the seal problem.”
Among its conclusions were that NASA and Morton Thiokol’s operation of the Shuttle was seriously flawed – concerns from individual engineers were not reaching appropriate managers, ‘critical’ items were not being given the attention they demanded and the need to stick to a ‘schedule’, partly in a bid to please customers, was overriding ‘safety’. Not only was NASA attempting to accommodate its major customers, but, evidenced in a teleconference with managers at the Marshall Space Flight Center and Kennedy Space Center on the evening of 27 January 1986, Morton Thiokol showed that it was prepared to ignore the safety concerns of its engineers in order to accommodate NASA, its own major customer. Worries of O-ring failure in the freezing weather conditions predicted for the following morning, as expressed by Roger Boisjoly and others, were downplayed and Morton Thiokol voted that Challenger was fit to fly, unwittingly signing the 51L crew’s death warrants in the process.
During that fateful teleconference, Bob Lund argued that his team’s ‘comfort level’ was not to fly SRBs at temperatures below 12°C – some 53 degrees Fahrenheit – for fear of catastrophic ‘blow-by’ of the O-rings and field joints, but he could present no evidence to Marshall that ‘proved’ it was unsafe to do so. In a lengthy debate, Lawrence Mulloy – based in Florida as Marshall’s KSC representative at the time – and other NASA officials challenged Morton Thiokol’s data and questioned its logic. At one stage, Marshall’s head of science and engineering, George Hardy, remarked that he was “appalled” at the company’s decision. So was Mulloy, who scornfully exploded with “For God’s sake, Thiokol, when do you expect me to launch? Next April?”
Neither man, however, was prepared to ignore the recommendation of their major contractor. Lund stood firm and, had he continued to do so, NASA would have had little choice but to postpone the 51L launch. Shortly thereafter, Morton Thiokol requested a five-minute recess from the teleconference to consider the situation. Five minutes ultimately became half an hour. Throughout this recess, Boisjoly and fellow engineer Arnie Thompson continued to argue that it was unsafe to fly outside of their proven field joint temperature range, but the Morton Thiokol senior executives in attendance felt the O-rings should still seat and function properly, despite the cold weather. “Arnie actually got up from his position and walked up the table, put a quarter pad down in front of the management folks and tried to sketch out once again what his concern was with the joint,” Boisjoly told the Rogers Commission, “and when he realised he wasn’t getting through, he stopped. I grabbed the photos and tried to make the point that it was my opinion from actual observations that temperature was indeed a discriminator and we should not ignore the physical evidence that we had observed. I also stopped when it was apparent that I couldn’t get anybody to listen.”
Then, executive Jerry Mason – presumably aware of the need not to upset NASA – explicitly asked Lund to remove his engineering hat and put on his management hat. When the teleconference resumed, Lund changed his vote and Morton Thiokol changed its position on the issue. The company’s new recommendation was that, although frigid weather conditions remained a problem, their data was inconclusive and hence the launch of 51L should go ahead. None of the engineers wrote out the new recommendation – “I was not even asked to participate in giving any input to the final decision charts”, Boisjoly told the Rogers hearing – and only the executive managers signed it.
However, when Marshall and KSC managers asked for any additional comments from around the Morton Thiokol table before closing the teleconference, none of them voiced their concerns. Boisjoly, in particular, remained silent; a fact which would later lead some observers to brand him a witness who turned State’s evidence, rather than a noble whistleblower. When questioned by a Rogers panel member, he emphasised that “I never [would] take [away] any management right to take the input of an engineer and then make a decision based upon that input, and I truly believe that. There was no point in me doing anything any further than I had already attempted to do…[but] I left the room feeling badly defeated. I personally felt that management was under a lot of pressure to launch and that they made a very tough decision, but I didn’t agree with it.”
Having analysed the results of the teleconference, and interviewed the participants, the Rogers report concluded that “there was a serious flaw in the decision-making process leading up to the launch…A well-structured and managed system, emphasising safety, would have flagged the rising doubts about the Solid Rocket Booster joint seal.” In fact, when brought to testify before the panel, key officials intimately involved with the decision-making process, including 51L Launch Director Gene Thomas, Shuttle Programme Director Arnie Aldrich and Associate Administrator for Space Flight Jesse Moore, admitted that they had not been privy to the issues raised at the 27 January teleconference. It was little defence and did nothing to detract from what had been a totally avoidable tragedy.
For Roger Boisjoly himself, his actions and inactions during that teleconference would continue to arouse debate, even years later. Shunned by many of his Morton Thiokol colleagues, he resigned from the company later in 1986 and subsequently became a lecturer in workplace ethics. His efforts were properly rewarded in 2006, when the American Association for the Advancement of Science awarded him its prestigious Prize for Scientific Freedom and Responsibility. This accolade paid tribute to his honesty and integrity in the months preceding, and after, the Challenger disaster. Boisjoly has gone to his grave as the honourable and righteous Mormon that he was and the world of aerospace engineering – and particularly company ethics, which he pioneered – is the better for it. More than a hundred Shuttle missions roared safely into space after 51L, equipped with far safer SRBs, and this success is due in no small part to Roger Boisjoly.