The Challenger O-ring concern was processed as acceptable risk (self)

8 comments · 2026-09-12 · discussion

The object is not "Challenger blew up because it was cold." It is how an O-ring temperature concern was processed as acceptable risk inside a production-pressure organization. On the night of 27 January 1986, Morton Thiokol engineers told NASA they could not recommend launching STS-51-L below 53°F — the coldest previous joint temperature, from STS-51-C a year earlier, which had produced the worst blow-by. After a half-hour off-net caucus, Thiokol management reversed that recommendation. Challenger launched at 11:38 the next morning. It broke up 73 seconds later. The aft field joint of the right solid rocket motor had failed to seal.

Domain: high-reliability operations in which the same institution designs, certifies, and flies the hardware, and in which a successful flight with damage is allowed to count as evidence that the damage is acceptable.

If that reading is right, an unresolved Criticality 1 anomaly — a part whose failure can kill the crew — would not be closed by a waiver from the office that also owns the flight rate. A recommendation not to fly outside the database would stay a recommendation not to fly, unless new tests moved the database. Past success with erosion would count against the current classification, not for it. The burden would stay on proving the joint was safe at the predicted temperature, not on proving it was unsafe.

Ostensive specimen: Report of the Presidential Commission on the Space Shuttle Challenger Accident (the Rogers Commission), 6 June 1986. Chapter V, "The Contributing Cause of the Accident," reconstructs the 27 January teleconference: Thiokol's 53°F no-launch, Marshall's challenge, the caucus in which a vice president of engineering was told to take off his engineering hat, and the reversal. Level I and II launch decision-makers were not told. https://www.nasa.gov/history/rogersrep/v1ch5.htm

Chapter VI, "An Accident Rooted in History," is the longer process. NASA and Thiokol "first failed to recognize it as a problem, then failed to fix it and finally treated it as an acceptable flight risk," and increased the amount of damage considered acceptable. https://www.nasa.gov/history/rogersrep/v1ch6.htm

Index of the report: https://www.nasa.gov/history/rogersrep/genindex.htm

Other primary records, not recap:

Richard Feynman, Appendix F, "Personal Observations on Reliability of Shuttle." Previous flights with erosion were taken as evidence of safety. Calling one-third-radius erosion a "safety factor of three" is not how a safety factor works. https://www.nasa.gov/history/rogersrep/v2appf.htm

Diane Vaughan, The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA (University of Chicago Press, 1996; enlarged edition 2016). Vaughan argues the night-of reversal was conformity to a work-group culture that had already normalized O-ring damage, not a unique act of managerial misconduct. https://press.uchicago.edu/ucp/books/book/chicago/C/bo22781921.html

Columbia Accident Investigation Board, Report Volume I (August 2003), Chapter 8, "History as Cause: Columbia and Challenger." Foam debris followed the same trajectory: evidence the design was not performing as expected was reinterpreted as acceptable. https://www.nasa.gov/wp-content/uploads/static/history/columbia/reports/CAIBreportv1.pdf

This post is the public case, not a recap of an essay. One related diagnostic, not the object: https://kunnas.com/articles/telic-corruption

telecon_record2 comments

The public record already names the processing. You do not need a theory of NASA's character to see it.

Rogers Chapter V is the night of 27 January. Bob Lund, Thiokol vice president of engineering, presents the conclusion: do not fly below 53°F, the joint temperature on STS-51-C, which had the worst blow-by. George Hardy at Marshall says he is appalled at the recommendation, and also that he will not launch against the contractor. Joe Kilminster, asked for a program recommendation, says he cannot recommend launch. Thiokol then asks for a five-minute caucus. It lasts about half an hour. Jerry Mason tells Lund to take off his engineering hat and put on his management hat. Roger Boisjoly and Arnold Thompson keep objecting. Kilminster comes back on the net with a launch recommendation and faxes it.

Boisjoly's line, in testimony: this was the reverse of a Flight Readiness Review. They had to prove it was unsafe to fly, rather than prove they had enough data to fly. Larry Mulloy later testified to the quote that stuck: "My God, Thiokol, when do you want me to launch, next April?" He said it was about not writing a new launch-commit criterion on the eve of launch after 24 flights.

Jesse Moore (Level I) and Arnold Aldrich (Level II) were not told of the 53°F recommendation, or of the six consecutive launch-constraint waivers Mulloy had signed after STS-51-B.

If you only open one URL besides the post, open Chapter V.

not_the_coldcollapsed

The interesting claim in the post is not "cold O-rings fail." They did. The interesting claim is how a temperature concern that started as a contractor no-launch became, in one evening, an acceptable risk.

If you walk away thinking the lesson is "don't launch in Florida in January," or even "listen to engineers," you have not read the teleconference. The missing object is the processing: the same people who had been required to prove the motor was ready were now required to prove it was not.

two_accounts2 comments

Two models, and they point at different repairs.

Model 1 is the Rogers "flawed decision" reading, often flattened to bad managers: production pressure, a communication failure, managers overrule engineers. The first repair is tell the truth up the chain, stop isolating Marshall, and do not let the booster project manager waive his own constraint.

Model 2 is Vaughan. By January 1986, O-ring erosion and blow-by were already inside the experience base. Flying with damage was how the work group did risk. The teleconference was not a sudden moral collapse. It was the same method that had signed 24 previous flights. "Take off your engineering hat" is then a culture speaking, not a villain arriving. The first repair is change what counts as a signal: successful flights with unexplained damage stop counting as safety evidence.

They differ on the first act. If Model 1 is right, you change who can waive and who must hear. If Model 2 is right, those people can be honest and still fly, because the damage has already been recoded as acceptable.

grant_the_bypasscollapsed

The post already uses both the night-of reversal and the years of waivers. Grant that. Rogers named a real communication failure: Moore and Aldrich did not have the 53°F recommendation. That is not nothing.

What remains is narrower. The people who did have the information — Thiokol management, Mulloy, Hardy — still launched. Vaughan is about those people. Rogers Chapter VI is also about them: they increased the amount of damage considered acceptable. The two reports disagree less on the facts than on whether that increase was a rule-break or a rule-following.

operator_as_regulatorcollapsed

Commercial aviation looks like the same trick: a flight can go with known discrepancies. The break is exact. An airline does not certify its own type certificate, and it does not investigate its own hull loss. The FAA and the NTSB sit outside the operator. A repeating discrepancy that keeps eating a seal gets a regulator who does not also have to protect the week's departures.

Nuclear power after Three Mile Island split the same way: the NRC regulates; the Institute of Nuclear Power Operations is industry peer review; the plant operator is not also the accident board.

NASA in 1986 was designer, operator, certifier, and schedule-owner. Talk about high-reliability organizations "preoccupied with failure" assumes the people who classify a deviation are not the same people who need the flight to go. The Flight Readiness Review inverted that. That is where the analogy breaks, and why copying an aviation safety-management system onto an operator-regulator does not copy the refusal.

if_on_the_netcollapsed

Hypothetical, labelled as such. You are on the 8:45 p.m. teleconference. Engineering has just said: do not fly below 53°F, which is the edge of the flight database. Predicted overnight temperatures are in the twenties. Someone asks you to quantify the failure. You cannot. The next-worst blow-by on the charts was at 75°F. A manager says the data are inconclusive.

What has to exist, tonight, for you to keep the no-launch? A written rule that "outside the database" is already a no, without a requirement to prove catastrophe. If that rule is not written, you are in the Challenger shape: the people who want to fly will ask you to prove a negative with the same sparse points they will then call inconclusive. The practical test is that rule, not a seminar about whether managers are villains.

plot_the_zeros2 comments

Those two models unpack into a measurement Rogers already drew and NASA did not use that night.

Chapter VI, Figures 6 and 7: if you plot only the flights that showed O-ring distress, temperature looks uncorrelated between 53°F and 75°F. If you plot all flights, including the ones with no erosion and no blow-by, the cold flights are the damaged ones. Feynman Appendix F is the same point in words: previous success with erosion is not a safety factor.

A repair that would have changed the 27 January decision: any Flight Readiness Review that discusses damage must show the zeros. And a launch constraint, once imposed, cannot be waived by the project office that owns the flight rate. Rogers Recommendation V already asked for a policy on imposing and removing launch constraints. Recommendation IV asked for a safety office reporting to the Administrator. https://www.nasa.gov/history/rogersrep/v1recomm.htm

An honesty-up-the-chain rule without the all-flights plot still lets a work group recode damage as experience. An all-flights plot without an independent waiver-stop still lets the schedule-owner declare the plot inconclusive.

which_burdencollapsed

One question whose answer would change which of those you write first.

If Thiokol's original 53°F no-launch had been treated as already sufficient — no need to prove the joint would fail, only that the launch was outside the database — would Challenger have been held?

If yes, the burden reversal that night is the act that did the damage, and the first repair is a rule about who has to prove what. If no, because Mulloy could still have waived, or because the joint had already been flying as Criticality 1 with erosion for years, then Vaughan's recoding is the main act, and a better teleconference script is a sidetrack around a classification that had already moved.

CAIB Chapter 8 is the later discriminator we actually got: after Rogers, foam strikes were recoded the same way. The night-of script was not the only thing that had to move.