Forty years ago, the Space Shuttle Challenger disintegrated shortly after launch. With this year’s Artemis mission putting space travel back in the spotlight, create reflects on what happens when management overrules engineering.
By Joe Ennis
On the morning of 28 January 1986, the temperature at Kennedy Space Center hovered at -1°C. While the public watched in anticipation, a group of engineers in Utah watched with a sense of impending doom. They knew something the flight directors didn’t want to acknowledge: the rubber seals designed to keep the rocket’s flames contained would not operate effectively at sub-zero temperatures.
Seventy-three seconds later, the world watched as a plume of white smoke signaled the deaths of seven astronauts and the grounding of the US space program.
Now, 40 years on, the Challenger disaster stands as a definitive ethical case study and the prime example of what American sociologist Diane Vaughan called the normalisation of deviance.
Known vulnerability
The space shuttle’s solid rocket boosters (SRBs) were too large to be shipped in one piece. Instead, they were manufactured in segments and assembled at the launch site using field joints. These joints were sealed by two fluorocarbon elastomer O-rings.
The engineering intent was simple: upon ignition, internal pressure would seat the primary O-ring into a gap, creating a gas-tight seal. However, the design suffered from a critical flaw known as joint rotation.
Under the massive pressure of ignition, the metal tang-and-clevis joints would bow outward, momentarily pulling the sealing surfaces apart. For the seal to hold, the O-ring had to expand rapidly to fill that widening gap. This was a property known as resiliency and had occurred successfully in all 24 previous missions.
But as temperatures drop, elastomers lose resiliency, becoming brittle and slow to respond. On that freezing January morning, the primary O-ring was too cold to move. It failed to seal, allowing a jet of super-hot combustion gas to blow past it and begin eroding the secondary backup in a process called hot gas scour.
This failure was, tragically, predictable. Roger Boisjoly, a lead engineer at Morton Thiokol, the manufacturers of the SRBs, had been tracking O-ring erosion for years. He had seen damage on previous flights launched in warmer weather and knew that cold would exacerbate the issue.
Six months before the disaster, he wrote a memo to his managers: “It is my honest and very real fear that if we do not take immediate action … we stand in jeopardy of losing a flight along with all the launch pad facilities.”
The night before the launch, engineers including Boisjoly filed a desperate protest. During a tense three-hour teleconference, he and his colleagues presented data showing a direct correlation between low temperatures and seal failure.
The engineers recommended not to launch below 11°C. However, NASA was under immense pressure. The mission had already been delayed multiple times, and a State of the Union address was scheduled for the following evening. When NASA officials challenged the Morton Thiokol data, claiming it was inconclusive, a pivotal shift occurred.
In a move that has since become a staple of engineering ethics courses, Thiokol’s Vice President of Engineering, Robert Lund, was told by his manager, Jerry Mason, to “take off his engineering hat and put on his management hat”.
The recommendation to delay was rescinded. The launch was a go.
Boisjoly couldn’t believe it. “I was so mad I couldn’t even stay in the room. I left … I was just totally helpless to do anything about it.”
Engineer Bob Ebeling told his wife that night: “The Challenger is going to blow up.”
The failure could be seen at launch. A puff of black smoke emerged from the right SRB, indicating that the O-rings had already failed to seal. For a few seconds, the leak was temporarily plugged by aluminum oxide slag generated by the solid fuel.
However, 58 seconds later, the shuttle encountered severe wind shear. The buffeting dislodged the slag plug, allowing a plume of flame to escape the joint, acting like a blowtorch against the massive external fuel tank.
At 72 seconds, the lower strut holding the SRB to the tank failed. The booster swivelled, piercing the tank’s skin. The resulting structural failure released a cloud of liquid hydrogen and oxygen, which ignited and tore the shuttle apart.
Acceptable risk
Nobel Prize-winning physicist Richard Feynman famously demonstrated the O-ring’s vulnerability by simply dropping a piece of the rubber into a cup of ice water during a televised hearing of the Rogers Commission, which investigated the accident highlighting the tragedy even further.
The disaster gave rise to the term “normalisation of deviance”, the dangerous tendency for organisations to accept a technical anomaly as normal because it hasn’t resulted in a catastrophe – yet.
For years, NASA had seen minor O-ring erosion and concluded that, because the shuttle had always returned safely, the erosion was an acceptable risk.
Feynman summed it up in Appendix F of the Rogers Commission report: “For a successful technology, reality must take precedence over public relations, for nature cannot be fooled.”
Following the Challenger disaster, the Rogers Commission overhauled NASA’s safety culture and hardware. The primary technical fix was the redesigned solid rocket motor. Engineers added a capture feature, a metal lip that physically prevented the joint from bowing outward during ignition, and included a third O-ring to ensure a redundant seal even if the primary failed.
Organisationally, the commission established the Office of Safety, Reliability, and Quality Assurance (OSRQA), giving it a direct line to the NASA Administrator to bypass management pressure.
It also implemented a telescopic pole escape system, allowing the crew to parachute out during a controlled glide.
Crucially, the critical items list was overhauled; any criticality 1 component, where failure meant loss of life, required a complete redesign or rigorous re-testing. These changes prioritised technical integrity over the launch schedule, leading to a successful “return to flight” with Discovery in 1988.
Today, OSRQA is known as the Office of Safety and Mission Assurance, and is the primary authority for ensuring the safety of the Artemis campaign.
Duty to dissent
Following the Challenger incident, engineer Roger Boisjoly became a forensic engineer and spoke widely on leadership and ethics.
He frequently called for engineers to have courage in their convictions and never “take off their engineering hats” to accommodate management pressure.
“Prioritise data over schedules, document every warning, and recognise that your primary loyalty belongs to public safety, not the corporate bottom line,” he said.
This article was originally published in the May 2026 edition of create with the headline “Cold compromise”.
Sources
Report of the Presidential Commission on the Space Shuttle Challenger Accident (The Rogers Commission), https://www.nasa.gov/history/rogersrep/genindex.htm
“The Challenger Disaster: 40 Years On”, ABC Science, January 2026, https://www.abc.net.au/news/science/2026-01-28/space-shuttle-challenger-disaster-nasa-explosion-video-engineers/106162902
“The Challenger Launch Decision”, Diane Vaughan, University of Chicago Press
“Roger Boisjoly – The Challenger Disaster”, Online Ethics Centre for Engineering and Science, https://onlineethics.org/cases/engineers-and-scientists-behaving-well/roger-boisjoly-challenger-disaster
“A Management Decision Overrides a Recommendation Not to Launch”, https://onlineethics.org/cases/management-decision-overrides-recommendation-not-launch
