The Seal Failure in the SRB That Doomed Challenger (2021)

That's my takeaway after a lot of reading about this.

The seal performed exactly as it was specified to. The spec was that below certain temperatures it wasn't guaranteed to perform as a seal, and that's exactly how it performed.

The issue was that some level of management was alerted that they were operating outside of the spec, and they gambled that it didn't matter.

TFA explains that the seal design was flawed. The cold helped, but the design had already failed in earlier flights, and that had been observed. It really was a seal failure.

However, do keep in mind the principle you need to think about when designing such an organization, which is warning fatigue.

Anything as complex as the shuttle is going to have any number of groups raising any number of warnings about any number of components. If you heeded all of them, you'd spend eternity investigating everything and nothing would ever fly (welcome to the SLS.) How many other warnings of similar perceived severity were ever raised but flew anyway and never resulted in anything catastrophic? Probably a lot. "Go fever" is a problem, but so is its opposite in warning fatigue.

It's easy to condemn the organization, but that has to also come with some sense that the organization had a million problems to deal with, and we only knew to pick out this one after it happened.

Your initial statement is a particularly bad sort of semantic mishandling.

The seal absolutely failed, in the way that any reasonable person would interpret that phrase. A seal prevents things from getting past it, and it did not do that.

Some alternate phrasings that I believe make the (valid) point without this semantic flaw:

- The Challenger did not explode because of a simple or unexpected seal failure.

- The seal failure was merely a symptom of a larger, harder to fix, much more troubling failure.

- The seal failed, but that was not the failure that mattered.

>couldn't guarantee that the O-ring would perform properly.

Small nit, but from a reliability perspective you can almost never guarantee something will work. It's a probability distribution but, to your point, you need decent data to estimate that probability.

The other issue is a psychological one. Humans aren't generally wired to think about probabilities well, especially low-probability events. There's a fairly decent chance you can roll the dice over and over on these types of decisions and not have anything bad happen, leading you to think you're good when in reality you're just lucky.

> I assumed, like I suppose many, the crew were killed outright at the time of disintegration and that would have been the most merciful outcome

The breakup was certainly slower and less directly destructive for the crew than the Columbia. Challenger essentially broke up due to aerodynamic stresses as the entire stack tumbled when the SRB broke loose (the stack rotated so the orbiter was on top, at Mach 1.92). The massive visible 'explosion' was actually the fuel from the external tank igniting as a result of the tank breaking up mechanically, not the initial cause of the orbiter's destruction. The separated but mainly intact crew compartment then continued upwards ballistically before beginning its long fall back to the ocean.

In contrast, due to earlier launch-time damage to its wing, Columbia entered a flat spin while re-entering hypersonically at Mach 15. Complete break-up was about 20 seconds after the last comms from the crew. By this time the crew were already dead, due to physical trauma from being violently buffeted around - e.g. their non-conforming 'fishbowl' helmets offered no real head-protection in the event of violent movement.

> That it wasn't even now fills me with horror and I shudder to think about it. The crew's final moments must have been sheer terror.

Having been in a situation where I thought I was about to die (head-on collision on an icy country highway), that wasn't my experience. When I saw the other car in my lane I was hit with a wall of adrenaline; I experienced the "bullet time" that you see sometimes in movies, where tiiime slooowwws doooowwwwnnn; and I felt like I was processing things calmly and rationally, thinking about what they tell you to do in that situation in driver's training, and even when it became clear that there was nothing I could do to avoid the oncoming car, I simply thought, "I wonder what it's like to die?"

(Now having been in a few more accidents, and experiencing "crumple zones", I'd probably just be thinking about whether the car would be totaled.)

The professional astronauts will have been put through loads of training for all kinds of contingencies; there's a very good chance they had similar responses, and a decent chance that McAuliffe did too.

The crew were likely alive, but not conscious.

The crew capsule experienced high g force on multiple axis' pretty quickly after the explosion.

That's enough force to put even the best fighter pilots to sleep VERY quickly.

Nasa also concluded that the emergency air system wouldn't have been sufficient to maintain consciousness with a complete loss of cabin pressure at their altitude. (https://www.nasa.gov/missions/space-shuttle/sts-51l/challeng...).

The emergency air system was designed for an evacuation on the ground, not at altitude.

>The overuse of emphasization (heavy phrases, all caps, underline, bold, italic, exclamations, COMBINED!! :) ) for the sometimes later coming clear statement of facts (not needing emphasis because speak for themselves) is an irritating read

Some of us are neurodivergent, and this flow both makes it easier to follow, as well as more closely reflects the way we think (and write).

You can enable your browser's reader mode to remove formatting.

We can't hit a button to add emphasis in relevant places.

Consider this next time you're tempted to comment on formatting (including that of this comment).

quick typo correction, 'Truth, Lies, and O-Rings'

It was revised after the Challenger disaster.

It's not the "best explanation yet" - it's outright historical revisionism that directly contravenes reams of documentation, test results, and testimony as part of the Rogers Commission.

The author repeatedly claims NASA created the design of the inter-section seal, that they were incompetent in solid rocket motor design, insisted on the design, etc because Those Silly Government Workers blah blah.

In reality, NASA engineers saw Thiokol's initial bore/face seal design (which was also a double seal...) and objected to it:

"The initial Thiokol design proposal was changed before the production motors were manufactured. Originally, the joint seal design incorporated both a face seal and a bore seal.16 (Figure 1.) However, the motor that was eventually used had double bore O-rings. The original bore seal/face seal design was chosen because it was anticipated that it "provides [better] redundance over a double bore ring seal since each is controlled by different manufacturing tolerances, and each responds differently during joint assembly. " 17 Because the early design incorporated tolerances similar to the Titan and it also incorporated a face seal, Thiokol believed it possessed "complete, redundant seal capability."

> Nevertheless, as the Solid Rocket Motor program progressed, Thiokol-with NASA's concurrence-dropped the face/bore seal design for one using a double bore seal (Figure 1). NASA engineers at Marshall said the original design would have required tapered pins to maintain necessary tolerances and assure enough"squeeze" on the face-sealing O-ring.19 However, design analysis determined that motor ignition would create tension loads on the joint sufficient to cause the tapered pins to pop out. Solving that would have meant designing some type of pin-retainers. Moreover, the rocket assembly was much easier with the dual bore seals. Because inspections and tests had to be conducted on the Solid Rocket Motor stack, horizontal assembly was required.

The seal design was still not adequate and NASA engineers objected more. Testing showed NASA engineer's concerns to be valid. During both static pressure testing and actual test-firings there was documented leakage, and Thiokol's response was to revise what was considered an acceptable amount of leaking.

Numerous NASA engineering staff, and even the o-ring suppliers, all objected. Thiokol repeatedly ignored those objections, as did NASA management.

You can read it right here: https://www.nasa.gov/history/rogersrep/v1ch6.htm

The entire premise of the blog post is contravened by early tests. Whereas the author claims that the seal was doomed to fail because the o-ring would leak until it was forced upward to where it would properly seal, the actual problem was:

> Although the test was successful in that it demonstrated the case met strength requirements, test measurements showed that, contrary to design expectations, the joint [123] tang and inside clevis bent away from each other instead of toward each other and by doing so reduced-instead of increased-pressure on the 0-ring in the milliseconds after ignition.26 This phenomenon was called "joint rotation." Testifying before the Commission, Arnold Thompson, Thiokol's supervisor of structures, said,

> "We discovered that the joint was opening rather than closing as our original analysis had indicated, and in fact it was quite a bit. I think it was up to 52 onethousandths of an inch at that time, to the primary O-ring."27

> Thiokol reported these initial test findings to the NASA program office at Marshall. Thiokol engineers did not believe the test results really proved that "joint rotation" would cause significant problems,28 and scheduled no additional tests for the specific purpose of confirming or disproving the joint gap behavior.

"in other scenarios they died from lack of oxygen before hitting the sea."

If they ran out in last 4 km of altitude or so, they would be in air dense enough not to even lose consciousness.

> The best scenario is that they had their last drops of oxygen around hitting the sea; in other scenarios they died from lack of oxygen before hitting the sea.

See [0] for a summary. It appears that at least one unidentified crew member activated the air pack for Smith (the pilot) but not Scobee (the commander). Smith operated some switches after the break-up so was certainly conscious. The crew compartment was tumbling but not so fast as to cause blackouts.

[0] https://en.wikipedia.org/wiki/Space_Shuttle_Challenger_disas...

I wonder what kind of effect that analysis would have on the launch decision. Here's how I would expect it to go:

Engineer: The logistic regression model shows there is a 99.96% chance of failure at 31deg

Manager: How good is the model?

Engineer: p=0.1157

Manager: So it's not statistically significant by our standards. In other words, it's not a very good model.

Engineer: Yeah, but still.

Manager: Well, what does the model say the temperature needs to be before we're more likely to have a successful launch than not?

Engineer: 64.8 degrees.

Manager: I can't defend pushing the schedule to the right that far based on a statistically insignificant model.

(It doesn't mean the manager was right, but I think it highlights hindsight bias. The model only seems good in hindsight because it aligns with the outcome we witnessed and not because it's a really good model. The managers at the time didn't have the benefit of hindsight.)

Indeed it wouldn’t, which is why they were removed when they started putting astronauts in the middeck seats.

Also, there was another very poor decision by NASA that the article does not mention. The summer before the Challenger launch, Thiokol, at the urgent request of its engineers, sent NASA a memo stating that the SRB O-rings were not sealing properly and recommending that all Shuttle flights be stopped until the issue was understood and fixed. NASA's response was to reclassify the SRB O-rings as a Criticality 1 flight risk instead of Criticality 1R--1R means the issue could cause loss of vehicle and loss of crew if it happens, but there is a redundant backup, whereas 1 means no redundant backup, which means the Shuttle should indeed have been grounded--and then waived the risk so the Shuttle could continue flying. So NASA not only put a very poor design into use, they kept on using it even after their own flight risk procedure told them they should stop.

Yes, what I found excellent about this explanation is how the system is actually dynamic, but NASA treated it as static.

In the reference good design, the single O-Rings must dynamically seat against the outermost surface from the forces in the initial leak test, and that seating is reinforced by the actual flight pressures. This also relies upon the free path of hot gasses from the hot pressurized combustion side to apply equal pressure around the ring and compress the now-hot air against the ring and steel walls, which act as a heat sink, and achieve 1/1-million failure rates.

In contrast, it looks like NASA treated it as a static system, just adding more "sealant" and O-Rings to the system, which actually forked-up the dynamics, forcing a single-point breakthru of the O-ring. And worse yet, they magnified the problem in the "fix", and the only reason it didn't happen again is they never launched in such cold temps again.

Also particularly sad to see the failure obvious in Pic #4, with hot gasses expelling from the SRB side even before it leaves the pad. They were already doomed. And even if someone somehow saw that failure happening on the pad, could anything have been done? A way to separate them from the main structure early and abort? Separate the shuttle from the main tank and abort?

Using a segmented solid was dumb from the start. Not to mention using a solid at all on a supposedly-reusable and/or human-carrying vehicle.

This is a really good point. The shuttle was doomed to be a failure before the first part was produced. A whole bunch of different organizations wanted a piece of the pie and were forcing changes on the design that turned it into a pasted together swiss army knife. If you said no to any of those organizations, they would have fought against your funding.

Space is an arena that needs a lot of hardware rich testing to see what works and what fails and fast turn around times.

The engineers tried. https://en.wikipedia.org/wiki/Space_Shuttle_Challenger_disas...

> Based upon O-ring erosion that had occurred in warmer launches, Morton Thiokol engineers were concerned over the effect the record-cold temperatures would have on the seal provided by the SRB O-rings for the launch. Cecil Houston, the manager of the KSC office of the Marshall Space Flight Center, set up a conference call on the evening of January 27 to discuss the safety of the launch. Morton Thiokol engineers expressed their concerns about the effect of low temperatures on the resilience of the rubber O-rings. As the colder temperatures lowered the elasticity of the rubber O-rings, the engineers feared that the O-rings would not be extruded to form a seal at the time of launch. The engineers argued that they did not have enough data to determine whether the O-rings would seal at temperatures colder than 53 °F (12 °C), the coldest launch of the Space Shuttle to date. Morton Thiokol employees Robert Lund, the Vice President of Engineering, and Joe Kilminster, the Vice President of the Space Booster Programs, recommended against launching until the temperature was above 53 °F (12 °C).

This article confirms that:

> The decision to fly cold-soaked colder than the SRB’s had ever been tested, was also a NASA management decision. Both NASA and Thiokol engineers objected, but were over-ruled. Thiokol upper management also over-ruled their own engineers, and told NASA to go ahead and launch. Thus emboldened by Thiokol management, NASA launched the thing, thus killing its crew.