The Challenger disaster is usually told as a rubber seal that failed in the cold. That is true, and it is the smallest part of the story.
On the twenty-eighth of January, nineteen eighty-six, the Space Shuttle Challenger left Launch Complex 39B in Florida. Seventy-three seconds later it came apart over the Atlantic. Seven people were aboard. One of them was a high school social studies teacher from Concord, New Hampshire, who had been selected from more than eleven thousand applicants to become the first ordinary citizen to fly in space.
Millions of schoolchildren were watching, because she was going. That is the part everyone remembers. This film is about the part that was already written down. Nothing about the cause of this accident was discovered afterwards.
A tracking camera on the ground had recorded the failure while the vehicle was still climbing. The Presidential Commission that investigated it names that camera in its own report, and gives the time to three decimal places. Quote: First Evidence of Flame on Right Solid Rocket Booster. Mission elapsed time, fifty-eight point seven eight eight.
Source, Camera E two zero seven. The evening before the launch, the engineers who built that booster recommended against flying. They were asked to reconsider, and the recommendation was reversed before the phone call ended. And the joint that failed had been coming back damaged from earlier flights for years.
Each time, someone wrote it down. Each time, the damage was reviewed and the flights continued. So the question this film asks is not what caused the Challenger accident. The Commission answered that in one sentence and we will read it to you shortly.
The question is why a failure that was photographed, predicted, and documented in advance was still able to happen. NOTHING HERE WAS DISCOVERED AFTERWARDS
WHAT A FIELD JOINT IS To follow any of this you need to know one piece of hardware, and it is a simple one. The Space Shuttle did not launch on its own engines alone. Strapped to the sides of the orange external tank were two solid rocket boosters. A solid rocket booster is not like a car engine that you throttle up and down.
It is a steel tube packed with rubbery propellant. You light it, and it burns until it is finished. There is no off switch. For the first two minutes of every Shuttle flight, those two boosters provided most of the thrust that lifted the vehicle.
Each booster was too long to build and ship in one piece. So it was made in segments — steel cylinders — and stacked at the launch site like sections of a chimney. The seam where two segments meet is called a field joint, because it is joined in the field rather than in the factory. Inside that seam is the part this whole story turns on.
Two rings of synthetic rubber, one behind the other, sit in grooves in the steel. They are called O-rings, and they do exactly what the rubber ring in a garden hose fitting does: they squash into the gap and stop what is inside from getting out. What is inside a burning solid rocket booster is gas at several thousand degrees, at about a thousand pounds per square inch of pressure. There was a second layer of protection: heat-resistant putty packed in front of the rings, meant to keep the hot gas from reaching them at all.
Now the part that matters. When the booster lights, the pressure inside it spikes in a fraction of a second, and the steel case bulges outward. The two sides of the joint move apart slightly. The rings have to follow that movement and reseal the gap in milliseconds.
That property — how fast rubber springs back after it is squashed — is called resilience. Rubber loses resilience when it gets cold. That is not an exotic finding. It is a property of the material, and it was known.
THE FLIGHTS THAT CAME BACK DAMAGED Boosters were recovered from the ocean after each flight and taken apart and inspected. And the inspections had been finding damage. Hot gas had been getting past the putty and reaching the primary O-ring. Sometimes it eroded the rubber — burned a pit into it.
Sometimes it blew past the ring entirely, which the engineers called blow-by, and left soot behind it as evidence of where it had gone. None of this was hidden. It was written into the flight readiness reviews — the formal process by which each mission was cleared to fly. The Commission devoted an appendix to how those reviews treated the O-ring problem.
The logic that emerged from the record is the reason this accident is still taught. The damage was treated as evidence that the design tolerated damage. If a booster came back with an eroded ring and the flight had been a success, then erosion was survivable. The margin was described as acceptable — and each flight that survived it made the next one easier to approve.
Richard Feynman, the physicist who sat on the Commission, described the logic in a passage the report quotes directly. Quote: a kind of Russian roulette. The Shuttle flies with O-ring erosion and nothing happens. Then it is suggested, therefore, that the risk is no longer so high for the next flights.
We can lower our standards a little bit because we got away with it last time. That is the state of the record before anyone woke up on the twenty-eighth of January. EVERY TIME, SOMEBODY WROTE IT DOWN
THE NIGHT BEFORE The launch had already slipped several times. And a cold front was moving into central Florida. On the evening of the twenty-seventh of January, engineers at Morton Thiokol — the contractor in Utah that built the solid rocket boosters — held a teleconference with NASA. Their concern was temperature.
Their data showed that the worst blow-by they had ever seen had occurred on the coldest launch they had ever flown. Their recommendation was to wait. Allan McDonald, Thiokol's director of the booster project, was at Kennedy Space Center that night. Asked under oath by Chairman Rogers whether the company's decision was to recommend against a launch, McDonald answered, quote: That is correct, that it was at that point, the recommendation was not to launch below fifty-three degrees.
Fifty-three degrees Fahrenheit — about twelve degrees Celsius — was the coldest temperature at which a booster had flown successfully. The engineers were saying: we have no data below this, so do not go below it. NASA's response was not to accept the recommendation. Thiokol asked for a caucus — a private discussion off the line.
When they came back, the recommendation had changed. The company now supported the launch. One more detail from the same testimony, because it shows how the argument was won. Thiokol's own data included a static test — a booster fired on the ground rather than in flight — conducted at thirty-six degrees Fahrenheit, which had shown no erosion and no blow-by.
That test was used as justification that cold was survivable. But as McDonald was asked directly: had anyone analysed what temperature the O-rings themselves had reached during that test? The answer was that the analysis was done after the fact, and the figure calculated was about forty-seven degrees. The rubber in the test had never been as cold as the air around it.
The number that made cold look safe was measuring the wrong thing. DO NOT LAUNCH BELOW FIFTY-THREE DEGREES
THE MORNING The forecast had been in the room the night before. In testimony, one of the Thiokol engineers describes getting the numbers from the launch operations centre: it would reach freezing or near freezing before midnight, it could fall as low as twenty-two degrees Fahrenheit in the early morning, around six o'clock, and the predicted temperature at the intended launch time — about nine thirty-eight the next morning — was about twenty-six degrees. Twenty-six degrees Fahrenheit is about minus three Celsius. The coldest launch flown before this one had been fifty-three degrees.
The engineers had asked not to go below fifty-three. The forecast was twenty-seven degrees below that line. The meeting at Kennedy Space Center broke up around one minute past midnight. Between roughly half past one and three in the morning, the ice crew went out to Pad B.
The Commission's timeline names them: Charles Stevenson, supervisor of the ice crew at Kennedy, and B. K. Davis of the Marshall ice crew. They found what the timeline calls a large quantity of ice on the fixed service structure, on the mobile launch platform, and on the pad apron, and they reported it.
Where the ice came from is in the record too. The pad's freeze protection plan normally means draining the water system completely, and that was not possible with a launch imminent. So instead the water was left running — a bleed through the fire system, the sound suppression system and the potable water system, the way you leave a tap dripping in a cold house so the pipes do not burst. It worked as intended for the pipes.
It also coated the north side of the launch complex in ice. The concern that raised was not the O-rings. It was that ice might break loose at ignition and strike the orbiter's heat shield tiles. But there is one observation in the same assessment that points the other way, and it is easy to miss.
At the base of each solid rocket booster sit water troughs, there to damp the pressure wave at ignition. During the night, the water in those troughs froze. They had been filled with an antifreeze mixture rated to protect down to sixteen degrees Fahrenheit. The measured ambient temperature was near twenty-four.
The report notes the concern this raised: that freezing in the troughs was an indication of additional cooling of the local environment on the pad. In other words, something on that pad was colder than the thermometers said. An assessment was run, chaired by Arnold Aldrich. Its conclusion, in the words of the testimony, was that the system was okay, that the launch should hold for about one more hour, and that a last-minute ice team should go out about twenty minutes before launch to validate the ice concerns and check again.
That was done. They came back and reported that everything was okay and that the launch should proceed. So the last inspection before flight was looking for ice that might fall on the wings. The temperature that the engineers had spent the previous evening arguing about was, by then, no longer an open question.
It had been closed the night before. The mission had originally been set to launch the previous morning, the twenty-seventh, at nine thirty-eight. That attempt was scrubbed. Challenger lifted off on the twenty-eighth of January at eleven thirty-eight in the morning.
TWENTY-SIX DEGREES AT THE PAD
CAMERA E-207 NASA did not simply watch its own launches. It photographed them, deliberately and systematically, from fixed camera sites around the pad and down the coast, with tracking cameras designed to hold the vehicle in frame as it climbed. The purpose of those cameras was engineering: if something went wrong, the film would show it. On this flight, it did.
The Commission's photographic evidence established a sequence. Smoke appeared from the aft field joint of the right solid rocket booster in the first second after ignition — before the vehicle had cleared the tower. The joint had failed immediately. What sealed it afterwards was not the rubber.
It was almost certainly the byproducts of its own destruction: burnt material packed into the gap, which held for most of a minute and then gave way. At just under fifty-nine seconds, the flame became visible. A computer-aided overlay put the earliest detection at fifty-eight point seven six two seconds mission elapsed time — one frame earlier than image enhancement alone could find it. The report's own caption reads: First Evidence of Flame on Right Solid Rocket Booster.
Mission elapsed time, fifty-eight point seven eight eight. Source, Camera E two zero seven. Understand what that means. The flame was not first noticed by a person.
It was first noticed by a camera, and then found on the film, frame by frame, by people looking for it afterwards. In the control room, and on television, the ascent looked normal. A witness told the Commission that on initial review the ascent appeared normal for the first seventy-three seconds — through the roll manoeuvre, through maximum dynamic pressure, through the throttle down and back up. The flame from the joint played against the external tank and against the strut holding the booster to it.
The tank contained liquid hydrogen and liquid oxygen. The strut failed, the bottom of the booster swung outward, and the tank came apart. The Commission's conclusion, in its own words, is one sentence. Quote: The consensus of the Commission and participating investigative agencies is that the loss of the Space Shuttle Challenger was caused by a failure in the joint between the two lower segments of the right Solid Rocket Motor.
The specific failure was the destruction of the seals that are intended to prevent hot gases from leaking through the joint during the propellant burn of the rocket motor. MISSION ELAPSED TIME 58.788
THE CREW COMPARTMENT This is the part of the story that is told worst, so we are going to stay inside one document. Six months after the accident, NASA released a report by Joseph Kerwin, a physician and former astronaut, on the cause of death of the crew. It is a letter, four pages, addressed to Admiral Richard Truly. It is public.
And its first substantive sentence is: The findings are inconclusive. Kerwin gives three conclusions, and the wording of each one is careful in a way that almost every retelling removes. Quote: the cause of death of the Challenger astronauts cannot be positively determined; the forces to which the crew were exposed during Orbiter breakup were probably not sufficient to cause death or serious injury; and the crew possibly, but not certainly, lost consciousness in the seconds following Orbiter breakup due to in-flight loss of crew module pressure. Read those clauses slowly.
Probably not sufficient. Possibly, but not certainly. Cannot be positively determined. That is a document declining to say more than it knows.
Here is what it does establish. The crew compartment separated from the rest of the orbiter intact. The forces of the breakup itself were estimated at twelve to twenty times gravity at most — severe, but not fatal. The onboard accelerometers stopped two tenths of a second after breakup, so the measurements end almost immediately.
And the breakup itself is not visible in the photographs, because the orbiter was inside the cloud of propellant from the ruptured tank. The compartment continued upward on its own momentum, reaching about sixty-five thousand feet roughly twenty-five seconds after the breakup, then fell. It struck the ocean about two minutes and forty-five seconds after breakup at approximately two hundred and seven miles per hour. The impact was around two hundred times gravity — far beyond what the structure or a human being can survive.
And there is one physical detail that carries more than any description could. Each crew member's helmet was connected to a personal egress air pack — an emergency supply of breathing air, not oxygen, intended for escaping the vehicle on the ground. It had to be switched on by hand. Four of those packs were recovered.
Three had been activated. Kerwin records that the one that had not been activated was the commander's, and that another belonged to the pilot. He also records that the packs were not switched on by the impact with the water. Kerwin does not tell you what that means, and neither will we.
It is in the report, and the report stops there. THE FINDINGS ARE INCONCLUSIVE
HOW THE COMMISSION FOUND IT The Commission was chaired by William Rogers, a former Secretary of State. Its vice chairman was Neil Armstrong — and Armstrong is not decorative in these transcripts; he is in the room asking Allan McDonald whether his comments might have been read by his own company as supporting the Marshall position. Sally Ride chaired the Mission Planning and Operations Panel. Chuck Yeager joined after the first meetings, and Chairman Rogers welcomed him with the observation that he had been absent because he was breaking another record.
The Commission did not have to build its case from nothing. It had the photographic record from the tracking cameras. It had telemetry — the stream of measurements radioed down from the vehicle while it flew. It had recovered hardware pulled off the sea floor, including the failed joint itself.
And it had people, under oath, in public. The hearings ran from the sixth of February to the second of May, and the transcripts fill two volumes of the report. That is why this film can quote Allan McDonald in his own words rather than paraphrase him: when he said the recommendation was not to launch below fifty-three degrees, he said it in a room with a stenographer in it.
APPENDIX F Feynman concluded that the report's body did not go far enough, and his own findings were published separately, as Appendix F: Personal Observations on the Reliability of the Shuttle. His argument was about numbers rather than rubber, and he opens with the disagreement itself. Quote: It appears that there are enormous differences of opinion as to the probability of a failure with loss of vehicle and of human life. The estimates range from roughly one in one hundred to one in one hundred thousand.
The higher figures come from the working engineers, and the very low figures from management. Sit with the size of that gap. It is not a disagreement about a decimal place. It is a factor of a thousand, inside one organisation, about how often the vehicle kills its crew.
Feynman then does the arithmetic out loud, and the sentence that follows is the reason people still read this appendix. Quote: Since one part in one hundred thousand would imply that one could put a Shuttle up each day for three hundred years expecting to lose only one, we could properly ask, what is the cause of management's fantastic faith in the machinery? He found the same spread inside a single component. On the Shuttle's main engines, he records the estimates side by side: engineers at Rocketdyne, the manufacturer, put the total probability of failure at one in ten thousand.
Engineers at Marshall put it at one in three hundred. NASA management, to whom those engineers reported, claimed one in one hundred thousand. An independent engineer consulting for NASA thought one or two in a hundred was reasonable. And he identified the pattern from chapter two of this film — the one where surviving the damage becomes the argument for accepting it.
Quote: certification criteria used in Flight Readiness Reviews often develop a gradually decreasing strictness. The argument that the same risk was flown before without failure is often accepted as an argument for the safety of accepting it again. The appendix ends in one sentence, and it is the reason it is still quoted forty years later. Quote: For a successful technology, reality must take precedence over public relations, for nature cannot be fooled.
ONE IN A HUNDRED, OR ONE IN A HUNDRED THOUSAND
WHAT WAS RECOMMENDED The Commission issued numbered recommendations, and NASA was required to report back to the President on what it had done about each one. Reading the headings in order tells you what the Commission thought the accident actually was. Recommendation one: the solid rocket motor — redesign the joint, and put independent oversight on it. Recommendation two: the Shuttle management structure — including astronauts in management, and a Shuttle safety panel.
Recommendation three: criticality review and hazard analysis. Recommendation four: safety organisation. Notice what is not first on that list, and notice what dominates it. One recommendation is about rubber and steel.
The rest are about who reports to whom, who is allowed to say stop, and how an organisation decides that a known problem is acceptable. The Commission did not conclude that NASA had a hardware problem that also had management consequences. It concluded very nearly the reverse. The Teacher in Space programme did not fly again.
Barbara Morgan, who had trained alongside Christa McAuliffe as her backup and stood on the ground that morning, went to orbit twenty-one years later, as a professional astronaut.
Set out what existed before the Commission convened. The physical property of cold rubber was known. The damage to the joints from earlier flights was recorded in the flight readiness reviews. The recommendation against launching below fifty-three degrees was made the night before, by the people who built the hardware, and it is on the record because they said it again under oath.
And the failure itself was on film from the first second, photographed by a camera pointed at the vehicle for exactly that purpose, by an agency that understood well enough to aim it. The investigation did not uncover a hidden cause. That is what makes this accident different from a mystery, and it is also what makes it harder to dismiss. There was no missing piece.
There was a set of known facts distributed across enough people, reviews and documents that no one was holding all of it at once — and a schedule that kept asking whether anyone could prove it was unsafe, rather than whether anyone could show it was safe. Feynman put it in nine words at the end of an appendix, and they are still the shortest summary anyone has managed. For a successful technology, reality must take precedence over public relations, for nature cannot be fooled. THE RECORD WAS ALREADY COMPLETE
Wonder Minute