I’m reading Truth, Lies and O-rings by Allan McDonald regarding the Challenger disaster.  The author was a senior manager at the time of the Shuttle disaster in Morton Thiokol, the company responsible for making the solid rocket motors, which were the point of the failure.

I’m only 16% of the way through, but it is seriously like watching a car crash.  It’s mind-boggling, but I suppose it shouldn’t be based on my worldview that most people, including most engineers, are incompetent and that engineering is very hard because unlike many professions, there is a right answer, and the wrong answer results in failures.

In any case, I am blown away by reading about how MT (Morton Thiokol) is busy analyzing their O-ring problems and is aware that there is a temperature component based on the observations on the retrieved hardware from previous flights.  However, they don’t bother to try and really figure this out until the night before a proposed Shuttle launch date in cold weather, at which point their engineering team hastily comes up with a hand-written proposal recommending a launch commit criteria of 53 F temperature at the O-ring.

Now, when your vendor is telling you it’s not safe to launch below 53 F and you’re flying humans, it seems obvious in retrospect that the proper course of action is to stand down and do a full analysis.  I mean, you don’t develop launch commit criteria using the back of an envelope.  The real question should have been, among other things, how can you be really sure that 53 F is really safe?  (The Shuttle had previously survived a mission with the O-ring at that condition, but that’s no guarantee it would survive a thousand or a hundred thousand missions at that condition given other uncertainties.)

If no astronauts were in the picture, it would have been absolutely appropriate for NASA to push back, consider proceeding at risk, pressure the vendor to reconsider, whatever.  But with astronauts’ lives on the line?  If your vendor pulls a new launch commit criteria out of their back pocket on a system that’s supposedly been qualified to 13 degrees lower?  (Keep in mind that in aerospace to qualify something to a given temperature you test in to temperatures 30 degrees lower or higher.  It’s unclear to me when the author says the booster was qualified to 40F whether he’s saying it was tested at 10F, or that it was tested at 40F.  I presume the former.)  I would conclude that my vendor was incompetent and that a full review of their system was needed.

Well, now I get to read what NASA really did.  It’s interesting reading because my knowledge about Challenger is really quite limited.