16 ms·

Remembering Roger Boisjoly: He Tried to Stop Shuttle Challenger Launch

559 points by drewvolpe 8y ago

hodgesrm 8y ago
It is much easier to prevent disasters like this if you design processes to surface problems as early in the process as possible. It does not take anything away from Roger Boisjoly to say that it's really hard to stop the process once you get far enough toward launch/release/production or whatever the end result is. The real failing of the NASA managers is that they failed to create a culture of safety that would encourage problems to be addressed long before they became catastrophes.
- jaggederest 8y ago
  This is easier to do if it's anonymous, in general. One I've seen is hand out decks of cards, have people put in a card, and if there isn't consensus on moving forward, things stop. https://retromat.org/en/?id=130 https://retromat.org/en/?id=130 is an example of this. Trust is the most important thing about teamwork imo.
  - kwhitefoot 8y ago
    Anonymous voting is only necessary because people don't trust each other. If you trust each other there is no need for anonymity.
    - skolsuper 8y ago
      Yes but the inverse isn't true either: removing anonymity doesn't cause everyone to trust each other. If you don't have trust, or you're not sure, an exercise like this is a good idea
    - deleted 8y ago
      [deleted]
    - pgwhalen 8y ago
      Trust generally isn’t by default, it is built. I’m not sure there’s anything wrong with that.
- lazyasciiart 8y ago
  He brought it up a year earlier as well. https://en.m.wikipedia.org/wiki/Roger_Boisjoly https://en.m.wikipedia.org/wiki/Roger_Boisjoly
  - hodgesrm 8y ago
    Thanks, I was unaware of that. The shuttle program clearly had a very messed up safety culture.
RachelF 8y ago
Unfortunately the management culture at NASA, something Richard Feynman also criticized, did not change. This lead to managers ignoring engineers' warnings about the foam strikes on Columbia, and also rejecting requests for high resolution images. Linda Ham, the manager who rejected these requests left the space shuttle program after the Columbia disaster and was moved to other positions at NASA. https://en.wikipedia.org/wiki/Linda_Ham#Columbia_disaster_and_investigation_report https://en.wikipedia.org/wiki/Linda_Ham#Columbia_disaster_an...
- maxxxxx 8y ago
  "and also rejecting requests for high resolution images." That's a decision I don't understand. Would taking the pictures have been a big change in flight plan or something like that?
  - foobarbecue 8y ago
    The issue had to do with the fact that that shuttle mission was doing some classified stuff for the military IIRC.
  - NikolaeVarius 8y ago
    Military stuff. Secondly, there was a strong prevalence of the idea that, even IF they had found something, nothing could have really been done, which was probably true according to the post-mortem.
    - maxxxxx 8y ago
      "even IF they had found something, nothing could have really been done, which was probably true according to the post-mortem." That would be a pretty weak excuse and only applicable in hindsight. I have read that depending on the size of the damage they could potentially have changed the descent profile to put more load on the other wing. To decide this you first need the data.
      - dgritsko 8y ago
ncmncm 8y ago
Not widely known is that it was Sally Ride who clued in Feynman ['s wingman], secretly. If it had got out, she would never have flown again. Also not widely known was that she was gay. She had to conceal that, too, from NASA. She died young of pancreatic cancer.
- justin66 8y ago
  The story people read in Feynman's autobiography was that General Donald Kutyna came by and made some very knowledgeable suggestions about areas worthy of investigation. Kutyna revealed after her death that Sally Ride clued him in, and he in turn passed the knowledge on to Feynman. Kutyna: On STS-51C, which flew a year before, it was 53 degrees [at launch, then the coldest temperature recorded during a shuttle launch] and they completely burned through the first O-ring and charred the second one. One day [early in the investigation] Sally Ride and I were walking together. She was on my right side and was looking straight ahead. She opened up her notebook and with her left hand, still looking straight ahead, gave me a piece of paper. Didn't say a single word. I look at the piece of paper. It's a NASA document. It's got two columns on it. The first column is temperature, the second column is resiliency of O-rings as a function of temperature. It shows that they get stiff when it gets cold. Sally and I were really good buddies. She figured she could trust me to give me that piece of paper and not implicate her or the people at NASA who gave it to her, because they could all get fired. Kutyna: I wondered how I could introduce this information Sally had given me. So I had Feynman at my house for dinner. I have a 1973 Opel GT, a really cute car. We went out to the garage, and I'm bragging about the car, but he could care less about cars. I had taken the carburetor out. And Feynman said, "What's this?" And I said, "Oh, just a carburetor. I'm cleaning it." Then I said, "Professor, these carburetors have O-rings in them. And when it gets cold, they leak. Do you suppose that has anything to do with our situation?" He did not say a word. We finished the night, and the next Tuesday, at the first public meeting, is when he did his O-ring demonstration. We were sitting in three rows, and there was a section of the shuttle joint, about an inch across, that showed the tang and clevis [the two parts of the joint meant to be sealed by the O-ring]. We passed this section around from person to person. It hit our row and I gave it to Feynman, expecting him to pass it on. But he put it down. He pulled out pliers and a screwdriver and pulled out the section of O-ring from this joint. He put a C-clamp on it and put it in his glass of ice water. So now I know what he's going to do. It sat there for a while, and now the discussion had moved on from technical stuff into financial things. I saw Feynman's arm going out to press the button on his microphone. I grabbed his arm and said, "Not now." Pretty soon his arm started going out again, and I said, "Not now!" We got to a point where it was starting to get technical again, and I said, "Now." He pushed the button and started the demonstration. He took the C-clamp off and showed the thing does not bounce back when it's cold. And he said the now-famous words, "I believe that has some significance for our problem." https://www.popularmechanics.com/space/a18616/an-oral-history-of-the-space-shuttle-challenger-disaster/ https://www.popularmechanics.com/space/a18616/an-oral-histor...
albntomat0 8y ago
My main unanswered question here (I admit I haven't looked particularly hard for the answer) is what the false positive rate was. How many times have similarly major concerns raised, about things that were not ultimately an issue? Where the NASA administrators bombarded with such concerns for every launch, or were reports a relatively rare occurrence? Designing processes to appropriately address such concerns seems to hinge on the answer. [edit for grammar]
- ncmncm 8y ago
  When the engineers are saying no, and the administrators are saying yes, you don't need to know much more.
  - rangibaby 8y ago
    See: Chernobyl
    - tantalor 8y ago
      Eh? The root causes of Chernobyl disaster were bad design and operator error. There were no ignored warnings.
      - LanceH 8y ago
        Perhaps a strong culture of not raising objections?
      - khuey 8y ago
        There were plenty of organizational failures in the design and conduct of the (failed) experiment which triggered the Chernobyl disaster.
      - ancorevard 8y ago
        > There were no ignored warnings. In a socialist society, good luck to you and your family when raising objections.
mark-r 8y ago
Needs a (2012) appended to the title. A very powerful story deserving to be retold.
deleted 8y ago
[deleted]
deleted 8y ago
[deleted]
moioci 8y ago
Also worth remembering Bob Ebeling, another Thiokol engineer who was wracked with guilt for 30 years, thinking he should've done more to stop the launch. https://www.npr.org/sections/thetwo-way/2016/02/25/466555217/your-letters-helped-challenger-shuttle-engineer-shed-30-years-of-guilt https://www.npr.org/sections/thetwo-way/2016/02/25/466555217...
cladari 8y ago
If I remember right the roberts report on this said each time they launched at a low temperature any degradation of the seal became the new normal and "safe". The launch temperature got lower and lower and each time the normal was reset.
alexhutcheson 8y ago
Serious question: What was the proposed course of action had they decided to cancel the launch? My (possibly wrong) understanding was that the O-ring damage only would have been apparent if they disassembled one or both of the solid rocket boosters. Was anyone seriously proposing to do this prior to the launch? The question is relevant because I’ve read conflicting sources about whether the damage to the O-ring caused by the freezing temperature was permanent. If the temperature permanently compromised the O-ring material, then a delay wouldn’t have saved the Challenger, only a disassembly of the boosters would have. However, if the O-ring performance would have recovered when brought back to a normal temperature range, then a delay could have prevented the disaster. Does anyone have any definitive sources on this?
- vilhelm_s 8y ago
  The O-rings were not damaged prior to launch, but they didn't function if they were too cold. You'd have to wait until a warmer day.
matchagaucho 8y ago
Edward Tufte made a great case that data visualization could have prevented the launch... and that PowerPoint was to blame. https://www.asktog.com/books/challengerExerpt.html https://www.asktog.com/books/challengerExerpt.html
- pgeorgi 8y ago
  Not literally PowerPoint: The Challenger disaster was in 1986, while PowerPoint 1.0 shipped in April 1987
  - Gravityloss 8y ago
    Powerpoint could have saved Challenger! If only the could have made it in time...
- dghf 8y ago
  It's the Columbia disaster for which Tufte blames PowerPoint: https://www.edwardtufte.com/bboard/q-and-a-fetch-msg?msg_id=0001yB&topic_id=1 https://www.edwardtufte.com/bboard/q-and-a-fetch-msg?msg_id=...
- justin66 8y ago
  Roger Boisjoly, and others, have a response to Tufte's analysis that is worth reading: https://people.rit.edu/wlrgsh/FINRobison.pdf https://people.rit.edu/wlrgsh/FINRobison.pdf Tufte made a number of errors, including the sorts of errors Tufte might freak out about: The other temperatures Tufte lists on Table 1 are of the ambient air at time of launch. Tufte has mixed apples and oranges. Tufte thus has both coordinates on the scatterplot wrong. The vertical axis should be “blow-by”, not “O-ring damage”, and the horizontal axis should be “O-ring temperature”, not a mixture of O-ring temperature and ambient air temperature. I don't know if he ever offered a response to this paper.
  - matchagaucho 8y ago
    Tufte's improvement on the NASA chart was adding an X/Y axis to show correlation between temperature and damage; something the original charts failed to communicate. Maybe he didn't offer a response to this paper because the fundamental design approach is correct, albeit the actual numbers need refinement?
camel_gopher 8y ago
Pretty sure an actor played him in the movie about the challenger disaster. https://imdb.com/title/tt2421662/ https://imdb.com/title/tt2421662/
mannykannot 8y ago
In many ways, this is an update of the Titanic story of technological hubris, with the twist that the man who was right, who fought hard to prevent what he foresaw, who was briefly relieved when his dire predictions seemed to be wrong, was still dogged by the event for the rest of his life. We don't know how those who were on the wrong side of the issue coped, and they should not be pressured to make public anything beyond what the inquiry required, but it seems plausible to me that those who could persuade themselves that they made the right decision, given the circumstances and despite the outcome, probably fared best. That is usually the case. Edward Tufte tried to suggest that Boisjoly could have presented his case more effectively. Tufte may have been thinking purely pedagogically, but regardless, the implied criticism was unjustified, as Boisjoly's point should have been clear to anyone familiar with the issue, and in fact it was clear to quite a few, though unfortunately not to the few who mattered, and I doubt that, for them, a different presentation would have made a difference. We can't always be right, and we can't all be heroes, but I hope we can all avoid being the person who said to Boisjoly, when it appeared that Boisjoly's testimony might be fatal to Morton Thiokol, that he would leave his children for Boisjoly to raise if he lost his job.
- Aloha 8y ago
  What do you consider the primary technological hubris of Titanic? To be clearer - the hubris of Titanic wasn't technological, it was operational - it was going too fast, in an ice field, with a lack of lookouts - beyond this, it didnt reduce speed after ice was spotted. Yes, there were issues, damage to such a small portion of the ship (less than 1/3) shouldn't have caused it to sink (I'll note, many other ships had similar or worse flaws than Titanic did). The lifeboats on the other hand (as most commonly cited) are not a real issue - Titanic started launching boats about 25 min after it struck the iceberg, which is about how long a damage survey would take. It had not launched all 20 boats by the time the forward list became so great that they were unable to launch more - this doesn't even touch the multitudes below decks, many of whom didnt speak english, or were unable to be moved up to the boat deck in a timely enough fashion. I'd also like to share something I dug up from the internet[1]: "As far as I can determine, Titanic is the single example of a passenger ship that sank with decks level. It was probably the only time in history when lifeboats could be launched from both sides simultaneously. The Andrea Doria sinking is a more typical event. In that case, half of the lifeboats were rendered useless by the cant of the decks. Given the testimony that Titanic was "lolling" as it foundered (listing from side to side), it is highly probable that carrying sufficient lifeboats would have raised the center of gravity sufficiently to have caused a permanent list early in the evening. In other words, the weight of those extra boats might have created a situation in which they could not have been used, anyway. And, it is conveniently overlooked that from the moment when launching boats became necessary until the moment when it became impossible was not long enough to launch the 24 boats the ship carried. If it had carried more boats, they could not have been filled and launched properly. This is not to say that some people might not have used the un-launched boats to survive--just to point out that more lifeboats was not the answer to saving everyone aboard Titanic. The only way to save everyone on any passenger ship is to not let it sink. That's the key, not lifeboats. White Star and the British Board of Trade had an embarassing situation on their hands. They had lost the world's largest ship...not to mention some 1,500 irreplaceable souls. They needed an issue to divert public attention from the real problems behind Titanic's foundering. For instance the lack of lookout, the speed, and the fact that the ship was already well into the ice when it struck. Why wasn't the conduct of the voyage changed at 10:00 p.m. instead of after the accident? Or, what was wrong with the design of the ship that allowed damage to the bow to ultimately claim the whole ship? These issues go to the heart of the matter, but public attention was easily diverted by the lifeboat issue. It was a diversion that worked so well that the lack of lifeboats has become almost the only safety issue ever discussed." [1]: https://www.encyclopedia-titanica.org/community/threads/board-of-trade-and-lifeboats.1799/ https://www.encyclopedia-titanica.org/community/threads/boar...
Dowwie 8y ago
There are commenters here who in usual HN form speak as if they would have acted differently than the team at NASA did if they had been in involved. The reality is that it is unlikely. Business schools use variations of the Challenger launch as a case study in group decision making and organizational behavior. I experienced one while at business school. The crucial parts of Challenger were applied to another scenario. Risk and safety were brought up in discussion but were outlier considerations by the group. The group agreed to proceed with the plan.
- degenerate 8y ago
  But risk of life, especially when everyone is watching, is the ultimate business risk. That's why self-driving cars will be an upstream battle for the next few decades - two steps forward, five steps back every time there's a death. This is simply how we are programmed as humans, our goals and motivations take center stage until risk of death is imminent, then we factor in safety.
  - justtopost 8y ago
    Car deaths happen constantly. The problem with self driving tech is nobody seems to be bearing the responsibility when they happen. There is a perverse disconnect of responsibility that will not easily be mitigated to the likings of ethics and profit at once.
    - patejam 8y ago
      You're missing the point. "Car deaths happen constantly" isn't a good enough rebut. People will always think they would have been able to avoid the accident if they were in control. It's worse because so far the few really bad accidents caused by "self driving" cars would have been stopped if a human was in control (see: Tesla + truck accident).
      - amanaplanacanal 8y ago
        On the other hand, I know I'm a shitty driver, and self-driving cars can't come soon enough :)
toolslive 8y ago
off topic: if I decline the cookie policy, I get the plain text site! That's an extra free benefit. Love it.
geggam 8y ago
This story should be shown to every manager who ignores engineers recommendations.
mcv 8y ago
> "We were talking to the people who had the power to stop that launch." The problem is that the people who had the power to stop the launch were managers dealing with other concerns. Engineers should have the power to stop the launch. And with principles like Agile and Lean, engineers are fortunately increasingly getting empowered to stop a launch if they feel it would be irresponsible. I hope NASA now uses these sort of principles too.
- jenscow 8y ago
  > Engineers should have the power to stop the launch. The engineers shouldn't have that responsibility. The higher-ups would just say "why didn't you stop it??".
- zilian 8y ago
  Agile and lean to launch rockets into space ? What ?
  - mcv 8y ago
    There's a surprising amount of engineering in rocketry. That's what these methodologies are designed for: people who know what they're doing, taking responsibility for what they're doing. One of the points of Lean at Toyota was that anyone on the factory floor could stop the process if they felt it was irresponsible to continue. Of course rockets are far bigger with much higher stakes than cars, but nothing about that justifies taking engineers out of the loop.
    - zilian 8y ago
      Sorry, I was thinking about the software, watered-down version of "lean", not the original one at toyota. That makes more sense. But still... agile and planning NASA's projects (or similar)... I would need to be convinced ;)
- snarfy 8y ago
  I have to disagree that Agile is any kind of solution to this. I've seen it fail too many times. If implemented correctly, maybe, but that rarely happens. And why is that? Why so many Agile horror stories? There is a real lack of leadership in the world, at all levels of society. It's not something an ideal like agile can fix. Without good leaders we end up with broken agile. I'm pretty sure NASA has a good engineering process. It doesn't matter if nobody listens.
billsmithaustin 8y ago
I wonder how many other times an engineer advised NASA to delay a flight.
moviuro 8y ago
GDPR-compliant link: https://text.npr.org/s.php?sId=146490064 https://text.npr.org/s.php?sId=146490064
- ahmedalsudani 8y ago
  Oh wow. Better presentation too.
S_A_P 8y ago
This got me following the rabbit hole and I found this NYTimes article from 1987 about the subsequent lawsuit against Morton Thiokol by Boisjoly. https://www.nytimes.com/1987/01/29/us/engineer-who-opposed-launching-challenger-sues-thiokol-for-1-billion.html https://www.nytimes.com/1987/01/29/us/engineer-who-opposed-l... If you forgot how different things were back then, here are a few highlights: Thiokol spokesmen ''consistently and falsely'' portrayed Mr. Boisjoly as ''a disgruntled or malcontented employee whose views should be discounted and whose professional expertise should be doubted,'' the suit said. It cited press interviews in which Thiokol spokesmen labeled Mr. Boisjoly a ''tattletale'' and an ''impatient'' employee who tried to hire subcontractors in violation of a contract. Roger stood his ground and paid dearly for it, kudos to him for having some integrity.
heyjudy 8y ago
Gotta get better at ringing the right alarms and persisting if you want to be heard. He could've done lots more things to warn but he didn't: tried to warn astronauts' families, leak it to the media, and such. But he didn't. Why lionize him for failing?
bensniffler 8y ago
The morning before the shuttle blew up I was watching the news on tv before catching the bus to school. You could tell just looking at the news feed that that the shuttle was covered in ice. Even to my 12 year old self it seemed insane to launch a space ship into orbit when covered in ice. I was so confused when told in school that the shuttle blew up. I was like, no way would anyone think that was a good idea to launch today. I still to this day don't know if they de-iced it first or just shot it up there and hoped for the best.

559 points by drewvolpe 8y ago

It is much easier to prevent disasters like this if you design processes to surface problems as early in the process as possible. It does not take anything away from Roger Boisjoly to say that it's really hard to stop the process once you get far enough toward launch/release/production or whatever the end result is. The real failing of the NASA managers is that they failed to create a culture of safety that would encourage problems to be addressed long before they became catastrophes.

jaggederest 8y ago
This is easier to do if it's anonymous, in general. One I've seen is hand out decks of cards, have people put in a card, and if there isn't consensus on moving forward, things stop. https://retromat.org/en/?id=130 https://retromat.org/en/?id=130 is an example of this. Trust is the most important thing about teamwork imo.
- kwhitefoot 8y ago
  Anonymous voting is only necessary because people don't trust each other. If you trust each other there is no need for anonymity.
  - skolsuper 8y ago
    Yes but the inverse isn't true either: removing anonymity doesn't cause everyone to trust each other. If you don't have trust, or you're not sure, an exercise like this is a good idea
  - deleted 8y ago
    [deleted]
  - pgwhalen 8y ago
    Trust generally isn’t by default, it is built. I’m not sure there’s anything wrong with that.
lazyasciiart 8y ago
He brought it up a year earlier as well. https://en.m.wikipedia.org/wiki/Roger_Boisjoly https://en.m.wikipedia.org/wiki/Roger_Boisjoly
- hodgesrm 8y ago
  Thanks, I was unaware of that. The shuttle program clearly had a very messed up safety culture.

RachelF 8y ago

Unfortunately the management culture at NASA, something Richard Feynman also criticized, did not change. This lead to managers ignoring engineers' warnings about the foam strikes on Columbia, and also rejecting requests for high resolution images. Linda Ham, the manager who rejected these requests left the space shuttle program after the Columbia disaster and was moved to other positions at NASA. https://en.wikipedia.org/wiki/Linda_Ham#Columbia_disaster_and_investigation_report https://en.wikipedia.org/wiki/Linda_Ham#Columbia_disaster_an...

maxxxxx 8y ago
"and also rejecting requests for high resolution images." That's a decision I don't understand. Would taking the pictures have been a big change in flight plan or something like that?
- foobarbecue 8y ago
  The issue had to do with the fact that that shuttle mission was doing some classified stuff for the military IIRC.
- NikolaeVarius 8y ago
  Military stuff. Secondly, there was a strong prevalence of the idea that, even IF they had found something, nothing could have really been done, which was probably true according to the post-mortem.
  - maxxxxx 8y ago
    "even IF they had found something, nothing could have really been done, which was probably true according to the post-mortem." That would be a pretty weak excuse and only applicable in hindsight. I have read that depending on the size of the damage they could potentially have changed the descent profile to put more load on the other wing. To decide this you first need the data.
    - dgritsko 8y ago

ncmncm 8y ago

Not widely known is that it was Sally Ride who clued in Feynman ['s wingman], secretly. If it had got out, she would never have flown again. Also not widely known was that she was gay. She had to conceal that, too, from NASA. She died young of pancreatic cancer.

justin66 8y ago
The story people read in Feynman's autobiography was that General Donald Kutyna came by and made some very knowledgeable suggestions about areas worthy of investigation. Kutyna revealed after her death that Sally Ride clued him in, and he in turn passed the knowledge on to Feynman. Kutyna: On STS-51C, which flew a year before, it was 53 degrees [at launch, then the coldest temperature recorded during a shuttle launch] and they completely burned through the first O-ring and charred the second one. One day [early in the investigation] Sally Ride and I were walking together. She was on my right side and was looking straight ahead. She opened up her notebook and with her left hand, still looking straight ahead, gave me a piece of paper. Didn't say a single word. I look at the piece of paper. It's a NASA document. It's got two columns on it. The first column is temperature, the second column is resiliency of O-rings as a function of temperature. It shows that they get stiff when it gets cold. Sally and I were really good buddies. She figured she could trust me to give me that piece of paper and not implicate her or the people at NASA who gave it to her, because they could all get fired. Kutyna: I wondered how I could introduce this information Sally had given me. So I had Feynman at my house for dinner. I have a 1973 Opel GT, a really cute car. We went out to the garage, and I'm bragging about the car, but he could care less about cars. I had taken the carburetor out. And Feynman said, "What's this?" And I said, "Oh, just a carburetor. I'm cleaning it." Then I said, "Professor, these carburetors have O-rings in them. And when it gets cold, they leak. Do you suppose that has anything to do with our situation?" He did not say a word. We finished the night, and the next Tuesday, at the first public meeting, is when he did his O-ring demonstration. We were sitting in three rows, and there was a section of the shuttle joint, about an inch across, that showed the tang and clevis [the two parts of the joint meant to be sealed by the O-ring]. We passed this section around from person to person. It hit our row and I gave it to Feynman, expecting him to pass it on. But he put it down. He pulled out pliers and a screwdriver and pulled out the section of O-ring from this joint. He put a C-clamp on it and put it in his glass of ice water. So now I know what he's going to do. It sat there for a while, and now the discussion had moved on from technical stuff into financial things. I saw Feynman's arm going out to press the button on his microphone. I grabbed his arm and said, "Not now." Pretty soon his arm started going out again, and I said, "Not now!" We got to a point where it was starting to get technical again, and I said, "Now." He pushed the button and started the demonstration. He took the C-clamp off and showed the thing does not bounce back when it's cold. And he said the now-famous words, "I believe that has some significance for our problem." https://www.popularmechanics.com/space/a18616/an-oral-history-of-the-space-shuttle-challenger-disaster/ https://www.popularmechanics.com/space/a18616/an-oral-histor...

albntomat0 8y ago

My main unanswered question here (I admit I haven't looked particularly hard for the answer) is what the false positive rate was. How many times have similarly major concerns raised, about things that were not ultimately an issue? Where the NASA administrators bombarded with such concerns for every launch, or were reports a relatively rare occurrence? Designing processes to appropriately address such concerns seems to hinge on the answer. [edit for grammar]

ncmncm 8y ago
When the engineers are saying no, and the administrators are saying yes, you don't need to know much more.
- rangibaby 8y ago
  See: Chernobyl
  - tantalor 8y ago
    Eh? The root causes of Chernobyl disaster were bad design and operator error. There were no ignored warnings.
    - LanceH 8y ago
      Perhaps a strong culture of not raising objections?
    - khuey 8y ago
      There were plenty of organizational failures in the design and conduct of the (failed) experiment which triggered the Chernobyl disaster.
    - ancorevard 8y ago
      > There were no ignored warnings. In a socialist society, good luck to you and your family when raising objections.

mark-r 8y ago

Needs a (2012) appended to the title. A very powerful story deserving to be retold.

deleted 8y ago

[deleted]

deleted 8y ago

[deleted]

moioci 8y ago

Also worth remembering Bob Ebeling, another Thiokol engineer who was wracked with guilt for 30 years, thinking he should've done more to stop the launch. https://www.npr.org/sections/thetwo-way/2016/02/25/466555217/your-letters-helped-challenger-shuttle-engineer-shed-30-years-of-guilt https://www.npr.org/sections/thetwo-way/2016/02/25/466555217...

cladari 8y ago

If I remember right the roberts report on this said each time they launched at a low temperature any degradation of the seal became the new normal and "safe". The launch temperature got lower and lower and each time the normal was reset.

alexhutcheson 8y ago

Serious question: What was the proposed course of action had they decided to cancel the launch? My (possibly wrong) understanding was that the O-ring damage only would have been apparent if they disassembled one or both of the solid rocket boosters. Was anyone seriously proposing to do this prior to the launch? The question is relevant because I’ve read conflicting sources about whether the damage to the O-ring caused by the freezing temperature was permanent. If the temperature permanently compromised the O-ring material, then a delay wouldn’t have saved the Challenger, only a disassembly of the boosters would have. However, if the O-ring performance would have recovered when brought back to a normal temperature range, then a delay could have prevented the disaster. Does anyone have any definitive sources on this?

vilhelm_s 8y ago
The O-rings were not damaged prior to launch, but they didn't function if they were too cold. You'd have to wait until a warmer day.

matchagaucho 8y ago

Edward Tufte made a great case that data visualization could have prevented the launch... and that PowerPoint was to blame. https://www.asktog.com/books/challengerExerpt.html https://www.asktog.com/books/challengerExerpt.html

pgeorgi 8y ago
Not literally PowerPoint: The Challenger disaster was in 1986, while PowerPoint 1.0 shipped in April 1987
- Gravityloss 8y ago
  Powerpoint could have saved Challenger! If only the could have made it in time...
dghf 8y ago
It's the Columbia disaster for which Tufte blames PowerPoint: https://www.edwardtufte.com/bboard/q-and-a-fetch-msg?msg_id=0001yB&topic_id=1 https://www.edwardtufte.com/bboard/q-and-a-fetch-msg?msg_id=...
justin66 8y ago
Roger Boisjoly, and others, have a response to Tufte's analysis that is worth reading: https://people.rit.edu/wlrgsh/FINRobison.pdf https://people.rit.edu/wlrgsh/FINRobison.pdf Tufte made a number of errors, including the sorts of errors Tufte might freak out about: The other temperatures Tufte lists on Table 1 are of the ambient air at time of launch. Tufte has mixed apples and oranges. Tufte thus has both coordinates on the scatterplot wrong. The vertical axis should be “blow-by”, not “O-ring damage”, and the horizontal axis should be “O-ring temperature”, not a mixture of O-ring temperature and ambient air temperature. I don't know if he ever offered a response to this paper.
- matchagaucho 8y ago
  Tufte's improvement on the NASA chart was adding an X/Y axis to show correlation between temperature and damage; something the original charts failed to communicate. Maybe he didn't offer a response to this paper because the fundamental design approach is correct, albeit the actual numbers need refinement?

camel_gopher 8y ago

Pretty sure an actor played him in the movie about the challenger disaster. https://imdb.com/title/tt2421662/ https://imdb.com/title/tt2421662/

mannykannot 8y ago

In many ways, this is an update of the Titanic story of technological hubris, with the twist that the man who was right, who fought hard to prevent what he foresaw, who was briefly relieved when his dire predictions seemed to be wrong, was still dogged by the event for the rest of his life. We don't know how those who were on the wrong side of the issue coped, and they should not be pressured to make public anything beyond what the inquiry required, but it seems plausible to me that those who could persuade themselves that they made the right decision, given the circumstances and despite the outcome, probably fared best. That is usually the case. Edward Tufte tried to suggest that Boisjoly could have presented his case more effectively. Tufte may have been thinking purely pedagogically, but regardless, the implied criticism was unjustified, as Boisjoly's point should have been clear to anyone familiar with the issue, and in fact it was clear to quite a few, though unfortunately not to the few who mattered, and I doubt that, for them, a different presentation would have made a difference. We can't always be right, and we can't all be heroes, but I hope we can all avoid being the person who said to Boisjoly, when it appeared that Boisjoly's testimony might be fatal to Morton Thiokol, that he would leave his children for Boisjoly to raise if he lost his job.

Aloha 8y ago
What do you consider the primary technological hubris of Titanic? To be clearer - the hubris of Titanic wasn't technological, it was operational - it was going too fast, in an ice field, with a lack of lookouts - beyond this, it didnt reduce speed after ice was spotted. Yes, there were issues, damage to such a small portion of the ship (less than 1/3) shouldn't have caused it to sink (I'll note, many other ships had similar or worse flaws than Titanic did). The lifeboats on the other hand (as most commonly cited) are not a real issue - Titanic started launching boats about 25 min after it struck the iceberg, which is about how long a damage survey would take. It had not launched all 20 boats by the time the forward list became so great that they were unable to launch more - this doesn't even touch the multitudes below decks, many of whom didnt speak english, or were unable to be moved up to the boat deck in a timely enough fashion. I'd also like to share something I dug up from the internet[1]: "As far as I can determine, Titanic is the single example of a passenger ship that sank with decks level. It was probably the only time in history when lifeboats could be launched from both sides simultaneously. The Andrea Doria sinking is a more typical event. In that case, half of the lifeboats were rendered useless by the cant of the decks. Given the testimony that Titanic was "lolling" as it foundered (listing from side to side), it is highly probable that carrying sufficient lifeboats would have raised the center of gravity sufficiently to have caused a permanent list early in the evening. In other words, the weight of those extra boats might have created a situation in which they could not have been used, anyway. And, it is conveniently overlooked that from the moment when launching boats became necessary until the moment when it became impossible was not long enough to launch the 24 boats the ship carried. If it had carried more boats, they could not have been filled and launched properly. This is not to say that some people might not have used the un-launched boats to survive--just to point out that more lifeboats was not the answer to saving everyone aboard Titanic. The only way to save everyone on any passenger ship is to not let it sink. That's the key, not lifeboats. White Star and the British Board of Trade had an embarassing situation on their hands. They had lost the world's largest ship...not to mention some 1,500 irreplaceable souls. They needed an issue to divert public attention from the real problems behind Titanic's foundering. For instance the lack of lookout, the speed, and the fact that the ship was already well into the ice when it struck. Why wasn't the conduct of the voyage changed at 10:00 p.m. instead of after the accident? Or, what was wrong with the design of the ship that allowed damage to the bow to ultimately claim the whole ship? These issues go to the heart of the matter, but public attention was easily diverted by the lifeboat issue. It was a diversion that worked so well that the lack of lifeboats has become almost the only safety issue ever discussed." [1]: https://www.encyclopedia-titanica.org/community/threads/board-of-trade-and-lifeboats.1799/ https://www.encyclopedia-titanica.org/community/threads/boar...

Dowwie 8y ago

There are commenters here who in usual HN form speak as if they would have acted differently than the team at NASA did if they had been in involved. The reality is that it is unlikely. Business schools use variations of the Challenger launch as a case study in group decision making and organizational behavior. I experienced one while at business school. The crucial parts of Challenger were applied to another scenario. Risk and safety were brought up in discussion but were outlier considerations by the group. The group agreed to proceed with the plan.

degenerate 8y ago
But risk of life, especially when everyone is watching, is the ultimate business risk. That's why self-driving cars will be an upstream battle for the next few decades - two steps forward, five steps back every time there's a death. This is simply how we are programmed as humans, our goals and motivations take center stage until risk of death is imminent, then we factor in safety.
- justtopost 8y ago
  Car deaths happen constantly. The problem with self driving tech is nobody seems to be bearing the responsibility when they happen. There is a perverse disconnect of responsibility that will not easily be mitigated to the likings of ethics and profit at once.
  - patejam 8y ago
    You're missing the point. "Car deaths happen constantly" isn't a good enough rebut. People will always think they would have been able to avoid the accident if they were in control. It's worse because so far the few really bad accidents caused by "self driving" cars would have been stopped if a human was in control (see: Tesla + truck accident).
    - amanaplanacanal 8y ago
      On the other hand, I know I'm a shitty driver, and self-driving cars can't come soon enough :)

toolslive 8y ago

off topic: if I decline the cookie policy, I get the plain text site! That's an extra free benefit. Love it.

geggam 8y ago

This story should be shown to every manager who ignores engineers recommendations.

mcv 8y ago

> "We were talking to the people who had the power to stop that launch." The problem is that the people who had the power to stop the launch were managers dealing with other concerns. Engineers should have the power to stop the launch. And with principles like Agile and Lean, engineers are fortunately increasingly getting empowered to stop a launch if they feel it would be irresponsible. I hope NASA now uses these sort of principles too.

jenscow 8y ago
> Engineers should have the power to stop the launch. The engineers shouldn't have that responsibility. The higher-ups would just say "why didn't you stop it??".
zilian 8y ago
Agile and lean to launch rockets into space ? What ?
- mcv 8y ago
  There's a surprising amount of engineering in rocketry. That's what these methodologies are designed for: people who know what they're doing, taking responsibility for what they're doing. One of the points of Lean at Toyota was that anyone on the factory floor could stop the process if they felt it was irresponsible to continue. Of course rockets are far bigger with much higher stakes than cars, but nothing about that justifies taking engineers out of the loop.
  - zilian 8y ago
    Sorry, I was thinking about the software, watered-down version of "lean", not the original one at toyota. That makes more sense. But still... agile and planning NASA's projects (or similar)... I would need to be convinced ;)
snarfy 8y ago
I have to disagree that Agile is any kind of solution to this. I've seen it fail too many times. If implemented correctly, maybe, but that rarely happens. And why is that? Why so many Agile horror stories? There is a real lack of leadership in the world, at all levels of society. It's not something an ideal like agile can fix. Without good leaders we end up with broken agile. I'm pretty sure NASA has a good engineering process. It doesn't matter if nobody listens.

billsmithaustin 8y ago

I wonder how many other times an engineer advised NASA to delay a flight.

moviuro 8y ago

GDPR-compliant link: https://text.npr.org/s.php?sId=146490064 https://text.npr.org/s.php?sId=146490064

ahmedalsudani 8y ago
Oh wow. Better presentation too.

S_A_P 8y ago

This got me following the rabbit hole and I found this NYTimes article from 1987 about the subsequent lawsuit against Morton Thiokol by Boisjoly. https://www.nytimes.com/1987/01/29/us/engineer-who-opposed-launching-challenger-sues-thiokol-for-1-billion.html https://www.nytimes.com/1987/01/29/us/engineer-who-opposed-l... If you forgot how different things were back then, here are a few highlights: Thiokol spokesmen ''consistently and falsely'' portrayed Mr. Boisjoly as ''a disgruntled or malcontented employee whose views should be discounted and whose professional expertise should be doubted,'' the suit said. It cited press interviews in which Thiokol spokesmen labeled Mr. Boisjoly a ''tattletale'' and an ''impatient'' employee who tried to hire subcontractors in violation of a contract. Roger stood his ground and paid dearly for it, kudos to him for having some integrity.

heyjudy 8y ago

Gotta get better at ringing the right alarms and persisting if you want to be heard. He could've done lots more things to warn but he didn't: tried to warn astronauts' families, leak it to the media, and such. But he didn't. Why lionize him for failing?

bensniffler 8y ago

The morning before the shuttle blew up I was watching the news on tv before catching the bus to school. You could tell just looking at the news feed that that the shuttle was covered in ice. Even to my 12 year old self it seemed insane to launch a space ship into orbit when covered in ice. I was so confused when told in school that the shuttle blew up. I was like, no way would anyone think that was a good idea to launch today. I still to this day don't know if they de-iced it first or just shot it up there and hoped for the best.