When Warnings Are Not Enough
On January 28, 1986, Space Shuttle Challenger lifted off from Kennedy Space Center. Just 73 seconds later, the shuttle broke apart, killing all seven crew members.
The physical cause was a failed rubber seal, known as an O-ring, in the right solid rocket booster. But Challenger was more than an equipment failure. Engineers had warned that the unusually cold weather could affect the seals, yet the launch went forward.
What Happened
The shuttle’s two solid rocket boosters were built in sections. Rubber O-rings sealed the connections between those sections and kept extremely hot gases inside the rockets.
On the morning of the launch, the outside temperature was 36°F—15 degrees colder than any previous shuttle launch. Part of the booster connection was estimated to be as cold as 28°F.
The cold weather made the rubber seals stiff. When pressure inside the rocket caused the connected sections to move slightly at ignition, the O-rings could not react quickly enough to close the opening. Hot gases escaped through the gap.
The leak developed into a flame that damaged the nearby external fuel tank and the structure connecting it to the booster. The shuttle then broke apart.
Engineers Had Raised the Concern
Inspectors had found O-ring damage after earlier shuttle flights. Because those missions returned safely, the damage gradually came to be accepted as something the program could manage. Previous success created confidence even though the underlying problem remained.
The night before Challenger launched, engineers from Morton Thiokol—the company that built the boosters—warned that the predicted cold weather could keep the O-rings from sealing properly. The company initially recommended delaying the launch.
After discussions with NASA, Thiokol management changed its recommendation and approved the launch. The engineers who objected did not change their minds. The Rogers Commission investigation later found that senior shuttle managers making the final decision were not told about Thiokol’s original recommendation.
The warning had been raised, but it did not reach the final decision-makers clearly and completely.
Why Previous Success Can Be Dangerous
Challenger shows how organizations can slowly become comfortable with a serious problem.
When damaged equipment continues to work, people naturally begin to believe the condition is not as dangerous as first thought. An abnormal condition starts to feel normal.
But getting away with something does not make it safe.
Previous flights with damaged O-rings did not prove the seals were reliable. They showed only that the damage had not yet caused a disaster. Engineers could not prove the seals would fail in the cold, so the launch proceeded.
For work that could kill people, the question should not be:
Can you prove it will fail?
The question should be:
Can we show that it is safe to proceed?
Lessons for Today’s Leaders
Challenger provides several lessons that apply far beyond the space program:
- Do not confuse previous success with proof that a known problem is safe.
- Treat repeated equipment damage as a warning, not a normal condition.
- Make sure technical concerns reach the person making the final decision.
- Do not require employees to prove that a disaster will happen before taking action.
- Be especially cautious when operating outside tested or familiar conditions.
Before returning to flight, NASA redesigned the booster connections and seals, added heaters, expanded testing, and changed parts of its management and safety-review systems.
The ARGO SH&E Perspective
Challenger reminds us that identifying a hazard is not enough. Employees need a clear Stop Work Obligation, and leaders must act when concerns are raised.
ARGO SH&E helps companies build practical safety programs, strengthen communication, and improve accountability. Do not wait for a warning to become an incident—reach out to ARGO SH&E today to learn how we can help your organization.