Challenger O-Ring: The Cold Seal That Leaked in the First Second

The Field Joint: Tang, Clevis, 177 Pins and Two O-Rings

Each Shuttle solid rocket booster was 146 in (3.7 m) across and about 149 ft long. Its Morton Thiokol motor used a case of D6AC high-strength steel roughly half an inch thick, loaded with propellant in Utah, shipped by rail as four segments and stacked at Kennedy Space Center. The three joints assembled there were the field joints, a design adapted from the Titan III booster, which used a single O-ring.

• The bottom edge of the upper segment, the tang, slid down into a U-shaped groove, the clevis, on top of the lower segment.
• 177 steel pins passed radially through the clevis outer leg, the tang and the clevis inner leg to carry the axial load.
• Two Viton fluoroelastomer O-rings with a 0.280 in (7.1 mm) cross-section sat in grooves in the clevis inner leg, bearing against the tang. The primary ring faced the hot gas; the secondary was the backup. Each ring was roughly 38 ft around.
• Zinc chromate putty filled the space between the two segments' insulation, meant to shield the rings from ~5,500 °F combustion gas.
• A leak-check port between the rings let technicians pressurize the space between them after stacking to prove the seals held.

On paper that is a redundant seal: gas must beat the putty, then the primary, then the secondary. In practice one mechanism could defeat both rings at once.

Joint Rotation: How Ignition Pried the Seal Gap Open

At ignition the chamber pressure climbs to ~900 psi in about 600 ms. A thin-walled cylinder carries that pressure as hoop stress, σ = p·r / t.

Worked example. With p ≈ 900 psi, radius r = 73 in and wall t ≈ 0.5 in, σ ≈ 900 × 73 / 0.5 ≈ 131,000 psi (~900 MPa), a large fraction of the strength of heat-treated D6AC. Steel's modulus is E ≈ 29 × 10⁶ psi, and the axial stress (p·r / 2t) trims the hoop strain through Poisson's ratio (ν ≈ 0.3), so ε ≈ (1 − ν/2)·σ / E ≈ 0.85 × 131,000 / 29,000,000 ≈ 0.0038. The radius grows by Δr = ε·r ≈ 0.0038 × 73 ≈ 0.28 in in this simple membrane estimate, about the thickness of the O-ring itself.

Away from the joints the wall balloons outward freely. The joint, with tang and clevis doubled up and pinned together, is far stiffer and grows less, so the shell must bend where it meets that stiff ring. Engineers called this bending joint rotation. The tang swings away from the clevis inner leg, opening the very gap the O-rings seal. Analyses and tests put the opening at up to 0.029 in at the primary O-ring and 0.017 in at the secondary, fastest at 200–300 ms, with the gap opening essentially complete at 600 ms, as pressure reaches ~900 psi.

That 0.029 in is about 10% of the ring's 0.280 in cross-section (0.029 / 0.280 ≈ 0.10). A passively squeezed seal cannot close it; the rubber must actively spring back while the steel moves. Thiokol had originally expected pressure to squeeze the joint tighter. Hydroburst tests in 1977 showed that it opened instead.

Pressure Actuation vs Cold Rubber: Why the Ring Lagged

An O-ring in a pressurized joint does not seal by squeeze alone. Gas arriving through the putty pushes the ring across its groove and wedges it into the gap between groove and tang. This pressure actuation works only if the ring still touches both surfaces when the gas arrives, so a pressure difference can build across it. Otherwise gas simply flows past: blow-by.

Three things worked against the ring on 51-L:

• Cold. Rubber is viscoelastic: its recovery is a time-dependent rearrangement of long molecules that slows steeply as it cools. Evidence cited by the Rogers Commission shows that an O-ring at 75 °F is ~5× more responsive than at 30 °F. With the right aft field joint ~28 ± 5 °F, whatever time a warm ring needed to spring back across the opening gap, this ring needed roughly five times as long, while the gap finished opening within 600 ms.
• Tight squeeze. In that joint the average static tang-to-clevis gap was estimated at only ~0.004 in, with metal-to-metal contact possible in places, so the ring started out crushed hard against all three walls of its groove, leaving no room for gas to get behind it and pressure-actuate it until it had recovered its shape.
• The wrong starting position. The leak check pressurized the space between the rings, pushing the primary ring toward the hot-gas side of its groove. At ignition it had to travel across the groove before it could seat.

A Thiokol resiliency chart shown the night before launch made the temperature effect concrete: in a bench test a ring at 100 °F kept contact with a separating surface, a ring at 75 °F lost contact for 2.4 s, and a ring at 50 °F had not regained contact after ten minutes. The secondary ring was no rescue: joint rotation could lift it off its sealing surface before any pressure reached it, which is why NASA had reclassified the joint in December 1982 from Criticality 1R (redundant) to Criticality 1, a single point of failure.

Timeline: A Leak at 0.678 s, a Flame at 58.788 s

Challenger lifted off from Pad 39B at 11:38 a.m. EST on 28 January 1986. Launch films and telemetry reconstruct the sequence:

• 0.678 s: the first smoke puff, gray, from the 270–310° sector of the right booster's aft field joint, the side facing the External Tank. Gas had already blown past both O-rings.
• 0.836–2.500 s: eight distinct puffs of increasingly blacker smoke, the color of burning grease, insulation and rubber. Then no more smoke was visible.
• ~2.5–58 s: the leak apparently plugged itself, most likely with glassy aluminum oxide from the burning aluminized propellant, and the booster ran normally.
• ~37–64 s: the vehicle flew through a series of unusually strong wind shears that flexed the stack and probably dislodged the plug.
• 58.788 s: first flame at the joint. Within about a second it became a well-defined plume, which the airflow bent onto the External Tank and the strut attaching the booster to it. By ~60 s the right booster's chamber pressure was falling below the left's.
• ~64–72 s: the plume breached the liquid hydrogen tank, then the lower strut gave way and the booster swung about its upper attachment.
• ~73 s: the tank's aft dome failed and the tank structure collapsed. Challenger, flying at nearly twice the speed of sound, was torn apart by aerodynamic forces at about 46,000 ft.

The crew cabin came through the breakup largely intact and struck the Atlantic minutes later. Commander Dick Scobee, pilot Michael Smith, Judith Resnik, Ellison Onizuka, Ronald McNair, Gregory Jarvis and teacher Christa McAuliffe were killed.

The Warnings: Flight Data, Memos and the Night Before

The joint's weakness was on record long before 51-L:

• 1977–79: Thiokol hydroburst tests showed joint rotation, and engineers at NASA's Marshall Space Flight Center, including Leon Ray, wrote memos calling the joint design unacceptable.
• 1982: the joint became Criticality 1, and flights continued under waivers rather than a redesign.
• January 1985 (STS-51-C): launched with joints at ~53 °F, the coldest before 51-L. Hot gas had blown past primary rings and blackened the grease between primary and secondary.
• 31 July 1985: Thiokol engineer Roger Boisjoly wrote that losing a flight to the joint would be “a catastrophe of the highest order – loss of human life.”

On the evening of 27 January 1986, with a hard freeze forecast, Thiokol engineers led by Boisjoly and Arnold Thompson presented charts in a teleconference with Marshall and recommended no launch below 53 °F, the coldest joint temperature ever flown. Marshall managers challenged the data; the booster project manager, Lawrence Mulloy, reportedly asked whether Thiokol wanted to wait until April. In an off-line caucus, Thiokol senior vice president Jerald Mason told engineering vice president Robert Lund to “take off your engineering hat and put on your management hat,” and Thiokol management reversed the recommendation over its engineers' objections.

The discussion that night centered on flights that had shown seal damage, which had happened at both warm and cold temperatures and made the link look inconclusive. Plotting every flight, including the undamaged ones, makes it plain: all four flights with joints below 65 °F had O-ring thermal distress, against only 3 of the 20 flights at 66 °F or above.

Commission member Richard Feynman later showed the cold effect with a clamp and a glass of ice water, and noted that officials had called erosion one-third of the way through the ring's radius a “safety factor of three,” a misuse of the term: the rings were never designed to erode at all.

How Seals Like This Are Specified, Tested and Redesigned

The Rogers Commission concluded that the joint design was unacceptably sensitive to temperature, physical dimensions, materials, reuse, processing and dynamic loading. The fix, the Redesigned Solid Rocket Motor (RSRM), shows how such a seal should be engineered:

• Capture feature: a lip on the tang that hooks around the clevis inner leg to limit joint rotation, carrying a third O-ring.
• Joint heaters that keep the seals warm before launch instead of leaving them at the mercy of the weather.
• No putty: the joint insulation was reshaped into a bonded “J-leg” flap that motor pressure pushes closed, removing the jets that putty blow-holes could aim at the rings.
• Full-scale proof: static firings and transient-pressure tests of complete joints, including deliberately flawed seals, rather than trust in flight experience.

The RSRM returned the Shuttle to flight on STS-26 in September 1988 and flew every remaining mission without another field-joint burn-through.

For elastomers in general, low-temperature behavior is now measured rather than assumed. ASTM D1329 (the TR test) stretches a specimen, freezes it in the stretched state, then releases and slowly warms it, recording the temperature at which it has retracted 10%, the TR-10 value. ASTM D395 measures compression set, the permanent flattening left after a ring is squeezed. Dynamic resilience tests open a gap against a compressed ring and time how long contact is lost. Standard fluoroelastomer (FKM, the Viton family) grades have TR-10 values of roughly −15 to −20 °C (about 5 to −4 °F). A ring at 28 °F (−2 °C) is therefore not glassy, but it is deep in the range where recovery slows sharply, and a dynamic seal fails long before rubber turns brittle.

Misconceptions and Look-Alikes

• “Challenger exploded.” The External Tank failed and its propellant burned in a vast fireball, but no bomb-like detonation destroyed the orbiter. It was broken apart by aerodynamic loads at nearly Mach 2.
• “The cold made the rubber crack.” The rings lost resilience, not integrity. That is different from brittle fracture in steel below its ductile-to-brittle transition, where a stiff material cracks.
• Confusing it with Columbia. Columbia (STS-107) was lost in 2003 because External Tank foam holed its left wing during ascent, and it broke up during re-entry. Different phase, system and physics, though both investigations blamed organizations that had come to accept recurring anomalies as normal.
• “It was just the weather.” Cold was the trigger, but the root cause was a joint that opened under pressure and relied on rubber chasing the gap. Blow-by had even appeared on a flight launched at 75 °F.
• “Two rings made it redundant.” Both rings sat in the same joint and suffered the same rotation and the same cold. A backup that fails by the same mechanism, from the same cause, is not independent redundancy.

Sociologist Diane Vaughan called the pattern normalization of deviance: each flight that survived erosion made the next feel safer, though the margin had not grown. Feynman's closing line states the engineering lesson: “For a successful technology, reality must take precedence over public relations, for nature cannot be fooled.”

The Challenger O-ring failure compared with events it is often confused with

Event	What actually failed	When the damage happened	Key difference
Challenger, STS-51-L (1986)	Cold, sluggish O-rings in the right booster's aft field joint let ~5,500 °F gas escape	At ignition: first smoke puff at 0.678 s; first flame at 58.788 s; breakup at ~73 s, 46,000 ft	The seal lost resilience as the joint flexed open; the vehicle was torn apart by aerodynamic loads
STS-51-C (January 1985)	Hot gas blew past primary O-rings and left blackened grease between primary and secondary	At ignition, with the joints at ~53 °F, the coldest before 51-L	The secondary ring held, so partial blow-by was treated as acceptable instead of as a design failure
Columbia, STS-107 (2003)	A ~1.7 lb piece of External Tank foam holed the left wing's reinforced carbon-carbon leading edge	Foam strike at ~82 s after launch; breakup during re-entry 16 days later at ~200,000 ft	Impact damage plus re-entry heating on a different vehicle, not a propulsion seal
A true explosion (detonation)	A supersonic reaction front shatters a structure from within	Milliseconds	Challenger's tank propellant burned in a fireball after the structure failed; aerodynamic forces broke up the orbiter
Brittle fracture in the cold	A stiff material cracks, as steel does below its ductile-to-brittle transition	At the moment of overload	The Viton rings did not crack or shatter; they stayed intact but recovered their shape too slowly