How Allan McDonald refused to sign off on the Challenger launch

Executive overview

The night before the Challenger disaster, Morton Thiokol's solid rocket booster program manager formally recommended against launch due to dangerously cold temperatures. NASA management pressured the contractor to reverse that recommendation. One engineer refused to sign the approval document.

Speaking truth to power rarely protects your career. McDonald was stripped of his role the day after testifying before the presidential commission. It took a literal act of Congress — the only such reinstatement in US history — to get his job back.

When professional responsibility conflicts with organizational pressure, the obligation to speak is not optional — and the cost is real.

The temperature problem and the night before launch

• In January 1985, post-flight booster inspection found black soot between the two O-rings on a joint 12 feet in diameter — evidence hot gas had bypassed the primary seal.
• The only distinguishing factor for that flight: it launched at 53°F, the coldest to date.
• Engineers did not know at what temperature the O-rings would fail completely; they only knew they were heading toward an unknown cliff.
• On January 27, 1986, McDonald learned temperatures at the Cape would drop to the low 20s overnight — the launch window would open at 22–26°F.
• He organized an emergency teleconference tying Thiokol engineers to NASA Marshall and Kennedy management.
• Thiokol's VP of engineering, Bob Lund, formally recommended: do not launch below 53°F.

NASA's response and the reversal

• NASA managers challenged the recommendation as "qualitative" with no hard test data.
• Larry Malloy asked whether they should wait until April — framing delay as absurd.
• George Hardy said he was "appalled" but would not override the contractor's recommendation.
• Thiokol management went off-mute for ~30 minutes; program management (not engineering) came back recommending launch proceed with no temperature floor specified.
• NASA immediately demanded written sign-off — unusual: it had never been required before.

The refusal

• McDonald was the responsible Thiokol official at Kennedy; the sign-off was his to give.
• He refused. His reasoning: the risk was avoidable with a one-day delay, engineers did not know how close they were to the failure threshold, and proceeding meant taking an unnecessary risk.
• His boss in Utah, Joe Kilminster, signed and faxed the document.
• The launch proceeded the next morning. Challenger broke apart 73 seconds after liftoff.

The investigation and testimony

• McDonald joined the failure team at Marshall the day after the accident, initially suspecting the main engines or the external tank structure.
• He was pulled back when film showed fire emerging from the side of a solid rocket booster near the aft field joint — exactly the joint whose O-rings he had been concerned about.
• He had not expected joint failure to manifest 73 seconds in; he had assumed failure would occur at ignition.
• A New York Times article surfaced a 1985 NASA budget memo referencing Thiokol's request for funds to fix the field joint O-ring system — that request had been rejected as too costly.
• At the presidential commission hearing, NASA testified that Thiokol had told them to proceed. McDonald, watching from the gallery, walked down and interrupted: Thiokol had recommended against launch below 53°F, in writing.
• Commission chairman William Rogers asked him to repeat it, saying it would be "in litigation for years to come."

Retaliation and reinstatement

• The day after testifying, McDonald was removed as head of the shuttle program and assigned to "scheduling" — a non-job intended to prompt resignation.
• The chief scientist at Thiokol recruited him instead to lead the effort to fix the joint system and return the shuttle to safe flight.
• While attending an unrelated aerospace symposium, he ran into General Don Kutyna — a commission member — who learned of McDonald's removal and called Chairman Rogers directly.
• Thiokol executives were brought back for a wire-brushing; McDonald was offered and accepted a senior role in the joint NASA–Thiokol task force to return the shuttle to flight.
• Congress passed House Joint Resolution 634 directing his reinstatement — the only such act directed at a single individual in US history; confirmed independently by a Cornell professor via the Library of Congress.

After Challenger

• McDonald led the redesign effort and served as launch representative for the first three post-Challenger flights (1988–89), all fully instrumented.
• He regards the solid rocket booster as the safest part of the shuttle by the time it retired in 2011 after 110 perfect flights post-Challenger.
• He remained at Morton Thiokol (later ATK) until 2001, working on advanced technology including airbags, tactical missiles, and strategic space motors.
• He published Truth, Lies, and O-Rings: Inside the Space Shuttle Challenger Disaster (with James R. Hansen, 2009), now required reading in some engineering programs.

Why speaking up matters even when it doesn't change the outcome

• McDonald's objection did not stop the launch, but it created an accurate record of what was known and when.
• 30 years later, the story continues to shape how engineers and managers think about safety and dissent.
• His core message to students: professional opinion is not just important — it is a professional responsibility.
• A practical caution from host Dave Stachowiak: speaking truth to power rarely ends well without significant external intervention; McDonald fully expected his career to be over when he stood up at the hearing.
• The obligation to speak is not contingent on the outcome.