One in a Hundred Thousand
How Appendix F Exposed the Fantasy Math Behind the Shuttle Disaster
A glass of ice water on a walnut hearing table in Washington, D.C., on February 11, 1986, held a crimped black strip of Viton fluorocarbon rubber. The sample came from a scale model of the Space Shuttle Challenger solid rocket booster. Fourteen days earlier, on the freezing morning of January 28, 1986, Challenger had disintegrated seventy-three seconds after liftoff from Cape Canaveral at an ambient pad temperature of $28^\circ\text{F}$, killing all seven crew members. Appointed to the Rogers Presidential Commission despite recovering from surgery for rare abdominal cancer, Richard Feynman was quietly tipped off by Air Force General Donald Kutyna and astronaut Sally Ride. They pointed him to company tests showing how cold temperatures affected the resilience of the 0.28-inch-diameter rubber O-rings sealing the field joints of the Morton Thiokol boosters.
During the televised afternoon session, Feynman squeezed the rubber sample inside a small hardware-store C-clamp, submerged it in the $32^\circ\text{F}$ ice water for two minutes, and loosened the screw. The cold rubber failed to spring back for several seconds. Because the steel walls of a solid rocket casing balloon outward within milliseconds of ignition, a stiffened rubber seal could not follow the widening metal gap. That gap allowed $5{,}000^\circ\text{F}$ combustion gases to blow past the joint and sever the external hydrogen tank strut.
Yet the physical failure of the rubber seal was only half the investigation. Flying down to NASA's Marshall Space Flight Center in Huntsville, Alabama, Feynman bypassed his official agency handlers. He sat down directly with the working propulsion engineers who maintained the Space Shuttle Main Engines and solid boosters. He discovered that NASA headquarters had been certifying the orbiter for civilian passengers—including schoolteacher Christa McAuliffe—using an official Range Safety probability of catastrophic vehicle loss of 1 in $100{,}000$ launches. At one flight per day, a $10^{-5}$ failure rate meant the fleet would fly every day for two hundred and seventy-four years without a single fatal accident.
In his unedited dissenting report—which he forced Chairman William Rogers to publish intact as Appendix F of the commission report—Feynman documented three systematic delusions that separated NASA management from physical engineering:
- * Normalization of O-ring blow-by as a safety factor: Even though hot gas had charred and eroded primary O-rings on more than a dozen prior flights, solid rocket project manager Lawrence Mulloy claimed a safety factor of three simply because only one-third of the rubber cross-section had burned away.
- * Top-down probability back-calculation: Instead of summing empirical component failure rates upward from test stands, managers set the total vehicle risk at $10^{-5}$ by decree and assigned individual subsystem valves and bolts an arbitrary failure rate of $10^{-7}$ or $10^{-8}$.
- * The two-hundred-fold gap between engineers and brass: When Feynman asked three propulsion engineers and their manager at Huntsville to write their independent estimates of shuttle failure probability on folded slips of paper, every engineer wrote numbers near 1 in 100 (ranging from 1 in 200 to 1 in 300), while the manager wrote 1 in $100{,}000$.
Feynman confronted that hundred-thousand-to-one fantasy directly in his report, arguing that any claim of a one-in-a-hundred-thousand failure probability was patently exaggerated when the booster seals were visibly eroding on flight after flight. He closed Appendix F with the warning that for a successful technology, reality must take precedence over public relations, for nature cannot be fooled. Historical flight records after two hundred and five Space Shuttle missions proved the working engineers right to the exact order of magnitude, with two catastrophic vehicle losses yielding an empirical failure rate of one in one hundred and two.