In one line: In 1986 engineers warned that cold temperatures threatened the shuttle’s booster seals. The launch went ahead anyway, and the case became the defining study of how organizations override engineering judgment.
Core idea
On January 28, 1986, the Space Shuttle Challenger broke apart shortly after launch, killing all seven crew. Hot gas had escaped past O-ring seals in a joint of a solid rocket booster. The night before, engineers at the booster contractor had recommended against launching at the forecast low temperature, because they had evidence that cold made the O-rings less resilient. Under pressure from the customer to justify the recommendation with data, contractor managers held an off-line caucus and reversed it. One senior engineering manager was famously urged to set aside his engineering judgment and decide as a manager instead. The launch proceeded.
How it works: what went wrong
- Normalization of deviance. Erosion of the seals had been seen on earlier flights. Each time it was rationalized as acceptable, so the anomaly slowly became an accepted risk.
- Burden of proof reversed. Instead of proving it was safe to launch, engineers were asked to prove it was unsafe, with incomplete data.
- Weak data presentation. The temperature trend was there, but it was not shown in a way that made the risk obvious to decision-makers.
- Structural pressure. The schedule, budget, and the program’s public profile all pushed toward launching.
- Communication filters. Concerns did not travel up the chain intact, and the final decision-makers did not hear the engineers’ full objection.
In practice
The class questions make the case personal. What could management have done differently? What could the engineers have done? What should the engineer who argued hardest against launch have done, knowing that his job and family’s security were at stake? How do you balance loyalty to an employer with your duty to protect the public?
There are no comfortable answers. There are, however, practical lessons:
- Make safety-critical dissent normal and protected.
- Keep the burden of proof on safety.
- Present data so that the risk is unmistakable.
- Escalate through every legitimate channel when lives are at stake.
Questions to ask yourself
- Where in my work has an anomaly quietly become “normal”?
- If I disagreed with a launch-like decision, what channels would I use, and in what order?
- Do I present risk data so that a non-specialist could not miss the trend?
Connections
- Framework: Ethical Reasoning (every component failed somewhere). Climate: Psychological Safety.
- Engineering lessons: Risk Management, Statistics in Engineering. Cultural mechanism: Logic of Appropriateness.
- Capabilities exercised: Ethical Actions and Integrity, Courage, Decision Making, Communicating and Advocacy.
Sources
- Vaughan (1996) The Challenger Launch Decision [1]
- Course case notes on the Challenger disaster; no public source.