The night before Challenger
The Shuttle Challenger disaster leadership lessons that matter to me aren’t about a faulty O-ring. They’re about a room that overruled the engineer who was right.
Roger Boisjoly did not sleep much the night before. He lay awake, replaying a meeting in his head.[1]
He had studied these rockets closely for thirteen months, and for months he had predicted catastrophic failure — in formal memos, and in a teleconference that had ended only hours earlier. He and his colleagues had laid out the analysis one more time. The engineers were unanimous: do not launch. But then four managers overruled them, and the launch was back on. It seemed his worst fear would come true, and he could not sleep.
He was not wrong.
What he was afraid of
Roger Boisjoly was a staff engineer at the Space Shuttle Solid Rocket Booster manufacturer, Morton-Thiokol. The huge rocket was built in Utah and carried in four major segments by train to Florida, where they were assembled and loaded with fuel. After launch, the boosters dropped into the Atlantic, where they were recovered and brought back to Roger, who inspected them for reuse. That is how he began to notice problems with the joints between the rocket segments.
A redesign of one of these joints — the field joint, where one booster segment joins the next — was recommended as early as October 1977, four years before the first Shuttle ever flew. A Marshall Space Flight Center study of the joint judged the existing design unacceptable: under pressure, the tang could move outboard and open the joint enough to let the seal leak. The study’s recommended long-term fix was to redesign it.[2] These joints hold the rocket segments together and contain the 6,000°F combustion gas inside the seams as the booster produces 1.5 million pounds of thrust over its two-minute burn.[3] The joint’s assembly was difficult, and there were doubts it could reliably survive the heat and vibration of a launch. The design was deemed acceptable and no change was made — though NASA would keep noting concerns with these joints, raised by post-launch inspections, in formal meetings from there on.[4]
Boisjoly inspected the booster joints from a Shuttle Discovery launch in January 1985. At 53°F, it was the coldest launch in Shuttle history. There was evidence that burning gas had escaped through the joint. He was alarmed, and started studying the joint’s sensitivity to temperature. Six months before Challenger launched, he added his voice to the calls for a redesign, putting his biggest fear in writing:
“It is my honest and very real fear that if we do not take immediate action to dedicate a team to solve the problem, with the field joint having the number one priority, then we stand in jeopardy of losing a flight along with all the launch pad facilities.”[5]
The meeting
The Management Information Center at Morton-Thiokol in Brigham City, Utah looked much like any large conference room in corporate America. Three large oak tables surrounded by chairs in the center of the room. A whiteboard on the wall; fluorescent lights overhead. This ordinary conference room was about to host an extraordinary meeting: the first time a rocket contractor had ever tried to halt a shuttle launch.
It was historically cold in Florida. Orange farmers were at risk of losing their crops to frost. The fortunate ones ran wind machines and grove heaters to protect their trees; most could only watch what the weather would do.[6]
The morning of the launch, the front page of the Lakeland Ledger, a paper published ninety miles away from the Cape, led with the cold — Citrus growers fear another killer freeze — in the largest type on the page. The danger that would doom the flight, run as a banner headline.
Just below it was an Associated Press photo: Christa McAuliffe, laughing, on her way to the pad the day before, when a balky hatch and high winds had scrubbed the attempt. “Ready but no ride,” the caption said. “But her happiness was short lived.” They were referring to a scrubbed launch the day before, but it looks so ominous to me looking back that this cold, the crew, and this caption shared the same sheet of newsprint that morning.
One of Morton-Thiokol’s engineer-managers in Florida, Al McDonald, knew Boisjoly’s analysis of the boosters’ sensitivity to cold, and recommended an emergency meeting. An engineer at the Kennedy Space Center began calling homes and motels, scrambling to get the right people from NASA onto the phone. Another group of engineers and managers joined from Alabama.
Boisjoly and two other engineers in Utah prepared fourteen slides. They had no time for a dry run, or even to review each other’s work, but they had studied this problem for a year and knew their material. They knew the deck was imperfect — some slides handwritten, others typed, in places contradictory.[7] But they believed their case was strong.
Roger, nine engineers, and four managers huddled around the black-and-silver AT&T phone in the MIC in Utah.[8] The three-way teleconference finally started at 7 p.m. Over thirty people would join. The Morton-Thiokol engineers presented for an hour. There were questions and debate. They were unanimous in their recommendation: the data proved they should not launch at a temperature lower than their previous coldest launch of 53°F. It was 26°F in Florida. Boisjoly breathed a sigh of relief. They had stopped a sure disaster.[9]
“Take off your engineering hat”
But the response from Florida was shocking:
“My God, Thiokol. When do you want me to launch? Next April?”
This came from Larry Mulloy, a 26-year veteran of NASA, who had received memos describing the O-ring issues and discussed them in ten formal meetings between 1983 and 1986.[10] Another NASA manager, George Hardy, from Alabama, piled on:
“I’m appalled that Thiokol would come up with this particular recommendation at this particular time.”[11]
He, too, had been with NASA since 1960, working on the Saturn V. These men had been working on space flight since before the first man was put in orbit.
Thiokol asked for five minutes to caucus offline. They took thirty. Boisjoly later described the room in his Congressional testimony:[12]
“Arnie [Thompson] actually got up from his position … and walked up the table and put a quarter pad down in front of the management folks, and tried to sketch out once again what his concern was with the joint, and when he realized he wasn’t getting through, he just stopped. I tried one more time with the photos. I grabbed the photos, and I went up and discussed the photos once again and tried to make the point that it was my opinion from actual observation that temperature was indeed a discriminator … I also stopped when it was apparent that I couldn’t get anybody to listen.”
A senior vice president in the room said, “We need to make a management decision.” He turned to the vice president of engineering and said, “Take off your engineering hat and put on your management hat.” And in those thirty minutes, the four managers overruled the ten engineers. They came back on the line and said, “Launch.”
Al McDonald, the engineer who had asked for the meeting, sitting across from Larry Mulloy, refused to sign the recommendation to launch. He would later write, in his memoir Truth, Lies, and O-Rings:
“Mulloy not only accepted a recommendation that was outside anyone’s interpretation of the shuttle launch constraints, which should have required a waiver, but he chose to intentionally withhold this information from the NASA Mission Management team during his discussions with them on the morning of the launch.”[13]
These objections from Mulloy and Hardy did not come from disagreeing with the data. They came from finding the timing inconvenient. The distinction matters. Scorn is not a counter-argument. It is a signal — to everyone else in the room — about the cost of speaking next.
The engineers did not stop knowing what they knew. They stopped saying it out loud when it was clear no one would listen.
Seventy-three seconds
On the morning of January 28, 1986, the shuttle was pushed into the sky on a never-ending stream of flame and smoke. The CNN newscaster narrated:
“So the twenty-fifth space shuttle mission is now on the way after more delays than NASA cares to count. This morning it looked like they would not be able to get off…”
He was cut off by Challenger exploding.[14] Story Musgrave, an astronaut who flew on Challenger twice, was watching with fellow astronauts and their wives.[15] He described his experience to Henry S.F. Cooper, the space reporter from the New Yorker:
“First, there was the fiery cloud — and a moment of disbelief. Then there was the contrail, and we saw the two horns of the solid-rocket boosters coming out of the cloud by themselves — and I knew that was it.”
The field joint had failed, and the escaping hot gas burned a hole in the liquid fuel tank like a blowtorch, turning it into a bomb. All seven astronauts were killed, including Christa McAuliffe, who was to have been the first teacher in space.
Roger Boisjoly knew exactly what caused this. And it would keep him up at night for years. The people who had read his memos knew too — including the managers who voted to launch. The timing, it turns out, was right.
Bad news does not improve with time
The O-ring risk was first raised in 1977 — four years before the first shuttle ever flew. By 1985, it had surfaced in multiple memos, across multiple contractors, from multiple engineers. A formal risk had been recorded. Redesign had been recommended, deferred, and recommended again.[16]
The danger was not unknown. It was just never urgent enough — until it was fatal. “Appalled at the timing,” from the manager who said it, is worth sitting with. It was not the first time the issue had been raised, nor the first time it had been raised to him. It was not even close to the first time. The issue had been circulating for almost nine years. What the phrase reveals is the real problem: the system had learned to treat the O-ring risk as background noise. Raised, noted, deferred. Raised again, noted again, deferred again.
The repetition did not build urgency. It built tolerance. Diane Vaughan called this “the normalization of deviance” in her 1996 book, The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA.[17] I first heard the term — “normalizing the deviants” — in 2004, from a future three-star admiral who had served on the Columbia Accident Investigation Board.
Bad news does not improve with age. Unaddressed risk does not shrink because no one is talking about it. It grows — quietly, invisibly, right up until the moment it doesn’t.
Challenger did not fail for lack of intelligence. It failed because intelligence was not integrated.
The proof is in what happened after. When the disaster finally made the redesign of the field joint inevitable — after roughly eight years of deferral — the fix got done. Al McDonald led it. Over about two years the joint was redesigned and recertified through a campaign of full-scale test firings, and on September 29, 1988, the shuttle flew again. It was not easy. But it was completely solvable — it had always been completely solvable. The redesigned joint flew the remaining 110 launches over twenty-four years of the shuttle program without a field-joint failure. Artemis, the program that just sent four astronauts around the Moon, uses a booster based heavily on the shuttle’s, reusing segments that previously flew on shuttle missions.[18]
The problem was solved. It just required a disaster to make solving it unavoidable.
That is the cost of a system that treats bad news as inconvenient rather than essential. Martin Luther King Jr. wrote that “human progress never rolls in on the wheels of inevitability.”[19] He was writing about a different kind of injustice, but the mechanism is the same. Time does not fix systems that are designed to tolerate failure. It ratifies them. The people who raised the O-ring concern in 1977 were not wrong. They were just working inside a system that had learned to wait.
The leadership lesson of the Challenger disaster
If intelligence, experience, and concern weren’t enough, what failed?
The manager’s job is not to be the smartest person in the room. It is to build the room where the truth can survive.
In Challenger, the truth was in the room. It did not survive.
That is the larger argument this story belongs to: why psychological safety is the byproduct of a well-built interdependent team rather than its foundation — and what to do when you’re the one who can see the danger but can’t force the room to look.
- [1]William C. Rempel, “Year After Disaster: Challenger’s Wake,” Los Angeles Times, Jan. 28, 1987. ↩
- [2]Report of the Presidential Commission on the Space Shuttle Challenger Accident (Rogers Commission), GPO, 1986, p. 233 — Leon Ray, “SRM Clevis Joint Leakage Study,” Oct. 21, 1977 (the earliest known indication the joint design was unacceptable; redesign named the best long-term fix). Narrative at p. 123. ↩
- [3]U.S. House of Representatives, Committee on Science and Technology, Investigation of the Challenger Accident, GPO, 1986, p. 76 (burn duration and thrust). ↩
- [4]U.S. House Committee report, pp. 52–60 — ongoing concerns, including the John Miller memo formally recommending redesign, Jan. 9, 1978. ↩
- [5]Rogers Commission report, pp. 249–250 — facsimile of R.M. Boisjoly’s July 31, 1985 memo to R.K. Lund; the quoted passage is on p. 250. ↩
- [6]Avie Schneider, “Citrus Growers Fear Another Killer Freeze,” The Ledger (Lakeland, FL), Jan. 28, 1986. The same front page carried an Associated Press photo of Christa McAuliffe and Ellison Onizuka, “Ready but no ride.” ↩
- [7]Rogers Commission report, p. 92 (Allan McDonald testimony on the slide deck). ↩
- [8]Participants: U.S. House Committee report, p. 604; Roger Boisjoly, “Unethical Decisions” lecture, Univ. of Minnesota, 1991. Room described in Adam Higginbotham, Challenger (Penguin Books, 2025), pp. 319–320. ↩
- [9]Higginbotham, Challenger, p. 325. ↩
- [10]U.S. House Committee report, pp. 52–60; Mulloy’s “Next April?” quotation in Higginbotham, Challenger, p. 327. ↩
- [11]Higginbotham, Challenger, p. 327. ↩
- [12]U.S. House Committee report, p. 227 (Boisjoly’s testimony describing the caucus). ↩
- [13]Allan J. McDonald, Truth, Lies, and O-Rings: Inside the Space Shuttle Challenger Disaster (University Press of Florida, 2012), p. 476. ↩
- [14]CNN, live coverage of the STS-51-L launch, Jan. 28, 1986. ↩
- [15]Henry S. F. Cooper Jr., “Letter from the Space Station,” The New Yorker, Nov. 10, 1986 (Cooper’s interview with Story Musgrave). ↩
- [16]U.S. House Committee report, pp. 52–53, 57, 101, 146, 204, 216, 264, 268 (the documented multi-year history). ↩
- [17]Diane Vaughan, The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA (University of Chicago Press, 1996). ↩
- [