Arrow
Get your free stagnation score
Arrow
Find Your Solution
Logo

They Asked If Anyone Disagreed. Nobody Spoke. Challenger.

by | Sep 22, 2026

FICTION · An Unfair Advantage Intervention

Fiction. Real history. Sourced below.

After Thiokol reversed its no-launch recommendation, a NASA manager asked the teleconference whether anyone disagreed or had further comment. Nobody spoke. The engineers who believed the shuttle would fail were still in the building and still believed it — but the reversal had been written in a private caucus they weren’t part of, and by the time the formal question came, there was no one left on the call whose job it was to answer it.

A note before this one. Seven people died: commander Dick Scobee, pilot Michael Smith, mission specialists Judith Resnik, Ronald McNair and Ellison Onizuka, and payload specialists Gregory Jarvis and Christa McAuliffe, the teacher whose flight children watched live in classrooms. This is examined soberly, to take the organizational failure seriously and to honour the engineers who tried to prevent it — not to reduce a tragedy to a tidy lesson.

I’m Timothy Matthews. I was overruled by management on a technical judgment I believed in, and I want to be careful about that, because being overruled is not the same as being right — I was largely wrong at Cartwell, and Roger Boisjoly was right about Challenger, and no amount of feeling aggrieved distinguishes those two cases from the inside. What distinguishes them is whether the system had any way to tell the difference. That night, it didn’t.

Full fiction disclosure and sourcing note

This is a work of fiction. Timothy Matthews is a fictional character from The Unfair Advantage by Todd Hagopian, and Cartwell is the book’s fictional company. Timothy analyzes the real, documented history of the Challenger disaster from the present day; he never met or spoke with any real person, and no dialogue is invented. Statements by Roger Boisjoly, Lawrence Mulloy, Jerry Mason and others are quoted from the Rogers Commission record and published accounts. The historical facts are accurate and sourced as of 2026; the framework analysis is invented.

The Commitment They Had

Thiokol did not arrive at that teleconference without a position. They arrived with a documented commitment, built over years, by the people closest to the hardware.

On 31 July 1985, six months before the launch, Roger Boisjoly sent an interoffice memo to Robert Lund, Thiokol’s vice president of engineering, copied to Allan McDonald and others, warning that the O-ring erosion problem could produce “a catastrophe of the highest order — loss of human life”. A full-time task force was working on booster blow-by.

On the evening of 27 January 1986, with overnight temperatures forecast near 18°F, Boisjoly and his colleagues presented their data and made the recommendation explicit: do not launch below 53°F. That figure wasn’t arbitrary — 53° was the coldest prior launch, and it had produced the worst blow-by they had seen.

So the commitment existed, it was specific, it was written down, and it was held by the people with the most knowledge. Every precondition people imagine would be sufficient was present. It lasted about half an hour.

The Pressure Resistance Protocol: Thirty Minutes

The Pressure Resistance Protocol concerns maintaining a strategic commitment when real pressure arrives — and its premise is that conviction is not a mechanism. Commitments that depend on individuals continuing to feel strongly about them fail predictably, because pressure is specifically designed to change how people feel. The protocol asks what structure holds the line when the person holding it is being leaned on.

Run it on Thiokol and the answer is nothing. There was no mechanism at all.

Look at the pressure that arrived. NASA needed to demonstrate the shuttle could fly on schedule in any month. Marshall’s George Hardy said he was “appalled” at the Thiokol recommendation, and Lawrence Mulloy asked, in a line he never denied, when Thiokol wanted him to launch — next April? Mulloy later testified that he did not believe he was applying pressure, only probing the basis of a conclusion, and I think that’s probably how it felt to him. Pressure rarely announces itself as pressure to the person applying it.

And underneath sat commercial reality. Thiokol’s booster contract was up for renewal, NASA badly needed a successful flight, and Jerry Mason knew both facts.

Then Joe Kilminster asked to take the discussion off-line, and Thiokol’s managers caucused privately. In that room Mason turned to Lund — the same man who had received Boisjoly’s memo six months earlier — and asked him to take off his engineering hat and put on his management hat. Lund changed his vote. Boisjoly and Arnie Thompson kept objecting and were not part of drafting the reversal.

That is the entire failure, and notice what it did not require. No villain, no negligence, no ignorance of the data. It required only that a commitment held by conviction meet pressure applied by a customer, with no structural mechanism in between. Thirty minutes in a private room was enough.

The Question That Got Silence

Here is the detail I find most difficult, and the one that should worry any operator who thinks their organization is different.

When the teleconference resumed, Kilminster stated Thiokol’s new position in favour of launching. Then NASA’s Stanley Reinartz asked whether anybody participating disagreed or had any other comment about the recommendation.

Nobody spoke.

The Marshall and Kennedy participants consequently had no idea that Thiokol engineers still believed the shuttle would fail. The formal opportunity for dissent existed. It was offered explicitly. And it returned silence, because by the time the question was asked, the reversal had already been written by people in a caucus the dissenters weren’t part of, and the dissenters were no longer positioned as participants with a view to state.

This is why “listen to your engineers” is an inadequate lesson. NASA did ask. The asking happened at the wrong point in the sequence — after the position had been consolidated rather than while it was being formed — and a question asked at the wrong point in a process is indistinguishable from a question that wasn’t asked at all.

At Kennedy, Allan McDonald refused to sign the launch authorization and appealed directly. He was overruled too, and his refusal never reached the people who could have acted on it either.

Inconclusive Data on an Irreversible Decision

Mason’s own defence deserves a hearing, because it isn’t stupid and it’s the argument that will be made in your organization. He later explained that the engineering data were not sufficient to settle the question, so a judgment had to be made by the people in charge. And he was factually correct about the data: the engineers could not give a firm figure for the precise temperature at which flight became unsafe.

The Decision Type Matrix is what answers this. Type 1 decisions — irreversible and critical — require 85 to 90 percent confidence. Type 2, reversible and critical, is where 70 percent is appropriate. The launch was as pure a Type 1 as exists: seven lives, no recall, no staged rollback.

So Mason is right that a judgment was required and wrong about which way uncertainty points. On a Type 1 decision, inconclusive data is not a licence to proceed on managerial judgment. It is the definition of failing the threshold. The engineers’ inability to specify an exact temperature was not a weakness in their case; it was their case.

What happened instead was a burden inversion: rather than requiring evidence the launch was safe, the discussion required evidence it would fail. That standard cannot be met — you can rarely prove a negative — and it converts every uncertain safety question into an automatic go. Notice that this inversion is invisible in the moment. It doesn’t feel like lowering a standard. It feels like asking rigorous questions of a soft recommendation.

Seventeen Years Later

The proof that the problem was structural rather than personal is that NASA fixed the hardware and lost another crew to the same organizational failure.

The booster joint was redesigned and the fleet returned to flight in September 1988. Then on 1 February 2003, Columbia broke apart on reentry, killing seven, after foam debris struck the wing during launch — foam that had been striking shuttles for years and had been absorbed into the definition of acceptable, exactly as the O-ring blow-by had been. NASA’s own Columbia Accident Investigation Board quoted the 1986 report to argue the organizational causes were essentially identical.

Sociologist Diane Vaughan named the mechanism in 1996: normalization of deviance. Each time a deviation from specification produced no disaster, it was folded into the definition of normal, and the group doing the folding was the same group later assessing risk. They weren’t ignoring their experience. They were applying it, and their experience had taught them that damaged seals were survivable, because until 28 January 1986 they always had been.

That is the harder version of this case. The engineers were right and were overruled — but even winning that night would have addressed one launch, not the accumulated debt that produced the situation. A system that treats “we got away with it” as evidence of safety is running a tab it cannot see, and the only variables are when it comes due and how many people are aboard.

What Actually Happened

On 28 January 1986, Challenger broke apart 73 seconds after liftoff from Kennedy Space Center, killing all seven aboard. An O-ring seal in the right solid rocket booster, stiffened by cold, failed to seat; hot gas blew past the joint, burned through, and breached the external tank. Launch temperature was about 36°F, roughly fifteen degrees colder than any previous shuttle launch, after overnight lows near 18°F.

The night before, Thiokol engineers presented temperature-versus-blow-by data and recommended against launching below 53°F. NASA managers pushed back, Hardy stating he was appalled and Mulloy asking when Thiokol wanted him to launch. Thiokol caucused off-line, where Mason asked Lund to take off his engineering hat and put on his management hat; Lund changed his vote and the recommendation was reversed over the objections of Boisjoly and Thompson, who were not part of writing it.

Kilminster conveyed the new position and signed the approval. The Rogers Commission later found that the reversal was not driven by new engineering data. When Reinartz asked whether anyone disagreed, nobody spoke, and the NASA participants never learned the engineers still objected. Allan McDonald refused to sign the launch authorization at Kennedy and was overruled.

The fleet was grounded for roughly two years and eight months, returning to flight with a redesigned joint in September 1988. Boisjoly testified candidly to the commission, was ostracized, effectively lost his career, and spent the rest of his life teaching engineering ethics until his death in 2012. McDonald was demoted before being vindicated. On 1 February 2003 Columbia was lost with seven aboard, and NASA’s investigation board found the organizational causes matched Challenger’s.

From the Operator’s Chair

I’m Todd Hagopian, and I’ve sat in go/no-go rooms under deadlines the whole building treated as fixed. I want to avoid flattering myself in hindsight, because the honest difficulty here is not “should you listen to engineers.” Of course you should. The difficulty is that organizations receive dozens of concerns a week, most don’t materialize, and the schedule pressure is genuine rather than cartoonish. Three things.

First, build the mechanism before the pressure, because conviction is not a mechanism. Thiokol’s engineers had data, a written warning, a task force, and complete conviction, and it survived half an hour in a private room. What they lacked was any structure that operated independently of how the people in that room felt — a standing minimum-temperature rule, a dissent that had to be transmitted with any reversal, a signature requirement that couldn’t be reassigned. Ask of any commitment your organization holds: what happens to this when your largest customer pushes back hard? If the answer is that someone senior would have to be brave, you don’t have a commitment.

Second, watch where in the sequence you ask for dissent. Reinartz asked. Nobody spoke. The question came after the position had been consolidated by people the dissenters weren’t among, which made it ceremonial without anyone intending ceremony. If you want real objections, they have to be gathered while a position is forming, from the people who hold them, not solicited from a room after a decision has been drafted. A question asked too late reads as a formality to everyone present, and everyone behaves accordingly.

Third, keep the burden of proof on safe, and know that inverting it feels like rigour. Nobody in that discussion said “let’s lower our standard.” They asked the engineers to substantiate a claim, which is what good managers do. But requiring proof that something will fail, rather than proof it is safe, converts every uncertain safety question into an automatic yes. And I’d add the part that should sit uncomfortably with all of us: the people who tried to stop this were ostracized, demoted, and driven out. Until the arithmetic in your own organization visibly rewards the person who raises the inconvenient concern, no policy statement about speaking up means anything, because everyone can see what actually happens.

The Monday Morning Playbook

  • Convert critical commitments into mechanisms. A standing rule, a required signature that can’t be reassigned, a threshold that binds. If holding the line depends on someone being brave in the moment, it will not hold.
  • Gather dissent while positions form, not after. Asking a room whether anyone disagrees, after a decision has been drafted by others, is a formality regardless of intent. Capture objections from the people who hold them, in writing, before consolidation.
  • Require dissent to travel with the recommendation. If a technical position is reversed, the original position and who still holds it should be transmitted alongside it. Thiokol’s engineers never appeared in what NASA received.
  • Keep the burden on “safe,” and name it out loud. On irreversible, critical decisions, inconclusive data means the threshold is not met. Demanding proof of failure is an inversion that feels like rigour.
  • Audit what happens to your messengers. Look at the last three people who raised inconvenient concerns and what happened to their careers. That record, not your policy, is what your organization believes.

The Contrarian Reappraisal

The standard reading — managers overruled engineers under schedule pressure — is accurate and lets every other organization off the hook, because nobody believes they’d have been in that room.

The commitment existed and had no mechanism behind it. Boisjoly’s written warning, the task force, the 53°F recommendation and complete engineering conviction all existed, and were reversed in a half-hour private caucus. Conviction is not a structure, and pressure is precisely designed to change how people feel.

The formal opportunity for dissent was offered and produced silence. Reinartz asked whether anyone disagreed. Nobody spoke, because the reversal had been drafted by managers the dissenters weren’t among. “Listen to your engineers” is inadequate when the asking happens at the wrong point in the sequence.

Winning that night still wouldn’t have been enough. The O-rings had eroded for years, each time absorbed into the definition of normal by the same group later assessing risk. NASA redesigned the joint, returned to flight in 1988, and lost Columbia in 2003 to a normalized foam hazard — with its own board finding the organizational causes identical. The lesson was identified in 1986 and not institutionalized.

The Challenger Timeline

  • 31 July 1985 — Boisjoly memos Lund warning that the O-ring erosion problem could cause a catastrophe of the highest order and loss of human life; a full-time task force is working on blow-by.
  • January 1985 — the coldest prior launch, at 53°F, produces the worst O-ring blow-by observed to that point.
  • Evening, 27 January 1986 — with lows forecast near 18°F, Thiokol engineers recommend no launch below 53°F; Hardy is “appalled” and Mulloy asks when they want him to launch, next April.
  • Off-line caucus — Mason asks Lund to take off his engineering hat and put on his management hat; Lund changes his vote and the recommendation is reversed over Boisjoly’s and Thompson’s objections.
  • Teleconference resumes — Kilminster conveys the reversal; Reinartz asks whether anyone disagrees and nobody speaks; McDonald refuses to sign the launch authorization at Kennedy and is overruled.
  • 28 January 1986 — Challenger breaks apart 73 seconds after liftoff at about 36°F, killing all seven aboard.
  • 1986–1988 — the Rogers Commission finds the reversal was not driven by new engineering data; the joint is redesigned and the fleet returns to flight in September 1988; Boisjoly and McDonald are ostracized and demoted.
  • 1 February 2003 — Columbia is lost with seven aboard to a normalized foam hazard; NASA’s investigation board finds the organizational causes identical to Challenger’s.

By the Numbers

  • 7 and 7 — lives lost on Challenger in 1986 and on Columbia in 2003, to organizational causes NASA’s own board found essentially identical.
  • 53°F recommended, ~36°F launched — the engineers’ threshold against the actual temperature, after overnight lows near 18°F.
  • ~30 minutes — the off-line caucus in which a years-long engineering commitment was reversed without new data.
  • 6 months — between Boisjoly’s written warning of a catastrophe of the highest order and the launch.
  • 1 question, 0 answers — Reinartz asking whether anyone disagreed, and the silence that left NASA unaware the engineers still objected.
  • 17 years — between the lesson being identified and the same failure recurring.

Frequently Asked Questions

What caused the Challenger disaster?

An O-ring seal in the right solid rocket booster, stiffened by cold, failed to seat properly. Hot gas blew past the joint, burned through, and breached the external tank, and the vehicle broke apart 73 seconds after liftoff on 28 January 1986. Launch temperature was about 36°F, roughly fifteen degrees colder than any previous shuttle launch.

Did engineers warn about the Challenger launch?

Yes. Roger Boisjoly had warned in a July 1985 memo of a possible catastrophe of the highest order and loss of human life, and on the evening before launch Thiokol engineers recommended not launching below 53°F. After NASA pushed back, Thiokol managers caucused privately and reversed the recommendation over their engineers’ objections; the Rogers Commission found the reversal was not driven by new engineering data.

Why didn’t NASA know the engineers still disagreed?

Because the reversal was drafted in a private caucus the engineers weren’t part of. When the teleconference resumed and NASA’s Stanley Reinartz asked whether anybody disagreed or had further comment, nobody spoke — so the Marshall and Kennedy participants never learned that the people who understood the seals best still believed the shuttle would fail. Allan McDonald separately refused to sign the launch authorization and was overruled.

Was the decision defensible given the data?

Jerry Mason later explained that the engineering data were insufficient to settle the question, so a judgment had to be made by the people in charge, and he was right that the engineers could not specify an exact unsafe temperature. But on an irreversible, life-critical decision, inconclusive data means the confidence threshold isn’t met. The error was inverting the burden of proof — demanding evidence the launch would fail rather than evidence it was safe.

Did NASA learn the lessons of Challenger?

The hardware was fixed and the fleet returned to flight in 1988 with a redesigned booster joint, but the organizational lessons weren’t institutionalized. On 1 February 2003 Columbia broke apart on reentry killing seven, after foam strikes that had been normalized much as the O-ring damage had been. NASA’s own Columbia Accident Investigation Board concluded the organizational causes were essentially identical.

About the Stagnation Assassin

Todd Hagopian is a Fortune 500 transformation executive who has generated $3B+ in shareholder value across Berkshire Hathaway, Illinois Tool Works, Whirlpool, and JBT Marel, where he serves as VP of Product Strategy and Marketing. Known as The Stagnation Assassin, he turns proprietary frameworks — including the Pressure Resistance Protocol and the Decision Type Matrix — into field-tested tools for organizations where being wrong is expensive. He is the author of The Unfair Advantage and the Stagnation Assassin series, a Forbes contributor, and an award-winning keynote speaker. Connect with Todd on LinkedIn or bring him to your stage via his speaking page. Contemporary accounts of the engineers who tried to stop the launch remain the best record of what they attempted.

They had the data, a written warning, a task force, and total conviction — and it survived thirty minutes in a private room, because conviction is not a mechanism. Build the structure before the pressure arrives, gather dissent while positions form rather than after, and look honestly at what happened to the last person who raised something inconvenient.

The discipline of holding a commitment when the pressure is real is in The Unfair Advantage.

Connect on LinkedIn · Book a keynote.