In 1986, NASA management put the odds of losing a space shuttle at 1 in 100,000.
At that rate, you could launch a shuttle every day for three hundred years and expect to lose one.
The engineers who worked on the hardware put the number closer to 1 in 100.
Both numbers lived inside the same organization. On January 28, 1986, the hardware settled which one was true.
THE SIGNAL
The shuttle’s solid rocket boosters were built in segments.
Rubber O-rings sealed the joints between them. Hot gas was never supposed to reach those seals.
On flight after flight, it did. Recovered boosters came back with O-rings scorched and eroded. The worst damage followed the coldest launch on record, in January 1985, at 53 degrees.
Cold rubber stiffens.
Stiff rubber seals slowly.
A slow seal lets fire through.
Engineers at Morton Thiokol, the contractor that built the boosters, understood this.
In the summer of 1985, engineer Roger Boisjoly wrote a memo warning that a joint failure could cost the lives of the crew.
The forecast for the morning of January 28 was far below freezing.
The signal was clear, specific, documented, and eight months old.
THE FAILURE POINT
The failure happened on the evening of January 27, during a teleconference between Thiokol and NASA.
Thiokol’s engineers recommended against launching below 53 degrees.
NASA’s booster project manager, Lawrence Mulloy, pushed back hard.
According to the presidential commission that investigated the disaster, he asked, “My God, Thiokol, when do you want me to launch, next April?”
Thiokol asked for a few minutes offline.
In that caucus, a senior manager told the company’s head of engineering to take off his engineering hat and put on his management hat.
Four managers voted.
The engineers who had raised the objection didn’t get a vote.
Thiokol came back on the line and approved the launch.
The Norman Decision Window was still open that night.
The shuttle was on the pad. A delay would have cost schedule and reputation, and nothing more. The window stayed open until the solid rocket boosters ignited at 11:38 the next morning. That was the Norman Failure Condition. Once the boosters lit, no intervention existed.
The temperature at the pad was around 36 degrees. There was ice on the launch tower. Challenger broke apart 73 seconds after liftoff.
Seven people died, including Christa McAuliffe, the teacher who was supposed to give lessons from orbit.
SIGNAL WITHIN THE SIGNAL
The engineering warning entered the system at full strength. It had data, a threshold, and a written record.
Then it moved.
At the contractor level, it became a recommendation that management overruled.
At the NASA project level, it became a concern that had been discussed and resolved.
At the top, it disappeared.
The commission found that the senior NASA officials who gave the final go were never told about the engineers’ objection. They made the launch decision inside a picture where the joint question had already been settled.
This is Signal Compression: the loss of truth, clarity, and urgency as real problems move through organizational layers.
Nobody at the top was deceived by a single lie. The warning was simply resolved out of the story on its way up.
The same compression ran across years. Each flight that returned with eroded seals made erosion feel more normal. The sociologist Diane Vaughan later called this the normalization of deviance. Evidence of danger was being read as evidence of safety.
That is how you get Institutional Hallucination: an organization operating with full confidence inside a model of reality that its own operating conditions no longer support. The 1 in 100,000 figure was sincere. It had been built from twenty-four successful flights, a demanding schedule, and a proud reputation. Nobody had built it from the hardware.
Worth checking where your own team sits on that same gap before assuming it's someone else's problem.
Score your gap →
BEHAVIOR UNDER PRESSURE
Look at what pressure did to the people in that teleconference.
NASA was behind on its flight schedule and under public scrutiny. The mission carried a teacher and a national audience. Delay had a visible cost. Risk had an invisible one.
Mulloy’s question about launching in April did its work as pressure more than argument. It told the contractor that its customer was frustrated.
Thiokol’s managers were facing their largest customer, with a contract relationship at stake. The engineering data had not changed during the caucus. The social pressure had.
And the burden of proof quietly flipped. For years, engineers had been required to show the shuttle was safe to fly. That night they were asked to show it was unsafe. They couldn’t prove it to management’s satisfaction, so the launch went ahead.
Under pressure, the question changed from “is this safe?” to “can you prove it isn’t?” That single shift decided the outcome.
SYSTEM DRIVER - MOS
Three structural failures made the decision possible.
Escalation stopped at the middle layer. No rule required an unresolved engineering objection to travel to the final launch authority. The dispute was settled below the people who owned the decision.
The burden of proof was undefined. Nothing in the system fixed who had to prove what. So it moved to whoever held the least power in the room.
The KPI was success count. The program measured flights completed. It did not measure the trend in O-ring damage as a leading indicator. A metric that counts outcomes will always look healthy right up until the first failure.
The MOS fix is structural.
Any safety objection from engineering travels automatically to the final decision authority, with the data attached. The default when evidence is incomplete is stop. And leading indicators of damage are tracked with the same visibility as the success rate.
LEADER DRIVER - INTERNAL OPERATING SYSTEM (IOS) - REGULATE
“Take off your engineering hat and put on your management hat.”
That sentence is Internal Signal Compression spoken out loud.
The engineering hat sees the data: cold rubber, eroded seals, a temperature far below anything the joint had survived.
The management hat sees the customer, the schedule, the contract, the relationship.
Under threat, the management hat wins because the social threat feels more immediate than the physical one.
This is Social Threat Compounding. The nervous system processes an angry customer on the phone with more urgency than a seal failure that might happen tomorrow.
The leader is sincere.
The leader is also filtering.
A regulated leader in that caucus would have noticed the shift. The data was the same as it had been an hour earlier. The only new input was frustration from the customer.
A regulated leader separates those two things before deciding.
An unregulated one lets the second decide the first.
IF YOU DO ONE THING TODAY
Pick one metric your leadership trusts.
Take it to the people who generate it and ask how they would estimate it themselves.
The distance between their number and yours is the width of your hallucination.
FINAL SIGNAL
The engineers had the data.
The managers had the confidence.
The launch followed the confidence.
Richard Feynman, the physicist on the investigating commission, closed his report with a line every leader should keep in view: for a successful technology, “reality must take precedence over public relations, for nature cannot be fooled.”
CTA
Find out where your gap is before it costs you. Score your own gap here, takes about three minutes.
mosei.org/gap-diagnostic.html
Somewhere in your organization, there is a number leadership believes and the floor quietly doesn’t.
If you want to measure the gap before it measures you, the diagnostic tools are at MOSei.org.
If this issue was useful, share it with one leader who owns a number like that.
SOURCES
Report of the Presidential Commission on the Space Shuttle Challenger Accident (1986)
Richard Feynman, “Personal Observations on the Reliability of the Shuttle,” Appendix F of the Commission report
Diane Vaughan, The Challenger Launch Decision (1996)