The night before the January 28, 1986 launch, Morton Thiokol engineers recommended against flying because cold temperatures (forecast in the 20s-30s Fahrenheit) would stiffen the solid rocket booster O-rings and impair their ability to seal joints. Under pressure from NASA managers who reversed the burden of proof by demanding the engineers prove it was unsafe rather than prove it was safe, Thiokol management overruled its own engineers and gave launch approval; the Challenger disintegrated 73 seconds after liftoff.
Reversing the burden of proof under pressure
Normally the party wanting to proceed must demonstrate safety; under schedule or authority pressure this burden can be silently inverted so dissenters must prove harm with certainty they cannot have. Because absence of conclusive proof of danger gets treated as proof of safety, the inversion manufactures approval while appearing to demand rigor.
Flown-with-damage treated as validated safety
Prior flights had shown O-ring erosion and blow-by without catastrophe, and the organization reinterpreted this escaping of disaster as evidence the design had acceptable margin. Treating a survived anomaly as a demonstrated safety margin steadily widened the range of conditions deemed acceptable until a boundary was crossed.
Retaliation as the price of dissent
After McDonald refused to sign the launch recommendation and later testified candidly to the presidential commission, he and other engineers were reassigned and demoted rather than heeded. Viewing an organization's treatment of its warners, not its stated safety values, reveals whether raising concerns is actually survivable there.