> the engineers should have stressed the point long before Jan 28, 1986. They did. They argued that the booster was unsafe at any temperature, but were overrul

> the engineers should have stressed the point long before Jan 28, 1986. They did. They argued that the booster was unsafe at any temperature, but were overruled when NASA demanded proof that it was unsafe - a clear inversion of the correct burden of proof. It was the breakdown in the safety culture at NASA that led to this inversion, and not anything that anyone at Thiokol did or didn't do, that was the root cause of the accident. That made some sort of catastrophic failure almost inevitable. Having lost this battle, the engineers were left the night before the launch to argue on much narrower grounds, and with an extreme paucity of data, that the launch was unsafe at the prevailing temperature even if it wasn't at a more usual temperature. (Even today it's not clear to me how big this effect was - remember that the expansion rate of the O-ring was insufficient to deal with the opening rate of the joint at any temperature.) Once again they were overruled, and the rest is history. It's possible to argue that the engineers should have brought all the data they had to bear and attempted to relitigate the safety of the entire booster design the night before the launch. (I think Tufte's case in Visual Explanations basically boils down to this.) But it's not at all clear that this would have been successful, or even permitted. You're correct that Challenger would likely have escaped but for the windshear. I'm almost certain, however, that recovery of a booster with the entire O-ring burned through for the first time would have have prompted some kind of action. Whether that would have lead to a complete redesign or just launch temperature restrictions that would have only delayed rather than prevented a catastrophic failure, we'll never know.