Inversion
The NASA Conundrum: What could possibly go wrong?
Flip the problem around. Instead of asking how the launch succeeds, work out how you would make it fail, and then make it impossible to fail.
The Method
The mightiest thing humans build
A rocket at launch is one of the most powerful machines humans have ever built, yet on a freezing morning in 1986 it was beaten by something you could hold in one hand: a rubber ring that turned too stiff in the cold.
That is exactly why we use spaceflight to learn one of the most powerful thinking methods in the world: Inversion.
Inversion: flip the question
Instead of asking How do we make this launch succeed?, you ask the opposite: How would I make this launch fail? First you hunt down every path to disaster. Then you close them one by one. When you have blocked every way to fail, success is what is left.
Charlie Munger, one of the most celebrated investors of the 20th century, put it this way: "Invert, always invert. Tell me where I'm going to die, so I never go there."
Not here for the rockets? If you only want the thinking method, Flip the Question teaches inversion in three minutes, no spaceflight. For younger children, the same idea comes as a playful game in Save the Party.
One team, one clear mission
Orion-7 Crewed Launch · Step 1/5 · Your team
- 1List the failures
- 2Make them impossible
- 3Your decision
- 4Hold your rules
Pick the team you'll own. You handle only this team's failures, nobody else's. Then think it through: how could your team's systems fail? Name the dangers you can see.
Now your turn
No rockets needed. Pick the situation closest to your life and run the same move: think like a villain, find every way it can fail, then write a rule for each one. There is already a worked example inside the machine to show you the format.
Mission brief
Your mission: guarantee a terrible Sunday evening. You have 48 hours and you are very good at this. What is the plan? List every move — the boring, invisible ones are the most effective.
1. What are you aiming at? Name your plan.
2. Failure storm: how could it fail? Collect the dangers.
Stuck? Click an idea to add it
No dangers yet. Think like a villain.
Mission brief
Two ways to a better grade: do more good work, or stop throwing away points you already earned. Be the villain of your own test — how do you guarantee you score worse than you actually could? The boring execution mistakes are worth the most.
1. What are you aiming at? Name your plan.
2. Failure storm: how could it fail? Collect the dangers.
Stuck? Click an idea to add it
No dangers yet. Think like a villain.
Mission brief
Your mission: make this hangout with friends painfully awkward — or have it quietly fizzle into nothing. What is the plan? List every move.
1. What are you aiming at? Name your plan.
2. Failure storm: how could it fail? Collect the dangers.
Stuck? Click an idea to add it
No dangers yet. Think like a villain.
✓ Mission complete
The true stories behind this mission
What really happened
Two shuttles. Two disasters. Seventeen years apart. The same mistake both times. Open each story and see what the data showed, who was in the room, and what one question could have changed everything.
Disaster 1: Challenger (1986) — the rubber ring that could not handle the coldtap to expand ↓
It is the coldest launch morning in NASA history. Seven people climb aboard. Icicles hang from the launch pad. The rocket lifts off. Seventy-three seconds later, it is gone.
28°F / -2°C
Temperature that morning
53°F
Lowest safe temperature for the rubber rings
73 sec
Before it broke apart
What happened, in plain terms
Inside the side rockets, rubber rings were supposed to seal the joints and stop hot gas from leaking out. Cold makes rubber stiff. Stiff rubber does not seal properly.
The engineers who built the rockets knew this. They had seen the rings show small damage on cold flights before. The night before the launch, they called NASA and said clearly: do not launch below 53°F. The temperature that morning was 28°F — a 25-degree gap that mattered enormously.
NASA managers pushed back. One told the engineers to "put on their management hat." The engineers withdrew their warning. The launch went ahead.
Seventy-three seconds after liftoff, a rubber ring in the right side rocket failed. Hot gas burned through the joint, the booster cracked, and the fuel tank exploded. Challenger was gone.
What they said
"We have launched in the cold before and it was fine."
True. But the rubber rings had been slightly damaged on those cold flights too. Surviving once is not proof it is safe. It is just luck that ran out.
Every dot is one launch. Green = no damage, orange = O-ring distress, dark red = Challenger. Below 65°F, damage was almost always present. Above it, almost never. The coldest flight before Challenger was 53°F — with severe damage. Challenger launched at 31°F.
Inversion asks instead
"How does cold weather make the rubber ring fail, and at what temperature?"
The engineers had this answer. Below 53°F, the rubber goes too stiff to seal. It was 28°F that morning. The data existed. Nobody asked the question at the decision table.
Every dot is one launch. Green = no damage, orange = O-ring distress, dark red = Challenger. Below 65°F, damage was almost always present. Above it, almost never. The coldest flight before Challenger was 53°F — with severe damage. Challenger launched at 31°F.
If you wanted failure to be more likely: launch in cold weather. Every serious O-ring incident happened below 65°F.
If you wanted the rubber ring specifically to fail: drop below 53°F. That morning it was 28°F.
The rule that would have stopped it
Never launch when the temperature is below the tested safe range for the rubber rings. This rule was already in the data. It was just never written as a hard stop that nobody was allowed to cross.
What really happened
Disaster 2: Columbia (2003) — the briefcase of foamtap to expand ↓
Columbia is sixteen days into a smooth mission. The crew is running experiments and getting ready to come home. They do not know about the hole in the wing.
81 sec
After launch, when the foam broke off
~770 g
Weight of the foam chunk (size of a briefcase)
16 days
The crew was in orbit after the strike
3,000°F
Outside temperature flying back through the atmosphere
What happened, in plain terms
Eighty-one seconds after launch, a chunk of foam insulation broke off the big fuel tank and hit the front edge of the left wing. It was moving fast enough to punch a hole in the tiles that protect the wing from the extreme heat of flying back through the atmosphere.
The strike was caught on video. Engineers at the company that built the wing ran computer models and found the hole could be big enough to destroy the wing on re-entry. They asked NASA to photograph the shuttle from a satellite. NASA managers said no: they called the foam strike a "turnaround issue" — meaning something to fix after landing, not a safety concern right now.
The crew was not told.
Sixteen days later, Columbia flew back through the atmosphere. Outside the shuttle, temperatures hit 3,000°F (hot enough to melt steel). The protective tiles normally keep the inside at a comfortable temperature. But hot gas found the hole, entered the wing, melted the structure from the inside, and Columbia broke apart. All seven crew members were killed.
What they said
"Foam strikes happen all the time. We have seen them before and the shuttle survived."
True. But the wing had been slightly damaged each time. And this was the largest strike ever recorded. Surviving the previous ones was not proof this one was fine.
Inversion asks instead
"If foam hits the heat protection, can the wing survive flying back through the atmosphere? What if it cannot?"
Boeing engineers asked exactly this. Their models showed the damage could be fatal. Their request to photograph the wing from space was denied.
The rule that would have stopped it
Any debris that hits the heat protection tiles during launch is a safety emergency. Take satellite photos. Inspect before flying home. No exceptions. This rule did not exist. After Columbia, NASA wrote it. They now photograph every mission from the space station before allowing re-entry.
Both stories are the same story. Engineers knew about the danger. The data was there. The warnings were made. But at the moment of decision, nobody asked the inversion question out loud: how could this kill us? And the rules that could have stopped both disasters were never written as hard stops that nobody was allowed to cross.
The rules you wrote in the game are real. What is the hard part: holding them when something appears that makes breaking them seem reasonable.