Originally Posted by blind pew
Somewhere in the incident report the investigators mentioned the demonstrated certification criteria which BA ignored.
There were indeed several references to certification criteria in the report:
In order to meet certification requirements for multi-engined public transport aircraft, the loss of an engine at the most adverse point is a design case that is catered for by redundancy. The B747 has an appreciable level of systems redundancy and no evidence was found to suggest that the aircraft systems would be affected by the loss of an engine.
Detailed information on the possible adverse consequences of a long period of flight with a damaged engine that had been shutdown was sought during the investigation. The engine manufacturer noted that engine certification regulations generally did not require a prolonged windmilling to be demonstrated and this was the case for the RB211 -524. However, the qualification testing for the type had included 3 hours of engine windmilling operation, related to the 180 minutes Extended Twin Operations (ETOPS) clearance, with no bearing damage expected. In accordance with this, the manufacturer’s Maintenance Manual permits an engine to be ferried, whilst windmilling, with no restriction except with relation to FAFC low temperature limits.
As a 4-engined aircraft the B747 is designed and certificated to tolerate the loss of a second engine following an initial IFSD, without losing essential systems or necessary performance capabilities. The likely effects on systems would include the need to shed non-essential electrical loads, such as galleys, and to limit bleed air supplies in order to maintain adequate performance from the operating engines. There would also be a loss of the auto-land capability with two engines inoperative on one side of the aircraft. Aircraft performance implications would include a substantial further loss of altitude capability, but it is intended that route planning after the first IFSD would cater for this eventuality. The probability of the loss of a third engine, during the diversion that would subsequently follow the second engine loss, is considered below.
Modern public-transport aircraft design has included target maximum rates for engine failure and IFSD in order to achieve an acceptably low risk of a potentially catastrophic loss of aircraft propulsion. For design and certification a risk level of “Extremely Improbable”, or 1 x 10-9 per flight hour, is generally used.
Systems operation should not be affected significantly following an IFSD; the level of redundancy would be reduced but the aircraft was designed and certificated to tolerate the loss of a second engine without losing essential systems. Previous experiences of the effects of engine surge suggest that it was likely that damage would be confined to the affected engine. Furthermore, the manufacturers did not foresee any problems with the extended windmilling of a damaged engine and previous cases had not resulted in significant additional damage.
Which one(s) are you saying was/were ignored ?