Tuc,
I see your point re ALARP - but this would perhaps depend on the "risk categorisation table" being used at the time on the project - & hence their defined categories of risk and when action had to be taken. Some guidance suggests that "broadly acceptable" risks don't necessarily have to be shown to be ALARP, though I think this can always be debated.
It is possible in this scenario that this risk being categorised as "improbable", could have been placed in a "broadly acceptable" area and hence no ALARP action was deemed necessary. From the comment:
It should have been graded higher and warranted further action, he admitted.
it sounds like something along these lines happened. Perhaps they also failed to categorise the impact correctly as "catastrophic" at the time too, only as e.g. "critical", compounding the issue. I don't think either of us have access to the tables being used at the time so not possible to comment further - it would be interesting to know what these were though.
Chug - I try (but perhaps fail) to keep my contributions related to the engineering processes surrounding design, airworthiness & safety management of complex systems - and understanding how & why these have failed with respect to the loss of 230. These processes are basically the same for civilian and military projects and driven by (safety) engineering best practice. I note that the safety targets themselves and the implementation of specific regulatory processes maybe different between the domains, but this does not detract from the fact that the basic engineering principles are the same when it comes down to e.g. hazard analysis & risk assessment. I don't seek to single out Boscombe themselves - just their (potential) key role as the "independant reviewer" (or whoever else undertook this role if it wasn't Boscombe) - this role is key in both civil and military safety engineering best practice and along with many other factors needs to be looked at in the review.