Originally Posted by Distant Voice
In the latest news statement on Rivet Joint MoD's Chief of Materiel (Air), Air Marshal Simon Bollom states "We have procured an aircraft with a proven track record". Now let us see what H-C stated after reviewing the Nimrod safety case;
Reliance on past data cannot be considered a substitute for critical hazard analysis as to the risk of a catastrophic event in the future. In simple terms, whilst an incident database may tell you what has happened in the past, it does not tell you what might, or could, happen in the future. It should be remembered that the day before Piper Alpha disaster itself in 1988, and the Challenger in 1986, the platforms involved were 'safe' based on an analysis of past incidents alone. [And Nimrod XV230 was considered 'safe' on the morning of 2nd Sept 2006 --- My addition]
You have to prove a platform is safe by producing a valid safety case. This means developing a properly structured Hazard Log, which looks at what could happen.
Boy, did H-C screw up that comparison!
Challenger blew up because engineers, giving a warning based on a known defect for the specific conditions of that specific launch, were ignored in that case.
In other weather/temperature conditions the launch would have been safe.
Any time you ignore a clear engineering limit and an accident occurs, saying the air/spacecraft is unsafe,
rather than saying it was operated in an incorrect and unsafe manner, is a bullshiite cop-out.
The US Space Shuttle program HAD identified what would be the cause of the Challenger disaster -
well over a year in advance!
The manufacturer of the boosters (Morton-Thiokol) had identified the gasket leak from a couple of previous launches, the cause (ice forming in the joint forcing the sections of the booster casing apart, allowing hot gasses to escape out the side of the booster), and that it could cause a catastrophic event.
Specific guidance had been provided to NASA about weather conditions in the 12 hours preceeding a launch, and on the morning of the Challenger launch the booster engineers at M-T, when polled as part of the standard pre-flight process, unanimously declared "unsafe to fly due to the overnight freezing rain and ice remaining on the launch vehicle".
However, since the procedures (later corrected) allowed for a "consensus go" report, rather than a "unanimous go", the NASA engineering head reported "the engineers say go" because the majority of all engineers for all systems thought it was safe as soon as the air temperature rose above a certain level.
The failure that caused the explosion would not have occurred if the launch had been postponed for 6 hours or so - to allow the casing of the booster to heat above that level, as that would have melted the ice, and the booster sections would have properly reseated.
It was operator error, not an unsafe vehicle, that caused the Challenger explosion.