|
All of us mourn the loss of
the Columbia crew - so close to touchdown, yet
an eternity away from landing. No one thought
there was any real danger to the shuttle. No human
lives had ever been lost on re-entry before. This
time wouldn't be any different - or so we thought.
Now that the cause of the accident is being investigated, theories abound as to what may have been less-than-optimal decisions that eventually contributed to
this catastrophe and the loss of seven lives. One such theory surrounds the original choice of a heat protection method to protect the shuttle upon re-entry into the earth's
atmosphere at Mach 20. The options originally considered were ceramic tiles, a thermal blanket, and titanium, as reported on television. It was said that tiles were chosen
because they were the least costly.
One of the major drawbacks considered in the use of tiles was that any damage to the tiles incurred during or after takeoff could not be repaired in space
before re-entry. Presumably, the other two options, although more expensive, would have been less susceptible to non-repairable damage, and less vulnerable to cascading into a
catastrophic failure.
In hindsight, perhaps one of the other choices would have provided a better, safer environment. As system safety engineers and practitioners, we know that the
probability of a catastrophe occurring should not outweigh the end consequences. Even if the probability of the event happening were 1 in 10-12, the high consequence of such a
failure - the failure of the heat protection system, for example, and then the failure of the shuttle and the loss of all lives on board - should not be allowed to happen. The
design must be weighed again the consequences. In retrospect, the fault tree examining and evaluating the thermal protection design should have had the following branches:
These three design options should have been carefully evaluated to determine all the ramifications
of one design choice over the other for performance, producibility, repairability and safety. One additional criterion should be included:
Consequences - and not just the probability of an occurrence - must be factored into every system
safety and design decision. "Highly improbable" should not be the reason to certify safety. The
final consequences must be weighed before a design is considered safe. 
|
