>>requiring multiple redundancy, this was the only way that the safety of the crew could be assured without designing the orbiter with a detachable crew compartment.<br /><br />Redundancy is not equivalent to reliability. Obviously there are situations where redundancy makes sense, i.e. if the redundant systems are completely independent with no common failure modes and any one of them can do the job; an example is the spelunker who carries three flashlights. But in an aerospace system the redundant systems are usually closely linked, creating additional and often unanticipated failure modes, and always adding weight, volume, and cost, increasing the parts count and the probability that at least one component will fail.<br /><br />NASA insists there be "no single point of failure", that the system be "fail operational, fail safe". In my humble opinion, this approach is simplistic and stems from the perspective of the manager looking at a block diagram of the system, not the tech who gets his hands dirty with the hardware or the engineers who design the actual chips and valves. Suppose there is a common failure mode? Suppose the failure is in the voting system or some other element that is "single path"? Suppose multiple components fail? In a real aerospace system, it is usually cheaper in the long run to increase the reliability of the components, and once a failure mode is known it can usually be designed out. In reality the Shuttle has a lot of potential single point failures; the TPS comes to mind. But we overlook them because they don't fit the "fail operational"philosophy.<br /><br />Of course design changes are slow and expensive in "man-rated" vehicles. But this slow and expensive modification process actually makes the vehicle LESS safe by delaying improvements, Challenger comes to mind; a new SRB joint was "in the pipeline" when the seven astronauts died. What good did all the man-rating paperwork do for the Challenger 7?<br /><br />The root cause is the m