[Maakuth]

This would be true if rockets actually never exploded. But it seems to me they actually do, and that's why it's useful to test very unfortunate scenarios as well. It's not like they design jet engines' blades to come loose and cause destruction, but they - or some aviation authority - have decided that the engines should not explode even in a case of blade separation. I find it a lot more comforting to know jet engine is tested to not explode in such situation than I would if I was told jet engines are designed perfect. Because perfection is not something engineering can achieve, only extremely small probabilities of failure.

[qntm]

I think the difference there is that when a 747 engine explodes, there are three other engines and the plane may well still be landable. When a Space Shuttle engine explodes, everybody is almost certainly dead and the Shuttle crashes.

I'm saying that pragmatically, unrecoverable errors don't need testing, and NASA's class of possible unrecoverable errors is much wider than any airline's. The fact that SpaceX feels the need to test so rigorously is a good sign about what they want to be "recoverable" and therefore about how safe their hardware is intended to be.

[mikeash]

A lot more rocket failures are recoverable than you might think, though.

Engines can fail in many ways that don't destroy everything. Apollo 13 nearly became famous for exploding on launch due to massive resonant vibration, but a premature shutdown of the affected engine saved it. (Oddly, that shutdown was due to a mistaken fuel level reading, not the vibrations directly, so the save was something of an accident.) At least one Shuttle launch experienced an engine failure/shutdown as well. These engines didn't explode, of course, but there's a whole range of failures and many can be planned for.

Even when the entire thing does explode, you can still save your crew if you've planned properly. A Soyuz capsule's escape system saved its crew when the rocket exploded in 1983.

It appears to me that NASA's approach is to prefer systems which can't fail over systems which can fail safely. On the surface, this seems better, but when your foolproof system still fails and you haven't built it to withstand that, then you're in serious trouble.

I don't think there's any inherent reason why shedding a turbine blade during a rocket launch has to destroy the entire vehicle. Designing the system to withstand that makes it heavier and not perform as well, of course, but it seems like an overemphasis on performance while disregarding nearly everything else has really hurt space technology.

[kens]

A few random comments:

There's a video of the Soyuz explosion mentioned above at http://www.youtube.com/watch?v=UyFF4cpMVag&noredirect=1 that shows the escape system saving the crew.

The use of solid rocket boosters for human space flight (as was planned for Ares I) is hugely controversial because they can't just be shut down in the event of a problem, as regular engines can, making survivability more difficult.

Personally, I think NASA is overly risk-adverse, to the point that nothing gets accomplished (see Constellation / Ares I). An interesting article on this is http://www.popularmechanics.com/science/space/news/4330356

On the topic of aircraft turbine failures, there's the interesting case of a DC-10 engine that disintegrated in flight due to a pilot experiment, killing a passenger. For details see: http://en.wikipedia.org/wiki/National_Airlines_Flight_27

Finally, if you're interested in SpaceX, NASA budgeting, and so forth, I recommend http://nasawatch.com

[nobody31415926]

Actually I think Nasa's approach is to design as best they can - then have layers of management each add a a factor of 10 to the assumed level of safety until it's sufficiently safe.

In the Challenger accident the engineers estimated the chance of a fatal accident at 1:100 , the next level of management 1:1000 senior management at 1:10,000 and the official Nasa press release 1:300,000

Presumably by adding more levels of management they could have made it even safer!

[nobody31415926]

Perhaps if they designed it so that when a single joint on a single booster failed it didn't explode they might have had a better image