The design of the Shuttle design produced a system that was excessively and unnecessarily dangerous. The Space Shuttle simply was not designed for minimum risk. Unlike the hardened Apollo capsule head shield, the Shuttle crew compartment used fragile tiles, unlike the Apollo crew module, the Shuttle crew compartment was next to rather than above the dangerous rockets, and unlike Apollo, the Shuttle had no launch abort system. These design errors directly led to the Challenger and Columbia accidents. These early fundamental design errors are deemphasized in favor of blaming operational people who with luck and diligence might have beaten the high probability of a failure. These design errors are implicitly acknowledged by the fact that the current rocket and crew vehicle designs are similar to the safer design configuration of Apollo, with a hardened crew capsule, the crew capsule above the rocket and fuel, and a launch abort system.
One reason that the Space Shuttle was not designed for minimum risk is that probabilistic risk analysis was not used in its initial design. The probability of failure was not computed for the alternate designs and not compared to traditional expendable rockets. Although risk analysis had helped improve Apollo safety, it was abandoned as too negative during later Apollo development and was thought too pessimistic after the success of Apollo. A high probability of failure was built into the Shuttle design, but this was not generally realized until after Challenger.