Background and statutory obligation

A major objective of the regulation (expressed in paragraph 25.1309 of the [FAR/CS 25]) is that a catastrophic event must be extremely improbable . A first level of interpretation is given by that same regulation a catastrophic event is a Failure Condition which would result in multiple fatalities, usually with the loss of the airplane . This is partly explained for example, if the available roll rate is higher than 3 /second, then the situation is not catastrophic if the aircraft is below the threshold, the criticality is evaluated by pilots and accepted, or not, by official services. 

An interpretation of extreme improbabihty is also given. First, by a magic number 10 . This is a probability of failttre averaged per hom of flight. 

This quantitative approach is entirely valid for designing the architecture of a system, a level of redundancy and monitoring. Such reasoning is based on the multiplication of elementary probabihties, and thus on an assumption of independence between components. This independence must be verified, mainly by a qualitative judgment. Also, a safeguard is associated with this probability calculation a simple failure (one), regardless of the probabihty of its occurrence, must not lead to catastrophic consequences. 

This whole process of safety analysis is regulated by the ARP 4761. Identification of safety objectives is given by a fimctional approach, documented in a functional hazard analysis demonstrating compliance with these objectives is achieved by identifying the combinations of failiues, and this is documented in the System Safety Assessment (SSA). 

A set of common causes of failures , i.e. specific risks , also need to be covered. These are events, such as a localized fire or explosion of a turbine, to which it is difficult to assign a probabihty. Such an event could be a single event capable of affecting several components, thus putting into question the independence assumption made by the SSA, when failures are combined. All these risks are extensively analyzed and tested. In addition, the final aircraft is inspected by experts to ensure that the installation rules have been foUowed, to verify whether the rules of separation between components expressed by the designers are well respected, and to identify whether any additional risks are likely to occur. All this is largely governed by the ARP 4761. 

---