Airliners designed to carry multiple airfare paying passengers are regulated by CFR 14 Part 25, and by EASA CS-25. The design regulations are such that the probability of a catastrophic failure with multiple deaths is extremely remote or extremely improbable.
How is that defined? Can it be quantified at all?
Extremely improbable is defined as 10$^{-9}$ per flight hour, or one in a billion flight hours. For instance, from EASA CS-25 Detail Design Requirements 4.3:
The actuation system minimum requirements should also be continuously met after any combination of failures not shown to be extremely improbable (occurrence less than 10$^{-9}$ per flight hour).
For aircraft systems and structures, that means we need to consider the following:
Flight control systems are flight critical: without it functioning, we may assume that a catastrophe will occur. NASA-TM-72860 depicts the accumulated failure analysis factors for flight control systems like this:
If we take the cruise autopilot as an example:
The reliability demand is for system functionality, including sensors, processors, electronics, power supply etc. One way to meet functionality demand is to duplicate the system, so that if one system fails, one or more remaining systems will still carry out the function. Not really necessary for the cruise autopilot 10$^{-3}$ demand, but for instance the auto land system must be 1000 times more reliable: it is only functional during landing, but the probability of function loss causing a catastrophe during landing can be quite high due to proximity of the ground and very short reaction times.
That is why the CAT III auto land systems are up to triple redundant - the complete system is duplicated three times - if we only need one functional system and we have three, the functionality failure rate is $f(sys)^3$ Each individual system can then have a failure rate of 10$^{-2}$ per flight hour.
To put these numbers into perspective: the average B777 now flies 12 hours per day, that is 4,380 hours per year. It would have to fly for 228,000 years in order to experience a catastrophic failure with a chance of 1 per 10$^{-9}$ flying hours.
EDIT
Some very good questions from the comments. I'm answering them here, since all comments may be removed once the tally is 20 or more.
@Michael But how are those probabilities determined? Verification through testing gets harder with increasing safety: in order to get any statistical relevance, one would have to subject a safety critical system to 10 billion operational hours and track if there are indeed 10 functional failures. Operational records of all aircraft throughout history provide a frame of reference. Most design changes in aircraft are incremental for this reason, build up operational history of the aircraft first. Design parameter restrictions for military aircraft are much lower, and that is where most revolutionary design changes come from.
@James S:It appears all of these p(Catastrophes) are in isolation. Is there any attempt to calculate chance of catastrophe when there are multiple failures, or chance of failure when one item has already failed?
Yes:
All of these failure modes may not result in more than 10$^{-9}$ per flight hour. For instance the Gust Load Alleviation: it is only required during an actual gust, but the status of the system since the last test or operation is unknown. Therefore the system reliability used in these failure calculations will have to include all possible failures since the last time the equipment was tested.
@Michael Kjörling Wikipedia claims that 1,526 Boeing 777 aircraft (all models) have been delivered. ... There have been six hull losses, minus one due to criminal act, or one non-criminal hull loss per about 31 million (about 10^7.5) flight hours. The estimates seem to be off by at least one order of magnitude. A hull loss without multiple deaths is not defined as a catastrophe. The design parameters only account for systems functionality and structural integrity, not acts of war. ...error conditions arising from system failures which did not result in a hull loss. are not defined as catastrophic, if a procedural change can fix the situation then the reliability requirements are less strict. The 10$^{-9}$ is a lower limit design parameter: for the B-777 case, divide the actual catastrophes as defined by authorities by the actual flying hours of the fleet, and it becomes apparent how excellent the safety numbers are. But they only start to gain statistical accuracy now, up to 5 - 10 billion flying hours accidents could all be flukes.
Then again: multiple similar catastrophic failures of a new fleet within a short time period may not be coincidental.
