# What are the design parameters for airliner safety?

Airliners designed to carry multiple airfare paying passengers are regulated by CFR 14 Part 25, and by EASA CS-25. The design regulations are such that the probability of a catastrophic failure with multiple deaths is extremely remote or extremely improbable.

How is that defined? Can it be quantified at all?

Extremely improbable is defined as 10$$^{-9}$$ per flight hour, or one in a billion flight hours. For instance, from EASA CS-25 Detail Design Requirements 4.3:

The actuation system minimum requirements should also be continuously met after any combination of failures not shown to be extremely improbable (occurrence less than 10$$^{-9}$$ per flight hour).

For aircraft systems and structures, that means we need to consider the following:

• What is the probability that failure of function causes a catastrophe?
• What is the exposure time to the failure condition?
• What is the failure rate of the hardware?

Flight control systems are flight critical: without it functioning, we may assume that a catastrophe will occur. NASA-TM-72860 depicts the accumulated failure analysis factors for flight control systems like this:

If we take the cruise autopilot as an example:

• When it fails, it just means that the pilot will hand-fly the aircraft, and the probability of its failure causing a catastrophe is set to one in a million flying hours. Pretty remote.
• During cruise, the autopilot is on all the time. Exposure is pretty close to 100% (= 1)
• That requires the cruise autopilot system to have a reliability of 1 failure per thousand flying hours.

The reliability demand is for system functionality, including sensors, processors, electronics, power supply etc. One way to meet functionality demand is to duplicate the system, so that if one system fails, one or more remaining systems will still carry out the function. Not really necessary for the cruise autopilot 10$$^{-3}$$ demand, but for instance the auto land system must be 1000 times more reliable: it is only functional during landing, but the probability of function loss causing a catastrophe during landing can be quite high due to proximity of the ground and very short reaction times.

That is why the CAT III auto land systems are up to triple redundant - the complete system is duplicated three times - if we only need one functional system and we have three, the functionality failure rate is $$f(sys)^3$$ Each individual system can then have a failure rate of 10$$^{-2}$$ per flight hour.

To put these numbers into perspective: the average B777 now flies 12 hours per day, that is 4,380 hours per year. It would have to fly for 228,000 years in order to experience a catastrophic failure with a chance of 1 per 10$$^{-9}$$ flying hours.

EDIT

Some very good questions from the comments. I'm answering them here, since all comments may be removed once the tally is 20 or more.

@Michael But how are those probabilities determined? Verification through testing gets harder with increasing safety: in order to get any statistical relevance, one would have to subject a safety critical system to 10 billion operational hours and track if there are indeed 10 functional failures. Operational records of all aircraft throughout history provide a frame of reference. Most design changes in aircraft are incremental for this reason, build up operational history of the aircraft first. Design parameter restrictions for military aircraft are much lower, and that is where most revolutionary design changes come from.

@James S:It appears all of these p(Catastrophes) are in isolation. Is there any attempt to calculate chance of catastrophe when there are multiple failures, or chance of failure when one item has already failed? Yes:

• Common mode failures, for instance EMD after an atomic blast that stops all electronics from functioning.
• Hidden failures from back-up systems, or systems not in use at the moment. Redundancy is always better because it is always known that the system is operating.
• Cascade failures, where one blade tears through all three hydraulic systems.

All of these failure modes may not result in more than 10$$^{-9}$$ per flight hour. For instance the Gust Load Alleviation: it is only required during an actual gust, but the status of the system since the last test or operation is unknown. Therefore the system reliability used in these failure calculations will have to include all possible failures since the last time the equipment was tested.

@Michael Kjörling Wikipedia claims that 1,526 Boeing 777 aircraft (all models) have been delivered. ... There have been six hull losses, minus one due to criminal act, or one non-criminal hull loss per about 31 million (about 10^7.5) flight hours. The estimates seem to be off by at least one order of magnitude. A hull loss without multiple deaths is not defined as a catastrophe. The design parameters only account for systems functionality and structural integrity, not acts of war. ...error conditions arising from system failures which did not result in a hull loss. are not defined as catastrophic, if a procedural change can fix the situation then the reliability requirements are less strict. The 10$$^{-9}$$ is a lower limit design parameter: for the B-777 case, divide the actual catastrophes as defined by authorities by the actual flying hours of the fleet, and it becomes apparent how excellent the safety numbers are. But they only start to gain statistical accuracy now, up to 5 - 10 billion flying hours accidents could all be flukes.

Then again: multiple similar catastrophic failures of a new fleet within a short time period may not be coincidental.

• But how are those probabilities determined? I can see that it would make sense for more or less random, statistical processes (e.g. a cosmic ray hitting and flipping a memory bit in your flight computer). But how do you determine the probability of a turbine blade fracturing and consequently smashing through all 3 redundant hydraulic systems? – Michael Dec 17 '17 at 16:28
• It appears all of these p(Catastrophes) are in isolation. Is there any attempt to calculate chance of catastrophe when there are multiple failures, or chance of failure when one item has already failed? – James S Dec 17 '17 at 17:37
• Wikipedia claims that 1,526 Boeing 777 aircraft (all models) have been delivered. That would be about 6.7 million flight hours per year. Let's play generous and say that all of those were delivered in the year of its first flight, 1994, and still fly (obviously neither being the case); that brings us to some 154 million flight hours total. There have been six hull losses, minus one due to criminal act, or one non-criminal hull loss per about 31 million (about 10^7.5) flight hours. The estimates seem to be off by at least one order of magnitude. – user Dec 17 '17 at 19:05
• @MichaelKjörling Only 1 of those hull losses that also had fatalities might have been due to a failure of the system, Malaysia Airlines Flight 17, all the others were either due to human error or had no fatalities – Mark Omo Dec 17 '17 at 19:40
• @MichaelKjörling the 10^-9 number is for mutable fatality incidents if the hull was a total loss with no injuries the design did its job – Mark Omo Dec 17 '17 at 20:31