In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

The ACJ was built around the principle that systems should be designed so thatthere was an inverse relationship between the severity of the consequences of afailure condition and the condition’s probability of occurrence. This concept wasdescribed in terms of a series of consequence (or ‘effect’) levels and probabilitylevels.The four consequence levels were catastrophic, hazardous, major and minor. Theywere defined using a range of criteria, as presented in Table 21. The probabilitylevels were probable, improbable (divided into remote and extremely remote), andextremely improbable. In addition to verbal descriptions, the ACJ providednumerical indicators of each probability level (Table 22).Consistent with JAR 25.1309(b), the ACJ stated that failure conditions associatedwith a catastrophic effect should be ‘extremely improbable’, and failure conditionsassociated with a hazardous effect should be no more likely than ‘extremelyremote’.The ACJ advised that the methods of demonstrating compliance with JAR25.1309(d) would depend on the complexity of the system. In addition, it noted thatthe assessment of the system should consider a range of factors, including thepossible failure modes that could lead to the failure condition, operation of relatedsystems, operating conditions, phase of flight, capability of detecting failures andmaintenance procedures. The ACJ also stated that assessments could take accountof previous experience using similar systems.Table 21: Effect levels described in ACJ No. 1 to JAR 25.1309Effect levelDefinitionCatastrophic • loss of the aeroplane and/or fatalitiesHazardous • a large reduction of safety margins;• physical distress or workload such that the flight crew cannot berelied upon to perform their activities accurately or completely; or• serious injury to, or death of, a relatively small proportion of theoccupantsMajor • significant reduction in safety margins;• reduction in the ability of the flight crew to cope with adverseoperating conditions as a result of the increase in workload or as aresult of conditions impairing their efficiency; or• injury to occupantsMinor • airworthiness is not significantly affected and any actions are wellwithin the capability of the crew, such aso slight reduction of safety marginso slight increase in workloado physical effects but no injury to occupants- 85 -