In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

Table 22: Probability levels described in ACJ No. 1 to JAR 25.1309ProbabilitylevelQualitative definition Quantitative description 92Probable 93Remote(category ofimprobable)Extremelyremote(category ofimprobable)Extremelyimprobablemay occur once or several times during thetotal operational life of each aeroplane ofthe same typeunlikely to each aeroplane during its totaloperational life but which may occurseveral times when considering the totaloperational life of a number of aeroplanesof the same typeunlikely to occur when considering thetotal operational life of all aeroplanes ofthe same type, but nevertheless, has tobe considered as being possibleso extremely remote that it does not haveto be considered as possible to occur> 10 -5 per flight hour10 -5 to 10 -7 per flight hour10 -7 to 10 -9 per flight hour< 10 -9 per flight hour2.3.4 United States Advisory Circular 25.1309-1AThe FAA released Advisory Circular 25.1309-1A (System design and analysis) inJune 1988. When it was released, it provided more detailed guidance than the ACJregarding the methods that could be used to satisfy the requirements ofFAR 25.1309. The background section of the document noted that there had been‘an increase in the degree of system complexity and integration, and in the numberof safety critical functions performed by systems’ in the years prior to the AC’srelease. It also stated that due to difficulties in assessing hazards for such systems,more structured approaches were being used for such assessments, which thereforerequired more detailed guidance.Some key features of the AC included the following:• It provided the same guidance as the European ACJ on the concept of an inverserelationship between the severity of the effects of a failure condition and theprobability of its occurrence, and this concept was illustrated with the diagramshown in Figure 33. However, the AC used the term ‘major’ to refer to both the‘hazardous’ and ‘major’ effect levels described in the ACJ, and it occasionallyused the term ‘severe major’ to refer to more serious conditions within thismajor level.• It used the term ‘fail-safe design’, which meant that no single failure shouldresult in a catastrophic failure condition. Although the European ACJ current atthe time did not include this term, the FAA and the European Aviation SafetyAgency (EASA) 94 advised that it was a commonly held principle in both theFAA and the European certifying authorities at the time. 9592939495For example, a value of 10 -3 per flight hour equated to once every 1,000 flight hours, and a valueof 10 -7 per flight hour equated to once per 10,000,000 flight hours.The range for ‘probable’ was also split into two, with ‘frequent’ described as more than 10 -3 perflight hour and ‘reasonably probable’ described as 10 -3 to 10 -5 per flight hour.EASA took over the role of aircraft certification in Europe in 2003.The fail-safe design principle was explicitly stated in later versions of the European ACJ.- 86 -