Light
Dark
System
Log In
Loading...
Compare / EASA/
Incorporated Amendments
/
Compare & Highlight Differences
Appendix 4 - Allowable Probabilities
Available versions for ERULES-1963177438-18330
ED Decision 2020/001/R
found in: CS-25 Amdt 27 - Large Aeroplanes (Jan 2023)
Version
CS-25 Amdt 27 - La... (Jan 2023)
Section
Share
Version
Show details
Hide details
Version
Appendix 4 – Allowable Probabilities ED Decision 2020/001/R The following probabilities may be used for environmental conditions and operational factors (not caused by aeroplane failures) in quantitative safety analyses: *Environmental Factors* <table border="1" cellpadding="0" cellspacing="0" width="606"><tr><td valign="top" width="263"><p><b>Condition </b></p></td><td valign="top" width="173"><p><b>Model or other Justification </b></p></td><td valign="top" width="170"><p><b>Probability </b></p></td></tr><tr><td valign="top" width="263"><p>CS-25 Appendix C icing conditions</p></td><td valign="top" width="170"><p>1 </p></td></tr><tr><td valign="top" width="263"><p>CS-25 Appendix O icing conditions</p></td><td valign="top" width="173"></td><td valign="top" width="170"><p>10<sup>-2</sup> per flight hour</p></td></tr><tr><td valign="top" width="263"><p>Icing conditions beyond certified conditions (considered as ‘Severe icing’)</p></td><td valign="top" width="170"><p>No accepted standard data</p></td></tr><tr><td valign="top" width="263"><p>Head wind >25 kt during takeoff and landing </p></td><td valign="top" width="173"><p>AC 120-28 </p><p>CS-AWO </p></td><td valign="top" width="170"><p>10<sup>-2 </sup>per flight </p></td></tr><tr><td valign="top" width="263"><p>Tail wind >10 kt during takeoff and landing </p></td><td valign="top" width="173"><p>AC 120-28 </p><p>CS-AWO </p></td><td valign="top" width="170"><p>10<sup>-2</sup> per flight </p></td></tr><tr><td valign="top" width="263"><p>Cross wind >20 kt during takeoff and landing </p></td><td valign="top" width="173"><p>AC 120-28 </p><p>CS-AWO </p></td><td valign="top" width="170"><p>10<sup>-2</sup> per flight </p></td></tr><tr><td valign="top" width="263"><p>Limit design gust and turbulence </p></td><td valign="top" width="173"><p><a href="#_DxCrossRefBm1709820927">CS 25.341</a> (Under review by Structures Harmonisation </p><p>Working Group) </p></td><td valign="top" width="170"><p>10<sup>-5</sup> per flight hour </p></td></tr><tr><td valign="top" width="263"><p>Air temperature < -70<em>°</em>C </p></td><td valign="top" width="170"><p>No accepted standard data </p></td></tr></table> *Aeroplane Configurations* <table border="1" cellpadding="0" cellspacing="0" width="606"><tr><td valign="top" width="263"><p><b>Configuration </b></p></td><td valign="top" width="172"><p><b>Model or other Justification </b></p></td><td valign="top" width="170"><p><b>Probability </b></p></td></tr><tr><td valign="top" width="263"><p>Centre of gravity </p></td><td valign="top" width="172"><p>Standard industry practice </p></td><td valign="top" width="170"><p>Uniform over approved range </p></td></tr><tr><td valign="top" width="263"><p>Landing and Takeoff Weights/Masses </p></td><td valign="top" width="172"><p>Standard industry practice </p></td><td valign="top" width="170"><p>Uniform over approved range </p></td></tr></table> *Flight Conditions* <table border="1" cellpadding="0" cellspacing="0" width="606"><tr><td valign="top" width="264"><p><b>Condition </b></p></td><td valign="top" width="172"><p><b>Model or other Justification </b></p></td><td valign="top" width="170"><p><b>Probability </b></p></td></tr><tr><td valign="top" width="264"><p>Flight condition requiring Stall Warning </p></td><td valign="top" width="172"><p>Assumption </p></td><td valign="top" width="170"><p>10<sup>-2</sup> per flight </p></td></tr><tr><td valign="top" width="264"><p>Flight condition resulting in a Stall </p></td><td valign="top" width="172"><p>Assumption </p></td><td valign="top" width="170"><p>10<sup>-5</sup> per flight </p></td></tr><tr><td valign="top" width="264"><p>Excessiveness of V<sub>MO</sub>/M<sub>MO </sub></p></td><td valign="top" width="172"><p>Assumption </p></td><td valign="top" width="170"><p>10<sup>-2</sup> per flight </p></td></tr><tr><td valign="top" width="264"><p>Flight condition greater than or equal to 1.5 g </p></td><td valign="top" width="170"><p>No accepted standard data </p></td></tr><tr><td valign="top" width="264"><p>Flight condition less than or equal to 0 g </p></td><td valign="top" width="170"><p>No accepted standard data </p></td></tr></table> *Mission Dependencies* <table border="1" cellpadding="0" cellspacing="0" width="605"><tr><td valign="top" width="262"><p><b>Event </b></p></td><td valign="top" width="172"><p><b>Model or other Justification </b></p></td><td valign="top" width="170"><p><b>Probability </b></p></td></tr><tr><td valign="top" width="262"><p>Any rejected take-off </p></td><td valign="top" width="170"><p>No accepted standard data </p></td></tr><tr><td valign="top" width="262"><p>High energy rejected take-off </p></td><td valign="top" width="170"><p>No accepted standard data </p></td></tr><tr><td valign="top" width="262"><p>Need to jettison fuel </p></td><td valign="top" width="170"><p>No accepted standard data </p></td></tr><tr><td valign="top" width="262"><p>Go-around </p></td><td valign="top" width="170"><p>No accepted standard data </p></td></tr></table> *Other Events* <table border="1" cellpadding="0" cellspacing="0" width="605"><tr><td valign="top" width="259"><p><b>Event </b></p></td><td valign="top" width="175"><p><b>Model or other Justification </b></p></td><td valign="top" width="170"><p><b>Probability </b></p></td></tr><tr><td valign="top" width="259"><p>Fire in a lavatory not caused by aeroplane failures</p></td><td valign="top" width="170"><p>No accepted standard data </p></td></tr><tr><td valign="top" width="259"><p>Fire in a cargo compartment not caused by aeroplane failures</p></td><td valign="top" width="170"><p>No accepted standard data </p></td></tr></table> Notes: 1. If “No accepted standard data” appears in the above tables, the applicant must provide a justified value if a probability less than 1 is to be used in the analysis. 2. The probabilities quoted in this Appendix have been found to be appropriate for use in the context of a quantitative safety analysis performed to demonstrate compliance with [CS 25.1309](#_DxCrossRefBm1709820691). They may not always be appropriate for use in the context of other requirements. [Amdt 25/24] Appendix 5 – Example of limit latency and residual probability analysis ED Decision 2021/015/R The following example illustrates how the quantitative criteria of [CS 25.1309(b)(5)](#_DxCrossRefBm1709820691) are to be implemented together with [CS 25.1309(b)(1)](#_DxCrossRefBm1709820691). The methodology used is based on the identification of the minimal cut sets associated with the catastrophic top event of the generic system level fault tree provided in Figure A5-1. The term ‘minimal cut set’ refers to the smallest set of primary events whose occurrence is sufficient to cause a system failure or, in this case, the failure condition of concern. (1) The list of minimal cut sets should be produced by cut set order. This will group all dual-order cut sets or failure combinations. The entire list of minimal cut sets of the fault tree in Figure A5-1 is provided in Table A5-1. (2) The dual-order minimal cut sets that contain a primary event that is latent for more than one flight are then identified from the list in Table A5-1. (3) Then group those dual-order minimal cut sets: (3.1) that contain the same active primary event. For each group, sum the remaining latent failure probabilities. For each group, the sum of the latent primary events should be less than 1/1 000. (3.2) that contain the same latent primary event. For each group, assume that the latent primary event has failed and sum the remaining active primary event probabilities. For each group, the sum of the primary event probabilities should be less than 1 × 10-5/FH. (4) The sum of all minimal cut sets should be in the order of 1 × 10-9/FH. An alternative method to perform step (3.2) would be to rerun the fault-tree-probability calculation assuming for each model rerun that a different latent primary event has occurred and then verify that the average probability per flight hour of the top event is of the order of 1 × 10-5/FH or less. The results of the limit latency and residual probability analysis are provided in Table A5-1. <table cellpadding="0" cellspacing="0" width="100%"><tr><td><div><p>Exposure time in flight hours</p><p>If no value, the failure is detected within one flight</p></div></td></tr></table> <table cellpadding="0" cellspacing="0" width="100%"><tr><td><div><p>Primary event name</p></div></td></tr></table> <table cellpadding="0" cellspacing="0" width="100%"><tr><td><div><p>Primary event probability</p></div></td></tr></table> <table cellpadding="0" cellspacing="0" width="100%"><tr><td><div></div></td></tr></table>  Figure A5-1: Fault Tree <table border="1" cellpadding="0" cellspacing="0" width="688"><tr><td valign="top" width="26"><p><b>#</b></p></td><td valign="top" width="77"><p><b>Probability (per flight hour) </b></p></td><td valign="top" width="57"><p><b>Event name</b></p></td><td valign="top" width="85"><p><b>Event description</b></p></td><td valign="top" width="86"><p><b>Failure rate (constant, unless noted)</b></p></td><td valign="top" width="76"><p><b>Exposure time</b></p></td><td valign="top" width="76"><p><b>Event probability (per flight)</b></p></td><td valign="top" width="207"><p><b>CS 25.1309(b)(5)</b></p><p><b>Applicability/ compliance</b></p></td></tr><tr><td rowspan="2" valign="top" width="26"><p align="center"><b>1</b></p></td><td rowspan="2" valign="top" width="77"><p>3.992E-10</p></td><td valign="top" width="57"><p>A001</p></td><td valign="top" width="85"><p>ACT 1</p></td><td valign="top" width="86"><p>1.000E-07</p></td><td valign="top" width="76"><p>2.5 h</p></td><td valign="top" width="76"><p>2.500E-07</p></td><td rowspan="2" valign="top" width="207"><p>Not compliant with the limit latency criterion [L001 probability is more frequent than 1.000E-03].</p></td></tr><tr><td valign="top" width="57"><p>L001</p></td><td valign="top" width="85"><p>LAT 1</p></td><td valign="top" width="86"><p>4.000E-06</p></td><td valign="top" width="76"><p>1 000.0 h</p></td><td valign="top" width="76"><p>3.992E-03</p></td></tr><tr><td rowspan="2" valign="top" width="26"><p align="center"><b>2</b></p></td><td rowspan="2" valign="top" width="77"><p>2.000E-10</p></td><td valign="top" width="57"><p>A002</p></td><td valign="top" width="85"><p>ACT 2</p></td><td valign="top" width="86"><p>2.000E-05</p></td><td valign="top" width="76"><p>2.5 h</p></td><td valign="top" width="76"><p>5.000E-05</p></td><td rowspan="2" valign="top" width="207"><p>Not compliant with the residual probability criterion [A002 probability per flight hour (2.000E-05/FH) is more frequent than 1.000E-05/FH].</p></td></tr><tr><td valign="top" width="57"><p>L003</p></td><td valign="top" width="85"><p>LAT 3</p></td><td valign="top" width="86"><p>1.000E-06</p></td><td valign="top" width="76"><p>10.0 h</p></td><td valign="top" width="76"><p>1.000E-05</p></td></tr><tr><td rowspan="2" valign="top" width="26"><p align="center"><b>3</b></p></td><td rowspan="2" valign="top" width="77"><p>1.000E-10</p></td><td valign="top" width="57"><p>A004</p></td><td valign="top" width="85"><p>ACT 4</p></td><td valign="top" width="86"><p>1.000E-05</p></td><td valign="top" width="76"><p>2.5 h</p></td><td valign="top" width="76"><p>2.500E-05</p></td><td rowspan="2" valign="top" width="207"><p>Not compliant with the residual probability criterion [while A004 probability per flight hour is equal to 1.000E-05/FH, the combined probability per flight hour of A004 and A002 (1.000E-05/FH + 2.000E-05/FH) is more frequent than 1.000E-05/FH.</p><p><i>Note: Dual-order minimal cut sets #2 and #3 are grouped due to same event L003 appearing under G002 and G004.</i></p></td></tr><tr><td valign="top" width="57"><p>L003</p></td><td valign="top" width="85"><p>LAT 3</p></td><td valign="top" width="86"><p>1.000E-06</p></td><td valign="top" width="76"><p>10.0 h</p></td><td valign="top" width="76"><p>1.000E-05</p></td></tr><tr><td rowspan="2" valign="top" width="26"><p align="center"><b>4</b></p></td><td rowspan="2" valign="top" width="77"><p>1.000E-10</p></td><td valign="top" width="57"><p>A004</p></td><td valign="top" width="85"><p>ACT 4</p></td><td valign="top" width="86"><p>1.000E-05</p></td><td valign="top" width="76"><p>2.5 h</p></td><td valign="top" width="76"><p>2.500E-05</p></td><td rowspan="2" valign="top" width="207"><p>Compliant with both limit latency and residual probability criteria <br/> [A004 probability per flight hour is equal to 1.000E-05/FH and combined probability of L005 and L003 (1.000E-05 + 1.000E-05) is less frequent than 1.000E-03].</p></td></tr><tr><td valign="top" width="57"><p>L005</p></td><td valign="top" width="85"><p>LAT 5</p></td><td valign="top" width="86"><p>1.000E-06</p></td><td valign="top" width="76"><p>10.0 h</p></td><td valign="top" width="76"><p>1.000E-05</p></td></tr><tr><td rowspan="2" valign="top" width="26"><p align="center"><b>5</b></p></td><td rowspan="2" valign="top" width="77"><p>5.000E-11</p></td><td valign="top" width="57"><p>A002</p></td><td valign="top" width="85"><p>ACT 2</p></td><td valign="top" width="86"><p>2.000E-05</p></td><td valign="top" width="76"><p>2.5 h</p></td><td valign="top" width="76"><p>5.000E-05</p></td><td rowspan="2" valign="top" width="207"><p>This dual-order minimal cut set does not contain any basic event being latent for more than one flight. <br/> Therefore, <br/> CS 25.1309(b)(5) is not applicable to this minimal cut set.</p></td></tr><tr><td valign="top" width="57"><p>A005</p></td><td valign="top" width="85"><p>ACT 5</p></td><td valign="top" width="86"><p>1.000E-06</p></td><td valign="top" width="76"><p>2.5 h</p></td><td valign="top" width="76"><p>2.500E-06</p></td></tr><tr><td rowspan="2" valign="top" width="26"><p align="center"><b>6</b></p></td><td rowspan="2" valign="top" width="77"><p>6.500E-13</p></td><td valign="top" width="57"><p>A003</p></td><td valign="top" width="85"><p>ACT 3</p></td><td valign="top" width="86"><p>6.500E-07</p></td><td valign="top" width="76"><p>2.5 h</p></td><td valign="top" width="76"><p>1.625E-06</p></td><td rowspan="2" valign="top" width="207"><p>Compliant with both limit latency and residual probability criteria <br/> [A003 probability per flight hour (6.500E-07/FH) is less frequent than 1.000E-05/FH and L004 probability is less frequent than 1.000E-03]</p></td></tr><tr><td valign="top" width="57"><p>L004</p></td><td valign="top" width="85"><p>LAT 4</p></td><td valign="top" width="86"><p>1.000E-07</p></td><td valign="top" width="76"><p>10.0 h</p></td><td valign="top" width="76"><p>1.000E-06</p></td></tr><tr><td rowspan="3" valign="top" width="26"><p align="center"><b>7</b></p></td><td rowspan="3" valign="top" width="77"><p>3.991E-11</p></td><td valign="top" width="57"><p>A002</p></td><td valign="top" width="85"><p>ACT 2</p></td><td valign="top" width="86"><p>2.000E-05</p></td><td valign="top" width="76"><p>2.5 h</p></td><td valign="top" width="76"><p>5.000E-05</p></td><td rowspan="3" valign="top" width="207"><p>This minimal cut set is more than a dual failure combination. <br/> Therefore, <br/> CS 25.1309(b)(5) is not applicable to this minimal cut set.</p></td></tr><tr><td valign="top" width="57"><p>L001</p></td><td valign="top" width="85"><p>LAT 1</p></td><td valign="top" width="86"><p>4.000E-06</p></td><td valign="top" width="76"><p>1 000.0 h</p></td><td valign="top" width="76"><p>3.992E-03</p></td></tr><tr><td valign="top" width="57"><p>L002</p></td><td valign="top" width="85"><p>LAT 2</p></td><td valign="top" width="86"><p>5.000E-06</p></td><td valign="top" width="76"><p>100.0 h</p></td><td valign="top" width="76"><p>4.999E-04</p></td></tr><tr><td colspan="8" valign="top" width="688"><p><b>Flight time = 2.5 hours</b></p><p><b>P[LAT i] ~ FR * T</b></p></td></tr></table> Table A5-1: Minimal Cut Sets [Amdt 25/24] [Amdt 25/27]