The probability of one in ten-to-the-minus-nine per operating hour is the requirement for single-component catastrophic failure, not the likelihood of catastrophic failure of the airplane. That would be one in ten-to-the-minus-seven.
According to engineers-urban-legend, this all comes from thinking that you want the airplane to have an overall probability of less than one in ten-to-the-minus-seven of single-component catastrophic failure from any source (subsystem) and as a rule of thumb an airplane has about 100 subsystems, so you get one in ...minus-nine for each subsystem. Now, this is *old* thinking, but it comes from Systematic Safety, by Lloyd and Tye, CAA Publications, 1982. (The CAA is the airworthiness authority for the United Kingdom, and Lloyd and Tye were at that point two of its most experienced certification authorities.)
The one-in---minus-seven was intended to be "not expected within the fleet life" of the airplane model. Things have changed there in the last few decades, too!
John Downer has written a thesis in the Science and Technology Studies department of Cornell University, under Trevor Pinch, about the one-in-ten-to-the-minus-nine requirements. He was turning it into a book, and I have a copy of the manuscript; I don't know whether he is distributing it. I suggested the topic to Trevor some years ago, and was glad to see someone take it up.
PBL
Last edited by PBL; 8th Aug 2007 at 21:32.