Thanks for that explanation Shawn, but my point is that its only the Failures that the designers have thought of that are considered for the FEMA - and if they have already thought of them, the chances are they have designed in redundancy or whatever to cater for the problem.
But its the failures they haven't thought of that cause the problems, and no matter how conscientious the designers are, surely its inevitable in something as complicated as a FAR29 helicopter that there are failure modes they haven't thought of?
In the case of the first S92 oil system problem that nearly caused a ditching in the Norwegian N Sea, the problem was that when one of the oil pumps stopped being driven, it became a turbine and allowed the oil pressure from the good pump to escape back through the failed pump because there were no check valves. The comment from the designers was "we didn't consider this failure mode".
With such a basic oversight as that, its difficult to have confidence in either the designers or the certifying authority!
Your post makes the point that a lot of work is done, but is there any point in that if it can be so flawed?
I have forgotten what "extremely remote" actually means (212 has probably told me before but I am getting old...) but isn't it 1 in 10^8 or thereabouts? How can what is effectively guesswork confirm that such a high reliability will actually be met?
HC