Lyman...no worries. I have seen this quote around, in this form, but it is really not the intent of the safety case analysis. It changes the flavor significantly from 1/Billion per fight hour to 1 Billion flight hours.
It is the sum of all of the parts, so while you may have a known battery failure every thousand flight hours, it is the sum of all of the components failure modes, happening at the same time, that must be 1/Billion probability.
OT alert...
I had to provide this type of analysis for RNP procedure criteria. as an example, you have a high probability of losing a single sat, then lower probabilities of losing more to where the GPS signal is degraded enough to be useless for nav, all that combined with on-board combination of system failures...adding up to an off-track probability per RNP level.
edit:
BUT. Does it not mean that a fire aboard must not happen in the life of the fleet, roughly?
not exactly. there is the potential for fire on an ac, such as with the engines...and the Li battery fires from devices has been addressed on ac.
While the potential for the LI fires was somewhat addressed by the FAA, it doesnt appear, from the design on-board, that it was considered an issue, and mitigated by other means such as the BMS controls, in the statistical models...
So I guess the answer, and the avenue Boeing appears to be following, it that yes, with this system, we have to add the probability of a fire with the battery system, and mitigate that potential. They must also re-evaluate the entire system, and how it allowed this to happen.
As we have noted, there is all of the bench testing, but there will be the testing with the 2 aircraft. Very, very complex issue. Personally, I dont feel that they will be able to mitigate the issues that caused the batteries into failure mode in a reasonable amount of time. Testing the battery containment box, on a production aircraft??
