Mishap likelihood

The mishap likelihood factor is the probability of the hazard components occurring and transforming into the mishap. The mishap severity factor is the overall consequence of the mishap, usually in terms of loss resulting from the mishap (i.e., the undesired outcome). Both probability and severity can be defined and assessed in either qualitative terms or quantitative terms. Time is factored into the risk concept through the probability calculation of a fault event, for example, Pfailure = 1.0 - e where T = exposure time and X = failure rate. 

In a risk assessment, hazard likelihood can be characterized in terms of probability, frequency, or qualitative criteria. Quite often, the term hazard probability is incorrectly used when the actual assessment is done in terms of frequency or qualitative criteria. This is why hazard likelihood is a more accurate term. Likelihood is a measure of how possible or likely it is that an event will occur, such as a hazard-mishap. Likelihood can typically be characterized in one of the following ways ... 

Hazard probability is typically obtained from calculations made using the HCF failure rates and the exposure time involved. It should be noted that mishap likelihood and hazard likelihood are really the same entity, just viewed from two different perspectives. 

Figure 2.37 presents the HRI matrix concept for establishing the level of potential mishap risk presented by a hazard. It can be seen from this figure that the HRI matrix concept essentially involves one matrix and three tables. The HRI matrix is the main component, which is based upon the combination of the hazard/mishap likelihood on one axis and hazard/mishap severity on the other axis. The hazard/mishap likelihood category is determined from the criteria stated in the Likelihood Table and the hazard/mishap severity category is determined from the criteria stated in the Severity Table. The Risk Level Table ranks each hazard into one of four risk levels (high, serious, medium, or low) based on the particular HRI matrix indices designated for the particular level. 

Mishap risk—a safety metric characterizing the amount of danger presented by a potential mishap, where the likelihood of the mishap s occurrence is combined with the resulting severity of the mishap. Mishap risk likelihood defines the likelihood of the mishap occurring, while mishap risk severity defines the expected final consequences and loss outcome expected from the mishap event. The mishap likelihood and severity can only be computed from the information contained in the hazard description. 

Risk iuialysis of accidents serves a dual purpose. It estimates tlie probability tliat iui accident will occur and also assesses the severity of the consequences of an accident. Consequences may include dmnage to tlie surrounding enviromnent, financial loss, injury to life and/or deatli. This Part of the book (Part IV) is primarily concerned witli tlie metliods used to identify liazards and causes and consequences of accidents. Issues dealing witli healtli risks have been explored in die previous Part (III). Risk assessment of accidents provides an effective way to help ensure eidier diat a mishap will not occur or reduces the likelihood of an accident. The result of die risk assessment also allows concerned parties to take precautions to prevent an accident before it happens. 

The hazard probability levels listed in Table 2.2 (MlL-STD-882) represent a qualitative judgment on the relative likelihood of occurrence of a mishap caused by the uncorrected or uncontrolled hazard. Here again, assuming a high probability that a situation will occur, a judgment can be made as to the importance of addressing one specific concern over another. 

Risk Assessment 2 2B (see Tables 2.1-2.3). Liquid contact with parts is assessed as a critical occurrence, since the potential damage to the parts would most likely render them unusable. The likelihood of such a mishap is considered highly probable, based on the proposed system design. The risk assessment matrix (Table 2.3) indicates that a risk classification of 2B is unacceptable. Therefore, the system safety precedence tells us that such risk should be approached with the intention of elimination, or possible reduction to an acceptable level. 

Therefore, when using the severity and probability techniques simultaneously, hazards can be examined, qualified, addressed, and resolved based upon the hazardous severity of a potential outcome and the likelihood that such an outcome will occur. For example, while an aircraft collision in midair would unarguably be classified as a Category I mishap (catastrophic), the hazard probability would fall into the Level D (remote) classification based upon statistical history of midair collision occurrence. The system safety effort in this case would require specific, but relatively minimal... 

The definitions for the terms safe and safety hinge around the terms hazard, mishap, and risk, which are closely entwined together. A mishap is an event that has occurred and has resulted in an outcome with undesired consequences. It should be noted that in system safety, the terms mishap and accident are synonymous. In order to make a system safe, the potential for mishaps must be reduced or eliminated. Risk is the measure of a potential future mishap event, expressed in terms of likelihood and consequence. Safety is... 

Since many systems and activities involve hazard sources that cannot be eliminated, zero mishap risk is often not possible. Therefore, the application of system safety becomes a necessity in order to reduce the likelihood of mishaps, thereby avoiding deaths, injuries, losses, and lawsuits. Safety must be designed intentionally and intelligently into the system design or system fabric it cannot be left to chance or forced-in after the system is built. If the hazards in a system are not known, understood, and controlled, the potential mishap risk may be unacceptable, with the result being the occurrence of many mishaps. 

On the surface it might seem that UIs and GUI designs are relatively benign and would not pose any safety concerns. However, clearly the opposite is true, as demonstrated by past mishaps in a variety of different systems. Just as a mechanical switch can fail on or off and affect an SCF, so too can a GUI switch however, the likelihood is apparently much smaller for a GUI. The primary safety concerns with GUIs tend to deal with user confusion and user overload (too many GUIs and GUI options) which could cause a safety error to be committed by the user. 

For a hazard to exist, three hazard components must be present (1) the HS which provides the basic source of danger, (2) the potential IMs that will transition the hazard from an inactive state to a mishap event, and (3) the TTO that will result from the expected mishap event. The HS and IM are the HCFs that are used to determine risk likelihood, and the TTO is the causal factor that estabhshes risk outcome and severity. The HS and IM hazard components can be broken into the major causal factor categories of hardware, software, humans, interfaces, functions, procedures, management safety culture, and the environment. Since hazard risk is the same as mishap risk, HCFs are also mishap causal factors because they are the same factors used to compute the risks. 

Likelihood is one parameter in the risk equation. Risk is the safety measure of a potential future event, stated in terms of event likelihood and event severity. Hazard likelihood is the expected likelihood that the identified hazard will be activated and becomes an actual mishap. Hazard likelihood is the estimated likelihood of a hazard transitioning from a conditional state to an actual mishap event state, resulting in an actual mishap with undesired outcome. 

The HRI is an index number indicating qualitatively the relative risk of a hazard. It is derived from the HRI matrix by identifying the matrix cell resulting from the intersection of the hazard likelihood and hazard severity values. In a typical HRI matrix, such as the matrix in MIL-STD-882, there are 20 cells created by a 4 x 5 matrix. The matrix cells are labeled with an index number of 1 through 20, where 1 represents the highest risk and 20 the lowest risk. The smaller the HRI number, the higher the safety risk presented by the hazard. The HRI number establishes the safety significance of a hazard and who can accept the risk for the hazard. It should be noted that the HRI is also often referred to as the mishap risk index (MRI). However, since hazard risk and mishap risk are really the same entity, then the HRI and the MRI are really the same entity, just viewed from two different perspectives. 

The Hazard Risk Index (HRI) matrix is a risk management tool used by system safety for hazard/mishap risk assessment. The HRI matrix establishes the relative level of potential mishap risk presented by an individual hazard. By comparing the calculated qualitative severity and likelihood values for a hazard against the predefined criteria in the HRI matrix, a level of risk is... 

Arbitrary categories have been established in MIL-STD-882 that provides qualitative measures for the most reasonable likelihood of occurrence of a mishap and for the outcome severity of a mishap. For example, if the safety analyst assesses that an event will occur frequently, it is assigned an index level A, or if it occurs occasionally, it is given an index level C. This qualitative index value is then used in qualitative risk calculations and assessments. 

---