Quantitative risk analysis study design

Design procedures are developed with the intention of improving the safety of equipment. Tools used in this step are hazard and operability studies and quantitative risk analysis (ORA). The following scheme may be used ... 

Consequence assessment for the purposes of establishing design basis differs from consequence assessment in the context of a risk analysis study (see Qualitative and Quantitative Methods, below). A qualitative, or semi-quantitative (order of magnitude) consequence severity estimate may suffice for the latter. 

In the past, qualitative approaches for hazard evaluation and risk analysis have been able to satisfy the majority of decision makers needs. In the future, there will be an increasing motivation to use QRA. For the special situations that appear to demand quantitative support for safety-related decisions, QRA can be effective in increasing the manager s understanding of the level of risk associated with a company activity. Whenever possible, decision makers should design QRA studies to produce relative results that support their information requirements. QRA studies used in this way are not subject to nearly as many of the numbers problems and limitations to which absolute risk studies are subject, and the results are less likely to be misused. 

Allowing time in the early stages of design for critical reviews and evaluation of alternatives would involve studies such as an early hazard and operability (HAZOP) study, using flowsheets, before final design begins,4 Fault tree analysis, quantitative risk assessment (QRA), checklists, audits, and other review and checking techniques can also be very helpful. These techniques are extensively discussed in the technical literature and will not be discussed in detail here. 

The AE double dot plot is a type of graph designed to compare safety data between an experimental treatment and its control group with a quantitative risk measurement (Eigure 11.3). It has also been used in meta-analysis in randomized controlled trials and observational studies. In AE reporting, double dot plots are often used to present the frequency of key AEs along with quantitative risk measurements. Having both types of information side-by-side helps reviewers to identify elevated AEs. 

The work described in this paper is preliminary. The most relevant related work seems to be the attack tree approach [5]. This approach proposes to use the classical fault tree notation in order to study security. As in our work, the attack tree contains basic events representing elementary threats. In some variants of the notation, the tree also include a description of the effect security barriers. In [7] the authors propose to use an extension of the fault-tree notation in order to deal with dynamic aspects of the threat propagation. Both of the previous works tend to focus on a quantitative assessment of security requirements whereas we have been working on qualitative requirements because this would be more consistent with the Airworthiness Safety process. Another relevant approach was proposed by the CORAS project [6], this notation aims at assisting the security risk analysis. A difference between this approach and our work is that the CORAS can be applied before the security architecture is designed whereas our approach is applied once the security architecture is established. 

Depending on the requirement of the safety analysts and the safety data available, either a qualitative or a quantitative safety analysis can be carried out to study the risks of a system in terms of the occurrence probability of each hazard and possible consequences. As described in Chapter 3, qualitative safety analysis is used to locate possible hazards and to identify proper precautions (design changes, administrative policies, maintenance strategies, operational procedures, etc.) that will reduce the frequencies or/and consequences of such hazards. 

In the quantification of the analysis, the importance of initiating event groups, component failures, safety system failure and operator errors should be derived to identify where the contributions to the risk are coming from and where there may be weaknesses in the design or operation of the safety systems. This could use quantitative measures of importance (such as Bimbaum and Fussell-Vesely — see Ref [10]) where applicable. This should be supported by sensitivity studies where there are uncertainties in the models and data. 

---