Risk graph

A risk graph represents a graphical output for risk estimation. It is based on a so-called decision tree in which every node represents a certain quantity, or risk parameter (e.g. consequence, probability of occurrence, the frequency of negative effect exposure, etc.), and the graph direction stands for a degree of severity (importance) of the given parameter. 

With more than two branches, that is, if the given parameter consists of three options (e.g. probability of undesirable event occurrence P is defined by values P, P2, and P3), the graph becomes more complicated and difficult to read. That is why, under these circumstances, a combination of a risk graph and a risk matrix is utilized (combined method). This procedure takes into account more possible parameters of hazard effects however, the division into individual groups depends on the subjective evaluation by company s risk assessment specialist. 

---

Graphs are an important aspect of quantif5ong benefit and risk. Statistical methods for benefit-risk are emerging as well. Worthy of particular note is a benefit-risk graph assessing benefits and risks within each patient over time. ... 

Next aspect of using properly modifiable risk graph is its calibration. It is done using defined risk severity... 

Risk assessment and SIL determination using the risk graph... 

This standard proposes also a risk graph method for determining qualitatively SIL for safety-related functions. In lEC 61511 the risk graph method is extended to semi-quantitative one hy possihihty of the graph cahbration (Bamert et al. 2008h). 

The risk graph method, proposed in lEC 61508 and lEC 61511, is useful in the process of determination of required risk reduction level associated with safety integrity level (SIL) of safety instrumented function (SIS). However, this normative document presents only an illustrative example which shows how the risk graph method can be used. 

In many cases it is impossible to apply this kind of risk graph directly to given risk analysis, taking into consideration some specific industrial solutions. It can sometimes make some difficulties. The number of parameters and their ranges describing the consequences and frequency of a dangerous event can differ for some accident scenarios considered. 

Proposed method of the SIL determination is based on modifiable risk graphs, which allows building any risk graph schemes with given number of the risk parameters and their ranges expressed qualitatively or preferably quantitatively. An example of modifiable risk graph is shown on Fig. 7. 

Proposed method allow buil ng architecture of modifiable risk graph based on specified risk parameters. This kind of analysis can be achieved for three main criteria orientated towards the consequence types ... 

Second part, related to the risk analysis and assessment, is based on risk graph method. The module consists of database storing risk parameters for each kind of saved graph and its description too. Its architecture is shown on Fig. 8. 

The main task of this module is to store the risk graphs parameters for three main criteria orientated to health, environment or financial consequences, which... 

To determine the SIL that should be achieved by components that realize safety functions the lEC 61508 provides several systematic approaches, e.g. risk graph, risk map and quantitative probabilistic analysis. In the case of the risk graph out of the following parameters of hazardous events the SIL can be determined consequence, fi equency and exposure time, possibility of avoiding hazard and probability of unwanted occurrence. 

There are minor differences between the two decision processes. The SSCl is determined in a more qualitative way by using two factors, i.e. hazard severity and software autonomy. The SIL should he determined in a quantitative probabilistic way by computing the risks of the system and comparing with accepted risk levels. Thus the necessary risk reduction is determined which in tun determines the rehahhity requirement for the safety function. Risk graphs (see section 2.2) and risk maps are rather considered as qualitative estimation methods by lEC 61508. Finally we mention that the AOP 52 presents in chapter 11 in total 6 case studies where 3 are taken fi om the ammunition domain. Such specific examples are not available in the lEC 61508. 

In the lEC 61508 the determination of the SILs is related to the necessary risk reduction for the system. However, the SILs themselves are defined quantitatively by numerical failure rates. Even the rather qualitative risk graph described in the lEC 61508 for the determination of SILs seems to be more specific. It needs four parameters consequence, frequency and exposure time, possibility of avoiding hazard and probability of unwanted occurrence. Each parameter is described in the lEC 615 08 and there is not much room for interpretation. We conclude that the lEC 61508 is somewhat more restrictive with respect to precision than the AOP 52 concerning the determination of SIL and SSCI, respectively. 

The preliminary risk assessment is made by a risk graph qualitative method described in lEC 61508-5 Annex E according Figure E.l (Figure 3) and Table E.l. This method has been used extensively within the machinery sector, see ISO 14121-2 and Annex A of ISO 13849-1, and enables the safety integrity level to be determined from knowledge of risk factors associated with the hoist machinery and it control system. 

Some of the parameters descriptions have been assigned numeric values to fit the mine hoist application, the risk graph is then per definition calibrated. But the cahbration is not... 

ISO 13849-1] includes a relative simple risk graph as described in Figure 2 to identify which requirements are placed on the E/E/PE based safety functions. 

To a certain degree it is a matter of preference which risk analysis method to choose. If it decided to use [ISO 13849-1] for the complete design of the E/E/PE-based safety functions, maybe it is more natural to use the risk graph within that standard. Either way, these risk analysis chapters in [ISO 13849-1] and [lEC 62061] are informative and allow you to use the risk matrix in [lEC 62061] to identify which SIL is required and then transform this SIL to a PLr by using table 4 in [ISO 13849-1] (see Figure 4) and then use [ISO 13849-1] for the remaining design steps of the E/E/PE-based safety functions. 

This paper discusses the application of 2 popular methods of determining SIL requirements - risk graph methods and layer of protection analysis (LOPA) - to process industry installations. It identifies some of the advantages of both methods, but also outlines some limitations, particularly of the risk graph method. It suggests criteria for identifying the situations where the use of these methods is appropriate. 

Risk graph, described in the standard as a qualitative method. 

Cahbrated risk graph, described in the standard as a semi-qualitative method, but by some practitioners as a semi-quantitative method. 

Risk graphs and LOPA are popular methods for determining SE requirements, particularly in the process industry sector. Their advantages and disadvantages and range of appUcability are the main topic of this paper. 

Risk graph methods are widely used for reasons outlined below. A typical risk graph is shown in Figure 1. 

The parameters of the risk graph can be given qualitative descriptions, e.g. Cc = death of several persons, or quantitative descriptions, e.g. ... 

Table 3 - Typical Definitions of Risk Graph Parameters...

Risk graph methods have the following advantages ... 

Note that geometric means are used because the scales of the risk graph parameters are essentially logarithmic.)... 

Risk graphs are popular in the process industries for the assessment of the variety of trip functions - high and low pressure, temperature, level and flow, etc - which are found in the average process plant. In this appheation domain, the benefits listed above are relevant, and the criterion that there are a number of fimetions whose risks can be aggregated is usually satisfied. 

Table 4 - Guidance from the Standards on Handling Other Technology Safety Related Systems with Risk Graphs...

The purpose of the W factor is to estimate the frequency of the unwanted occurrence taking place without the addition of any safety-related systems (E/E/PE or other technology) but including any external risk reduction facilities. (Part 5, Annex D - A quaUtative method risk graph)... 

Before a risk graph can be calibrated, it must first be decided whether the basis will be ... 

---