Air Force System Safety Handbook - System Safety Society

3.5 Mishap Risk Assessment.
By combining the probability of occurrence with mishap
severity, a matrix is created where intersecting rows and
columns are defined by a Mishap Risk Assessment Value.
The value forms the basis for judging both the acceptability of
a risk and the management level at which the decision of
acceptability will be made. The value may also be used to
prioritize resources to resolve risks due to hazards or to
standardize hazard notification or response actions.
Prioritization may be accomplished either subjectively by
qualitative analyses resulting in a comparative mishap risk
assessment or through quantification of the probability of
occurrence resulting in a numeric priority factor for that
hazardous condition. Figures 3-5 and 3-6 show two sample
matrices for mishap risk assessment which can be applied to
provide qualitative priority factors for assigning corrective
action. In the first matrix, an identified hazard assigned a
mishap risk assessment value of 1A, 1B, 1C, 2A, 2B, or 3A
might require immediate corrective action. A value of 1D, 2C,
2D, 3B, or 3C would be tracked for possible corrective action.
A value of 1E, 2E, 3D, or 3E might have a lower priority for
corrective action and may not warrant any tracking actions. In
the second matrix, risk values of 1 through 20 (1 being highest
risk are assigned somewhat arbitrarily. This matrix design
assigns a different value to each frequency-category pair, thus
avoiding the situation caused by creating values as products
of numbers assigned to frequency and category which causes
common results such as 2 X 6 = 3 X 4 = 4 X 3. This situation
hides information pertinent to prioritization. These are only
examples of a risk assessment methods and do not fit all
programs. (30:9)
The mishap risk assessment value will be more useful if the
severity and probability scales are carefully defined. Some
suggestions for each are as follows. (18:14-17)
“Severity ranges should be sized so that events within each
category are of comparable severity....Equating the severity of
event and conditions which can cause one fatality with those
which can cause 100 or 1,000 does not make sense. The
potential problems associated with sizing of the severity
ranges grow as the size of the system grows. Program
23
managers need to be provided with risk information that has
the fidelity to distinguish the hazardous events that meet
general criteria.
Severity range thresholds for each severity category should be
comparable when considering personal, system, or facility
losses....For example, events or conditions which could cause
the loss of an E-4 Airborne Command Post would be
categorized by MIL-STD-882 as catastrophic. Loss of a single
crewman, mechanic, or passenger would also fall in the
catastrophic category....Severe injuries, such as total loss of
sight of a mechanic, and system damage of several million
dollars are not normally considered to have equal value, even
though both are considered as values for the critical category.
If the ranking criteria use risk as a function of severity and
probability, quantitative scales or qualitative scales based on
quantitative logic should be used. If the concept that the
expected losses (or risk) associated with a hazardous event or
condition may be estimated by multiplying the expected
severity of the accident by the probability of the accident, then
some sort of quantitative basis is necessary....Failure to
provide a quantitative basis for the scales can cause
significant confusion and dissipation of safety resources when
an arbitrary risk ranking scale is used.
Develop the severity values using order of magnitude ranges.
This gets severity values far enough apart to avoid hair-splitting
arguments and simplifies severity assessment during
PHAs.
Quantify the threshold values for the probability ranges.
Quantification reduces confusion associated with strictly qualitative
definitions. Although it is impossible to quantify the
ranges in MIL-STD-882 due to its extremely broad application,
developing quantified probability ranges for specific systems is
a relatively easy task to accomplish.
The probability of occurrence should refer to the probability of
an accident/consequence as opposed to the probability of an
individual hazard/basic event occurring. The typical accident
sequence is much more complicated than a single line of erect
dominos where tipping the first domino (hazard) triggers a
clearly predictable reaction.
Develop the probability values using order of magnitude
ranges. Do this for the same reason you did it when
developing the severity ranges.”