Toward risk assessment 2.0: Safety supervisory control and model-based hazard monitoring for risk-informed safety interventions

Abstract

Probabilistic Risk Assessment (PRA) is a staple in the engineering risk community, and it has become to some extent synonymous with the entire quantitative risk assessment undertaking. Limitations of PRA continue to occupy researchers, and workarounds are often proposed. After a brief review of this literature, we propose to address some of PRA's limitations by developing a novel framework and analytical tools for model-based system safety, or safety supervisory control, to guide safety interventions and support a dynamic approach to risk assessment and accident prevention. Our work shifts the emphasis from the pervading probabilistic mindset in risk assessment toward the notions of danger indices and hazard temporal contingency. The framework and tools here developed are grounded in Control Theory and make use of the state-space formalism in modeling dynamical systems. We show that the use of state variables enables the definition of metrics for accident escalation, termed hazard levels or danger indices, which measure the "proximity" of the system state to adverse events, and we illustrate the development of such indices. Monitoring of the hazard levels provides diagnostic information to support both online and offline safety interventions. For example, we show how the application of the proposed tools to a rejected takeoff scenario provides new insight to support pilots' go/no-go decisions. Furthermore, we augment the traditional state-space equations with a hazard equation and use the latter to estimate the times at which critical thresholds for the hazard level are (b)reached. This estimation process provides important prognostic information and produces a proxy for a time-to-accident metric or advance notice for an impending adverse event. The ability to estimate these two hazard coordinates, danger index and time-to-accident, offers many possibilities for informing system control strategies and improving accident prevention and risk mitigation. Finally we develop a visualization tool, termed hazard temporal contingency map, which dynamically displays the "coordinates" of a portfolio of hazards. This tool is meant to support operators' situational awareness by providing prognostic information regarding the time windows available to intervene before hazardous situations become unrecoverable, and it helps decision-makers prioritize attention and defensive resources for accident prevention. In this view, emerging risks and hazards are dynamically prioritized based on the temporal vicinity of their associated accident(s) to being released, not on probabilities or combination of probabilities and consequences, as is traditionally done (offline) in PRA.This approach offers novel capabilities, complementary to PRA, for improving risk assessment and accident prevention. It is hoped that this work helps to expand the basis of risk assessment beyond its reliance on probabilistic tools, and that it serves to enrich the intellectual toolkit of risk researchers and safety professionals.

Accident Prevention Analysis: Exploring the Intellectual Structure of a Research Field

“…"Safety" is the purpose of research, "model" is the theory and method of research, and "management" is the means to achieve safety. Favaro and Saleh developed a hazard time contingency diagram for improved risk assessment and accident prevention, with predictive information that could alert operators to intervene in hazardous situations before they become unrecoverable [66]. Uzun and Cebi used a fuzzy Kano model approach to classify measures to protect and prevent occupational health problems, and analyzed occupational health and safety measures from a new point of view [67].…”

Integration-In-Totality: The 7th System Safety Principle Based on Systems Thinking in Aerospace Safety

“…Aerospace 2020, 7, x FOR PEER REVIEW 4 of 24 (1) The fail-safe principle [22] mandates that the system design should prevent or mitigate the unsafe consequences of the failure of a system; (2) The safety margin principle [23] requires that features be put in place to maintain the operational conditions and the associated hazard level at some "distance" away from the estimated critical hazard threshold or accident-triggering threshold; (3) The ungraduated response principle [24] posits that the first course of action to explore for accident prevention and mitigation is the possibility of eliminating a hazard altogether, regardless of the extent of its belligerence, using creativity and technical ingenuity (4) The defence-in-depth principle [25][26][27] calls for safety protection by means of multiple lines of defences or safety barriers along the potential accident sequences. (5) The observability-in-depth principle [26,27] requires that various features be put in place to observe and monitor for the system state and breaches of any safety barrier, and reliably provide this feedback to the operators, so that all safety-degrading events or states (that the safety barriers are meant to protect against) are observable.…”