The Risk Surface

Abstract

It is traditional in system safety engineering practice to enumerate system hazards in the worksheets of the Preliminary Hazard Analysis and the Final Hazard Analysis. The first compilation details hazards at the beginning of a program, while the latter describes hazards at the end of a program after some mitigation has taken place during system development. Hopefully, there are fewer hazards after development than before. In addition to the worksheets of these two analyses, there corresponds Qualitative Risk Characterization charts and, based on the entries in these, a program administrator must decide if a system is “safe”. This decision may be based on need as well as purely safety considerations. Clearly, human opinion as to what constitutes an acceptable system can never be completely eliminated. But, is there a more objective way to make decisions than opinion? This chapter describes a safety criterion based on a comparison of real system risk with the risk of an ideal Model Infinite System (MIS) having an infinite number of subsystems and possible failure modes.