CVEN9892 Chap.4 Risk Analysis for Engineered Systems
Risk Analysis for Engineered Systems
This chapter describes risk through scenarios, likelihoods and consequences rather than one vague score. Bow-tie reasoning separates causes, hazardous events, preventive barriers, mitigative barriers and outcomes. Decision trees then organise alternatives and chance events for expected-value calculations, while interpretation reopens questions of tolerability, uncertainty, equity and non-monetary consequences.
Begin by naming the hazard and then writing a complete scenario: initiating cause, loss of control, exposed system or population and consequence. A flood, chemical or machine is a hazard source rather than a numerical risk on its own. The time or demand basis must accompany likelihood.
Annual probability, probability per start and probability conditional on extreme inflow answer different questions and cannot be substituted without conversion evidence. A bow-tie places the hazardous event at the centre. Causes and preventive barriers sit to the left; consequence pathways and mitigative barriers sit to the right.
This structure helps test whether a proposed control removes a cause, prevents the central event, detects loss of control or limits harm afterward. Give every barrier a performance measure, operating condition, failure mode and verification method. Multiple controls may share electricity, sensors, maintenance or operator action, so apparent redundancy needs a common-cause check.
Risk matrices can organise attention when likelihood and consequence categories are defined for the same exposure frame. Their ordinal labels do not become measured quantities by assigning integers. Two scenarios with the same cell can differ in health severity, reversibility, legal duties, uncertainty or vulnerable groups. Keep the scenario evidence visible behind the colour. Decision trees support choices with chance events.
Draw the decision node, chance nodes, probabilities and terminal consequences before calculating. Probabilities leaving a chance node should sum to one, and every terminal path should contain all costs incurred by that alternative. Expected value multiplies probability by consequence and sums branches, but a lower expected monetary cost does not establish tolerability.
Screen regulatory, health and environmental constraints, then compare feasible options. Test break-even probability and consequence values instead of relying on a single estimate. Risk treatment follows the scenario. Elimination and substitution act upstream; engineered barriers interrupt pathways; detection and emergency response limit consequences. Monitoring requires a threshold, responsible role and action.
Communication should pair a quantitative estimate with its frame, consequence description and uncertainty. State what new incident, loading condition or asset state would trigger review. The completed analysis is an argument about how harm can occur and how a specified control changes that pathway, not a score detached from engineering mechanisms.
What this chapter covers
- 01
Risk scenarios
- 02
Bow-tie analysis
- 03
Risk matrices
- 04
Barrier performance
- 05
Decision trees
- 06
Expected value
Worked example · free
Compare an annual risk control
- +1Calculate 0.12 × $240,000 = $28,800.
- +1Calculate $18,000 + 0.03 × $240,000 = $25,200.
- +1Find a $3,600 modelled annual saving.
- +1Add uncertainty and non-monetary consequences.
Key terms
- Hazardous event
- A loss of control or exposure event connecting causes to consequences.
- Preventive barrier
- A control intended to reduce the likelihood of a hazardous event.
- Mitigative barrier
- A control intended to reduce consequences after an event occurs.
- Expected value
- A probability-weighted average of outcomes under a stated model.
- Common-cause failure
- One initiating condition that defeats several nominally separate barriers and reduces the protection expected from redundancy.
Risk Analysis for Engineered Systems FAQ
Why is a risk matrix not the final answer?
Matrix categories are ordinal summaries and may hide consequence type, uncertainty and exposure frame. Equal cells can represent very different situations, so tolerability and treatment still need context-specific reasoning.
What makes a decision tree readable?
Separate decision nodes from chance nodes, label every branch, show probabilities and terminal consequences, and calculate totals at the endpoints. A reader should be able to reproduce the rollback without guessing.
How should a control be justified?
Locate it on the causal pathway, explain which likelihood or consequence term it changes, define a performance indicator and state the response when monitoring shows the control has degraded.
Exam move
Write full risk scenarios from cause to event to consequence. Practise placing controls on bow-tie pathways and defining measurable performance signals. For numerical work, draw the tree before multiplying and ensure probabilities leaving each chance node sum to one. Finish with one non-monetary consequence and one sensitivity threshold.
For each barrier, add its demand condition, failure mode, test interval and common dependencies. Challenge apparently redundant equipment by looking for shared power, location, software, maintenance or operator action. Rebuild an expected-cost example with all terminal paths shown, then move any cost paid on every path outside the chance calculation. Solve for the probability at which two alternatives break even.
Finally, apply a tolerability screen covering health, environmental and regulatory constraints before accepting the lowest expected value. Convert the selected uncertainty into a monitoring threshold and a dated trigger for reassessment.
