1.1.0.2.2.

The following three analyses can be used together in selecting which Risk Reduction options to adopt, and therefore support quantitative ALARP justification:

• Loss Analysis – Provides an estimate, in financial terms, of the effect of incidents and accidents identified through consequence analysis
• Options Analysis – Determines candidate optio ns to reduce safety losses
• Impact Analysis – Assesses the effect on the safety losses of candidate mitigation options

1.1.0.3.1.

Consequence Analysis is a bottom up, deductive, analytical technique. It examines time-sequenced responses to initiating events. The analysis may be quantified to determine the probability of the range of outcomes possible.

1.1.0.3.3.

Cause Consequence Diagrams illustrate the failure logic of a system to identify the potential effect of each hazard and possible subsequent accident. The technique can include a determination of the overall risk of all known quantified hazards.

1.1.0.4.1.

Cause Consequence Diagrams involve a combination of Causal Analysis and Consequence Analysis. They are used to examine events that might occur between a hazardous state and a resulting Accident, in effect the accident sequence.

1.1.0.4.3.

The ‘Consequence’ element covers activities which may characterize a series of outcomes which, when sequentially evaluated, may develop both successful and unsuccessful events with their own probability of occurrence.

1.1.0.4.6.

To estimate the frequency of the outcome - Major Fire - requires an estimate of the frequency of the initial event (i.e. Ignition) and the likelihood or probability of failure on demand of the barriers to a Major Fire, Fire Suppressor and Alarm, and their correlation. The Risk arising from Ignition can then be determined.

1.1.0.5.1.

Loss Analysis is a systematic investigation of the Safety losses associated with all Accidents identified through Consequence Analysis. It involves assessment of the magnitude of the losses associated with the Hazards of a system before considering Risk reduction measures. Losses associated with persons (i.e. injuries and deaths) are aggregated separately for each group that may be affected; for a defence system, these groups might include Trained Operators, Trained Maintainers, other MOD personnel and the General Public.

1.1.0.5.4.

The (typically annual) frequency of each Accident is determined in Cause Consequence Diagrams by multiplying the estimated Hazard frequency by the estimated likelihood or probability of the Hazard leading to the Accident, once the Hazard has occurred. Safety losses, whether for personnel, equipment or environment, are typically expressed in monetary terms in order to consider in subsequent Cost Benefit Analysis.

1.1.0.5.6.

An example of Loss Analysis is shown below.

Example – Results of personnel Loss Analysis for “Fire” (figures are not representative)

1.1.0.5.8.

Following application of further Risk Assessment techniques of Impact Analysis and Options Analysis, the Loss Analysis table may be revised to demonstrate any Safety improvement obtained by the application of one or more mitigation measures.

1.1.0.6.1.

Options Analysis is used following initial Loss Analysis to determine options to reduce potential Safety losses for each Hazard.

1.1.0.6.3.

In order to show compliance with the ALARP principle, all potential risk reduction measures must be identified and considered.

1.1.0.7.2.

The quantitative and qualitative elements, in turn, of previous stages of analysis should be revisited to identify impacts. Quantitative sensitivity parameters for each option may be derived from Cause Consequence Diagrams developed for the system in question. The likely effects of each mitigation measure will be identified in an Options Analysis in which a Cost Benefit Analysis is performed.

1.1.1.1.1.

Cause Consequence Diagrams may be constructed when there is some information available to describe the system design. It can help to identify opportunities for improving the design and the analysis can be refined as the design develops.

• Common cause failure – identification and modelling
• Interdependencies of failures
• Logical consistency and accuracy

1.1.2.1.1.

Cause Consequence Diagram

• A qualitative model of cause and consequence structures can be developed to model possible Accident sequences;
• Quantification can be introduced and improved as data becomes available to produce probabilistic outcomes, where required by high risk;
• The technique facilitates consideration of differing scenarios and barriers to event escalation, which is an essential part of demonstrating the ALARP principle.

1.1.2.1.3.

Impact Analysis

• Impact Analysis provides confirmation and/or re-evaluates previous analyses to provide a soundly based argument for the Safety value of the change;

1.1.2.2.2.

Loss, Options and Impact Analysis

• The techniques for examining the benefit of Risk Reduction options are time consuming and will be inappropriate for common hazards whose control is well covered by Standards or documented Good Practice;
• The results of these related analyses may be very sensitive to the estimated rates of accident occurrence, the predicted scale of harm and the expected costs and benefits of risk reduction options. The studies must therefore include an examination of the sensitivity of the conclusions to the inputs and assumptions.
• All benchmarks used to identify Safety losses to persons are inexact reflections of views held by society at the time of the analysis and, as such, are liable to change with public perceptions of any particular hazard;
• It is important to review and refine the results of early assumptions and modelling, to ensure that results remain relevant and appropriate;
• Given that only costs directly associated with implementing an option for a particular Hazard are considered, it might be found that there is some positive impact on options for other hazards. Any such potential dependencies should be considered, analysed and apportioned;
• When multiple mitigating options are being considered the order in which they are considered for implementation (Mitigation hierarchy) will affect both the individual and cumulative benefit obtained.
• When considering potential effects of the mitigation option on other systems, the relevance and accuracy of the argument must be demonstrated appropriately and be fully supported. Similarly, when considering supplier or subcontractor arguments, a rigorous assessment of assumptions, models and conclusions must precede their inclusion in the Safety Case;
• Care should be taken to ensure that all dependencies are properly addressed, e.g. those between two identified options for the same or related Hazards;

1.1.3.0.1.

A list of additional information (e.g., Standards, textbooks, and websites) includes but is not limited to:

• Application of the Cause-Consequence Diagram Method to Static Systems
• Health and Safety Executive (HSE) Cost Benefit Analysis (CBA) Checklist

1.1.3.1.1.

Cause consequence analysis uses decision trees, operating on the assumption that truly independent variables contribute to occurrences and outcomes, i.e. independent events must occur to bring about an event. Cause consequence analysis looks at the possible outcomes of these events.

1.1.5.1.

Version 3.0 to 3.1 Uplift

Link within Sources of Additional Information has been updated.

Version 2.3 to 3.0 Uplift

Major uplift from the Acquisition System Guidance (ASG) to online version.