Fundamentals of Systems Safety and Risk Analysis
This domain tests whether you can separate a hazard from a risk, choose an analysis method that fits the life-cycle phase, and apply the system safety order of precedence. Questions often supply a short system description and ask for the first analysis, the risk level, or the control that should be preferred.
Core distinctions
- A hazard is a condition with the potential to cause harm, damage, or loss.
- Risk combines the severity of the potential harm with its probability.
- A mishap is the actual event; system safety works upstream to prevent it.
- System safety is proactive and hazard-based, not merely incident-driven.
Order of precedence
- Eliminate or design out the hazard.
- Add safety devices or engineered controls.
- Use warnings and alerts.
- Rely on procedures and training.
- Use personal protective equipment. Lower levels are acceptable only when higher levels are shown to be impractical, and the rationale must be documented.
Matching method to phase
Use preliminary hazard analysis early; HAZOP for process deviations; FMEA bottom-up for component failure modes; fault tree analysis top-down for combinations and single-point failures; LOPA for independent protection layers; STPA for control and software-intensive behavior.
Worked example
A fuel test stand has a catastrophic-severity hazard, an uncontained fuel release, rated “Remote” probability on the approved matrix. The cell maps to “Serious,” not “High.” A candidate argues it is acceptable because probability is remote. The better reasoning: severity still drives the acceptance authority and monitoring requirements; “Serious” requires documented acceptance at the designated level, interim detection and automatic shutoff, and verification evidence. If a design change removes the release path, re-score the hazard rather than simply accepting it.
Traps that cost marks
- Treating “remote” as “safe” without considering severity.
- Reading a matrix cell as a precise quantitative probability.
- Choosing PHA after design freeze instead of before concept commitment.
- Calling a warning label an “inherent” control.