C3.9 Structural models

Probabilistic risk assessment procedures guide [11]

What it requires. Where the failure logic of a system can be drawn, the analysis builds it: a fault tree from the top event through gates to basic events with estimable rates, event trees from initiating events through the success or failure of each barrier, with common-cause failure and human reliability treated explicitly. The minimal cut sets, the smallest combinations of basic events that produce the top event, are listed, and importance measures rank the basic events and the controls by their contribution to the top-event probability. Where the logic cannot be drawn, the component is not used and the record says so.

Where it comes from. The agency's procedures guide [11], in its second edition of 2011, supplies the modeling layer beneath the handbook: a master logic diagram, initiating events, event trees, fault trees, data, human reliability, common-cause failure, uncertainty and importance measures. The agency adopted the method after losing one shuttle and formalized its risk management after losing a second.

What it reconciles. This component connects analysis to controls in a way no other method does. A matrix, a simulation and an index all produce a number for the risk; only a structural model produces a number for each control's share of it, which is what C4.2 and C4.3 need when they ask which control to move up the hierarchy or to re-rate. It is also honest about its limits: credit and market losses emerge from correlated continuous variables, not from gates, so the component is reserved for systems whose logic can be drawn, and the record names the method used and why.