In safety engineering, a hazard is a potential source of harm. A hazardous event occurs when a hazard is realized under specific conditions, and risk combines the likelihood of that event with the severity of its consequences.

For a single identified hazard \( H \), we denote:

• \( P(H) \): probability that the hazardous event occurs in a specified reference interval (e.g., per hour, per mission).
• \( S(H) \): severity of harm if the event occurs, modeled as a nonnegative scalar (e.g., cost, injury level).

A simple scalar risk index is then

\[ R(H) = P(H)\,S(H), \quad S(H) \ge 0,\; 0 \le P(H) \le 1. \]

For multiple hazards \( H_1,\dots,H_n \), assuming their consequences can be expressed in a common unit (e.g., expected cost or a normalized severity scale), the total risk is often approximated by a sum:

\[ R_{\text{tot}} = \sum_{i=1}^n P(H_i)\,S(H_i). \]

This definition is an application of the expected value of a nonnegative-valued random variable describing loss. It makes explicit that risk can be reduced either by lowering probabilities \( P(H_i) \) or by reducing severities \( S(H_i) \), or both.

We formalize risk in terms of a nonnegative random loss \( L \). Let \( \Omega \) be the set of possible safety-related outcomes during a mission and \( L(\omega) \ge 0 \) the loss (e.g. injury score) if outcome \( \omega \in \Omega \) occurs. The risk is the expected loss:

\[ R = \mathbb{E}[L] = \sum_{\omega \in \Omega} L(\omega)\, \mathbb{P}(\omega). \]

If we discretize outcomes by hazards \( H_i \) and associate each hazard with a single severity value \( S_i \) whenever it occurs and zero otherwise, we can write:

\[ R = \sum_{i=1}^n S_i\,\mathbb{P}(H_i) = \sum_{i=1}^n S_i P_i, \]

where \( P_i = \mathbb{P}(H_i) \). From this:

• If \( S_i \) and \( P_i \) are nonnegative, then \( R \) is nonnegative.
• If for some \( j \) we decrease either \( S_j \) or \( P_j \) while holding all other terms fixed, then \( R \) does not increase. Formally, for \( S_j' \le S_j \) and \( P_j' = P_j \), we have:

\[ R' - R = S_j'P_j - S_jP_j = (S_j' - S_j)P_j \le 0 \]

because \( S_j' - S_j \le 0 \) and \( P_j \ge 0 \). A similar argument holds if we reduce \( P_j \). This simple property shows that any mitigation technique that provably reduces either probability or severity of one hazard cannot worsen the total risk according to this metric.

In practice, risk indices are often discretized on ordinal scales. For instance, let severity \( S \) take values \( 1,2,3,4 \) (from minor to catastrophic) and probability \( P \) take values \( 1,2,3,4 \) (from very unlikely to frequent). A simple risk index is the product:

\[ I_{\text{risk}} = S \cdot P. \]

Thresholds on \( I_{\text{risk}} \) partition hazards into categories such as “acceptable”, “tolerable with mitigation”, and “unacceptable”.

In robotics, we must consider how risk accumulates over time as the robot operates. A common reliability model assumes that a hazardous event occurs with a constant rate \( \lambda \) per hour (Poisson process). The probability that at least one event occurs in a time interval of length \( T \) is

\[ P(H \text{ within time } T) = 1 - e^{-\lambda T}. \]

If each event has severity \( S \), the mission risk over an interval \( T \) is

\[ R(T) = S \bigl(1 - e^{-\lambda T}\bigr). \]

For small \( \lambda T \), we can use the first-order approximation \( e^{-\lambda T} \approx 1 - \lambda T \), which yields

\[ R(T) \approx S \lambda T, \quad \text{for } \lambda T \ll 1. \]

Thus, in low-failure regimes, risk grows approximately linearly with time and with the hazard rate \( \lambda \). This justifies separating:

• design decisions that reduce \( \lambda \) (e.g., more reliable sensors, better shielding), and
• operational decisions that limit \( T \) (e.g., maintenance intervals, duty cycles).

A structured risk assessment for a robotic system typically follows a systematic sequence of steps. From a control perspective, these steps provide constraints within which all controllers and software must operate. A generic procedure is:

1. Define the system and its boundaries.
2. Identify hazards in all operating modes.
3. Estimate probability and severity for each hazard.
4. Evaluate risk against acceptance criteria.
5. Apply mitigations (engineering controls, procedures).
6. Verify residual risk and iterate if necessary.

flowchart TD
  A["Define system and limits"] --> B["Identify hazards in all modes"]
  B --> C["Estimate severity S and probability P"]
  C --> D["Compute risk index and classify"]
  D --> E{"Risk acceptable?"}
  E -->|yes| F["Document and monitor"]
  E -->|no| G["Design mitigations \n(controls, guards, procedures)"]
  G --> H["Implement and \nvalidate mitigations"]
  H --> C
        

Mathematically, step 3 corresponds to choosing \( S_i \) and \( P_i \) for each hazard \( H_i \), then forming \( R(H_i) = S_i P_i \) or a more refined metric. The decision in step 4 compares \( R(H_i) \) to thresholds derived from policy or standards.

Suppose a mitigation (e.g., a light curtain, safety-rated encoder, or interlock) reduces the probability of a hazardous event from \( P \) to \( P_{\text{res}} \). Define the risk reduction factor

\[ K = \frac{P}{P_{\text{res}}}, \quad K \ge 1. \]

The residual risk is then

\[ R_{\text{res}} = S P_{\text{res}} = \frac{S P}{K} = \frac{R_{\text{init}}}{K}, \]

where \( R_{\text{init}} = S P \) is the initial risk. If independent mitigations are applied in series (e.g., two safety channels that both must fail to allow the hazardous event), and if they reduce probability by factors \( K_1 \) and \( K_2 \), then under independence:

\[ P_{\text{res}} = \frac{P}{K_1 K_2}, \quad R_{\text{res}} = \frac{R_{\text{init}}}{K_1 K_2}. \]

This multiplicative structure motivates redundant safety architectures: each additional independent safety layer can significantly reduce risk, especially when \( K_1, K_2 \) are large.

flowchart TD
  H["Initial hazard with risk R_init"] --> M1["Mitigation 1, factor K1"]
  M1 --> M2["Mitigation 2, factor K2"]
  M2 --> Rres["Residual risk R_init / (K1 * K2)"]
        

A common safety requirement is that a robot must stop before reaching a human once a hazard is detected. Consider a 1D motion along a line with initial speed \( v_0 \) towards a human and a constant braking deceleration \( a \gt 0 \) once a stop command is issued. From basic physics (constant deceleration):

\[ v(t) = v_0 - a t, \quad t \ge 0. \]

The robot stops when \( v(t_s) = 0 \), so

\[ t_s = \frac{v_0}{a}. \]

The distance travelled during braking is

\[ d_{\text{brake}} = \int_0^{t_s} v(t)\,dt = \int_0^{t_s} \bigl(v_0 - a t\bigr)\,dt = v_0 t_s - \tfrac{1}{2} a t_s^2 = \frac{v_0^2}{2a}. \]

In practice, we must also account for a reaction delay \( t_r \) between hazard detection and start of braking. During this interval, the robot moves at approximately constant speed \( v_0 \), adding distance

\[ d_{\text{react}} = v_0 t_r. \]

The total stopping distance is thus

\[ d_{\text{stop}}(v_0) = v_0 t_r + \frac{v_0^2}{2a}. \]

If a safety scanner guarantees that a human can only appear closer than a minimum distance \( d_{\min} \) if some fault occurs, we require:

\[ d_{\text{stop}}(v_0) \le d_{\min}. \]

For a given \( t_r \), \( a \), and \( d_{\min} \), this inequality defines a maximum safe speed \( v_{\max} \) as the largest solution of the quadratic inequality

\[ \frac{v_0^2}{2a} + t_r v_0 - d_{\min} \le 0. \]

Solving the corresponding quadratic equation gives

\[ v_{\max} = -a t_r + \sqrt{a^2 t_r^2 + 2 a d_{\min}}. \]

Any speed \( v_0 \le v_{\max} \) satisfies the safety constraint. This type of inequality is central in speed-and-separation monitoring for collaborative robots.

In a real robot controller, risk assessment logic is often embedded in supervisory layers rather than low-level control loops. Here we show simple numerical risk calculations in four languages. These can be adapted into ROS/ROS2 nodes or other robotics frameworks.

7.1 Python Example

We compute a risk index for a list of hazards and classify each hazard as “low”, “medium”, or “high” according to thresholds on \( I_{\text{risk}} = S \cdot P \).

from dataclasses import dataclass
from typing import List

@dataclass
class Hazard:
    name: str
    severity: int   # 1..4
    probability: int  # 1..4

def risk_index(h: Hazard) -> int:
    return h.severity * h.probability

def risk_level(I: int) -> str:
    if I <= 4:
        return "low"
    elif I <= 8:
        return "medium"
    else:
        return "high"

hazards: List[Hazard] = [
    Hazard("Pinch at wrist joint", severity=3, probability=3),
    Hazard("Controller overtemperature", severity=2, probability=2),
    Hazard("Unexpected fast motion", severity=4, probability=3),
]

for h in hazards:
    I = risk_index(h)
    print(f"{h.name}: I={I}, level={risk_level(I)}")
      

In a ROS2 Python node, the same logic would be invoked inside subscriber callbacks that monitor sensor states and operating modes.

7.2 C++ Example

A similar calculation can be implemented in C++, suitable for use inside a ROS2 rclcpp node that supervises joint states or safety signals.

#include <iostream>
#include <string>

struct Hazard {
    std::string name;
    int severity;   // 1..4
    int probability; // 1..4
};

int riskIndex(const Hazard& h) {
    return h.severity * h.probability;
}

std::string riskLevel(int I) {
    if (I <= 4) return "low";
    if (I <= 8) return "medium";
    return "high";
}

int main() {
    Hazard hazards[] = {
        {"Pinch at wrist joint", 3, 3},
        {"Controller overtemperature", 2, 2},
        {"Unexpected fast motion", 4, 3}
    };

    for (const auto& h : hazards) {
        int I = riskIndex(h);
        std::cout << h.name
                  << ": I=" << I
                  << ", level=" << riskLevel(I)
                  << std::endl;
    }
    return 0;
}
      

7.3 Java Example

Java is common in some robotics environments (e.g., educational robotics). We again compute a simple risk index.

public class Hazard {
    public final String name;
    public final int severity;
    public final int probability;

    public Hazard(String name, int severity, int probability) {
        this.name = name;
        this.severity = severity;
        this.probability = probability;
    }

    public int riskIndex() {
        return severity * probability;
    }

    public String riskLevel() {
        int I = riskIndex();
        if (I <= 4) return "low";
        if (I <= 8) return "medium";
        return "high";
    }

    public static void main(String[] args) {
        Hazard[] hazards = new Hazard[] {
                new Hazard("Pinch at wrist joint", 3, 3),
                new Hazard("Controller overtemperature", 2, 2),
                new Hazard("Unexpected fast motion", 4, 3)
        };
        for (Hazard h : hazards) {
            System.out.println(h.name + ": I=" + h.riskIndex()
                    + ", level=" + h.riskLevel());
        }
    }
}
      

7.4 MATLAB / Simulink Example

In MATLAB, we can vectorize the risk calculation. The same computation can be implemented in Simulink using basic gain and product blocks.

% Vector of severities and probabilities (1..4 scale)
S = [3; 2; 4];   % severities for 3 hazards
P = [3; 2; 3];   % probabilities

I = S .* P;  % risk indices

risk_level = strings(size(I));
risk_level(I <= 4) = "low";
risk_level(I > 4 & I <= 8) = "medium";
risk_level(I > 8) = "high";

disp(table(S, P, I, risk_level));

% Simulink sketch:
%  - Three constant blocks for S(i)
%  - Three constant blocks for P(i)
%  - Product blocks computing I(i) = S(i)*P(i)
%  - MATLAB Function block to map indices to string labels
      

In this lesson we formalized risk as expected loss, expressed both at the hazard level via \( R(H_i) = S_i P_i \) and at the mission level for systems with constant failure rates. We showed that any mitigation which reduces severity or probability is monotonic with respect to this risk metric, and we introduced the concept of risk reduction factors to quantify the effect of safety functions.

We also derived a simple but practically important inequality for safe stopping distance, yielding a closed-form expression for the maximum safe speed as a function of reaction time, braking capability, and minimum separation distance. Finally, we illustrated how risk indices can be computed programmatically in Python, C++, Java, and MATLAB, which allows integration of quantitative risk assessment into supervisory control software and robot operating frameworks.