Despite being the dominant risk analysis paradigm, event guessing is useless for systems design. In management, no event guessing has ever preempted the launch of policies that are decided, not designed. In engineering, events are not guessed; rather, they are created for testing purposes. Events provide inputs to which systems respond according to their structure, as described by state-space or equivalent System Dynamics models. A new risk analysis framework draws design support information from model attributes. Risk-informed dynamic models help design physical architectures or organizational policies that capably respond to arbitrary events. The approach builds on the notion that all inputs carry energy. Physical or policy systems change states by trading energy with the surroundings, through expected transactions and unexpected disturbances. A non-probabilistic risk framework supports the design by showing that the system exhibits intended functionality when responding to arbitrary inputs. Instead of guessing countless hypothetical events, the framework systematically and comprehensively analyzes weaknesses in the system model using a programmed algorithm. It applies to any state-space dynamic model by defining risk as a function of the energy needed to move the system from an acceptable to a faulty state. Robust systems dissipate excess energy, whereas vulnerable systems lose functionality. Fuses and cushions are generic classes of protections. Placing them into system models at identified weak points helps improve design. Two published simple models of business policies illustrate the framework, which is extended to define measures for consequence and uncertainty as functions of acceptable and faulty states.

中文翻译：

---

基于模型的系统设计风险分析

尽管事件猜测是占主导地位的风险分析范式，但它对于系统设计来说毫无用处。在管理中，任何事件猜测都不会先于已决定而非设计的政策的启动。在工程学中，事件是无法猜测的；相反，它们是为了测试目的而创建的。事件提供系统根据其结构做出响应的输入，如状态空间或等效系统动力学模型所描述的。新的风险分析框架从模型属性中提取设计支持信息。基于风险的动态模型有助于设计能够响应任意事件的物理架构或组织策略。该方法建立在所有输入都携带能量的概念之上。物理或政策系统通过与周围环境交换能量、通过预期的交易和意外的干扰来改变状态。非概率风险框架通过表明系统在响应任意输入时表现出预期的功能来支持设计。该框架不是猜测无数的假设事件，而是使用编程算法系统、全面地分析系统模型中的弱点。它适用于任何状态空间动态模型，将风险定义为将系统从可接受状态转变为故障状态所需能量的函数。稳健的系统会消耗多余的能量，而脆弱的系统会失去功能。保险丝和缓冲垫是通用保护类别。将它们放入系统模型中已识别的薄弱点有助于改进设计。两个已发布的简单商业政策模型说明了该框架，该框架被扩展为将后果和不确定性的度量定义为可接受和错误状态的函数。