Aurorisk FR

Methods and tools

Catalogue of risk analysis methods and the tools that implement them, with reference standards. Source, licence and access terms are shown separately.

Links checked on 2026-09-26

How to read this page

Tools are grouped by method. A tool may appear under several methods.

Inclusion criteria: publicly accessible, maintained, and matching the stated method. Commercial tools are listed for information, without any assessment of their quality.

Source identifies the publisher or organisation. “Open source” is shown only when known. Access describes price and conditions; “not specified” means the catalogue has no confirmed information.

Links only: no affiliation, no endorsement. Trademarks belong to their owners. A link that responds does not prove the tool still matches its description.

Qualitative hazard analysis

# PHA — Preliminary hazard analysis Guide PHA →

Identify hazardous situations, causes, consequences and first measures.

ToolSource · licence · accessScopeDescription
Polyodos ↗ Commercial publisherFree for teaching International PHA, FMEA, HAZOP, LOPA, bow-tie in one platform.
Kenexis Open-PHA ↗ Commercial publisherFree United States Integrated PHA/LOPA application, free.
Sphera PHA-Pro ↗ Commercial publisher International HAZOP, LOPA and PHA templates.

Standards and references : ISO/IEC 31010 — Techniques d’appréciation des risques · ISO 31000 — Management du risque

# HAZOP / LOPA Guide HAZOP → Guide LOPA →

Process deviations by guide words, then layers of protection.

ToolSource · licence · accessScopeDescription
Polyodos ↗ Commercial publisherFree for teaching International HAZOP and LOPA with action tracking.
Kenexis Open-PHA ↗ Commercial publisherFree United States HAZOP scenarios linked to LOPA scenarios.
BakerRisk PHA-Tool ↗ Commercial publisher United States Suite for facilitating PHA studies.

Standards and references : IEC 61882 — Études HAZOP · CCPS — Layer of Protection Analysis (2001) · IEC 61511 — Sécurité fonctionnelle des systèmes instrumentés de sécurité

# FMEA Guide FMEA →

Failure modes, effects and criticality (severity × occurrence × detection).

ToolSource · licence · accessScopeDescription
Polyodos ↗ Commercial publisherFree for teaching International FMEA with reusable libraries.
APIS IQ-Software ↗ Commercial publisher Europe Leading tool in the automotive industry; structure, function and failure trees, aligned with the harmonised manuals.
ReliaSoft XFMEA ↗ Commercial publisher International Reliability-engineering standard; links design and process FMEA, generates control plans.
DataLyzer FMEA ↗ Commercial publisher Europe Production-oriented; integrates with SPC and shop-floor quality management.
Isograph Reliability Workbench (FMECA) ↗ Commercial publisher International FMECA module linked to fault trees and RBDs.

Standards and references : IEC 60812 — Analyse des modes de défaillance et de leurs effets (AMDE/AMDEC)

# Bow-tie Guide Bow-tie →

Threats, barriers, central top event and consequences.

ToolSource · licence · accessScopeDescription
Polyodos ↗ Commercial publisherFree for teaching International Bow-tie alongside the other industrial methods.
BowTieXP (Wolters Kluwer) ↗ Commercial publisher International Reference software for bow-tie diagrams.

Standards and references : ISO/IEC 31010 — Analyse par nœud papillon · CCPS / Energy Institute — Bow Ties in Risk Management (2018)

Reliability and system safety

# STPA (STAMP) Guide STPA →

Hazard analysis through control structures and unsafe control actions (MIT, Leveson).

ToolSource · licence · accessScopeDescription
XSTAMPP ↗ Open sourceFree Europe Eclipse platform for STPA and CAST.
STPAmaster ↗ Free International STAMP toolset; free Lite version.
MIT PSAS — STPA Handbook ↗ Public bodyFree United States STPA handbook and STAMP resources from MIT.
awesome-stpa ↗ Open sourceFree International Curated list of STAMP/STPA resources.

Standards and references : Leveson N., Thomas J. — STPA Handbook (MIT, 2018) · Leveson N. — Engineering a Safer World (MIT Press, 2011)

# Fault and event trees (FTA/ETA) Guide Fault trees →

Probability calculation, minimal cut sets and importance measures.

ToolSource · licence · accessScopeDescription
Aurorisk — fiabilité (RBD & fail-safe / fail-dangerous) Free for teaching France Teaching tool with two views (switch): reliability blocks (RBD, series/parallel/k-out-of-n topology, Monte Carlo) and dynamic fail-safe/fail-dangerous simulation (named failure modes per component, dependency rules for common-cause failures, proof test, editable safety logic, PFDavg). Not validated, not for real studies.
SCRAM ↗ Open sourceFree International Probabilistic risk analysis: fault and event trees, Monte Carlo, Open-PSA format.
Arbre-Analyst ↗ Open sourceFree France Free fault tree tool based on the XFTA engine (Open-PSA); successor to OpenFTA.
OpenFTA ↗ Open sourceFree International Long-standing fault and event tree tool; this repository preserves the software whose original site is no longer reachable.
BlockSim (Ansys / ReliaSoft) ↗ Commercial publisher International Industry-reference reliability block diagram (RBD) tool. Handles complex dependencies, standby redundancy, reliability allocation and life-cycle cost.
Isograph Reliability Workbench (RBD) ↗ Commercial publisher International Widely used in aerospace and defence. Full RBD module, integrated with Petri nets and FMECA.
RAM Commander ↗ Commercial publisher International Integrated RAMS solution (reliability, availability, maintainability, safety), by ALD Service.
GRIF — Package Booléen (Satodev) ↗ Commercial publisher France French dependability suite (25 years of R&D, formerly TotalEnergies): fault and event trees, RBD, bow-tie, reliability network, SIL loop, Albizia BDD engine.
Item ToolKit (RBD) ↗ Commercial publisher International Dedicated RBD and functional safety analysis modules, by Item Software.

Standards and references : IEC 61025 — Analyse par arbre de panne · IEC 62502 — Analyse par arbre d’événement · Open-PSA Model Exchange Format

Quantification and stochastic simulation

# Monte Carlo simulation Guide Monte Carlo →

Propagate input uncertainty to a result (cost, schedule, probability).

ToolSource · licence · accessScopeDescription
Aurorisk — Monte Carlo Free for teaching France Teaching tool: probability-distribution inputs, equation, results as histogram, cumulative curve (P10/P50/P90) and tornado diagram. Not validated, not for real studies.
OpenTURNS ↗ Association or foundationOpen sourceFree France Python library for uncertainty and reliability (EDF, Airbus, Phimeca).
SALib ↗ Open sourceFree International Sensitivity analysis in Python.
Yasai ↗ Open sourceFree United States Simple Excel Monte Carlo add-in for teaching.
@RISK (Lumivero) ↗ Commercial publisher International Reference Excel add-in.
Oracle Crystal Ball ↗ Commercial publisher International Forecasting and simulation in Excel.
ModelRisk (Vose) ↗ Commercial publisher International Quantitative risk simulation.

Standards and references : ISO/IEC 31010 — Simulation de Monte-Carlo · JCGM 101:2008 — Supplément 1 au GUM (propagation par Monte-Carlo)

# FAIR — risk in monetary terms Guide FAIR →

Quantify a (cyber or operational) risk as frequency and monetary loss.

ToolSource · licence · accessScopeDescription
FAIR Institute — FAIR-U ↗ Association or foundationFree United States Free FAIR learning application.
Open FAIR (The Open Group) ↗ Association or foundation International Open FAIR standard and body of knowledge.
Safe Security ↗ Commercial publisher International Cyber risk quantification platform.

Standards and references : The Open Group — Open FAIR (O-RT, O-RA)

Cybersecurity and OT

# EBIOS Risk Manager Guide EBIOS RM →

French method for digital risk analysis in five workshops.

ToolSource · licence · accessScopeDescription
Polyodos ↗ Commercial publisherFree for teaching International EBIOS RM in five workshops, with IEC 62443.
ARIMES ↗ Commercial publisher France ANSSI EBIOS RM label (v1.2, standalone). Publisher: ADACIS.
Fence ↗ Commercial publisher France ANSSI EBIOS RM label (v3.16, standalone and client-server). Publisher: Airbus Protect.
Agile Risk Manager ↗ Commercial publisher France ANSSI EBIOS RM label (v2.6.2, client-server). Publisher: ALL4TEC.
EGERIE Risk Manager ↗ Commercial publisher France ANSSI EBIOS RM label (v4.0, standalone and client-server). Publisher: EGERIE Software.
Oligo Risk Manager ↗ Commercial publisher France ANSSI EBIOS RM label (v2.1.0 standalone, v1.0.0 client-server). Publisher: RECIPROC-IT.
C2R — Cyber Risk Review ↗ Commercial publisher France ANSSI EBIOS RM label (v1.0, client-server). Publisher: Sia Partners.
Phinasoft Risk Manager ↗ Commercial publisher France ANSSI EBIOS RM label (v2.0, client-server and SaaS). Publisher: Phinasoft.
CISO Toolbox — analyse de risques ↗ Open sourceFree France EBIOS RM tool (five workshops) in the browser; data stored locally; free, MIT licence.
Digi-IT — EBIOS Risk Manager pour Odoo ↗ Commercial publisherOpen source International Odoo module covering the five workshops; LGPL-3 licence; publisher DIGI-ERP (Tunisia).
EBIOS-RM-Graph ↗ Free France Standalone HTML page to build EBIOS RM scenario graphs; JSON export; licence not stated.
risk.mlab.sh ↗ Commercial publisher France Online platform (Cyber Dream) covering the five workshops; free plan with registration, paid advanced features; EU hosting.
BlueKanGo IRM — méthode EBIOS RM ↗ Commercial publisher France EBIOS RM module of a SaaS risk management platform; demo on request.

Standards and references : ANSSI — EBIOS Risk Manager (2018) · ISO/IEC 27005 — Gestion des risques de sécurité de l’information

# Threat modelling Guide Threat modeling →

Data-flow diagrams, STRIDE threats, attack techniques.

ToolSource · licence · accessScopeDescription
OWASP Threat Dragon ↗ Association or foundationOpen sourceFree International Threat modelling (STRIDE, LINDDUN…), desktop or web.
MITRE ATT&CK Navigator ↗ Association or foundationOpen sourceFree United States Map attack techniques.

Standards and references : STRIDE (Microsoft) · MITRE ATT&CK · LINDDUN (vie privée)

# Assessment and compliance (IT and OT) Guide IEC 62443 →

Self-assessment against frameworks (IEC 62443, NIST, ISO 27001…).

ToolSource · licence · accessScopeDescription
Polyodos — IEC 62443 ↗ Commercial publisherFree for teaching International OT/ICS risk analysis under IEC 62443-3-2.
CISA CSET ↗ Public bodyFree United States Security evaluation of IT and industrial networks.
MONARC ↗ Public bodyOpen source Europe Four-phase risk analysis reusing similar analyses; online or self-hosted; published by NC3 (Luxembourg).
CISO Assistant ↗ Open sourceFree France Open-source GRC platform (risk, compliance).

Standards and references : IEC 62443 — Sécurité des systèmes d’automatisation et de commande industriels · ISO/IEC 27001 · NIST SP 800-82 — Guide to OT security · Directive (UE) 2022/2555 (NIS2)

# OT network monitoring

Industrial traffic analysis and detection.

ToolSource · licence · accessScopeDescription
Malcolm (CISA) ↗ Public bodyOpen sourceFree United States Network traffic analysis, including industrial protocols.

Physical effects modelling

# Atmospheric dispersion Guide Atmospheric dispersion modelling →

Concentrations and toxic or flammable threshold footprints.

ToolSource · licence · accessScopeDescription
Aurorisk — dispersion Free for teaching France Teaching tool: Gaussian plume, release sources and toxic thresholds, with map. Compared with ALOHA on reference cases, but not validated for real studies.
RMP*Comp (EPA) ↗ Public bodyFree United States Threshold distances for US risk management plans.
Phast (DNV) ↗ Commercial publisher International Consequence analysis (release, dispersion, fires, explosions).
EFFECTS (Gexcon) ↗ Commercial publisher Europe Effects models based on the TNO Yellow Book.
FLACS (Gexcon) ↗ Commercial publisher Europe CFD dispersion and explosion simulation.

Standards and references : CCPS — Guidelines for Chemical Process Quantitative Risk Analysis · TNO — Yellow Book (CPR 14E) · Arrêté du 29 septembre 2005 (France) — probabilité, gravité, cinétique

# Explosion, fires, BLEVE Guide Explosion, fire and BLEVE →

Overpressure, heat flux and effect distances.

ToolSource · licence · accessScopeDescription
Aurorisk — explosions (VCE, BLEVE, TNT) Free for teaching France Teaching tool: vapour cloud (Baker-Strehlow-Tang), BLEVE and TNT equivalence. Compared with ALOHA on reference cases, but not validated for real studies.
ALOHA (EPA/NOAA) ↗ Public bodyFree United States Dispersion, BLEVE, fires and explosions for emergency response; a long-standing reference in the field, used with CAMEO/MARPLOT.
FLUMilog (INERIS) ↗ Public bodyFree France Heat flux from a warehouse or storage cell fire.
PRIMARISK (INERIS) ↗ Public body France BLEVE, pool fire, boilover, multi-energy; registration required.
Phast (DNV) ↗ Commercial publisher International Fire and explosion models.

Standards and references : TNO — Yellow Book (CPR 14E) et Purple Book (CPR 18E) · Baker Q. et al. — Baker-Strehlow-Tang (CCPS) · INERIS — Ω (études de dangers)

Occupational safety

# Chemical hazards Guide Chemical hazards →

Properties, hazards and response guidance for a given substance.

ToolSource · licence · accessScopeDescription
Seirich (INRS) ↗ Public bodyFree France Free software to assess and prioritise workplace chemical risk (in French).
INRS — fiches toxicologiques ↗ Public bodyFree France Summary sheets on substance hazards.
NIOSH — Pocket Guide ↗ Public bodyFree United States Pocket guide to chemical hazards (limits, protection).
CAMEO Chemicals (NOAA) ↗ Public bodyFree United States Hazard and reactivity datasheets for thousands of substances.
PubChem ↗ Public bodyFree United States Physicochemical and toxicological properties.

# Occupational risk assessment Guide DUERP →

Risk inventory by work unit and action plan.

ToolSource · licence · accessScopeDescription
EasyRisk Pro ↗ Commercial publisherFree for teaching France French DUERP occupational risk assessment document.
OiRA (EU-OSHA) ↗ Public bodyFree Europe Sector-specific online risk assessment, in several languages.
DigiRisk ↗ Commercial publisherOpen sourceFree France Free and open-source AGPL-3.0 software for occupational risk assessment; paid support and hosting are optional.
HSE (Royaume-Uni) ↗ Public bodyFree International Five-step risk assessment method.
INRS — Faire le point RPS ↗ Public bodyFree France Psychosocial risks, small companies.

Standards and references : Code du travail, articles R.4121-1 et suivants (France) · ISO 45001 · Directive 89/391/CEE

Logistics, continuity and finance

# Logistics and supply chain risk

Supplier mapping, disruption monitoring, network simulation.

ToolSource · licence · accessScopeDescription
ASCM — SCOR ↗ Association or foundation International Supply chain reference model, including risk management.
anyLogistix ↗ Commercial publisher Europe Supply network simulation with uncertainty.
Resilinc ↗ Commercial publisher United States Supplier mapping and risk monitoring.
Everstream Analytics ↗ Commercial publisher United States Predictive disruption analytics.

Standards and references : ISO 28000 — Sécurité de la chaîne d’approvisionnement · ASCM — SCOR Digital Standard

# Business continuity (BCP) Guide Business continuity planning (BCP) →

Impact analysis, continuity and recovery plans.

ToolSource · licence · accessScopeDescription
SGDSN — guide PCA ↗ Public bodyFree France Official guide with 27 practical sheets.
Ready.gov — Business Continuity ↗ Public bodyFree United States Continuity plan template (FEMA).

Standards and references : ISO 22301 — Continuité d’activité · SGDSN — Guide pour réaliser un plan de continuité d’activité (2013)

# Financial risk Guide Financial risk and Value at Risk (VaR) →

Market, credit and project: valuation, VaR, simulation.

ToolSource · licence · accessScopeDescription
Open Source Risk Engine (ORE) ↗ Open sourceFree International Open-source market and credit risk engine.
QuantLib ↗ Open sourceFree International Quantitative finance library.
RiskyProject (Intaver) ↗ Commercial publisher International Project risk: cost and schedule via Monte Carlo.

Standards and references : Comité de Bâle sur le contrôle bancaire — Bâle III · ISO 31000 — Management du risque

Natural risks and climate

# Natural hazards and climate

Flood, earthquake, ground movements, climate projections.

ToolSource · licence · accessScopeDescription
Géorisques ↗ Public bodyFree France Risks for an address or municipality.
Vigicrues ↗ Public bodyFree France Real-time flood watch.
DRIAS ↗ Public bodyFree France Regionalised climate projections.
ThinkHazard! ↗ Public bodyFree International Hazards by territory, worldwide (GFDRR).
INFORM Risk Index (JRC) ↗ Public bodyFree Europe Humanitarian crisis risk index by country.
OpenQuake (GEM) ↗ Association or foundationOpen sourceFree International Open-source seismic hazard and risk calculation.
CLIMADA (ETH Zurich) ↗ Public bodyOpen sourceFree Europe Open-source climate risk and impact platform.
WRI Aqueduct ↗ Association or foundationFree International Water risk (stress, floods) by location.
EFFIS (JRC) ↗ Public bodyFree Europe European forest fire information system.
Copernicus EMS ↗ Public bodyFree Europe Satellite crisis mapping.
FEMA Flood Map Service Center ↗ Public bodyFree United States US flood maps.
USGS — Earthquake Hazards ↗ Public bodyFree United States Seismic hazard and data.

Standards and references : Directive 2007/60/CE (inondations) · Cadre de Sendai pour la réduction des risques de catastrophe (ONU)

Radiological and nuclear

# Radiological risks

Exposure, radon, nuclear safety.

ToolSource · licence · accessScopeDescription
ASNR (ex-IRSN) ↗ Public bodyFree France Public tools including Radon & Radioactivity.
IAEA ↗ Public bodyFree International International Atomic Energy Agency: standards and guides.

Standards and references : IAEA — General Safety Requirements Part 3 · Directive 2013/59/Euratom

Cite this page

Aurorisk, "Methods and tools", accessed 2026-09-26, https://aurorisk.com/en/methods/

Open data

The catalogue is available as JSON: /catalogue.json

Report an error or suggest a tool

Write to the author