凡自治之物 · LGD 治理学 · 创造术家族 ｜ 评测协议：skill-quality-gate

何时用

• 需要把 严重度 × 概率 转成一致风险等级；建 / 审风险管理文件做 ISO 14971:2019 条款完整性核查（见正文 When to Use）
• 触发词：ISO 14971、风险矩阵、风险控制选项层级、风险管理文件自查

用法

• python scripts/risk_matrix.py（零依赖）
  • matrix：参考 5×5 矩阵
  • assess -s <1-5> -p <1-5> [--rs <1-5> --rp <1-5>]：评一个风险 + 残余风险对比
  • options：ISO 14971:2019 7.1 风险控制选项层级
  • check <风险管理文件.md>：16 要素完整性核查
  • 退出码 0 = ok / 1 = 阻断发现 / 2 = 用法错误

流程

1. matrix 选定等级带约定（注意：矩阵是惯例，风险管理计划自带标准优先）
2. assess 评初始与残余风险，工具标记"残余未降反升 / 纹丝不动"等可疑模式
3. check 对风险管理文件逐要素过 ISO 14971:2019 4–10 条款，缺关键条款逐条补

ISO 14971 Risk Matrix (风险矩阵计算与风险管理文件自查)

When to Use

• You need to turn a severity/probability pair into a risk level consistently, in the vocabulary the standard itself uses.
• You are building or auditing a risk management file and need a clause-by-clause completeness pass against ISO 14971:2019 before a QMS audit or a submission.
• You are training or checking a team's use of the risk-control option hierarchy — the single most common audit finding is a file that jumps straight to "add a warning label".
• You want a falsification check: does the file show any evidence that the control measures actually reduced anything?

Usage

# reference matrix
python scripts/risk_matrix.py matrix

# score one risk
python scripts/risk_matrix.py assess -s 4 -p 2

# score initial + post-control residual risk in one call
python scripts/risk_matrix.py assess -s 5 -p 5 --rs 2 --rp 1

# risk-control option hierarchy (ISO 14971:2019 7.1)
python scripts/risk_matrix.py options

# completeness check on a risk management file / its outline
python scripts/risk_matrix.py check risk_management_file.md

Exit code 0 = ok, 1 = blocking finding (residual risk still unacceptable, or critical RM elements missing), 2 = usage error.

The Reference Matrix

Severity 1–5 (可忽略 / 轻度 / 严重 / 危重 / 灾难性) × probability 1–5 (极不可能 / 罕见 / 偶然 / 很可能 / 频繁); score = S × P.

| score | level | what it obliges | |---|---|---| | 1–4 | L 低 / 可接受 | record and monitor; evaluate residual risk per 7.3 | | 5–9 | M 中 / ALARP | reduce to as low as reasonably practicable; verify the measure works | | 10–25 | H 高 / 不可接受 | redesign or add protective measures; if the residual risk is still unacceptable, a benefit-risk analysis (7.4) is required |

⚠️ This matrix is a convention, not the standard. ISO 14971:2019 §4.4 requires the manufacturer to define, in its risk management plan, the policy for determining acceptable risk. A formal document must cite your own plan's criteria. This tool states that limit in its own output rather than quietly implying authority it does not have.

What assess Also Does

• Prints the ISO 14971:2019 clause 3 vocabulary chain — hazard → sequence of events → hazardous situation → harm — as a completeness prompt. Analyses that skip a link are the usual root cause of "we found no risk".
• With --rs/--rp, compares the residual risk against the initial risk and flags suspicious patterns: residual still H, residual worse than initial, or residual identical to initial (i.e. the file claims control measures but the numbers never moved).

What check Looks For

16 elements across ISO 14971:2019 clauses 4–10, each with EN and ZH keyword alternatives. Critical elements (plan, file, intended use, hazards, estimation, evaluation, control-option analysis, implementation, residual risk, overall residual risk, review, post-production) are reported separately from optional ones (safety characteristics, benefit-risk, risks from control measures, completeness).

Keyword hits mean "the document mentions this", not "this is done." The tool says so in its output; use it to find holes, then read.

Known Limits (be explicit with users)

• ISO 14971 does not mandate a specific matrix; the 5×5 shipped here is one common convention. If your risk management plan defines different bands, the plan wins — reband the tool's mapping to match.
• Probability anchors (1e-6 … 1e-2 per device lifetime) are indicative only and are not from the standard.
• check is keyword-based and language-limited (EN + ZH). A file written in another language, or one using unusual headings, will produce false "missing" results.
• This tool does not write the risk file, does not decide acceptability for you, and does not constitute a regulatory opinion.

Output Discipline

• Always show the arithmetic (S × P = score → band), never a bare band name.
• When the residual risk is worse than or equal to the initial risk, say plainly that the file shows no evidence of effective risk reduction — do not soften it.
• When a risk management file is checked, list the missing critical clauses individually so they can be closed one by one.

证据与安全声明

• 证据：TBD（暂无评测/徽章链接；产生后在此更新实际链接）
• 版本：1.0.0
• 安全：未做独立安全扫描（TBD），结论待补；补全前不作推荐背书。