KUREAS: An Open-Source Browser Tool Brings Risk Analysis to Everyone

For decades, the software that decides whether nuclear plants, spacecraft, and chemical facilities are safe enough to operate has been locked behind expensive licenses, legacy architectures, and opaque interfaces. A new open-source project described in the journal SoftwareX aims to break that monopoly. KUREAS, which stands for Knowledgebase with Uncertainty for Risk Engineering Analysis of Systems, was developed by Curtis Lee Smith and released under the MIT license as a suite of browser-based modules that perform professional-grade probabilistic risk assessment without any installation, server, or database. Every module is a single HTML file with embedded JavaScript, meaning the entire toolkit can be emailed, stored on a laptop, or hosted on a static web page and run in any modern browser on Windows, Apple, or Linux machines.

The motivation is rooted in a persistent problem in high-consequence industries. Probabilistic Risk Assessment, or PRA, is the discipline that identifies potential failure modes, estimates their likelihoods, and quantifies their consequences across hazards ranging from internal component failures to external events like floods and earthquakes. Yet many commercial-grade tools that carry out this work rest on software architectures dating back to the 1980s. They demand complex installations, specific operating environments, and costly licensing agreements, creating a high barrier for academic researchers, start-ups, small engineering firms, and regulators who simply need to run a rapid check or verify a third party’s results. Worse, the black-box nature of proprietary code makes it difficult to audit how a risk number was actually computed.

KUREAS answers with a zero-deployment philosophy built entirely on HTML5, CSS3, and JavaScript. Because all processing happens in the user’s local browser memory, sensitive facility data never leaves the machine, an air-gapped-by-design property that is especially valuable in nuclear and aerospace settings. The one-file-per-module approach also simplifies configuration management: users can archive the exact software version alongside their project data, ensuring that future analysts can reproduce results with the same tools used in the original study. Since the source code is the HTML itself, anyone can read precisely what calculations are performed, a transparency the author argues is essential for regulatory verification and peer review of safety-critical logic.

The suite mirrors the multi-stage workflow of contemporary risk engineering through specialized modules. KUREAS-HA handles hazard analysis, letting analysts categorize internal and external hazards by frequency and impact, visualize hazard curves, and embed engineering justifications with a built-in rich text editor. KUREAS-FTL constructs fault trees on a drag-and-drop canvas supporting the full range of Boolean gates, including AND, OR, NOT, NAND, and N-of-M voting logic, with automated name-conflict detection and support for sub-tree transfers. KUREAS-ETL manages event trees for accident sequences using a backward rendering algorithm that keeps branch placement consistent with established PRA standards, with real-time path highlighting to trace failures from initiating events to end states.

The heart of the suite is KUREAS-SYS, which departs from conventional graphical modeling with a novel scripting language the author calls How the System Works. Instead of manually wiring logic gates, analysts describe system success in readable keywords such as SYSTEM WORKS, RELIES ON, and IF/THEN, the way system engineers naturally think about their designs. A redundant emergency cooling system with three pumps and two power buses, for example, is captured in a single line combining two of three pumps with either power bus. The software then automatically translates that success description into failure logic, generates the fault tree, and quantifies it. Each component can carry multiple failure modes, ISA-standard piping and instrumentation diagram symbols, and a graphical Failure Modes and Effects Analysis built inside the module’s editors.

In a worked example, with each pump assigned a failure probability of 0.06 and each power bus 0.05, KUREAS-SYS identified the minimal cut sets, the smallest combinations of failures that doom the system: any two pumps failing, or both power buses failing. The overall system failure probability came to 1.3E-2 using Binary Decision Diagram quantification, a result validated independently in Excel. When the built-in common-cause failure module was engaged with a beta-factor of 0.02, accounting for the possibility that supposedly independent components fail together, the estimate rose to 1.9E-2. The engine then produces importance measures that turn raw probabilities into engineering guidance: the Risk Increase Ratio shows how much system risk spikes if a component is assumed failed, the Risk Reduction Ratio shows the safety gain from making a component perfectly reliable, and Percent Contribution identifies which events dominate the failure profile. In the example, each pump carried a Risk Increase Ratio of 9.24, flagging pump maintenance as the most risk-sensitive activity.

Under the hood, the solver proceeds through five steps: translating the success script into failure logic via De Morgan transformations, computing minimal cut sets bottom-up with memoization so repeated modules are solved only once, truncating cut sets whose bounded probability falls below a project threshold, expanding common-cause candidates that share failure mode and component type, and finally quantifying by rare-event approximation, the Minimal Cut-set Upper Bound method, or BDD, the default. The BDD construction orders basic events by frequency of appearance, shares identical nodes through a unique table, and memoizes pairwise operations, and it treats complements exactly, so non-coherent logic is handled without approximation. For repeated importance calculations, the diagram is built once and re-evaluated with modified probabilities at a cost of one pass each.

Benchmarking suggests the browser-based approach is no toy. Against the U.S. Nuclear Regulatory Commission’s classic Fault Tree Handbook, KUREAS reproduced the handbook’s results for series and parallel systems, including a two-phase redundant valve problem yielding a system failure probability of 8E-4. More demanding, the full Generic Pressurized Water Reactor model released for the established SAPHIRE software, comprising 244 fault trees, was solved in KUREAS-FTL down to a 1E-10 truncation in roughly 18 seconds on a laptop, versus 36 seconds for SAPHIRE. A proprietary pumping system design produced more than 13,000 minimal cut sets at a 1E-12 truncation in about nine seconds. A synthetic stress test stacking nested 3-of-5 voting gates grew from 100 to 100,000 cut sets, with KUREAS-SYS matching SAPHIRE’s counts exactly, taking about 92 seconds at the largest size compared with SAPHIRE’s 4 seconds. A built-in Reliability Designer also lets analysts adjust component failure probabilities interactively; in one demonstration, degrading damper reliability fivefold raised system failure probability from 1.1E-4 to 2.0E-4.

Quality assurance is treated as a first-class concern given the software’s ambitions for nuclear and high-safety facilities. KUREAS is developed with ASME NQA-1 Subpart 2.7 software quality requirements in mind, though it does not yet hold NQA-1 certification. The current test suite for KUREAS-SYS contains 76 automated tests covering probability storage edge cases, logic generation, quantification methods, common-cause handling, and importance measures, and periodic regression tests compare outputs against SAPHIRE within numerical tolerances. Project data can be validated and locked from inside the software, with change tracking and quality reporting built in, while GitHub version control provides a transparent record of every modification. Bayesian analysis capabilities round out the suite, maintaining prior and posterior failure distributions alongside operational data, and a reporting module generates formatted Word and Markdown documents with automatic acronyms, numbering, and templates.

The broader significance may lie less in raw speed than in access. Small firms can now run in-house reliability studies without enterprise licensing; students can explore Boolean logic, uncertainty quantification, and system modeling without installation hurdles; and infrastructure projects in developing regions can adopt modern risk methods with nothing more than a browser. For regulators, the one-file, one-logic design means an auditor can read the script directly or rerun an analysis in a controlled environment to confirm reproducibility, potentially smoothing licensing cycles and fostering collaboration between designers and authorities. The author positions KUREAS not as a finished product but as a flexible framework for the next generation of risk research, including dynamic PRA with time-dependent failure models, advanced uncertainty sampling techniques, and machine learning approaches to automated model generation. By lowering the cost of entry to rigorous analysis, the project aims to foster a culture of proactive safety, empowering more engineers to ask what-if questions about the complex systems that underpin modern life before those questions are answered by failure.

Subject of Research: Open-source browser-based software for probabilistic risk assessment and system reliability engineering

Article Title: KUREAS: knowledgebase with uncertainty for risk engineering analysis of systems

Article References: Smith, C. L. (2026). KUREAS: knowledgebase with uncertainty for risk engineering analysis of systems. SoftwareX, 36, Article 103105. https://doi.org/10.1016/j.softx.2026.103105

Image Credits: AI Generated

DOI: 10.1016/j.softx.2026.103105

Keywords: probabilistic risk assessment, system reliability, fault tree analysis, open-source software, minimal cut sets, common-cause failure, importance measures, nuclear safety, Bayesian analysis, web-based tools, Binary Decision Diagrams, quality assurance