## 3 Risk Management Methodology  
The safe management of a railway system is possible through the application of a systematic method of identifying, analyzing, and treating risk. In this sense, Risk Management does not represent a sterile analysis of the current conditions of the system but provides the tools for the definition of safety improvement strategies and for the evaluation of their efficiency [24]. RM process involves several key phases, as shown in Figure 1.  
In the system definition phase, the characteristics, interfaces, and limits of the system to be analyzed are expressed. All technological, operational, and organizational elements of the system contributing to the overall safety and the historical information of the system must be identified and accurately described [28]. The information collected allows analysts to identify, analyze, and evaluate events that generate risks. The hazards identification phase intends to describe and characterize all possible Hazardous Events (HEs) able to generate risk in the system. Accidental historical data, hazard logs, and reliability information of systems, subsystems, and parts are investigated, and hazards are identified through methodologies like checklists, Hazard and Operability (HAZOP), Failure Modes, Effects, and Criticality Analysis (FMECA), and so on [29]. The output of this phase is a list of critical hazards for the safe operation of the system characterized by their respective frequencies and consequences [30; 31]. For each identified HE, the risk analysis phase aims to estimate the associated risk level starting from the available information. Risk, in particular, is defined as the combination of the expected frequency of loss and the related severity [32; 33]. The risk linked to HE, however, is governed not only by the frequency of the causes that can trigger it but also by the succession of possible consecutive events capable of giving rise to different accident scenarios, characterized by different frequencies and severities and, therefore, a different risk level. Based on this consideration, the calculation of the risk associated with the HE must take into account all the possible scenarios associated with it. The 'Bow-tie' methodology allows the analysis of the evolution of an accident through logical connections, starting from the triggering causes up to the expected final scenarios, integrating into a common platform the fault tree analysis (FTA) for the accident causes identification and the event tree analysis (ETA) for the accident evolution analysis [34]. FTA is a top-down, deductive methodology where an HE is decomposed into low-level faults until the single independent causes, called Basic or Root Events (REs). Relation  
Figure 1: Risk Management process [24]. between events is expressed using Boolean logic. FTA is a commonly used methodology for railway risk assessment and fits well with qualitative and quantitative input data [35; 36; 37]. ETA is a bottom-up methodology that, starting from the HE, combines the probabilities that further subsequent events will occur or not, influencing each step both the extent of the consequences and the probability of their occurrence, describing all the possible final accidental scenarios [27]. Also, ETA has found application in the railway sector for the qualitative and quantitative analysis of the accident consequences, usually applied after FTA in a bow-tie structure [17; 38; 39]. In the risk calculation phase, the combination of the risk level of all scenarios expresses the overall risk level of the HE analyzed. In particular, risk can be expressed as Total Expected Risk (R), Cumulative Risk (CR), or Individual Risk (IR) [40]. Those indicators, in the risk evaluation phase, are compared with criteria and thresholds to assess their acceptability [31]. In particular, the risk level can result in acceptable, tolerable, or unacceptable. In the first case, the risk is low, no intervention is required, and only monitoring activities should be carried out [27; 41].