The Development, Implementation, and Application of a Probabilistic Risk Assessment Framework to Evaluate Supply Chain Shortages

Abstract

Background: Supply chain disruptions from natural hazards, geopolitical tensions, or global events, such as the COVID-19 pandemic, can trigger widespread shortages, with particularly severe consequences in healthcare through drug supply interruptions. Existing methods to assess shortage risks include scoring, simulation, and machine learning, but these approaches face limitations in interpretability, scalability, or computational cost. This study explores the application of probabilistic risk assessment (PRA), a method widely used in high-reliability industries, to evaluate pharmaceutical supply chain risks. Methods: We developed the supply chain probabilistic risk assessment framework and tool, which integrates facility-level failure probabilities and flow data to construct and quantify fault trees and network graphs. Using FDA inspection data from drug manufacturing facilities, the framework generates shortage risk profiles, performs uncertainty analysis, and computes importance measures to rank facilities by risk significance. Results: SUPRA quantified 7567 supply chain models in under eight seconds, producing facility-level importance measures and shortage risk profiles that highlight critical vulnerabilities. The tool demonstrated scalability, interpretability, and efficiency compared with traditional simulation-based methods. Conclusions: PRA offers a systematic, data-driven approach for shortage risk assessment in supply chains. SUPRA enables decision-makers to anticipate vulnerabilities, prioritize mitigation strategies, and strengthen resilience in critical sectors such as healthcare.

1. Introduction

Supply chains are logistic networks of suppliers, manufacturers, warehouses, distributors, and retailers [1]. The raw materials, intermediate products, and finished products flow between these facilities. Disruptions in supply chain logistics due to natural hazards, geopolitical relationships, and more recently the pandemic can cause devastating consequences, including supply chain shortages [2]. For example, the semiconductor industry has faced widespread delays due to global supply chain fragility, and the 2021 blockage of the Suez Canal by the Ever Given vessel disrupted international shipping for weeks [3,4]. In the healthcare sector, such disruptions manifest as drug shortages with adverse economic and clinical effects on patients [5,6]. These examples highlight the need for systematic methods to identify vulnerabilities and quantify risks across supply chains.

Significant research is underway to characterize the impact of shortages on supply chains. Existing approaches in the literature span qualitative and quantitative scoring, probabilistic and network models such as fault trees and Bayesian networks, simulation-based techniques including discrete-event, system dynamics and agent-based models, optimization formulations, and artificial intelligence or machine learning methods, each with distinct trade-offs in interpretability, data requirements and computational cost. Probabilistic Risk Assessment (PRA), widely applied in high-reliability industries, provides a structured approach for evaluating the likelihood and impact of disruptive events and can be adapted to general supply chain contexts. In this work, we demonstrate a probabilistic approach by applying PRA to the pharmaceutical supply chain, leveraging inspection data that the FDA publishes for domestic drug manufacturing facilities [7]. From our literature review, we find that PRA aligns well with the type of facility data available to the FDA.

The objective of this study is to develop and implement a supply chain shortage risk assessment tool that integrates facility failure and flow data to support mitigation planning. The tool constructs supply chain fault trees and network graphs to generate shortage risk profiles, perform uncertainty analysis, and compute importance measures, based on the methodology presented in our paper, “A Quantitative Approach to Assess the Likelihood of Supply Chain Shortages” [8]. Facility and flow data are parsed to form fault trees, which are quantified using the SCRAM engine. In this study, we have generated and quantified 7567 supply chain fault trees in a total time of 7942.583 ms. Through the development of a shortage risk profile and importance measures the study provides decision-makers with systematic, data-driven tools to establish risk profiles, anticipate vulnerabilities, strengthen resilience, and implement effective shortage-mitigation strategies. In addition, the SUPRA framework includes a Monte Carlo-based uncertainty analysis capability, which was not demonstrated in this study but remains available for future applications.

This paper’s organization is as follows: Section 1 gives a brief literature review on supply chain risk assessment methods. Section 2 briefly summarizes the supply chain shortage risk quantification methodology developed in “A Quantitative Approach to Assess the Likelihood of Supply Chain Shortages” [8]. Section 3 describes the development of SUPRA and gives its results. Section 4 presents the development of SUPRA, and Section 5 introduces new postprocessing methods for SUPRA results. Section 6 concludes the paper, and section seven discusses future work.

1.1. Multiple Criteria Decision-Making and Decision Support Methods

Multiple Criteria Decision-Making (MCDM) methods evaluate and choose among alternatives based on criteria [9]. They are valuable for reconciling conflicting objectives in policy and risk assessment. The Analytical Hierarchy Process (AHP), a method used to identify the relative importance of decision elements through pairwise comparisons at each hierarchy level, is widely used due to its simplicity but relies on subjective expert judgment and does not address uncertainty. Fuzzy AHP incorporates triangular fuzzy numbers to handle uncertainty, and Majumdar et al. have applied it to assess risks in a green clothing supply chain [10].

Sharma et al. adopted the fuzzy synthetic evaluation method to quantify risks faced by the pharmaceutical supply chain in India [11]. Their findings indicated that the most significant contributing risks were counterfeit drugs, demand fluctuations, and customer loss due to poor service performance by partners. Moreover, the primary risks identified were demand, finance, and logistics. Rathore et al. focused their analysis on the food supply chain within developing countries [12]. They employed the grey AHP and the grey technique for order performance to develop an extensive risk index, providing a holistic perspective on the subject. Grey AHP extends AHP by using grey numbers to represent uncertain or incomplete expert judgments, while the grey technique provides a way to rank alternatives under similar conditions.

The Analytical Network Process (ANP), a generalization of AHP, represents decision problems as networks capturing interdependencies, though prioritization remains challenging. Decision Making Trial and Evaluation Laboratory (DEMATEL) analyzes cause–effect relationships but cannot rank factors. Tarei et al. combined DEMATEL and ANP to create a risk index considering risk drivers and their interactions, demonstrating the application of this method in a case study centered around the petroleum supply chain [13]. Ramesh K.T. et al. utilized a hybrid approach, combining expert judgment with DEMATEL-ANP for data analysis, to establish an overall inbound supply risk score, demonstrating their framework in the context of the Indian electric supply chain [14].

Faisal et al. have employed graph theory and Interpretive Structural Modeling (ISM) to formulate a risk index that addressed information risks impacting the supply chain [15]. Interpretive Structural Modeling (ISM) is a method that uses expert knowledge to organize and represent the interrelationships among elements within a specific domain. Sheffi et al. qualitatively distinguish between increasing flexibility and adding redundancy to reduce supply chain vulnerability [16]. Pavlov et al. have used network graphs to quantify supply chain resilience using a hybrid fuzzy-probabilistic method, but they do not consider the throughput of the supply chain [17].

1.2. Simulation-Based Methods

Simulation-based methods model processes or systems to generate possible outcomes under different scenarios. In supply chain risk modeling, they simulate supply chain behavior under conditions such as demand changes, disruptions, or natural catastrophes. Klibi et al. [18] proposed a three-phase hazard modeling approach to develop a set of possible scenarios including disruptions and characterize their impact on the supply chain. While they characterize the impact of disruptions on supply chains, including average capacity loss and loss of operational days, they have not explicitly quantified the overall supply chain failure, from individual facility level failure.

Simchi-Levi et al. focus on quantifying the duration of a supply chain disruption and have developed a time-to-recover model that uses a network graph to fail a node and calculate the impact iteratively [19,20]. Munoz et al. conducted a simulation-based study to construct a comprehensive operational supply chain resilience metric encompassing multiple echelons and dimensions [21]. They used disruptions as inputs to quantify the transient response of the supply chain effectively. Cube et al. used discrete event and Monte Carlo simulations on graphical process models to evaluate the monetary impact of supply chain disruptions [22].

1.3. Artificial Intelligence

Artificial Intelligence (AI) is the field of computer science focused on designing algorithms and systems that can perform tasks requiring human-like intelligence, such as learning, reasoning, and problem-solving [23]. Machine Learning and Deep Learning (DL) are key subfields of AI [24].

Bassiouni et al. propose a DL methodology to predict the risk associated with the intercity export of shipment [25]. They performed the study using the online data set: “United States Supply Chain Information for COVID-19”. Results showed that one of the proposed models is almost a hundred percent accurate in predicting the risk of shipment to a target location under COVID-19 restrictions. Engelking et al. collaborated with an automotive case study company on an Action Design Research (ADR) project to develop a ML prototype for Supply Chain Risk Management (SCRM) [26]. The ADR process results in a framework of design principles for applying ML in SCRM.

Kosasih et al. propose using Graph Neural Networks (GNNs) to reduce supply chain risk by identifying potential links in the supply chain network unknown to the buyer [27]. Additionally, Kosasih et al. have developed a framework that combines GNNs and knowledge graphs to uncover hidden risks in supply chains [28]. Aziz et al. propose a novel method for learning a representation of a supply chain network as a heterogenous graph [29]. The Graph Representation Learning (GRL) method was used in the study to estimate missing data from supply chain entities to increase visibility into interdependencies. Lau et al. proposed a federated learning-enabled multi-criteria risk evaluation system to systematically identify, assess, and prioritize risks within the cold supply chain [30].

Typically, the black box nature of AI results challenges their use [31]. Hence, Andreas Holzinger et al. [32] motivate using GNNs to enable information fusion for multi-modal causability. Causability is the extent to which explaining a statement to a human expert achieves a specified level of causal understanding with effectiveness, efficiency, and satisfaction in a specified context of use. Apart from causability, another important aspect to consider is the trustworthiness of the AI or neural network. In [33], Andreas Holzinger suggests using a human in the loop for certain tasks to promote reliability and trust in AI while ensuring that humans remain in control. Given data availability, we can consider the GNN and GRL methods to analyze supply chain risk in future work.

1.4. Bayesian Networks

Bayesian networks are directed acyclic graphs where nodes represent variables and links denote causal dependencies. Lawrence et al. developed a Bayesian causality model to represent the supply chain and quantify its cumulative risk [34]. Predictive inference reasoning and sensitivity analysis were employed to analyze the results of this quantification. Qazi et al. devised a framework that integrated Bayesian networks and game theory to quantify the probability of high development costs and time [35].

1.5. Probabilistic Risk Assessment

Probabilistic Risk Assessment (PRA) systematically evaluates risk by asking what can go wrong, how likely it is, and what the consequences are, and is widely applied in industries such as nuclear power, aerospace, and transportation [36]. Fault tree analysis, a key PRA method, graphically represents how failures lead to undesired events. Sherwin et al. applied fault tree analysis to a low-volume, high-value supply chain to establish baseline unreliability and evaluate mitigation options [37].

1.6. Literature Review Conclusions

The literature review highlights that the selection of supply chain risk assessment methods largely depends on the type and level of detail of information available. Methods such as MCDM, simulation, AI, and Bayesian networks provide valuable insights under varying data conditions, but each has limitations in transparency, scalability, or ability to connect local disruptions to system-wide consequences.

In cases where supply chain structure, facility failure data, and throughput information are available, a PRA framework offers distinct advantages. PRA can be used to develop shortage risk profiles that quantify how disruptions propagate through the network, enabling systematic ranking of risk-significant facilities and supporting informed operation and maintenance prioritization. Within this context, the SUPRA tool demonstrates a promising path forward by combining fault tree analysis with network graph modeling.

2. Overview of Supply Chain Shortage Quantification

In “A Quantitative Approach to Assess the Likelihood of Supply Chain Shortages,” [8], we described a methodology to represent supply chains as network graphs and fault trees to quantify the supply chain flow and failure probability, respectively, as shown in Figure 1. The first step is to organize the supply chain data in a format suitable for analysis, such as a network graph. We then quantify the total supply chain flow, given facility-level flow. After flow quantification, we can use a fault tree solver to generate and quantify the supply chain fault trees. We organize the results of the flow and failure probability quantifications in postprocessing to derive insights from the results. The failure probability versus flow graph compares the susceptibility to failure of all the facilities in the supply chain. Given a certain demand value, we can plot the probability vs. shortage similarly, which gives a shortage risk profile.

This paper presents the adaptation of the shortage risk quantification methodology into a software package, SUPRA. Additionally, we present extra steps for postprocessing results, as shown in Section 4 and Figure 1. The extra steps include quantifying importance measures and applying the results for mitigating supply chain risk.

The vertices of the network graph, as shown in Figure 2, denoted as ‘V,’ represent the facilities and facility failure probabilities. In contrast, the graph’s edges represent the flow of goods between the facilities, denoted by ‘E’ in Figure 2. The nodes ‘s’ and ‘t’ represent the source and termination of the supply chain and are not included in the quantification process. We use the network graph representation of the supply chain to calculate the total throughput and visualize the supply chain. The fault tree of the supply chain gives the supply chain failure probability. We can get the shortage probability and generate a risk profile by relating the supply chain failure probability with the flow. Figure 3 and Figure 4 show supply chains represented as network graphs and fault trees.

3. Development of SUPRA

We first began the development of SUPRA to quantify pharmaceutical drug supply chain shortage risk, leveraging inspection data that the FDA publishes for domestic drug manufacturing facilities [4]. Therefore, the presentation of the tool in this paper relies on pharmaceutical drug supply chain taxonomy. The supply chain facilities that we considered for drug manufacturing are the Active Pharmaceutical Ingredient (API) and the Finished Dosage Form (FDF) facilities, as shown in Figure 5, based on the system reliability approach given by Tillman et al. in [38]. The facilities have been assigned data points such as a facility ID, a reliability probability (R) or a failure probability (F = 1 − R), and a facility flow (f).

Using SUPRA, we can read input data from an Excel sheet (or optionally as a Pandas dataframe) to make a fault tree, quantify it, and post-process the results [39]. Figure 6 illustrates a generated fault tree, visualized in the open-source, collaborative PRA tool OpenPRA [40]. The following subsections describe the development of SUPRA beginning with pre-processing the input data, using the data to create fault trees and quantify the flow, the pseudocode of SUPRA’s algorithm, how we tackled the corner cases we encountered and lastly further extensions in SUPRA that we envision would be beneficial.

3.1. Data Structures

We stored the input data for this program in Excel sheets, which contain values corresponding to various drugs denoted by a unique drug ID. The choice of using Excel as the vehicle for the input information was dictated by ease of interfacing with the analysts that develop the supply chain data. What matters to the algorithm is the structure of the data shown in

Table 1. Input Data for SUPRA.

Column	Data Label
A	drug_id
B	app_id
C	api_id
D	api_failure_probability
E	fdf_id
F	fdf_failure_probability
G	api_flow
H	fdf_flow
I	api_flow_max
J	fdf__flow_max

; if we have that, we can just as easily choose any other input or output format as excel. Each row of the sheet describes a single API and FDF chain. We organized the rows into the following columns relevant to fault tree construction, as shown in Table 1. Columns A, B, C, and E give us the names of the drug supply chain tiers. Columns D, F, G, H, I, and J give the failure probability, flow, and maximum flow for the FDF and API facilities.

We placed no arbitrary limits on the size or number of the input sheets. In our testing, we have scaled the data from hundreds of thousands to millions of rows, each representing partial drug information. Therefore, efficiently reading and processing the input data is vital. To accomplish this, we used the Python (version 3.13.7) library Pandas to quickly read the input Excel sheets and store the information in a Pandas Dataframe, an object provided by the library that allows the data to be queried and processed through the Pandas API [39]. The code iterates over the rows stored in this data frame to construct fault trees, following the format specified by SCRAM (version 0.16.2), a command-line tool for various risk analysis methods, including fault tree quantification [41]. A Python interface for SCRAM provides a Python class with methods for constructing fault trees and exporting the trees to an XML file compatible with the SCRAM command-line tool.

3.2. Fault Tree Creation Algorithm

The algorithm starts by parsing the input data as shown in Table 1 and storing it in suitable data structures. For each drug, it identifies all unique app_ids and iterates over them. For each app_id, a gate is created, and the rows linked to the drug_id and app_id are queried to obtain the API and FDF chains. An OR gate is created, and basic events for each chain’s API and FDF facilities are added using their failure probabilities. These basic events connect to the chain gates, chain gates connect to the app gates, and app gates connect to the root gate. The choice between an AND or OR gate depends on the number of supply chains for the drug.

To support efficient access, the algorithm builds a Python dictionary (hash map) for the generated events. Memory is pre-allocated based on the total number of API and FDF facilities, avoiding repeated allocations during iteration. Parallelization with pthreads is used to create separate maps for API and FDF, while the data is kept in read-only memory to ensure thread safety without extra copying overhead [42]. Since API and FDF IDs are unique, the two maps are later merged in constant time. The flowchart for the algorithm is shown in Figure 7.

3.3. Modeling Backup Facilities

Some API or FDF facilities have a non-zero maximum flow and a zero flow; these are backup facilities. It is of value to know how much the drug failure probability is because of their inclusion. In the drug supply chain shown in Figure 8, if we consider fdf_2 a backup facility, SUPRA determines whether the facility is a backup facility by checking its flow and maximum flow and quantifying the supply chain failure with and without the facility.

3.4. Modeling Shared Facilities

Multiple supply chains may share API and FDF facilities. Supply chains may sometimes have the same facility as an API and an FDF. For example, api_1 in Figure 7 can be a shared facility in two supply chains, in this case:

• aap_1 > chain 1 > api_1 > fdf_1;
• app_1 > chain 1 > api_1 > fdf_2.

SCRAM treats objects with the same ID as one object. If a facility shared among multiple drug supply chains fails, then knowing the relative impact of its failure as compared to other facilities is important.

Currently, our dataset has facilities shared among chains within the same drug_id. If more than one drug supply chain shares a facility, we can update the terminology to reflect the shared facility among multiple drug applications.

3.5. Single Child Corner Case

SCRAM requires each gate in the tree to have more than one input to be quantified. Still, many drugs in the input data share the facility for the FDF and API process. In these cases, we add a house event with perfect reliability and quantify the chain, as shown in Figure 9.

3.6. Extending SUPRA to Quantify Supply Risk of Select Combinations of Drugs

Our current analysis considers the supply chains of individual drugs for quantification. However, for stakeholders, such as federal regulators, an important layer to add to the current analysis is the supply risk of a drug treatment plan. A drug treatment plan may consist of combinations of requisite drugs. Sometimes, the plan may also consist of more than one acceptable drug. The stakeholders select an AND gate or an OR gate and ultimately construct the body of the drug treatment plan as a network graph. Figure 10 and Figure 11 show an example of a combination where we require more than one drug for treatment. Another example can be a treatment plan with more than one acceptable drug, shown in Figure 12 and Figure 13.

4. Additional Steps for Supply Chain Shortage Risk Quantification Methodology

In this section, we present the additions to the methodology we have developed in our previous paper, “A Quantitative Approach to Assess the Likelihood of Supply Chain Shortages” [8]. The additions include importance measure quantification and possible avenues for mitigation analysis.

4.1. Calculating Importance Measures

Importance measures help us evaluate and rank the risk significance of the supply chain facilities with respect to one another [43]. Based on the importance measures, stakeholders can develop reliability improvement methods for vulnerable facilities. We calculate the importance measures of API and FDF facilities using built-in SCRAM libraries. A well-designed supply chain will have equally balanced importance measures. Otherwise, a supply chain configuration may be optimal in production but not have a resilient production flow. In the following sections, $I\left(i\right)$ denotes the importance measure type, $i$ denotes a facility, $F$ denotes failure probability, $R$ denotes reliability, $P$ denotes probability, $s$ denotes supply chain and $mcs$ denotes minimal cutsets.

4.1.1. Marginal Importance Measure

The marginal or Birnbaum’s importance measure (MIF) quantifies the rate of change of the supply chain risk with respect to changes to the reliability of a single facility as shown in Equation (1). Hence, if the Birnbaum measure of a facility is high, then it means that we need to keep the facility at its current reliability, or we may see a dip in the supply chain resilience profile.

$$I^{MIF}(i)={\displaystyle \frac{\partial F_s}{\partial F_i}}$$

(1)

4.1.2. Diagnostic Importance Measure

The diagnostic or Fussell–Vesely importance measure (DIF) is the probability that at least one minimal cut-set that contains a specific facility results in system failure as shown in Equation (2). It is the fraction of risk associated with a facility, which means strengthening safeguards at facilities with the highest DIF gives us the highest rewards in increasing the supply chain resilience.

$$I^{DIF}(i)={\displaystyle \frac{{\sum }_j^{{mcs}_i}{P}_j^i}{P_s}}$$

(2)

4.1.3. Risk Achievement Worth

The risk achievement worth (RAW) importance measure quantifies the relative increase in the supply chain failure probability given that facility i is in a failed state as shown in Equation (3). We can use this to judge which facilities to keep at current reliability.

$$I^{RAW}(i)={\displaystyle \frac{F_{s_{i=1}}}{F_s}}$$

(3)

4.1.4. Risk Reduction Worth

The risk reduction worth (RRW) importance measure quantifies the relative reduction in the supply chain failure probability given facility i is made perfectly reliable as shown in Equation (4). We can use this to judge improvements in which facilities will give us maximum payoff in increasing supply chain resilience.

$$I^{RRW}(i)={\displaystyle \frac{F_s}{F_{s_{i=0}}}}$$

(4)

4.1.5. Application of Importance Measures

Once we have calculated the importance measures for the objects of interest, in our case, the supply chain facilities, we can use the results to inform mitigation efforts. For example, in the nuclear industry the RAW and FV measures are recommended by the PRA standard for non-light water reactors as criteria for determination of risk-significance [44]. As shown in Figure 14, the red and blue lines represent the importance measure thresholds that we can use to inform the Operation and Maintenance (O&M) procedures at nuclear power plants. Similarly, stakeholders can develop importance measure criteria for supply chain facilities.

4.2. Mitigation Methods

Using the minimal cutsets, supply chain shortage risk profile, and importance measures we arrive at sets of risk-significant facilities that warrant risk mitigation strategies. For these supply chains, it is of interest to mitigate the risk by implementing improvements at the facility, logistics, and network levels. At the facility level, measures include troubleshooting manufacturing issues, optimizing processes, training staff, and implementing preventive maintenance to reduce downtime and quality failures. Logistics risks can be addressed by diversifying transport routes and carriers, maintaining buffer inventories of critical inputs and finished products, and strengthening cold chain management with real-time monitoring and redundancy. Network-level strategies focus on redundancy through qualifying backup manufacturing facilities, engaging multiple suppliers for raw materials and packaging, and maintaining strategic stockpiles. These actions are supported by enhanced supply chain visibility through digital tracking systems and risk monitoring tools, which allow early detection of disruptions and faster response.

5. SUPRA Results

In this section, we present and discuss the failure and flow quantification results generated by SUPRA.

5.1. Fault Tree Quantification Results

We generated outputs in the form of excel sheets as shown in

Table 2. Output Data from SUPRA for Drug Supply Chain Flow and Failure Probability.

Drug ID	$\mathit{D}\mathit{r}\mathit{u}\mathit{g}\_1$
Failure Probability	$2.87\times {10}^{-3}$
Warnings	none
Throughput/Flow	$8.00\times {10}^{+3}$
Demand	$7.95\times {10}^{+3}$
Shortage/Surplus	$4.40\times {10}^{+1}$

,

Table 3. Output Data from SUPRA for Drug Supply Chain Importance Measures.

Facility ID	$\mathit{A}\mathit{p}\mathit{i}\_\mathit{I}\mathit{d}$
Occurrence	$4.00\times {10}^{-0}$
Failure Probability	$9.10\times {10}^{-2}$
MIF	$4.46\times {10}^{-3}$
DIF	$9.33\times {10}^{-1}$
RRW	$1.03\times {10}^{+1}$
RAW	$1.50\times {10}^{+1}$

and

Table 4. Summary of Statistics from SUPRA Results.

Failure Probability	5th Percentile	Median	95th Percentile
Without Backup	$5.02\times {10}^{-8}$	$3.36\times {10}^{-5}$	$1.46\times {10}^{-2}$
With Backup	$2.48\times {10}^{-8}$	$1.95\times {10}^{-5}$	$8.91\times {10}^{-3}$

. Table 2 lists the quantified drug supply chains with failure probability, any quantification error warnings, the supply chain output, a demand value, and the calculated drug shortage. Table 3 lists the importance measures of supply chain facilities calculated with respect to the drug supply chain they belong to. Lastly, Table 4 gives a summary of the failure probability quantification results. From Figure 15, Figure 16 and Figure 17 we can see that adding backup facilities reduces the failure probabilities for a significant number of supply chains.

We plotted the shortage risk profile with and without back-ups using a variable demand that we randomly picked in the range of 90–100% of the drug supply units calculated without backup. The shortage risk profile is an important result that helps us:

• To parameterize and quantify the effect of constant or variable demand on the supply chain shortage.
• To establish the basis for the cost-benefit analysis of adding backup facilities.
• To develop consequence analysis and risk-significance determination criteria. Using expert judgment, the shortage risk profile can be used to quantify drug shortages’ economic consequences, and the risk-significance criteria can be used to inform prioritization of facility risk reduction efforts.

As we can see from Figure 18 and Figure 19, adding backup facilities shifts the distribution of supply chain facilities to lower failure probabilities and lower shortage. Figure 20 presents the RAW and DIF for each facility in a representative drug supply chain. Facilities APP2-API1 and APP1-API2 appear in the upper-right corner, indicating that reliability improvements at these sites would yield the greatest reduction in overall supply chain risk. In contrast, facilities clustered in the lower-left corner exhibit low DIF and RAW values, implying that reducing investment at these sites (e.g., under austerity measures) would have minimal impact on shortage risk as compared to the facilities in the upper-right corner.

This ranking provides the foundation for a cost–benefit analysis. For instance, improving reliability at APP2-API1 might require investment in an additional production line or quality-control system. Although this incurs upfront costs, the expected benefits such as avoided drug shortages, reduced patient impact, and lower emergency procurement costs, can outweigh the investment, especially for high-demand drugs. On the other hand, investing similar resources in low-importance facilities would yield minimal reductions in shortage probability, offering poor returns. Thus, importance measures allow decision-makers to weigh the cost of mitigation actions against the value of avoided disruptions, supporting efficient allocation of limited resources across the supply chain.

5.2. Computational Complexity and Parallelization

The computational complexity of SUPRA is driven by the underlying SCRAM engine, whose complexity can be expressed as a linear term in the number of basic events, plus a term that depends quadratically on the number of gates [45]. Because each drug-specific fault tree can be constructed independently, the problem is trivially parallelizable, enabling us to distribute fault-tree construction across cores with minimal communication overhead.

Using this scheme, 7567 fault trees were quantified in 7942.583 ms on a machine with 8 physical CPU cores, each capable of running two threads simultaneously for a total of 16 logical processors. This is consistent with SCRAM engine benchmarks, which quantify medium-sized fault trees in milliseconds, and compares favorably with commercial PRA tools that often require seconds to minutes for larger integrated models [46]. Unlike simulation-based methods that can require hours for uncertainty propagation, SUPRA’s runtime demonstrates near-linear scalability and suitability for large-scale supply chain analysis.

6. Conclusions

There is a need for a method that represents the supply chain in a format conducive to decision-making analysis and can be automated. In this paper, we presented a software tool to assess the likelihood of supply chain shortages in this paper to suit the research need. The software tool, Supply chain Probabilistic Risk Assessment (SUPRA), takes in supply chain facility failure and flow information and outputs supply chain failure probability. Thus, this paper advances the knowledge representation and extraction of supply chain shortages by relating facility-level failure to supply chain level failure, generating a shortage risk profile, and automating the process. This study introduced the Supply chain Probabilistic Risk Assessment (SUPRA) tool as a systematic framework for quantifying shortage risks in pharmaceutical supply chains. By combining fault tree analysis with network graph modeling, SUPRA links facility-level failures to supply chain-level outcomes, enabling the development of shortage risk profiles, importance measures, and uncertainty analyses. In contrast to much of the existing supply chain risk management literature, which relies on qualitative scoring, simulation-based methods with potentially long runtimes, or artificial intelligence approaches that often lack transparency and explainability, SUPRA provides an approach rooted in the well-established principles of probabilistic risk assessment. The tool demonstrated scalability by quantifying 7567 fault trees in under eight seconds (~1 ms per tree), performance that is consistent with SCRAM benchmarks and compares favorably with commercial PRA tools that often require seconds to minutes for larger integrated models. These results highlight SUPRA’s suitability for large-scale supply chain analyses, where efficiency and interpretability are essential. Overall, SUPRA advances the state of supply chain risk assessment by offering decision-makers a data-driven methodology to establish risk profiles, identify vulnerabilities, prioritize mitigation strategies, and strengthen resilience in critical sectors such as healthcare.

7. Future Work

At its current stage, SUPRA is designed to quantify shortage risks in pharmaceutical drug supply chains. Ongoing development aims to extend the framework to generic supply chains by varying the input structure to include gate information, enabling representation of diverse supply chain configurations. The overarching objective is to establish a probabilistic framework for general supply chains, where a Boolean representation supports the full suite of PRA analyses and the corresponding directed acyclic graph can be leveraged for optimization studies. This integration will allow optimization results to be directly related to reliability outcomes, thereby enabling the development of likelihood–consequence profiles.

A key limitation of applying this framework is the availability of supply chain information. However, this challenge can often be mitigated depending on the stakeholder. Regulatory agencies, for example, typically have access to inspection data that can serve as a foundation for failure probability estimates, while industrial stakeholders often maintain internal logistics reliability data. Even in the absence of detailed probability inputs, structural analysis through minimal cut sets can reveal single-point failures that might otherwise remain hidden. In this way, SUPRA can be used not only for quantification but also for risk-informed decision-making to strengthen supply chain resilience across sectors.