8. Hazard Analysis

In contrary to fault tree analysis (FTA) focusing on root causes of failures on system level and to failure mode and effects analysis (FMEA) focusing on effects of single failures on system level, hazard analysis (HA) focuses on hazards (potential sources of high risks, hazard sources, hazard modalities, kinds of hazards, hazard modes) and their resulting risks on system level. It is argued that hazard analysis can be considered as inductive when starting from the hazard types. However, it allows for the (management) summary of bottom-up inductive as well as top-down deductive system analysis results. This is shown by relating hazard analysis to other approaches, in particular, the collection of results of other methods and the identification for more refined assessments. The following hazard analyses are introduced, related to each other and summarized using a matrix: preliminary hazard list (PHL), preliminary hazard analysis (PHA), subsystem hazard analysis (SSHA), system hazard analysis (SHA), and operation and support hazard analysis (O&SHA). The hazard log documents of past failures of similar systems, during development, testing and in the field, and their implications on system design and analyses. A further focus is on the evaluation of hazard analyses, including risk comparison, risk criteria, risk acceptance matrices, and risk graphs. All of them can also be used to determine requirements for safety functions, in particular, safety integrity levels (SIL). The different hazard analysis types are related to the phases of the functional safety life cycle according to IEC 61508 and a general system development process. Application examples include a standardization approach for a highly safety-critical domain summarizing best practices for hazard analyses, FMEA, FTA, reliability prediction, and hazard log, in particular, in which order to conduct and how to link the analysis methods and all the tabular approaches. Several hazard analysis templates and application examples are provided.