Background - Using Event-B for Critical Device Software Systems - page 18

Fig. 2.2 FTA—Evaluating back from consequence to cause

(FMEA) [ 31 ] are standards to apply for hardware intensive systems that are also
applicable for the software systems. Traditional safety analysis therefore begins by
defining the hazards associated with a system, determines their severity, and then
attempts to identify the factors that can initiate the hazards. These safety analysis
techniques provide a rigorous way to examine the causes and their consequences of
the identified hazards.

Functional Hazard Assessment (FHA)

Hazard are unfavourable conditions that a system should avoid to occur or must be
identified in advance. Once the hazards are known that it becomes possible to trace
backwards from the hazards to the particular events that can cause them. Functional
Hazard Assessment (FHA) is used to identify such type of hazards that can be oc-
curred because of functional failure. The safety analysis techniques concentrate on
defining the required functionality and analysing the consequences of failures. The
FHA is an informal process that is used to document hazards and determine their
severity. The FHA produces a list hazards in tabular form with different degree of
severity [ 109 ].

Fault Tree Analysis (FTA)

Where a system is self-contained, having its boundaries well defined, one focuses on
the hazards that are internal to the system, which may be termed faults. Thus, a fault
is always a hazard, but not conversely. At this level, we have another technique to
analyse the systems using Fault Tree Analysis (FTA) [ 73 ]. The FTA is a safety anal-
ysis technique that is deductive and top-down method of analysing system design
and performance to identify all the possible failures or errors. It is based on a feed-
back process that can start with a system level hazard and try to discover backward
for identifying all the possible causes of hazards (see Fig. 2.2 ). The FTA shows a
list of hazards according to the hazard level. Although, the FTA has limited use for
identifying the faults of a system using a visual technique that can trace higher level
events down to their contributing events in form of failures, errors or faults. The
FTA is represented in a tree structure that shows various factors to contribute a high