Background - Using Event-B for Critical Device Software Systems - page 20

Fig. 2.4 FMEA—Evaluating forward from cause to consequences

Fig. 2.5 HAZOP—Evaluating from the fault in both directions for causes and consequences

Hazard and Operability Analysis (HAZOP)

Hazard and operability studies (HAZOP) are more commonly used at the broadest
level for analysing process plants like chemical and nuclear industries [ 57 ]. The
HAZOP supports the chemical process industry, takes a representation of a system
and analyses how its operation may lead to an unsafe deviation from the intent of the
system [ 57 ] with special attention to the environment of operation. This technique
is very popular in industries because it aims to predict possible failures, and identify
their impact.
HAZOP [ 92 ] is a most prominent formal technique for identification of the haz-
ards. This technique examines all the essential components and their interconnec-
tions of a system to explore the possible causes of errors and their consequences.
Particularly, HAZOP is a powerful technique for exploring the interaction between
parts of a system. HAZOP is based on a theory that assumes risk events are caused
by deviations from design or operating intentions. Identification of such deviations
is assessment and generally facilitated by using a set of “guide words” as a system-
atic list that includes process, and deviation perspectives. HAZOP starts to analyse
in both directions, backwards to explore its possible causes, and forwards to exam-
ine its consequences (see Fig. 2.5 ).
A set of safety analysis techniques like FHA, FTA, FMEA, and HAZOP, is used
to identify a list of base events that can contribute to hazardous conditions. A list of
events gives the general categories of safety properties required to the requirement
model of a system. A more detailed discussion of the system hazard analyses (SHA)
with the software perspective is provided in [ 57 , 72 ].