Selecting System Safety Analysis Techniques

Why This Topic Matters on the CSP Exam

The BCSP Certified Safety Professional (CSP) exam tests not only whether you know what a Fault Tree or a HAZOP is, but whether you can choose the right tool for the right situation. This is a core program management skill: safety professionals have limited time, budget, data, and personnel, and selecting an inappropriate technique wastes resources, produces incomplete hazard identification, or fails to satisfy regulatory or contractual requirements (such as MIL-STD-882, OSHA Process Safety Management under 29 CFR 1910.119, or ISO 45001 planning clauses). Questions in this area are typically scenario-based: you are given a system, a life-cycle stage, a goal, and available information, and asked which analysis method is most appropriate. Understanding the logic behind selection lets you reason through unfamiliar scenarios rather than relying on memorization alone.

What Is System Safety Analysis Technique Selection?

System safety is the application of engineering and management principles, criteria, and techniques to achieve acceptable risk within the constraints of operational effectiveness, time, and cost throughout all phases of a system life cycle. Selecting a technique means matching the analytical method to:

1. The purpose of the analysis (identify hazards, find causes of a specific top event, estimate probability, verify design controls, investigate an incident).
2. The life-cycle phase (concept, design, development, production, operation, maintenance, disposal).
3. The level of detail available (concept sketches versus complete drawings, component data, and operating procedures).
4. The type of system (hardware, software, human-centered process, chemical process, organizational).
5. The desired output (qualitative ranking versus quantitative probability).
6. Resources and expertise (time, money, data, trained analysts, availability of a multidisciplinary team).
7. Regulatory, contractual, or standards-driven requirements.

Key Classification Dimensions You Must Know

Inductive vs. Deductive
- Inductive (bottom-up, forward-looking): starts with a component failure or initiating event and asks what happens next. Examples: FMEA, FMECA, Event Tree Analysis, PHA, HAZOP, What-If. Good for identifying a broad range of hazards.
- Deductive (top-down, backward-looking): starts with an undesired top event and asks what combinations of causes could produce it. Examples: Fault Tree Analysis, MORT. Good for analyzing a known, specific, high-consequence event.

Qualitative vs. Quantitative
- Qualitative: ranks hazards by category (e.g., severity and probability matrices from MIL-STD-882). Examples: PHL, PHA, Checklist, What-If, JHA, HAZOP.
- Quantitative: produces numerical probabilities or rates. Examples: FTA with probability data, ETA, FMECA criticality numbers, Markov analysis, Reliability Block Diagrams, LOPA, Human Reliability Analysis (THERP).

Life-Cycle Timing
- Early (concept/preliminary design): PHL, PHA, Energy Trace and Barrier Analysis, Checklists, What-If.
- Detailed design: Subsystem Hazard Analysis (SSHA), System Hazard Analysis (SHA), FMEA/FMECA, FTA, HAZOP, Sneak Circuit Analysis, Software Hazard Analysis.
- Operations and maintenance: Operating and Support Hazard Analysis (O&SHA), JHA/JSA, Change Analysis, Management Oversight and Risk Tree (MORT) for incident investigation, Bow-Tie for communicating barriers.

Quick Reference: Major Techniques and When to Select Them

Preliminary Hazard List (PHL) - Very early concept phase; a brainstormed list of hazards with little system detail. Select when the question emphasizes earliest possible identification.

Preliminary Hazard Analysis (PHA) - Early design; qualitative, inductive, uses severity and probability categories. Select when a system is new, drawings are preliminary, and you need an initial risk assessment to guide design. Often the foundation for later analyses.

Checklist Analysis - Any phase; uses established lists derived from codes, standards, and experience. Fast and cheap but limited to known hazards. Select when the system is well understood and standards exist.

What-If Analysis - Any phase; brainstorming of questions beginning with what if. Flexible, low cost, relies heavily on team experience. Often combined with checklists (What-If/Checklist) for PSM compliance on simpler processes.

Hazard and Operability Study (HAZOP) - Detailed design or existing operations in chemical or continuous process systems; uses guide words (No, More, Less, Reverse, Part of, As well as, Other than) applied to process parameters (flow, pressure, temperature, level). Requires a multidisciplinary team, complete P&IDs, and significant time. Select when the question mentions process deviations, piping and instrumentation, or PSM-covered processes.

Failure Mode and Effects Analysis (FMEA) - Detailed design; inductive, component-level, hardware-oriented; examines each component failure mode and its effect on the system. Select when the question focuses on single-point component failures and reliability. Does not handle multiple simultaneous failures or human error well.

Failure Mode, Effects, and Criticality Analysis (FMECA) - FMEA plus a criticality ranking (often quantitative using failure rates). Select when prioritization by severity and probability of each failure mode is required.

Fault Tree Analysis (FTA) - Detailed design, operations, or incident investigation; deductive, uses Boolean logic gates (AND, OR) to trace a defined top event to basic causes; can be qualitative (minimal cut sets) or quantitative. Select when the question identifies a specific undesired event, asks about combinations of failures, or requires calculating the probability of a top event.

Event Tree Analysis (ETA) - Inductive; starts from an initiating event and branches through success or failure of safeguards to show possible outcomes. Select when the question asks about consequences and sequences following an initiating event or the effectiveness of layers of protection.

Cause-Consequence Analysis - Combines FTA (causes) and ETA (consequences). Select when both cause and outcome paths are needed in one model.

Bow-Tie Analysis - Visual combination of threats, preventive barriers, top event, mitigating barriers, and consequences. Select when the goal is communicating barrier management to operations personnel and management.

Layer of Protection Analysis (LOPA) - Semi-quantitative; evaluates whether independent protection layers reduce risk to a tolerable level. Often follows a HAZOP. Select when the question involves safety instrumented systems or SIL determination.

Job Hazard Analysis / Job Safety Analysis (JHA/JSA) - Operations phase; task-oriented; breaks a job into steps, identifies hazards, and specifies controls. Select when the question concerns worker tasks rather than equipment design.

Energy Trace and Barrier Analysis (ETBA) - Identifies energy sources, energy flow paths, targets, and barriers. Select when the scenario emphasizes energy sources (electrical, mechanical, chemical, thermal, pressure) and barrier adequacy.

Change Analysis - Compares a planned or actual condition to a baseline to find what changed. Select for management of change (MOC) questions or incident investigations where something was altered.

Management Oversight and Risk Tree (MORT) - Comprehensive deductive tree focused on management system and oversight failures. Select for in-depth incident investigation or evaluating the safety management program itself.

Sneak Circuit Analysis - Finds latent, unintended paths in electrical or control circuits that cause unwanted functions without a component failing. Select when the question involves electrical or control logic systems producing unexpected operations.

Software Hazard Analysis - Applied to software-controlled safety functions; often uses Software Safety Integrity Levels. Select when software controls a hazardous function.

Human Reliability Analysis (HRA/THERP) - Quantifies human error probabilities within a system. Select when human performance is the dominant risk contributor.

Markov Analysis and Reliability Block Diagrams - Quantitative reliability modeling of systems with redundancy, repair, or state transitions. Select when the question asks about system availability or redundant configurations.

Subsystem Hazard Analysis (SSHA), System Hazard Analysis (SHA), O&SHA - MIL-STD-882 task analyses: SSHA looks within a subsystem, SHA at interfaces between subsystems, O&SHA at human procedures in operation and support. Know these for defense or government contract scenarios.

How the Selection Process Works (Step by Step)

1. Define the objective. Is it broad hazard identification, root cause of a specific event, probability estimation, or verification of controls?
2. Determine the life-cycle phase and available information. No detailed drawings means PHL/PHA/What-If; complete P&IDs allow HAZOP; component failure data enables FMECA or quantitative FTA.
3. Characterize the system. Process plant favors HAZOP; electromechanical hardware favors FMEA; human tasks favor JHA; software favors software hazard analysis; management systems favor MORT.
4. Decide on inductive, deductive, or both. Unknown hazards: inductive. Known catastrophic event: deductive.
5. Decide on qualitative or quantitative output. Regulatory or contractual requirements for numerical risk often drive FTA, ETA, LOPA, or FMECA.
6. Assess resources. HAZOP and FTA are resource-intensive; checklists and What-If are quick.
7. Consider combining techniques. Mature programs layer them: PHA early, HAZOP and FMEA in detailed design, FTA for critical events, LOPA for safeguards, JHA for operations, MORT for investigations.
8. Document the rationale. Program management requires justifying the choice in the System Safety Program Plan (SSPP).

Exam Tips: Answering Questions on Selecting System Safety Analysis Techniques

Tip 1 - Look for the trigger words. The stem usually contains a clue that maps to one technique:
- Top event, undesired event, combinations of failures, AND/OR gates, minimal cut set = FTA
- Initiating event, sequence of outcomes, success or failure of safeguards = ETA
- Guide words, process deviations, P&IDs, chemical process = HAZOP
- Component failure mode, single-point failure, effect on system = FMEA/FMECA
- Earliest phase, concept, limited design information = PHL or PHA
- Job steps, task, worker exposure = JHA/JSA
- Energy source, barrier, target = ETBA
- Management system weakness, oversight, incident investigation = MORT
- Something was modified or differs from baseline = Change Analysis
- Unintended electrical path with no component failure = Sneak Circuit Analysis
- Independent protection layers, SIL = LOPA
- Visual communication of threats and barriers = Bow-Tie

Tip 2 - Match the life-cycle phase. If the question says the design is not yet finalized, eliminate techniques that need detailed drawings or failure-rate data (HAZOP, FMECA, quantitative FTA). If the system is already operating, lean toward O&SHA, JHA, Change Analysis, or Bow-Tie.

Tip 3 - Distinguish inductive from deductive. Many questions hinge on this. Remember: FTA is deductive and top-down; FMEA and ETA are inductive and bottom-up. If a question asks which technique starts with a single undesired outcome and works backward, the answer is FTA, not FMEA.

Tip 4 - Watch for qualitative versus quantitative wording. If the stem asks for a probability of system failure or a numerical risk value, choose a quantitative method (FTA with data, ETA, FMECA, Markov, LOPA). If it asks for initial ranking or screening, choose a qualitative method (PHA, Checklist, What-If).

Tip 5 - Know the limitations. Exam distractors often exploit weaknesses: FMEA does not handle multiple simultaneous failures or human error well; Checklists miss novel hazards; HAZOP is time-consuming and process-specific; FTA requires a well-defined top event and can miss hazards outside the tree; What-If depends on team experience.

Tip 6 - Choose the MOST appropriate, not just a possible one. Several options may technically work. The CSP exam asks for the best fit given constraints such as time, cost, phase, and system type. Eliminate options that are overkill for the information available or too shallow for the stated objective.

Tip 7 - Remember the MIL-STD-882 task sequence. PHL, then PHA, then SSHA, SHA, O&SHA, and Health Hazard Analysis. Questions about a defense or government program often expect this terminology.

Tip 8 - Recognize combined approaches. Answers such as HAZOP followed by LOPA, or FTA combined with ETA (Cause-Consequence), reflect real program management practice and are frequently correct when the stem describes a comprehensive analysis of a high-hazard process.

Tip 9 - Apply basic probability when FTA appears. For an OR gate with independent, small probabilities, add them (or use 1 minus the product of the complements for precision). For an AND gate, multiply. Be ready to compute a simple top-event probability.

Tip 10 - Think like a program manager. The correct answer often balances rigor with practicality. If the organization lacks process data and experts but needs a quick screening of a simple operation, a What-If/Checklist is more defensible than a full HAZOP.

Practice Scenarios

Scenario 1: A design team has only concept sketches of a new conveyor system and wants to identify hazards before detailed design. Best choice: Preliminary Hazard Analysis, because detailed component and process information does not exist yet.

Scenario 2: A refinery wants to systematically evaluate deviations in flow, pressure, and temperature on a new distillation unit with completed P&IDs. Best choice: HAZOP, because guide-word deviation analysis of process parameters on a continuous chemical process is its defining application.

Scenario 3: Management wants to know the probability that a hydraulic press will cycle unexpectedly with an operator in the point of operation and which combinations of failures could cause it. Best choice: Fault Tree Analysis, because there is a defined top event and interest in failure combinations and probability.

Scenario 4: A relief valve lifts; the company wants to map possible outcomes depending on whether the flare, scrubber, and detection systems function. Best choice: Event Tree Analysis, because it begins with an initiating event and branches on safeguard success or failure.

Scenario 5: An investigator wants to determine how management planning, oversight, and barriers failed in a fatal incident. Best choice: MORT, because it is designed to evaluate management system and oversight deficiencies.

Scenario 6: A reliability engineer must evaluate every component in a braking assembly for how it can fail and the effect of each failure on braking performance. Best choice: FMEA (or FMECA if ranking by criticality is required).

Summary

Selecting a system safety analysis technique is a matching exercise: align the method with the objective, life-cycle phase, system type, information available, desired output, and resources. On the CSP exam, read each stem for trigger words, identify whether the task is inductive or deductive and qualitative or quantitative, eliminate techniques that do not fit the phase or data available, and choose the single most appropriate method. Mastering this reasoning process will let you answer both direct recall questions and complex scenario questions in the Program Management domain with confidence.