System Hazard analysis Cause-Consequence Analysis Used primarily in Europe A combination of forward and top-down search Again based on converging chain -of-events Diagrams can become unwieldy Separate diagrams required for each initiating event Cause-Consequence Uncontrolled Diagram eaction Valve failure does not critical event Pressure too high open Relief valve 1 opens? YesNo Operator Valve does not failure open Relief valve 2 opens? N Pressure reduced ExplosionCause−Consequence Analysis Leveson − 151 System Hazard Analysis A combination of forward and top−down search. Again based on converging chain−of−events. Diagrams can become unwieldy. Separate diagrams required for each initiating event. Used primarily in Europe. c c Leveson − 152 System Hazard Analysis Cause−Consequence Diagram critical event open does not Computer Pressure too high opens? Valve Operator open Valve reaction Yes No Relief valve 1 Pressure Explosion reduced does not Yes No Relief valve 2 failure opens? failure Uncontrolled