14-Safety ↔ Security

Consolidated view of the coupling between hazard analysis (safety) and cyber analysis (security). The page cross-checks the PHA — Hazard study, the fault tree, the Cyber-LOPA and ZCR 2 — inconsistencies that none of these modules can see from its own page.

Conditional page

It is only useful if the "Cyber causes" extension is enabled in the Methods tab of the RI study context. Without it, the page invites you to enable it and shows nothing.

The chain

From the declared cause to the conditional likelihood, in four clickable steps:

Declared cyber causes  →  Grafts on the trees  →  Rows in Cyber-LOPA  →  Vp calculated
   (PHA — Hazard study)        (FTA)                  (Cyber-LOPA)         (ZCR 2 / 5)

Each step displays its counter: number of causes, grafts, rows.

The three cross-module checks

Each one cross-checks two modules — none can be detected from a single page.

Coverage of action modes

Checks that the library covers all action modes at every phase. Flags cells with no rule and no justification: an unjustified empty cell is a gap in the method, not an absence of risk.

Uncoted cyber causes

Flags initiating events carrying a cyber cause with no row in Cyber-LOPA. Their likelihood remains unknown: they are declared attackable but never coted.

Barrier double-counting

The methodologically most important check. It detects rows that keep a judged Vp while a barrier in the same scenario is marked cyber-vulnerable.

Why this is a defect

A barrier neutralised by the attacker cannot be credited twice: once in the Vp (process robustness) and once in the Cyber-LOPA. When it is, the risk is under-assessed — this is the classic error in safety/security coupling.

A read-only page

TIP

This page only reads data. Any correction is made in the relevant module — PHA — Hazard study, fault tree, LOPA or ZCR 2. It holds no data of its own.