Topic · Hazard analysis

How do I do hazard analysis for a software component and tie it to the code?

Proof walks each requirement against an obligation catalog. Every class the reviewer considered gets ACCEPT, SUPPRESS, DEFER, or DRAFT. The next audit fails if one of those exits silently.

proof audit --check obligation_baseline

Jama, Polarion, and codeBeamer store the worksheet. Ansys medini authors a HARA. Neither re-reads the Go you ship.

Request demo One requirement, five classes

01 · The distinction

A worksheet is a document. A class is a promise on the requirement.

Hazard analysis in Proof is not a spreadsheet of failure modes. It is a pass over requirements after the spec lints are clean, before coverage spends evidence on classes nobody consulted the catalog about.

The catalog ships classes such as csrf_protection, recursion_depth_bounded, redos_resistant. The toolchain does not propose them. The reviewer reads proof catalog list and proof catalog show, then records one of four equal decisions.

ACCEPT adds the class to obligation_checklist. Coverage later has to evidence it. SUPPRESS needs a rationale of 32 characters or more that names why the class does not apply. DEFER opens a KnownIssue. DRAFT authors a project-local class when the shipped catalog has no row for the hazard.

proof audit --check obligation_baseline
proof audit --check code_signal_obligations_reviewed

Those two checks are the tie to the code. obligation_baseline fails if a catalog candidate left the pass with no decision. code_signal_obligations_reviewed fails if the analyzer inferred a class from the implementation and nobody ACCEPT/SUPPRESS/DEFER'd it.

02 · The exhibit

The shall was sharing a WebSocket. The catalog asked five other questions.

Drawn from the hazard-analysis help page. A system requirement: the user shall share one WebSocket across browser tabs.

HARA / ALM

Stores a document of failure modes
Pass the worksheet opens

Authored

The code

The worksheet does not re-read Go.

Not tied

Worksheet

Still a document. Silence is allowed.

Opens

Proof

Decision ACCEPT / SUPPRESS / DEFER / DRAFT
Check obligation_baseline

Silence fails CI

Same hazard pass. Two artefacts. Click the tabs.

Catalog class	Why it came up	Decision
`concurrent_invariant_preserved`	Tabs read and write the same socket.	ACCEPT
`compound_operation_atomic`	Connect-and-subscribe is one logical act.	ACCEPT
`redos_resistant`	The shall does not parse untrusted text.	SUPPRESS
`cache_version_coherent`	The socket is the source of truth, not a cache.	SUPPRESS
`shared_connection_back_pressure_bounded`	Per-tab back-pressure. No shipped class.	DRAFT

SUPPRESS on redos_resistant is not a skip. The rationale has to name the concrete reason: framed binary payloads with a fixed schema, no untrusted strings. Shorter than 32 characters fails the audit. Silence fails it too.

DRAFT is the fourth equal decision, not a fallback. The project class is authored, then attached:

proof catalog new shared_connection_back_pressure_bounded --category domain --domain concurrency
proof req edit SYS-REQ-001 --add-obligation shared_connection_back_pressure_bounded

Each decision lands on the requirement as obligation_checklist, obligation_suppressions, or a hazard_review block pinned to reviewed_against_catalog_version. The next reviewer can re-derive why each class is where it is. A catalog bump without a fresh review fails hazard_review_current.

Job	HARA / ALM worksheet	Proof
Author the hazard worksheet	Yes. Jama, Polarion, medini.	No. Not a HARA editor.
Record a class on the requirement	A link a human asserted.	ACCEPT, SUPPRESS, DEFER, or DRAFT.
Fail CI if a considered class exits silent	No. The document still opens.	`obligation_baseline`
Tie the class to the code that ships	A matrix row, until someone edits it.	Coverage, or a code-signal review.

03 · The honest loss

This is not a HARA, not STPA, and not FMEA software.

Jama still wins at programme authoring. Ansys medini still authors the ISO 26262 worksheet. ReliaSoft still owns the FMEA form. Proof will not draw a GSN tree.

The catalog is a list of recurring software hazards, not a complete hazard identification method. STPA unsafe-control-action tables and IEC 61508 HARA remain the method documents. We do not replace them.

The toolchain does not invent classes. If the reviewer never opens the catalog, the pass is empty and the checks stay red. A green obligation_baseline means every considered class got a decision. It does not mean every hazard that exists was considered.

IBM DOORS sits on the Jama compare, not a twin. Traceability of shalls to code is the matrix page. The shalls themselves are FRETish.

Request demo Instruments