This approach is generally preferred for components that are being used as part of larger systems because it allows the ultimate consequences to be ignored in favor of the technical outcomes that can be produced by the component(s).

Fault modeling: Based on historical experience and data (e.g., manufacturers data, experimental data, plant experience, proximate and root cause analysis, etc.), classes of faults (e.g., stuck open, stuck closed, transient, bridging, operator error or malice, etc.) associated with components (e.g., PLC model #33457, manufacturing run 23, valve controllers, the components comprising it, its operating environment, its protocols, etc.) should be identified, cataloged, and modeled.

Fault set determination: For the composite comprising relevant components (e.g., the gas mixing chamber PLC), composites (e.g., the gas mixing chamber and associated components), the entire plant (the fuel factory), and its environment (i.e., a war zone in Tornado alley next to a global child refugee camp), the set of relevant faults should be identified. This depends on the level of analysis being performed (e.g., all SPOFs, multiple fault models, event sequence analysis, common mode failure analysis, human accidental, intentional, and malicious acts, etc.).

Analysis linking faults to failures: Analysis of the paths from faults to failures are then undertaken to determine all failures that can results from all faults in the fault set(s) (e.g., various faults in the PLC as well as operator override can lead to the ability to open the door to the gas missing chamber while it has gas present).

Failure consequence analysis: If this is the final plant or composite, then analysis of the consequences of each failure should be undertaken to rate the consequences per the risk rating methodology in use. At the level of the PLC, all the failures are essentially conditions that can exist from underlying faults, but no consequences are identified other than "wrong output". At the level of the gas mixing chamber, consequences could include having the access door open while gas was in the gas mixing chamber. At the level of the gas mixing chamber and associated components, consequences could include ignition of the gas, explosion, and death to present operator(s). As the context increases, the greater consequences to the children in the refugee camp may be revealed.

This approach is generally preferred for large composite systems because it limits the analysis sooner and further but has less thorough coverage of details and can miss cases that were not anticipated or found to be realistic.

Consequence hypotheses: A set of potentially serious negative consequences of interest are generated and used as the basis for the analysis. In this analysis, feasibility of consequence is ignored with the goal of producing a comprehensive set of serious negative consequences (e.g., the gas mixing chamber blows up).

Consequence to failure analysis: From the set of consequences, hypothetical proximate causes that could produce those consequences are generated (e.g., an ignition source comes into contact with the gas in the gas mixing chamber). From those proximate causes, causal sequences and root causes are sought to the level of components in the plant (e.g., the gas chamber PLC could fail and allow the chamber to be opened when gas is present) and threats and their ultimate actions (e.g., authorized employee decides to commit suicide by lighting a match and throwing it into the gas mixing chamber). This results in a set of failure modes and sequences of interest (e.g., the PLC could be overridden by an employee who then decides to commit suicide ...). In this analysis, it is assumed that failures can happen and that normal controls (e.g., the employee reliability program and PLC change controls) are not effective.

Analysis linking failures to faults: Analysis then combines the proximate causes to a set of root causes that may produce these consequences and combines them to identify fault sets (e.g., the gas mixing chamber access door can be opened when gas is present by manual override of the PLC AND the same person who can override the PLC controls can access the access door) that may be addressed by failsafe mechanisms (e.g., a mechanical interlock that prevents physical opening of the door when the internal pressure differs from normal atmospheric pressure) as opposed to another compensating control (e.g., separation of duties prohibits the individual who has physical PLC access from also having physical access to the gas mixing chamber door).

Determination of preferred (safest) failure mode(s) and mechanism(s): Given all the scenarios in which different event sequences may produce potentially serious negative consequences (e.g., failure to allow physical access to the gas mixing chamber during an overpressure event may result in a breech of the chamber resulting in poisoning of plant personnel) and the different potential "safe" modes for failures (e.g., a relief valve releasing noxious gases to the environment) some of which may conflict with each other (e.g., the relief valve could be damaged by mechanical attack leading to a mixing chamber explosion), failsafe modes and mechanisms are selected so as to cover, or leave uncovered with management acceptance of the risk, each sequence with consequences above management specified thresholds.

Engineering limits on failsafes: All failsafes must be engineered, and engineering helps to define the limits of these failsafes. Such limits are designed so as to withstand the anticipated ranges of events to the level necessary in order to fail in the desired (safe) mode.

Root (and proximate) cause analysis and improvement: Over time, better understanding and analysis and changing environments (i.e., operating ranges and threats) lead to anticipatable and/or realized events with consequences. These are analyzed over time to identify and better understand proximate and root causes of failures and to adapt the approach to and mechanisms for failsafes.