HARA (Hazard Analysis and Risk Assessment)
The HARA (Hazard Analysis and Risk Assessment) is the hazard analysis and risk assessment according to ISO 26262-3. It rates the hazards of a vehicle system by severity, exposure and controllability, derives the ASIL from this and defines the top-level safety goals — it thus stands at the beginning of all safety activities in an automotive project.
How a HARA proceeds
The HARA takes place in the concept phase and builds on the item definition, which establishes the object under consideration and its system boundaries. The process in brief:
- Situation analysis and hazard identification: Relevant driving situations (e.g., motorway driving, parking, city traffic) are combined with possible malfunctions of the item. Each combination yields a hazardous event.
- Rating by S, E and C: Each hazardous event is rated by severity of possible injuries (S0–S3), probability of the driving situation (E0–E4) and controllability by the driver or other road users (C0–C3).
- ASIL classification: The combination of the three parameters yields QM or ASIL A to D.
- Safety goals: For each relevant hazardous event, a safety goal is formulated — the top-level safety requirement, which inherits the ASIL.
An example
A simplified HARA row for an electric power steering system could look like this:
| Element | Content |
|---|---|
| Malfunction | Unintended steering intervention |
| Driving situation | Driving at high speed on the motorway |
| S / E / C | S3 (life-threatening injuries possible) / E4 (frequent situation) / C3 (difficult to control) |
| Classification | ASIL D |
| Safety goal | An unintended steering intervention at high speed must be prevented. |
From this safety goal, functional and technical safety requirements are subsequently derived — all the way down to architecture, implementation and test cases.
Distinction: HARA, TARA and FMEA
| Method | Guiding question | Context |
|---|---|---|
| HARA | Which hazards arise from malfunctions at the vehicle level? | Safety, ISO 26262-3, top-down |
| TARA | Which threats arise from malicious attacks? | Security, ISO/SAE 21434 |
| FMEA | Which failure causes and effects does a design have at the component level? | Analysis method, bottom-up |
HARA and TARA look at exactly the same system from two angles: safety protects the environment from the system, security protects the system from the environment. The FMEA comes in later — it analyses how a concrete design can fail, while the HARA asks which misbehaviour at the vehicle level is dangerous in the first place.
HARA in practice: not a static document
The biggest practical challenge is not the initial creation, but the maintenance. Late changes to the system boundaries regularly force a re-assessment of hazardous events — not infrequently shortly before the design freeze. Anyone who maintains the HARA as a frozen document then works against copies and loses consistency with requirements, analyses and tests. The opposite approach is what holds up: the HARA as a continuously maintained work product, linked to the system model via trace links. If a hazardous event is re-assessed, the links immediately show which requirements, architectural elements and test cases are affected — and which remain untouched.