Ulfat-Bunyadi, NelufarHatebur, DenisHeisel, MarittaDencker, PeterKlenk, HerbertKeller, Hubert B.Plödererder, Erhard2017-06-162017-06-162017978-3-88579-663-3Safety analysis typically consists of hazard analysis and risk assessment (HARA) as well as fault tree analysis (FTA). During the first, possible hazardous events are identified. During the latter, failure events that can lead to a hazardous event are identified. Usually, the focus of FTA is on identifying failure events within the system. However, a hazardous event may also occur due to invalid assumptions about the system’s environment. If the possibility that environmental assumptions turn invalid is considered during safety analysis, a more realistic and complete safety analysis is performed than without considering them. Yet, a major challenge consists in eliciting first the ‘real’ environmental assumptions. Developers do not always document assumptions, and often they are not aware of the assumptions they make. In previous work, we defined the Six-Variable Model which provides support in making the ‘real’ environmental assumptions explicit. In this paper, we define a safety analysis method based on the Six-Variable Model. The benefit of our method is that we make the environmental assumptions explicit and consider them in safety analysis. In this way, assumptions that are too strong and too risky can be identified and weakened or abandoned if necessary.ensafety analysishazard analysisrisk analysisfault tree analysisassumptionenvironmentsix-variable modelText/Conference Paper1617-5468