  In system development, epistemic uncertainty is an ever-present possibility
when reasoning about the causal factors during hazard analysis. Such
uncertainty is common when complicated systems interact with one another, and
it is dangerous because it impairs hazard analysis and thus increases the
chance of overlooking unsafe situations. Uncertainty around causation thus
needs to be managed well. Unfortunately, existing hazard analysis techniques
tend to ignore unknown uncertainties, and system stakeholders rarely track
known uncertainties well through the system lifecycle. In this paper, we
outline an approach to managing epistemic uncertainty in existing hazard
analysis techniques by focusing on known and unknown uncertainty. We have
created a reference populated with a wide range of safety-critical causal
relationships to recognise unknown uncertainty, and we have developed a model
to systematically capture and track known uncertainty around such factors. We
have also defined a process for using the reference and model to assess
possible causal factors that are suspected during hazard analysis. To assess
the applicability of our approach, we have analysed the widely-used MoDAF
architectural model and determined that there is potential for our approach to
identify additional causal factors that are not apparent from individual MoDAF
views. We have also reviewed an existing safety assessment example (the ARP4761
Aircraft System analysis) and determined that our approach could indeed be
incorporated into that process. We have also integrated our approach into the
STPA hazard analysis technique to demonstrate its feasibility to incorporate
into existing techniques. It is therefore plausible that our approach can
increase safety assurance provided by hazard analysis in the face of epistemic
uncertainty.
