Hazard causal analysis is used to refine the high-level safety constraints into more detailed constraints. This process requires a model of the system, even if that model is just in the head of the analyst. Causal analysis almost always involves some type of search through the system design (model) for states or conditions that could lead to system hazards. Search can be top-down or bottom-up and either forward or backward.