Glossary

帅哥

FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A-1 Appendix A Glossary FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A-1 CONCEPT or TERM DESCRIPTION Acceptable Risk The residual (final) risk remaining after application of controls, i.e. Hazard Controls / Risk Controls, have been applied to the associated Contributory Hazards; that have been identified and communicated to management for acceptance. Accident An unplanned fortuitous event that results in harm, i.e. loss, fatality, injury, system loss; also see Risk Severity. The specific type and level of harm must be defined; the worst case severity that can be expected as the result of the specific event under study. Various contributory hazards can result in a single accident; also see Contributory Hazard, Cause, Root Cause, and Initiating Events. Accident. An unplanned event that results in a harmful outcome; e.g. death, injury, occupational illness, or major damage to or loss of property. Accident. An unplanned event or series of events resulting in: Death. Injury. Occupational illness. Damage to or loss of equipment or property. Damage to the environment. Accreditation A formal declaration by the Accreditation Authority that a system is approved to operate in a particular manner using a prescribed set of safeguards. Act A formal decision or law passed by a legislative body. Administrative Hazard Control Administrative controls to eliminate or reduce safety related risk, i.e. training, programs, procedures, warnings, instruction, tasks, plans; also see Risk Control. Anomalous Behavior Behavior which is not in accordance with the documented requirements Architecture The organizational structure of a system, identifying its components, their interfaces and a concept of execution between them. Assumed Risk The residual risk associated with a specific hazardous event or primary hazard, which has been accepted by management. Audit An independent examination of the life cycle processes and their products for compliance, accuracy, completeness and traceability. Audit Trail The creation of a chronological record of system activities (audit trail) that is sufficient to enable the reconstruction, review, and examination of the sequence of environments and activities surrounding or leading to an operation, procedure, or an event in a transaction from its inception to its final results. Authenticate (1) To verify the identity of a user, device, or other entity in a system, often as a prerequisite to allowing access to resources in the system. (2) To verify the integrity of data that has been stored, transmitted, or otherwise exposed to possible unauthorized modification. Barrier A material object or set of objects that separates, Demarcates, or services as a barricade; or FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A -2 CONCEPT or TERM DESCRIPTION something immaterial that impedes or separates. Both physical and non-physical barriers are utilized and applied in hazard control; i.e. anything used to control, prevent or impede unwanted adverse energy flow and / or anything used to control, prevent or impede unwanted event flow. Baseline The approved, documented configuration of a software or hardware configuration item, that thereafter serves the basis for further development and that can be changed only through change control procedures. Cause Something that brings about an event; a person or thing that is the occasion of an action or state; a reason for an action or condition. Certification Legal recognition by the certification authority that a product, service, organization or person complies with the applicable requirements. Such certification comprises the activity of checking the product, service, organization or person and the formal recognition of compliance with the applicable requirements by issue of certificate, license, approval or other document as required by national law or procedures. In particular, certification of a product involves: (a) the process of assuring the design of a product to ensure that it complies with a set of standards applicable to that type of product so as to demonstrate an acceptable level of safety, (acceptable risk); (b) the process of assessing an individual product to ensure that it conforms to the certified type design; (c) the issue of any certificate required by national laws to declare that compliance or conformity has been found with applicable standards in accordance with item (a). Certification Authority The organization or person responsible within the state (country) concerned with the certification of compliance with applicable requirements. Class(es) Parameters of risk are classified in order to conduct analysis, evaluations, reviews, presentations, etc.; i.e. generic contributory hazards, generic risks, generic events. Code A collection of laws, standards, or criteria relating to a particular subject. Component A combination of parts, devices, and structures, usually self-contained, which performs a distinctive function in the operation of the overall equipment. Configuration The requirements, design and implementation that define a particular version of a system or system component. Configuration Control The process of evaluating, approving or disapproving, and coordinating changes to configuration items after formal establishment of their configuration identification. Configuration Item A collection of hardware or software elements treated as a unit for the purpose of configuration management. Configuration Management The process of identifying and defining the configuration items in a system, controlling the release and change of these items throughout the system life cycle, recording and reporting the status of configuration items and change requests, and verifying the completeness and correctness of configuration items. Contributory The potential for harm. An unsafe act and / or unsafe condition which contributes to the FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A -3 CONCEPT or TERM DESCRIPTION Hazard accident, (see cause, root cause, contributory events, initiator; the potential for adverse energy flow to result in an accident.) A hazard is not an accident. A failure or a malfunction can result in an unsafe condition, and / or unsafe act. Human error can result in an unsafe act. Contributory Hazards define the contributory events that lead to the final outcome. For simplicity, Contributory Hazards can also include Initiating Events and Primary Hazards. Sequential logic defining the Hazardous Event should remain consistent throughout the hazard analysis process. Consequence See Risk Severity. Control See Risk Control Criticality Reliability term. The degree of impact that a malfunction has on the operation of a system. Critical Path Defines the sequence of events that control the amount of time needed to complete the effort described within the PERT (Program Evaluation Review Technique) network. Danger Danger expresses a relative exposure to a hazard. A hazard may be present, but there may be little danger because of the precautions taken. Damage Damage is the severity of injury, and / or the physical, and/ or functional, and /or monetary loss that could result if hazard control is less then adequate. Debug The process of locating and eliminating errors that have been shown, directly or by inference, to exist in software. Deductive Analysis A top down approach of analysis logic: “What can cause a specific event to occur?” Derived Requirements Essential, necessary or desired attributes not explicitly documented, but logically implied by the documented requirements. Development Configuration The requirements, design and implementation that define a particular version of a system or system component. Design Handbooks, Guides and Manuals Contain non-mandatory general rules, concepts, and examples of good and best practices to assist a designer or operator. Emulator A combination of computer program and hardware that mimic the instruction and execution of another computer or system. Engineering Controls Engineering design controls to eliminate or reduce safety related risks; also Hazard Control and Risk Control. Entity Item That which can be individually described and considered. May be an activity, process, product, organization, system, person or any combination thereof. Environment (a) The aggregate of operational and ambient conditions to include the external procedures, conditions, and objects that affect the development, operation, and maintenance of a system. Operational conditions include traffic density, communication density, workload, etc. Ambient conditions include weather, emi, vibration, acoustics, etc. (b) Everything external to a system which can affect or be affected by the system. An act that through ignorance, deficiency, or accident departs from or fails to achieve what FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A -4 CONCEPT or TERM DESCRIPTION Error should be done. Errors can be predictable and random. Errors can also be categorized as primary or contributory. Primary errors are those committed by personnel immediately and directly involved with the accident. Contributory errors result from actions on the part of personnel whose duties preceded and affected the situation during which the results of the error became apparent. The difference between a computed, observed, or measured value or condition and true, specified, or theoretically correct value or condition. A mistake in engineering, requirement specification, or design, implementation, or operation which could result in a failure, and /or contributory hazard. There are four types of Human Errors: 1) Omission 2) Commission 3) Sequence 4) Timing Explosion Proof The item is designed to withstand an internal explosion; designed to vent explosive bases below ignition temperature. Fail- Operational A characteristic design which permit continued operation in spite of the occurrence of a discrete malfunction. Fail-safe A characteristic of a system whereby any malfunction affecting the system safety will cause the system to revert to a state that is known to be within acceptable risk parameters. Fail-Soft Pertaining to a system that continues to provide partial operational capability in the event of a certain malfunction. Failure Reliability term. The inability of a system, subsystem, component, or part to perform its required function within specified limits, under specified conditions for a specified duration. A failure may result in an unsafe condition and / or act, i.e. a hazard; the termination of the ability of a system element to perform a required function; the lack of correct performance. Failures and hazards are not interchangeable. Firmware The combination of a hardware device and computer instructions and data that reside as readonly software on that device. Formal Verification The process of evaluating the products of a given phase using formal mathematical proofs to ensure correctness and consistency with respect to the products and standards provided as input to that phase. Formal Qualification Review Formal evaluation by top management of the status and adequacy of the quality system in relation to quality policy and objectives. Formal Qualification The process that allows the determination of whether a configuration item complies with the requirements allocated to it. Hazard The potential for harm; also see Contributory Hazard, Primary Hazard. A hazard is not an accident. Per FAA Order 8040.4 a " Condition, event, or circumstance that could lead to or contribute to an unplanned or undesired event." Hazard or hazardous condition. Anything, real or potential, that could make possible, or contribute to making possible, an accident. Hazard. A condition that is prerequisite to an accident. Hazardous An accident; also see Accident. It should be noted that a Hazardous Event is not being defined FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A -5 CONCEPT or TERM DESCRIPTION Event an occurrence that creates a hazard. This logic indicates that a Hazardous Event is an occurrence that creates the potential for harm; Initiating Event, or Root Cause, are more appropriate terms. The Hazardous Event (now) defines the total sequence of events from the Initiating Event to the final outcome, the harm, the Initiating Event, Contributory Hazards, Primary Hazard, and Risk Severity. The Hazardous Event under study is considered open or closed depending Report Status on the status of Hazard Control. The Hazardous Event under study is considered open; the corrective action Report Status evaluation and verification is in process. The status will remain open until (Open) management has reviewed the actions taken and accepted the associated risk. All related Contributory Hazards are to be evaluated. The hazardous Event under study is considered closed; the corrective Report Status action evaluation and verification is completed, and management has (Closed) reviewed the actions taken and has accepted the associated risk. Hazard Probability Hazard Probability defines in quantitative or qualitative terms, the estimated probability of the specific Contributory Hazards which are defined within the Hazardous Event under study; possible elements within a fault tree. Note that hazard probability is not defined as the aggregate probability of occurrence of the individual hazardous events that create a specific hazard; see Hazardous Event and Accident. Also note that Hazard Probability is not the same as likelihood; see likelihood. Hazard Probability. The aggregate probability of occurrence of the individual events (conditions). Hazard Severity. An assessment of the consequences of the worst credible accident that could be caused by a specific hazard. Hazard Tracking and Resolution. A tracking log is maintained for closeout. Risk Tracking and Risk Resolution should be conducted throughout the system life cycle. Risk/Hazard Controls are to be formally verified. Inadvertent Operation Unintentional operation. Independent Verification & Validation (IV&V) Confirmation by independent examination and provision of objective evidence that specified requirements have been fulfilled, and that the particular requirements for a specific intended use are fulfilled. Inductive A bottom-up analysis approach of analysis logic: “What happens if a specific failure occurs?” FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A -6 CONCEPT or TERM DESCRIPTION Analysis Incident A near miss accident with minor consequences that could have resulted in greater loss. An unplanned event that could have resulted in an accident, or did result in minor damage, and which indicates the existence of, though may not define, a hazard or hazardous condition. Sometimes called a mishap. Initiating Events Initiating Events; initiator; the contributory hazard; unsafe act and / or unsafe condition that initiated the adverse event flow, which resulted in the hazardous event under evaluation; also see Root Cause. Intrinsically Safe Design Designers determine which hazards could be present, the level of associated risk that could constitute danger, and the controls to assure acceptable risk. Nothing is perfectly safe; see safe. Inspection A static technique that relies on visual examination of development products to detect deviations, violations or other problems. Latent Present and capable of becoming though not now visible or active. Likelihood Likelihood defines in quantitative or qualitative terms, the estimated probability of the specific Hazardous event under study. Likelihood is one element of associated risk. Fault Trees and other models can be constructed and individual Hazard Probabilities are estimated, and likelihood can be calculated via Boolean Logic. It should be noted that estimated likelihood defined in conventional hazard analysis may be appropriate due to the variability, conference, resources, and other factors. See chapter 3 for specific definitions of likelihood. Malfunction Fail to operate in the normal or usual manner. Any anomaly which results in system deviation. Maintainability The ability of an item to be retained in or restored to specified condition when maintenance is performed by personnel having specified skill levels, using prescribed procedures, resources and equipment at each prescribed level of maintenance and repair. Managing Activity FAA organization assigned acquisition management responsibility for the system, facility, or prime or associated contractors or subcontractors who wish to impose system safety tasks on their suppliers. Methodology A particular procedure or set of procedures. Mishap A source of irritation, annoyance, grievance, nuisance, vexation, mortification. Note that mishap is not a synonym for accident. It is more appropriate to consider a mishap a minor accident. A hazard. Note that the use of mishap is different within the FAA community than as used in MIL-STD-882C. The latter equates mishap to an accident. N-Version Software Software developed and tested to fulfill a set of requirements where multiple versions of software are intentionally made independent and different. Differences can be in some or all of: specifications, design, use of language, algorithms, data structures, etc. Non- Developmental Deliverable part not developed as a part of the developmental process being addressed. The developer, or some other party but provides software - deliverable software that is not FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A -7 CONCEPT or TERM DESCRIPTION Item (NDI) developed under the contract. Non-developmental software may also be referred to as reusable software, government furnished software, commercially available software, or Commercial Off- The-Shelf (COTS) software. Non- Programmable (N-P) System A system based upon non-programmable hardware devices (i.e., a system not based on programmable electronics. NOTE: Examples would include hardwired electrical or electronic systems, mechanical, hydraulic, or pneumatic systems, etc. Objective Evidence Information, which can be proved true, based on facts obtained through observation, measurement, test or other means. Optimum Safety The associated risks that have been identified have been accepted provided that all identified controls are implemented and enforced. Phase Defined segment of work. Note: a phase does not imply the use of any specific life-cycle model, nor does it imply a period of time in the development of a product. Practice Recommended methods, rules, and designs for voluntary compliance. Process Set of inter-related resources and activities, which transform inputs into outputs. Product Service History Historical data generated by activities at the interface between the supplier and the customer and by supplier internal activities to meet the customer needs regarding the quality, reliability and safety trends of the product or service. Product Liability Generic term used to describe the onus on a producer or others to make restitution for loss related to personal injury, property damage or other harm caused by a product. Proximate Cause The relationship between the plaintiff’s injuries and the plaintiff’s failure to exercise a legal duty, such as reasonable care. Primary Hazard A primary hazard is one that can directly and immediately results in: loss, consequence, adverse outcome, damage, fatality, system loss, degradation, loss of function, injury, etc. The primary hazard is also referred to as: catastrophe, catastrophic event, critical event, marginal event, and negligible event. Quality Assurance A planned and systematic pattern of actions necessary to provide adequate confidence that an item or product conforms to established requirements. Quality Audit Systematic and independent examination to determine whether quality activities and related results comply with planned arrangements and whether these arrangements are implemented effectively and are suitable to achieve objectives. Quality Evaluation Systematic examination of the extent to which an entity is capable of fulfilling specified requirements. Qualification Process Process of demonstrating whether an entity is capable of fulfilling specified requirements. Quantitative Assessment. In any discussion of mishap risk management and risk assessment, the question of quantified acceptability parameters arises. Care should be exercised, under such conditions not to forget the limitations of a mathematical approach. In any high-risk system, there is a strong temptation to rely totally on statistical probability because, on the surface, it looks like a convenient way to measure safety "who can argue with numbers"? To do so, however, requires that the limitations and principles of this approach are well understood and that past engineering experience is not ignored. Quantitative acceptability parameters must be well FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A -8 CONCEPT or TERM DESCRIPTION defined, predictable, demonstrable, and above all, useful. They must be useful in the sense that they can be easily related to the design and the associate decision criteria. More detail may be found in chapter 7 on the limitations of the use of probabilities. Many factors fundamental to system safety are not quantifiable. Design deficiencies are not easily examined from a statistical standpoint. Additionally, the danger exists that system safety analysts and managers will become so enamored with the statistics that simpler and more meaningful engineering processes are ignored. Quantification of certain specific failure modes, which depend on one of two system components, can be effective to bolster the decision to accept or correct it. General risk management principles are: a. All human activity involving a technical device or process entails some element of risk. b. Most hazards (safety risks) can be neutralized or controlled. c. Hazards should be kept in proper perspective. Weighing the risk does this by knowledge gained through analysis and experience against program need. d. System operations represent a gamble to some degree; good analysis assists the MA in controlling the risk. e. System safety analysis and risk assessment does not eliminate the need for good engineering judgment. f. It is more important to establish clear objectives and parameters for risk assessment than to find a cookbook approach and procedure. g. There is no "best solution" to a safety problem. There are a variety of directions to go. Each of these directions may produce some degree of risk reduction. Redundancy The existence in a system of more than one means of accomplishing a given function. Reliability The ability of a system to perform its required functions under stated conditions for a specified period of time. A reliable system is no total assurance of acceptable risk. Requirements Statements describing essential, necessary or desired attributes. Requirements Specification Specification that sets forth the requirements for a system or system component. Risk Risk is an expression of possible loss over a specific period of time or number of operational cycles. It may be indicated by the probability of an accident times the damage in dollars, lives, FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A -9 CONCEPT or TERM DESCRIPTION and / or operating units. Hazard Probability and Severity are measurable and, when combined, give us risk. Total risk is the sum of identified and unidentified risks. Identified risk is that risk which has been determined through various analysis techniques. The first task of system safety is to identify, within practical limitations, all possible risks. This step precedes determine the significance of the risk (severity) and the likelihood of its occurrence (hazard probability). The time and costs of analysis efforts, the quality of the safety program, and the state of technology impact the number of risks identified. Unidentified risk is the risk not yet identified. Some unidentified risks are subsequently identified when a mishap occurs. Some risk is never known. Unacceptable risk is that risk which cannot be tolerated by the managing activity. It is a subset of identified risk that must be eliminated or controlled. Acceptable risk is the part of identified risk that is allowed to persist without further engineering or management action. Making this decision is a difficult yet necessary responsibility of the managing activity. This decision is made with full knowledge that it is the user who is exposed to this risk. Residual risk is the risk left over after system safety efforts have been fully employed. It is not necessarily the same as acceptable risk. Residual risk is the sum of acceptable risk and unidentified risk. This is the total risk passed on to the user. Eliminate Control Residual Unacceptable Acceptable Unidentified Total Risk Residual Risk Risk Analysis The development of qualitative and / or quantitative estimate of risk based on evaluation and mathematical techniques. Risk Acceptance. Accepting risk is a function of both risk assessment and risk management. Risk acceptance is not a simple matter and the concept is difficult for some to accept. Several points must be kept in mind. (1) Risk is a fundamental reality. FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A -10 CONCEPT or TERM DESCRIPTION (2) Risk management is a process of tradeoffs. (3) Quantifying risk doesn't ensure safety. (4) Risk is a matter of perspective. On the surface, taking risks seems foolish and to be avoided. Everything we do, however, involves risk. Defining acceptable risk is subjective and perceived risks are often as important as actual risks. Risks imposed on us by others are generally considered to be less unacceptable than those inherent in nature. There are dangers in every type of travel, but there are dangers in staying home--40 percent of all fatal accidents occur there. There are dangers in eating most food caused by pesticides, preservatives, natural fats, or just eating more than necessary. There are breathing related dangers in industrial and urban areas. The results of air pollution leads to the death of at least 10,000 Americans each year; inhaling natural radioactivity is believed to kill a similar number; and many diseases are contracted by inhaling germs. 12,000 Americans are killed each year in job related accidents, and probably 10 times that number die from job related illness. There are dangers in exercising and dangers in not getting enough exercise. Risk is an unavoidable part of our everyday lives. We all accept risk, knowingly or unknowingly. In a FAA program, it is the ultimately the responsibility of the MA to determine how much and what kind is to be accepted and what is not. In the real word, making this decision is a trade-off process involving many inputs. As tradeoffs are being considered and the design progresses, it may become evident that some of the safety parameters are forcing higher program risk. From the program manager's perspective, a relaxation of one or more of the established parameters may appear to be advantageous when considering the broader perspective of cost and performance optimization. The program manager has the authority and responsibility, in some circumstances, to make a decision against the recommendation of his system safety manager. The system safety manager must recognize such management prerogatives. A prudent program manager must make a decision whether to fix the identified problem or formally document acceptance of the added risk. In some cases, this requires contract or system specification modification. When the program manager decides to accept the risk, the decision must be coordinated with all affected organizations and then documented so that in future years everyone will know and understand the elements of the decision and why it was made. It also provides necessary data if the decision must be revisited. Risk Assessment The process by which the results of risk analysis are used to make decisions. Risk Control The Risk associated with the hazardous event under study is adequately controlled, by the reduction of severity and / or likelihood, via the application of engineering and/ or administrative hazard controls. Anything that mitigates or ameliorates the risk. See system FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A -11 CONCEPT or TERM DESCRIPTION safety design order of precedence in Chapter 3. Risk Hazard Index. By combining the probability of occurrence with hazard severity, a matrix is created where intersecting rows and columns are defined by a Risk Hazard Index (RHI). The risk hazard index forms the basis for judging both the acceptability of a risk and the management level at which the decision of acceptability will be made. The index may also be used to prioritize resources to resolve risks due to hazards or to standardize hazard notification or response actions. Prioritization may be accomplished either subjectively by qualitative analyses resulting in a comparative hazard risk assessment or through quantification of the probability of occurrence resulting in a numeric priority factor for that hazardous condition. Risk Management The application of management methods for the identification, evaluation, elimination and control of all forms of risk. This effort is not confined only to safety-related risks. Risk Management comprised of two parts, Risk Control and Risk Finance. Risk Control considers all aspects in System Safety, Safety Management, and Safety Engineering. Risk Finance considers insurance, risk pooling, and self-insurance. Risk Perspectives. There are three different perspectives in safety risk assessment: 1. Standpoint of an INDIVIDUAL exposed to a hazard. An individual exposed to a hazard is primarily concerned with the questions: How large is the probability that I will be killed or injured in an accident? How much does my individual risk due to this hazard increase my normal fatality rate? INDIVIDUAL RISK is defined as the (usually annual) probability that an identified person will be killed or injured as a consequence of an accident. 2. Standpoint of the SOCIETY. Besides being interested in guaranteeing minimum individual risk for each of its members, society is concerned about the total risk to the general public: How large are the total losses (e.g., per year) from a hazardous activity? The risk to society is called COLLECTIVE RISK. If expressed in terms of annual risks, it corresponds to the respective value shown in annual accident statistics. 3. Standpoint of the INSTITUTION RESPONSIBLE FOR THE ACTIVITY. The institution responsible for an activity can be a private company or a government agency. From their point of view, it is not only essential to keep individual risks of employees or other persons and the collective risk at a minimum but also to avoid catastrophic and spectacular accidents. As experience clearly demonstrates (Bhopal, Seveso, Challenger, etc.), such catastrophic accidents damage the reputation, the image, and even the prosperity of the, institution responsible for the activity. Such risks are defined as INSTITUTIONAL RISKS. 3.7 Residual Risk. To make important program decisions, the PM must know what residual risk exists in the system being acquired. When such risks are marginally acceptable or potentially unacceptable, the PM is required to raise the presence of residual risk to higher levels of authority such as the Service Director or Associate/Assistant Administrator for action FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A -12 CONCEPT or TERM DESCRIPTION or acceptance. To present a cohesive description of the hazard to this higher level of decision making, all analyses performed and either the contractor or the FAA must document actions taken to control the hazard. In some contractual situations, the PM may apply additional resources or other remedies to help the contractor satisfactorily resolve the issue. If not, the PM can add his position to the contractor information and forward the matter to a higher decision level. A decision matrix very similar to a Risk Hazard Index called in this example a Risk Hazard Level index can be used to establish which decisions fall under the PM and which should be forwarded to a higher organizational level. Risk Severity The harm expected should the hazardous event occur, (i.e., loss, consequence, adverse outcome, damage, fatality, system loss, degradation, loss of function, injury) considering the risk associated with the hazardous event under evaluation. See chapter three for specific definitions of severity. Severity ranges should be sized so that events within each category are of comparable severity. Equating the severity of event and conditions, which can cause one fatality with those, which can cause 100 or 1,000 does not make sense. The potential problems associated with sizing of the severity ranges grow as the size of the system grows. Program managers need to be provided with risk information that has the fidelity to distinguish the hazardous events that meet general criteria. Severity range thresholds for each severity category should be comparable when considering personal, system, or facility losses. For example, events or conditions that could cause the loss of an entire aircraft or facility would be categorized by MIL-STD-882 as catastrophic. Loss of a single crewman, mechanic, or passenger would also fall in the catastrophic category. Severe injuries, such as total loss of sight of a mechanic, and system damage of several million dollars are not normally considered to have equal value, even though both are in the critical category. If the RHI ranking criteria use risk as a function of severity and probability, quantitative scales or qualitative scales based on quantitative logic should be used. If the concept that the expected losses (or risk) associated with a hazardous event or condition may be estimated by multiplying the expected severity of the accident by the probability of the accident, then some sort of quantitative basis is necessary. Failure to provide a quantitative basis for the scales can cause significant confusion and dissipation of safety resources when an arbitrary risk ranking scale is used. Develop the severity values using order of magnitude ranges. There are several advantages to separating severity categories by orders of magnitude ranges: They include: Limiting the likelihood of misuse of the analysis. Avoiding meaningless hair-splitting arguments. Simplifying severity assessment during PHAs without impacting usefulness. FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A -13 CONCEPT or TERM DESCRIPTION Quantify the threshold values for the probability ranges. Quantification reduces confusion associated with strictly qualitative definitions. Although it is impossible to quantify the ranges in 882(C) due to its extremely broad application, developing quantified probability ranges for specific systems is a relatively easy task to accomplish. The probability of occurrence should refer to the probability of an accident/consequence as opposed to the probability of an individual hazard/basic event occurring. The typical accident sequence is much more complicated than a single line of erect dominos where tipping the first domino (hazard) triggers a clearly predictable reaction. Develop the probability values using order of magnitude ranges. Reaction Time Human response movement time plus response initiation time. Root Cause The contributory events, initiating events, which started the adverse event flow are considered root causes. Should these causes be eliminated the hazardous event would not have occurred. It should be noted that accidents are the result of many contributors, both unsafe acts and /or unsafe conditions; also see Contributory Hazards, Hazard. Safe Freedom from all forms of harm. Nothing is safe. Generals term denoting an acceptable level of risk of, relative freedom from, and low probability of harm. The associated risks that have been identified have been accepted provided that all identified controls are implemented and enforced. Safety or Safe. Freedom from those conditions that can cause death, injury, occupational illness, or damage to or loss of equipment or property, or damage to the environment. Note that absolute safety is not possible because complete freedom from all hazardous conditions is not possible. Therefore, safety is a relative term that implies a level of risk that is both perceived and accepted. Thus the emphasis in SSPs as reflected in the definitions above is in managing risk. Chapter 3(FAA SS HB) describes the risk management process. "System" is also a relative term. A subsystem can be viewed as a system with more narrow predetermined boundaries than the system. System safety is not an absolute quantity either. System safety is an optimized level of risk that is constrained by cost, time, and operational effectiveness (performance). System safety requires that risk be evaluated and the level of risk accepted or rejected by an authority. Finally, system safety is a discipline employed from the initial design steps through system disposal (also known as "cradle to grave or "womb to tomb"). Safety Analysis All associated analysis methods, process, and / or techniques to systematically evaluate safety related risks. Safety Risk Management Committee (SRMC) The principal reason to employ risk management and/or risk analysis is to improve decisionmaking. Risk analysis and risk management is at the heart of many FAA regulatory decisions. For example, risk analysis was performed to determine the hazards to flight from airborne wind shear. Risk management was also evident in the decision to require that all airliners be equipped with airborne wind shear detection. Risk management requires first analyzing risk inturn requiring access to sufficient credible data, and then developing policies and procedures to FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A -14 CONCEPT or TERM DESCRIPTION eliminate, mitigate, and/or manage them. In keeping with this process, an intra-agency team (the SRMC) was formed to examine the FAA’s approach to risk management. The committee was and remains open to representatives of all FAA organizations interested in risk management. If the RHI ranking criteria use risk as a function of severity and probability, quantitative scales or qualitative scales based on quantitative logic should be used. If the concept that the expected losses (or risk) associated with a hazardous event or condition may be estimated by multiplying the expected severity of the accident by the probability of the accident, then some sort of quantitative basis is necessary. Failure to provide a quantitative basis for the scales can cause significant confusion and dissipation of safety resources when an arbitrary risk ranking scale is used. This committee inventoried existing FAA risk management processes, capabilities, and practices. Processes included types of decisions appropriate for risk management and current technical approaches. Capabilities included personnel skill levels, tools, and access to needed data. Practices include details of implementation and documentation. The SRMC has become a standing committee to serve as a resource for the FAA. It currently: exchanges risk management information between offices and other government agencies to avoid duplication of effort. It provides support across program lines including risk management/analysis training assistance capability. It identifies and recommends needed enhancements to FAA risk management/analysis capabilities and/or efficiencies. Safety Critical All interactions, elements, components, subsystems, functions, processes, interfaces, within the system that can affect a predetermined level of risk. Safety Engineering Report Documents the results of safety analyses, including Operational Safety Assessments (OSA), Comparative Risk Assessments (CRA), Preliminary Hazard Analyses (PHA), System Hazard Analyses (SHA), Subsystem Hazard Analyses (SSHA), and Operational and Support Hazard Analysis (O&SHA). Security Risk Some safety risks that the FAA must manage are the result of security issues. By its nature, the details of methodologies used to analyze and assess security hazards/risks cannot be published in this document. The section does, however, summarize a top-level approach to security risk management, especially as it relates to the methodologies used for safety risk management. Since the development of safety and risk management has not always been parallel, their terminology is sometimes different. Several security unique terms are introduced. Safety and Security hazards are both caused by experiencing a series of events that lead to a questionable condition. In security analyses, the term vulnerability is used to summarize the event path (approach used to achieve negative effect) that leads to the hazard. Single Point Failure A single item of hardware, the failure of which would lead directly to loss of life, and / or system. Actually, a single malfunction, and / or failure, and /or error, of which would lead to loss of life, and / or system. FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A -15 CONCEPT or TERM DESCRIPTION Software Computer programs, procedures, rules, and associated documentation and data pertaining to the operation of a computer system. Software Code A software program or routine or set of routines, which were specified, developed and tested for a system configuration. Structured Programming Any software development technique that includes structured design and results in the development of structured programs. Subprogram A separately compilable, executable component of a computer programs. Subroutine A routine that returns control to the program of subprogram that called it. Subsystem An element of a system that, in itself, may constitute a system. Syntax The structural or grammatical rules that define how the symbols in a language are to be combined to form words, phrases, expressions, and other allowable constructs. System A composite, at any level of complexity, of personnel, procedures, materials, tools, equipment, facilities, and software. The elements of this composite entity are used together in the intended operational or support environment to perform a given task or achieve a specific production, support, requirement; a set of arrangement of components so related or connected as to form a unity or organic whole. A composite of people, procedures, materials, tools, equipment, facilities, and software operating in a specific environment to perform a specific task or achieve a specific purpose, support, or mission requirement. Systems Approach A step - by - step procedure for solving problems; a decision making process which moves from the general to the specific; an iterative process. System Safety The application of engineering and management principles, criteria, and techniques to optimize safety within the constraints of operational effectiveness, time, and cost throughout all phases of the system life cycle. A standardized management and engineering discipline that integrates the consideration of man, machine, and environment in planning, designing, testing, operating, and maintaining FAA operations, procedures, and acquisition projects. System safety is applied throughout a system's entire life cycle to achieve an acceptable level of risk within the constraints of operational effectiveness, time, and cost. System Safety Analysis The analysis of a complex system by means of methods, techniques, and / or processes, to comprehensively evaluate safety related risks that are associated with the system under study. System Safety Engineer An engineer qualified by appropriate credentials: training, education, registration, certification, and / or experience to perform system safety engineering. One should have an appropriate background and credentials directly related to system safety in order to practice in the field, i.e., CSP, PE, training, education, and actual experience. System Safety Engineering An engineering discipline requiring specialized professional knowledge and skills in applying scientific and engineering principles, criteria, and techniques to identify and eliminate, or reduce safety related risks. System Safety A formally charted group of persons representing organizations associated with the system FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A -16 CONCEPT or TERM DESCRIPTION Working Group under study, organized to assist management in achieving the system safety objectives. System Safety Manager A person responsible for managing the system safety program. System Safety Objectives System safety is achieved through the implementation and careful execution of an SSP. As stated previously, the ultimate objective of system safety is eliminated or minimize accidents and their results. The objectives of an SSP are to ensure that: • Safety, consistent with system purpose and program constraints, is designed into the system in a timely, cost-effective manner. • Hazards are identified, evaluated, and eliminated, or the associated risk reduced to a level acceptable to the managing activity (MA) throughout the entire life cycle of a system. • Historical safety data, including lessons learned from other systems, are considered and used. • Minimum risk is sought in accepting and using new designs, materials, and production and test techniques. • Actions taken to eliminate hazards or reduce risk to a level acceptable to the MA are documented. • Retrofit actions are minimized. • Changes in design, configuration, or operational requirements are accomplished in a manner that maintains a risk level acceptable to the MA. • Consideration is given to safety, ease of disposal, and storage of any hazardous materials associated with the system. • Significant safety data are documented as "lessons learned" and are submitted to data banks, design handbooks, or specifications. • Hazards identified after production are minimized consistent with program restraints. System Safety Order of Precedence. The overall goal of a system safety program is to design systems that do not contain unacceptable hazards. However, the nature of most complex systems makes it impossible or impractical to design them completely hazard-free. As hazard analyses are performed, hazards will be identified that require resolution. System safety precedence defines the order to be followed for satisfying system safety requirements and reducing the presence and impact of risks. The alternatives for eliminating the specific hazard or controlling its associated risk must be evaluated so that an acceptable method for risk reduction can be pursued. FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A -17 CONCEPT or TERM DESCRIPTION Design for Minimum Risk. The most effective safety program is one that eliminates hazards through design. If an identified hazard cannot be eliminated, reduce the associated risk to an acceptable level, as defined by the MA, through design selection. Defining minimum risk is not a simple matter. It is not a cookbook process that can be numerically developed without considerable thought. Minimum risk varies from program to program. See paragraph 3.6 for more information. Incorporate Safety Devices. If identified hazards cannot be eliminated or their associated risk adequately reduced through design selection, that risk should be reduced to a level acceptable to the MA through the use of fixed, automatic, or other protective safety design features or devices. Provisions should be made for periodic functional checks of safety devices when applicable. Provide Warning Devices. When neither design nor safety devices can effectively eliminate identified hazards or adequately reduce associated risk, devices should be used to detect the condition and to produce an adequate warning signal to alert personnel of the hazard. Warning signals and their application must be designed to minimize the probability of incorrect personnel reaction to the signals and shall be standardized within like types of systems. Develop Procedures and Training. Where it is impractical to eliminate hazards through design selection or adequately reduce the associated risk with safety and warning devices, procedures and training should be used. However, without a specific waiver from the MA, no warning, caution, or other form of written advisory shall be used as the only risk reduction method for Category I or II hazards. Procedures may include the use of personal protective equipment. System Safety Program The tasks and activities of system safety that enhance effectiveness by ensuring that requirements are met, in a timely, cost-effective manner throughout all phases of the system life cycle. System Safety Program Plan A description of the planned methods to be used to implement the system safety requirements. System Safety Requirements by Acquisition Phase Concept Exploration • Evaluate system safety design features • Identify possible interface problems • Highlight special safety considerations • Describe safety tests/data needed for next phase • Update requirements based on analysis results • Review designs of similar systems • Use past experience with similar system requirements • Identify waiver requirements • Prepare a report for milestone reviews • Tailor subsequent phase SSPs. FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A -18 CONCEPT or TERM DESCRIPTION Demonstration/Validation • SSPP describing contractor's proposed safety program effort • Establish criteria for validating contractor performance • Update specifications, requirements, safety characteristics • PHA for hazards and inherent risks • Safety Interface study for subsystems, e.g., Subsystem Hazard Analysis (SSHA) • Trade-off studies • Identify risks from design, operating environment, and technology • Identify qualification/quantitative system safety requirements • Perform system and equipment interface analyses e.g., System Hazard Analysis (SHA) and Operating and Support Hazard Analysis (O&SHA) • Update test plans • Prepare summary reports for major program milestones • Review test plans • Review training plans • Evaluate hazards and failures for corrective actions • Perform SHA on test model • Identify need for special production and maintenance tools (e.g. barriers) • Review all related maintenance and production instructions • Review applicable safety requirements from FAA, DOT, EPA, and Occupational Safety and Health Administration (OSHA). Full Scale Development • Timely implementation of SSPP • Update system safety requirements • Perform hazard analyses. (SHA/O&SHA) • Evaluate system design for hazards and safety improvements • Establish test requirements and ensure verification of design • Participate in design reviews • Provide inputs to training manuals, emergency procedures • Evaluate mishaps/failures and make recommendations • Review/input to trade-off studies • Review drawings/specifications for safety • Identify safety/protective equipment • Provide safety input to training • Ensure designs incorporate safety • Correct hazards identified demonstration/validation phase FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A -19 CONCEPT or TERM DESCRIPTION • Evaluate storage, packing, and handling requirements/plans • Review production plans, drawings, procedures • Review plans for disposal of hazardous materials • Prepare documentation for major milestones • Tailor requirements for production • Review National Airspace Integrated Logistics Support (NAILS) considerations. Production and Deployment • Monitor system for adequacy of design safety • Evaluate design changes to prevent degraded inherent safety • Review operations and maintenance publications for safety information • Evaluate accidents; recommended design changes • Review deficiency reports for operators • Review disposal of hazardous materials • Update SSPP • Monitor production line for safety and safety control of system • Review production, maintenance, and operation manuals for necessary cautions, warnings etc. for previously identified hazards • Review system for necessary cautions, warning labels, etc. previously identified (e.g., high voltage) • Verify safety precautions in test and evaluation (T&E) plans and procedures • Identify safety related aging problems and associated controls. • Update O&SHA • Identify critical parts, procedures, facilities, and inspections • Continue to monitor design and procedures to uncover residual hazards; follow-up on corrective action. Facilities-Related Requirements • Ensure building, fire, and other related requirements are met • Review facility and installed systems interfaces • Review equipment plans • Update hazard tracking system • Evaluate accidents for deficiencies/oversights/corrective actions • Review design modifications for hazards; monitor corrective actions. Test Case A set of test inputs, execution conditions, and expected results developed for a particular objective, such as to test a particular program path or to verify compliance with a specific requirement. Testing The process of operating a system under specified conditions, observing or recording the results, and making an evaluation of some aspect of the system. Test Procedure (a) Specified way to perform a test. FAA System Safety Handbook, Appendix A: Glossary December 30, 2000 A -20 CONCEPT or TERM DESCRIPTION (b) Detailed instructions for the set-up and execution of a given set of test cases, and instructions for the evaluation of results of executing the test cases. Traceability Ability to trace the history, application or location of an entity by means of recorded identifications. Transient Error An error that occurs once, or at unpredictable intervals. Validation The process of evaluating a system (and subset), during or at the end of the development process to determine whether it satisfies specified requirements. Conformance to requirements is no total assurance of acceptable risk. Verification The process of evaluating a system (and subset) to determine whether the products of a given development phase satisfy the conditions imposed at the start of the phase. Volatile Memory Memory that requires a continuous supply of power to its internal circuitry to prevent the loss of stored information. Voting A scheme in which the outputs of three of more channels of a system implementation are compared with each other in order to determine agreement between two or more channels, and to permit continued operation in the presence of a malfunction in one of the channels. A degree of fault / malfunction tolerance is obtained. Watchdog Timer A device that monitors a prescribed operation of computer hardware and / or software and provides an indication when such operation has ceased. Zero Energy State All energy within the system has been reduced to the lowest possible energy level, at “zero energy level” if possible. All stored or residual energy, such as within capacitors, springs, elevated devices, rotating flywheels, hydraulic systems, pneumatic systems, have been dissipated. It should be noted that it is not possible to dissipate / de-energize all energy within the system additional controls should be implemented, i.e. lockout, repositioning, isolating, restraining, guarding, shielding, relief, bleed off devices.