hazards as credible and the OHA is further developed. The Bow-Tie Model 10  may be used as a  tool for distinguishing between hazards, causes, and effects within the PHL.  Identify the controls; the rationale for their use; and any supporting data that confirm the  controls’ use, applicability, and feasibility related to the hazard under consideration. Controls  are measures, design features, warnings, and procedures that already mitigate credible  outcomes (i.e., they have already been validated and verified as being effective). They may  include procedural requirements as well as aircraft or ground system requirements related to the  solution under review. The Bow-Tie Model (specifically the event tree side) can be used for  identifying controls and safety requirements. Determine the effects of each operational hazard by evaluating the services in the solution state  (including legacy system considerations) for the intended operational capabilities, as defined in  the OSED. The Bow-Tie Model (specifically the outcome side) can be used for identifying  effects.  Classify each operational hazard according to the severity of its identified effects using the  current version of the SMS Manual. When determining severity, the SRM panel must assess all  effects of the hazard on operations—taking into account the aircrew, the aircraft, and air traffic  services—and must use the measure yielding a higher severity (i.e., the most conservative  estimate). This enables safety objectives and safety requirements to be given a consistent and  objective meaning.  The severity of each hazard is determined by the worst credible outcome or effect of the hazard  on the solution or the NAS. The severity must be determined using a Bow-Tie Model or any  other analysis tool, as appropriate.  Establish overall safety objectives (either qualitative or quantitative) based on the operational  hazard classifications. Assign a DAL to each function based on its severity. (As the design  matures, the DALs may be reduced using architecture.) Once the safety objective is  determined for each hazard, safety requirements can be written to ensure that the appropriate  hazard controls are established as product requirements. Note that a requirement is a  description of what must be done to achieve a safety objective. Document the OHA by populating an OHA Worksheet with information for all the identified  hazards and their associated safety objectives and safety requirements. The worksheet  categories are described in Table C.1.  5.2.9  Develop an OHA Worksheet  5.2.8  Identify Safety Objectives 5.2.7  Classify Operational Hazards  5.2.6  Identify Operational Hazard Effects  5.2.5  Identify Controls and Safety Requirements  10. The Bow-Tie Model is a diagram of the hazard, the undesirable event, the trigger events or threats, potential outcomes, and the controls that minimize the risk. The methodology is an excellent way of visualizing risk management and communicating the context of the controls (barriers and mitigations) that manage or could manage risk. C_SRMGSA_202003  Originally published March 2020  Uncontrolled copy when downloaded  C-11