01/05/05  ssprocdesrv103.doc  1. Define Objectives  2. System Description  3. Hazard Identification: Identify Hazards & Consequences  4. Risk Analysis: Analyze Hazards and Identify Risks  5. Risk Assessment: Consolidate & Prioritize Risks 6. Decision Making: Develop Action Plans  7. Validations and Control: Evaluate Results of Action Plan for Further Action  8. Modify System/Process (if needed) The first step in the System Safety process is to define the objectives of the system under review. These  objectives are typically documented in business plans and operating specifications  A description of the interactions among people, procedures, tools, materials, equipment, facilities, software,  and the environment. This also includes descriptions of data available  Potential hazards may be identified from a number of internal and external sources. Generally, hazards are  initially listed on a Preliminary Hazard List (PHL), then grouped by functional equivalence for analysis. Prior  to risk analysis you must also include the consequence (undesired event) resulting from the hazard scenarios.  Hazard scenarios may address the following: who, what where, when, why and how. This provides an  intermediate product that expresses the condition and the consequences that will be used during risk analysis.  Risk analysis is the process whereby hazards are characterized for their likelihood and severity. Risk analysis  looks at hazards to determine  what  can happen  when . This can be either a qualitative or quantitative analysis.  The inability to quantify and/or the lack of historical data on a particular hazard does not exclude the hazard  from the need for analysis. Some type of a Risk Assessment Matrix is normally used to determine the level of  risk (see an example contained in Attachment 1)  Risk Assessment is generally defined as the process of combining the impacts of risk elements discovered in  risk analysis and comparing them against some acceptability criteria. Risk Assessment can include the  consolidation of risks into risk sets that can be jointly mitigated, combined, and then used in decision making.  This step begins with the receipt of a prioritized risk list. Review the list to determine how to address each risk,  beginning with the highest prioritized risk. The four options that may be chosen for a risk are transfer,  eliminate, accept, or mitigate (T.E.A.M). Generally, design engineering follows the “safety order of  precedence”: 1) Design for minimum risk, 2) Incorporate safety devices, 3) Provide warning devices, or 4)  Develop procedures and training. This may result in alternative action plans. Validation and control begins with (1) the results of scheduled analyses on the effectiveness of actions taken  (this will include identification of data to be collected and identification of triggering events if possible; then  developing a plan to review the data collected) and (2) the current status of each prioritized risk. If the residual  risk is acceptable, then documentation is required to reflect the modification to the system, and the rationale  for accepting the residual risk. If it is unacceptable, an alternate action plan may be needed, or a modification  to the system/process may be necessary.  If the status of a risk should change or the mitigating action does not produce the intended effect, a  determination must be made as to why. It may be that the wrong hazard was being addressed, or the  system/process needs to be modified. In either case, one would then re-enter the system safety process at the  hazard identification step.  2 