15 2.2_SMSM_201904  Originally published April 2019  Uncontrolled copy when downloaded Managing Safety Risk in a System of Systems  Section 2  When examining adverse events attributed to human error, it is often determined that elements  of the human-to-system interface (such as display design, controls, training, workload, or  manuals and documentation) are flawed. The analysis of human reliability and the application  of human performance knowledge must influence system design for safety systems and be an  integral part of risk management. Recognizing the critical role that humans and human error  play in complex systems and applications has led to the development of the human-centered  design approach. This approach is central to the concept of managing human error that affects  safety risk.  Safety risk can be reduced proactively and reactively. Monitoring operational data, carefully  analyzing the system, and reporting safety issues make it possible to proactively detect and  prevent sequences of events where system deficiencies (i.e., faults and errors, either separately  or in combination) could lead to an incident or accident before it actually occurs. The same  approach also can be used to reactively analyze the chain of events that led to an accident or  incident. With adequate information, safety professionals can take corrective action to  strengthen the system’s defenses when devising new air traffic procedures, operations, and  NAS equipment, or when making changes to them. The following is an illustrative, but not  comprehensive, list of typical defenses used in combination to close gaps in defenses:  Equipment Defense Strategies:  Operating Procedures:  • Redundancy: o Full redundancy, which provides the same level of functionality when operating on the alternate system o Partial redundancy, which results in some reduction in functionality (e.g., local copy of essential data from a centralized network database) • Independent checking of design and assumptions • System design that ensures that critical functionality is maintained in a degraded mode if individual elements fail • Policy and procedures regarding maintenance to prevent a loss of some functionality in the active system or a loss of redundancy • Automated aids or diagnostic processes designed to detect system failures or processing errors and the appropriate reporting of those failures • Scheduled maintenance • Adherence to standard phraseology and procedures • Readback of critical items in clearances and instructions • Checklists and habitual actions (e.g., requiring a controller to follow through the projected flight path of an aircraft, looking for conflicts, receiving immediate coordination from the handing-off sector) 2.2.3  Closing Gaps Using SRM and Safety Assurance Principles and Processes 