coordination with external NAS entities. Though all such external dependencies may be noted,  it may not be possible to address them within the bounds of this system. Analyze all external causes that cannot be mitigated within system bounds for faulty  assumptions that may invalidate the efficacy of the best solution that could be engineered. Adjust concepts as needed until a good fit is obtained between hazard causes that can be  mitigated within this system boundary and operational plans for reaching adequacy of every  listed (known) external constraint. Decide which alternative solutions remain viable after a cursory look at safety. Discard any  potential solution “fragments” 7  that inadequately address safety concerns.  From the FA and solution description, refine and expand (as necessary) the partial PHL  developed in the OSA (assuming an OSA was conducted). If a partial PHL was not previously  compiled, then develop one as described in the SMS Manual. Carry over any valid  OSA-identified hazards / causes / solution states / severity ratings to the CSA. If any OSA  hazards need to be deleted or modified in the CSA, provide a supporting rationale as to why this  must be done. Table D.1 presents a sample hazard list that has been expanded/modified from  an OSA.  Evaluate each hazard-alternative combination (including the reference case) for risk differences  using the definitions and principles contained in the SMS Manual. Evaluate the hazard severity  in the context of the worst credible conditions. Remember, severity can and should be defined  independently of the likelihood of occurrence. Evaluate the likelihood of the hazard conditions  resulting in an event at the highest level of severity and not simply the probability of any hazard  occurring. Clearly define which adverse events are to be tracked as the best indicators of safety. Identify  how to measure adverse events and provide any baseline measures prior to the proposed  7. NAS services may be composed of many cooperating parts or “solution fragments” in the form of federated systems, sub-systems, or services, all of which must be efficiently orchestrated to achieve some desired operational capability outcome for users. Solution fragments accomplish nothing individually without the rest of the NAS “System-of-Systems” to provide benefits to end users. D_SRMGSA_202003 Originally published March 2020  Uncontrolled copy when downloaded  D-5 4.2.6  Document the Assumptions and Justifications  4.2.5  Assess Risk in the Context of Each Alternative  ID  Hazard  Disposition for CSA  Validity/Rationale  OSA TFDM-1  Loss of all system functionality  Becomes TFDM-1  Valid hazard  OSA TFDM-2  Loss of electronic flight display  Becomes TFDM-2 with  enhanced wording  When updated, needed  hazard  OSA TFDM-3  Incorrect flight data display  Becomes TFDM-3  Valid hazard  OSA TFDM-4  Controller fails to pass and/or edit  electronic flight strips in a timely  and efficient manner  Deleted  Invalid hazard: SRM  panel believes the  system fails, not the  controller  TFDM-X  (To be determined)  Newly identified  N/A  Table D.1: CSA Hazards List  4.2.4  Develop a Hazards List 