The Safety Analysis and Risk Mitigation Process  Section 3  Identify and document potential safety issues, their possible causes, and the conditions under  which the safety issues are revealed (i.e., the system state).  Causes  are events occurring independently or in combination that result in a hazard or failure. They include, but are not limited to, human error, latent failure, active failure, design flaw,  component failure, and software error.  A  system state  is the expression of the various conditions (characterized by quantities or  qualities) in which a system can exist. It is important to capture the system state that most  exposes a hazard, while remaining within the confines of any operational conditions and  assumptions defined in existing documentation. Refer to Section 9 for the definition of  assumption. The system state can be described using a combination of, but not limited to, the  following terms:  Any given hazard may have a different risk level in each possible system state. Hazard  assessment must consider all possibilities while allowing for all system states. In a hazard  analysis, it is important to capture different system states when end results lead to the  application of different risk reduction methods and tools.  The current version of  FAA Order 8040.4,  Safety Risk Management Policy , provides risk  management policy to follow when hazards, risks, and associated safety analyses affect  multiple Lines of Business. The ATO must consider and, when necessary, use the provisions in  this order when coordinating safety assessments with other FAA organizations. AJI will function  as the ATO liaison to interface with organizations outside of the ATO when the provisions of  FAA Order 8040.4 are invoked. There may be cases in which the ATO and another FAA organization disagree on key issues  surrounding a NAS change. The ATO Safety Manager and ATO Chief Safety Engineer 1  must  be made aware of such NAS changes and must work to determine the appropriate course of  action. The ATO Chief Safety Engineer will determine whether such hazards and issues need  to be elevated to an FAA-level mediation process facilitated by the FAA Safety Management  System (SMS) Committee.  For more information, refer to the FAA SMS Hazard Escalation Reporting Process.  • Operational and Procedural:  Visual Flight Rules versus Instrument Flight Rules, simultaneous procedures versus visual approach procedures, etc. • Conditional:  Instrument Meteorological Conditions versus Visual Meteorological Conditions, peak traffic versus low traffic, etc. • Physical:  Electromagnetic environment effects, precipitation, primary power source versus back-up power source, closed runways versus open runways, dry runways versus contaminated runways, environmental conditions, etc. 3.4.5  Addressing Hazards that Cross FAA Lines of Business  3.4.5.1  Hazard Escalation and Reporting  3.4.4 Causes and System State Defined  3 5  3.4_SMSM_201904  Originally published April 2019  Uncontrolled copy when downloaded 1. The primary function of the ATO Chief Safety Engineer is to provide leadership and expertise to ensure that operational safety risk in the air traffic services that the ATO provides is identified and managed. He or she also ensures that safety risk is considered and proactively mitigated in the early development, design, and integration of solutions. Refer to the Safety Risk Management Guidance for System Acquisitions for a description of the ATO Chief Safety Engineer’s roles and responsibilities.