4.2.8  Assess Development Assurance Risk  4.2.9  Establish Safety Requirements and Predict Residual Risks  Consider the architectures of the alternatives, the different components, and their DALs. Developing all components to the highest DAL is expensive and spreads all the developer’s  resources across the entire project. However, partitioning the components may permit different  DALs, limiting the most severe functions to one component. Other functions can be assigned  lower DALs, thus conserving resources. Also, if the different implementations are from different  vendors, consider their experience with the DAL standard; inexperience may add additional risk.  For each alternative, establish:  At this point, the CSA may only lay the groundwork to better define a preferred alternative (as  yet unselected) that will be better detailed in the PHA. Again, some aspects of relative  difference among alternatives may be apparent even if absolute measures of each alternative’s  suitability against the reference case may not be known. Intelligently discount and drop out similar unknowns deemed “equal” across each of the  alternatives, leaving the known differences as key points of distinction. When completed, the  CSA positively impacts the decision-making process by helping to discount several lesser  alternatives, indicating one preferred alternative on the basis of clear differences in predicted  residual risk. Alternatively, the CSA may return a “no discernible difference” result, leaving  subsequent IIDs to be made on the basis of outside business case factors. Use Table D.3 to  tabulate results. ( Note : Each alternative assessed has its own table.)  For decision-making purposes, compare the results of the safety risk assessment of each  alternative considered. Compile the results in Table D.4. ( Note : Not all hazards may apply to  each alternative assessed. Enter “N/A” in Table D.4 when appropriate.) Ensure the decision  4.2.10 Make Recommendations Based on the Data in the CSA  • Preliminary safety issues for tracking in the future; • Needs, which may become requirements when validated; • Missing functional requirements needed to turn solution fragment(s) into complete and viable solutions; and • Predicted residual risk levels based on potential and achievable performance minima should this alternative be selected, designed, fabricated, tested, fielded, and logistically supported for its full lifecycle. Table D.3: Safety Requirements and Residual Risks  Hazard ID  Initial Risk  Safety  Requirement  Description  Predicted  Residual Risk  Predicted  Residual Risk  Rationale  Alpha-numeric  identifier (under  10 characters)  The composite of  the severity and  likelihood of a  hazard,  considering only  controls and  documented  assumptions for a  given system state  A planned or  proposed means  to reduce a  hazard’s causes  or effects  The risk that is  estimated to exist  after the safety  requirements are  implemented or  after all avenues  of risk mitigation  have been  explored  If necessary, any  additional  explanation  needed to help  the reader  understand how  the predicted  residual risk was  determined  D-7 D_SRMGSA_202003 Originally published March 2020  Uncontrolled copy when downloaded 