hazards as credible and the OHA is further developed. The Bow-Tie Model 10  may be used as a tool for distinguishing between hazards, causes, and effects within the PHL. 

## 5.2.5 Identify Controls and Safety Requirements 

Identify the controls; the rationale for their use; and any supporting data that confirm the controls’ use, applicability, and feasibility related to the hazard under consideration. Controls are measures, design features, warnings, and procedures that already mitigate credible outcomes (i.e., they have already been validated and verified as being effective). They may include procedural requirements as well as aircraft or ground system requirements related to the solution under review. The Bow-Tie Model (specifically the event tree side) can be used for identifying controls and safety requirements. 

## 5.2.6 Identify Operational Hazard Effects 

Determine the effects of each operational hazard by evaluating the services in the solution state (including legacy system considerations) for the intended operational capabilities, as defined in the OSED. The Bow-Tie Model (specifically the outcome side) can be used for identifying effects. 

## 5.2.7 Classify Operational Hazards 

Classify each operational hazard according to the severity of its identified effects using the current version of the SMS Manual. When determining severity, the SRM panel must assess all effects of the hazard on operations—taking into account the aircrew, the aircraft, and air traffic services—and must use the measure yielding a higher severity (i.e., the most conservative estimate). This enables safety objectives and safety requirements to be given a consistent and objective meaning. 

The severity of each hazard is determined by the worst credible outcome or effect of the hazard on the solution or the NAS. The severity must be determined using a Bow-Tie Model or any other analysis tool, as appropriate. 

## 5.2.8 Identify Safety Objectives 

Establish overall safety objectives (either qualitative or quantitative) based on the operational hazard classifications. Assign a DAL to each function based on its severity. (As the design matures, the DALs may be reduced using architecture.) Once the safety objective is determined for each hazard, safety requirements can be written to ensure that the appropriate hazard controls are established as product requirements. Note that a requirement is a description of what must be done to achieve a safety objective. 

## 5.2.9 Develop an OHA Worksheet 

Document the OHA by populating an OHA Worksheet with information for all the identified hazards and their associated safety objectives and safety requirements. The worksheet categories are described in Table C.1. 

