## 3.4.4 Causes and System State Defined 

Identify and document potential safety issues, their possible causes, and the conditions under which the safety issues are revealed (i.e., the system state). 

Causes  are events occurring independently or in combination that result in a hazard or failure. They include, but are not limited to, human error, latent failure, active failure, design flaw, component failure, and software error. 

A system state  is the expression of the various conditions (characterized by quantities or qualities) in which a system can exist. It is important to capture the system state that most exposes a hazard, while remaining within the confines of any operational conditions and assumptions defined in existing documentation. Refer to Section 9 for the definition of assumption. The system state can be described using a combination of, but not limited to, the following terms: 

• Operational and Procedural: Visual Flight Rules versus Instrument Flight Rules, simultaneous procedures versus visual approach procedures, etc. 

• Conditional:  Instrument Meteorological Conditions versus Visual Meteorological Conditions, peak traffic versus low traffic, etc. 

• Physical: Electromagnetic environment effects, precipitation, primary power source versus back-up power source, closed runways versus open runways, dry runways versus contaminated runways, environmental conditions, etc. 

Any given hazard may have a different risk level in each possible system state. Hazard assessment must consider all possibilities while allowing for all system states. In a hazard analysis, it is important to capture different system states when end results lead to the application of different risk reduction methods and tools. 

## 3.4.5 Addressing Hazards that Cross FAA Lines of Business 

The current version of FAA Order 8040.4, Safety Risk Management Policy , provides risk management policy to follow when hazards, risks, and associated safety analyses affect multiple Lines of Business. The ATO must consider and, when necessary, use the provisions in this order when coordinating safety assessments with other FAA organizations. AJI will function as the ATO liaison to interface with organizations outside of the ATO when the provisions of FAA Order 8040.4 are invoked. 

## 3.4.5.1 Hazard Escalation and Reporting 

There may be cases in which the ATO and another FAA organization disagree on key issues surrounding a NAS change. The ATO Safety Manager and ATO Chief Safety Engineer 1  must be made aware of such NAS changes and must work to determine the appropriate course of action. The ATO Chief Safety Engineer will determine whether such hazards and issues need to be elevated to an FAA-level mediation process facilitated by the FAA Safety Management System (SMS) Committee. 

For more information, refer to the FAA SMS Hazard Escalation Reporting Process. 

