曝光臺 注意防騙 網曝天貓店富美金盛家居專營店坑蒙拐騙欺詐消費者

consideration. Apart from the facilitator, the participants do not necessarily need prior experience in hazard
identification.
Note.— While the use of group sessions has been addressed here in the context of hazard
identification, the same group would also address the assessment of the likelihood and severity of the
hazards they have identified.
The assessment of hazards should take into consideration all possibilities, from the least to the most likely. It
has to make adequate allowance for “worst case” conditions, but it is also important that the hazards to be
included in the final analysis be “credible” hazards. It is often difficult to define the boundary between a worst
credible case and one so dependent on coincidence that it should not be taken into account. The following
definitions can be used as a guide in making such decisions:
Chapter 13. Safety Assessments 13-7
Worst case: The most unfavourable conditions expected, e.g. extremely high levels of
traffic, and extreme weather disruption.
Credible case: This implies that it is not unreasonable to expect that the assumed
combination of extreme conditions will occur within the operational life cycle of the system.
The assessment should always consider the most critical phase of flight within which an aircraft could be
affected by the system failure under consideration, but it should not generally be necessary to assume that
simultaneous unrelated failures will occur.
It is, however, important to identify any potential common mode failure, which occurs when a single event
causes multiple failures within the system.
All identified hazards should be assigned a hazard number, and be recorded in a hazard log.
The hazard log should contain a description of each hazard, its consequences, the assessed likelihood and
severity, and any required mitigation measures. It should be updated as new hazards are identified, and
proposals for mitigation are introduced.
STEP 3: ESTIMATION OF THE SEVERITY OF THE CONSEQUENCES OF A HAZARD OCCURRING
Prior to the commencement of this step, the consequences of each hazard identified in Step 2 should have
been recorded in the hazard log. Step 3 involves the assessment of the severity of each of these
consequences.
Risk classification schemes have been developed for a large number of applications where hazard analysis
is regularly used. An example of one such scheme can be found in the Joint Aviation Requirements — Large
Aeroplanes (JAR-25), developed by the Joint Aviation Authorities (JAA).
JAR-25 is recognized by many Civil Aviation Authorities as an acceptable basis for showing compliance with
their national airworthiness codes. JAR 25.1309 and the associated advisory material, AMJ 25.1309, specify
risk classification criteria to be used to determine acceptable levels for the risk associated with various
failure conditions in aircraft systems. The levels of acceptability take into account historical accident rates,
and the need for there to be an inverse relationship between the probability of loss of function(s) and the
severity of the hazards to the aircraft and its occupants arising from such an event.
While the criteria as specified in JAR-25 relate specifically to airworthiness of aircraft systems, they can be
used as a guide to the development of similar classification schemes for other purposes. A number of States
have already done this. Table 13-3 shows an example of a severity classification scheme based on the
JAR-25 approach, but adapted for ATS application, taken from the U.K. CAA CAP 670, Air Traffic Services
Safety Requirements.
The same group that performed the hazard identification would be most appropriate to assess the severity of
the consequences. The guidelines for the conduct of the group sessions contained in Appendix 1 to this
chapter apply equally to the assessment of the severity of the consequences as to hazard identification.
13-8 Safety Management Manual (SMM)
Table 13-3. Severity classification scheme
Severity classification
Catastrophic Hazardous Major Minor Negligible
Results in
one or
more of
the
following
effects
ATC issues
instruction or
information which
can be expected to
cause loss of one
or more aircraft (no
reasonable means
exist for the aircrew
to check the
information or to
mitigate against
hazards).
Continued safe
flight or landing
prevented.
The ATC separation
service provided to
aircraft that are
airborne or are inside
a runway protected
area in one or more
sectors is suddenly,
and for a significant
period of time,
completely
　
中國航空網 www.k6050.com
航空翻譯 www.aviation.cn
本文鏈接地址：Safety Management Manual (SMM) 安全管理手冊(88)