The safety assessment decides whether mitigation is acceptable: the FFPA first lists all Level A and B FFPs where mitigation is credited, the methods and rationale, and adequacy is judged per supporting function within the overall architecture. Common mode analysis addresses errors in requirements, implementation, manufacture and maintenance capable of defeating the mitigation; random failures that could make the mitigation unavailable are considered, with its availability commensurate with the consequence of losing it. Correct operation and independence must be achieved and kept, special safeguards against residual common mode effects identified and incorporated, and FFPs left unmitigated or inadequately mitigated re-addressed by another method (for example partial mitigation plus safety-specific analysis).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.