Document 108

SEBoK *Safety*, Distilled

safety

SEBoK Safety, Distilled

Third-batch SEBoK distillation, batch 4/5. Read on the canonical System Safety page (Part 6 > SE and Quality Attributes, lead author Dick Fairley). The article is the batch's anchor stress-test for Cluster K (V3 as procedure-binding). The eight core safety activities (document approach, identify and analyze hazards, assess risk, identify mitigations, implement reduction, verify reduction, gain authority acceptance of residuals, track hazards) are read as V3-as-procedure-binding in the strongest form yet seen in the SEBoK sweep: the safety procedure is constitutively V3-shaped because rankism, optimism, and complacency have lethal consequences in the safety domain. Where SE-079 read Decision Management's 10-step process as V3-binding, SE-108 reads Safety's 8-step process as V3-binding under harder constraint — the bias-mitigation discipline is not optional procedural craft but a design-rule of the safety lifecycle. Cluster F pulverization is dual: backward (residual risk acceptance) and forward (premortem hazard analysis); Cluster H hypostatic-boundary brushed at "freedom from harm"; Cluster A at the hazard-severity-and-probability lattice.

I. Source

II. Source Read

Lead author Dick Fairley; Part 6 > SE and Quality Attributes. Core definition: "Safety is freedom from harm. As an engineering discipline, system safety is concerned with minimizing hazards that can result in a mishap with an expected severity and with a predicted probability." MIL-STD-882E framing: system safety applies "engineering and management principles, criteria, and techniques to achieve acceptable risk, within the constraints of operational effectiveness and suitability, time, and cost, throughout all phases of the system life cycle" (DoD 2012). Hazard definition: "a real or potential condition that could lead to an unplanned event or series of events (i.e., mishap) resulting in death, injury, occupational illness, damage to or loss of equipment or property, or damage to the environment." "Mishaps do occur from combinations of unlikely hazards with minimal probabilities. As a result, safety engineering is often performed in reaction to adverse events after deployment." "Failure to identify risks to safety and the according inability to address or 'control' these risks can result in massive costs, both human and economic." Eight core activities: (1) document safety approach, (2) identify and analyze hazards across system lifecycle, (3) assess risk (severity plus probability), (4) identify mitigation measures, (5) implement risk reduction, (6) verify risk reduction effectiveness, (7) gain authority acceptance of residual risks, (8) track hazards throughout lifecycle. Standards: MIL-STD-882E.

III. Structural Read

Cluster K — Virtue constraints (Doc 314), as the batch's anchor stress-test, with V3-as-procedure-binding in the strongest form yet seen. SE-079's reading of Decision Management surfaced V3-as-procedure-binding (the procedural decomposition is the structural form V3 takes in that domain). SE-108's Safety reading strengthens the finding: safety's 8-step process is constitutively V3-shaped under the hardest possible constraint, because rankism, optimism, and complacency in safety have lethal consequences directly. Step 2 (identify and analyze hazards across lifecycle) is the V3 mandate against under-surfacing — the procedural form that prevents the safety engineer from suppressing inconvenient hazards under schedule pressure. Step 3 (assess risk: severity plus probability) is V3 against single-axis rankism — both axes must be assessed, not the one preferred by the program manager. Step 7 (gain authority acceptance of residual risks) is V3 against complacency — residuals must be procedurally surfaced to a named accepting authority, not silently absorbed. Step 8 (track hazards throughout lifecycle) is V3 across time — the procedural form that prevents post-deployment forgetting.

The reactive observation that "safety engineering is often performed in reaction to adverse events after deployment" is the keeper-side acknowledgment that V3 conformance fails systematically in the safety domain when not procedurally bound. The 8-step process exists because V3 cannot be reliably maintained on virtue alone; it must be encoded in procedure. This is the strongest form of the V3-as-procedure-binding refinement: the procedure is not merely shaped by V3, the procedure exists because V3 is structurally insufficient as a personal or cultural discipline at the safety stakes. SE-079's "Continue" / fold-confirmation finding gains its third instance after Risk Management (SE-035) and Decision Management (SE-036/645). Cluster K rises from 4 to 5 instances, deepening the synthesis case SE-039 §VII.5 already named ripe.

Cluster F — Pulverization (Doc 445), in dual mode. Forward-pulverization at hazard analysis (premortem-shaped: enumerate ways the system could fail before it does). Backward-pulverization at residual-risk acceptance (the safety case is decomposed by hazard so each residual is named for acceptance). The dual-mode reading is structurally interesting; Cluster F may have a paired-mode sub-form distinct from the forward-only and backward-only canonical readings. Worth flagging.

Cluster A — Universal-sibling lattice (Doc 572 Appendix D), at the hazard-assessment rung. Severity and probability are universal-sibling lattice: every hazard is assessed against both axes, the discriminator is aspect (severity-axis vs. probability-axis). This is a small N=2 instance, the cleanest possible illustration of the lattice structure. Pairs naturally with SE-039 §VII.5's three-baselines triplet candidate as a teaching-example.

Cluster H — Hypostatic Boundary (Doc 372), brushed at "freedom from harm." "Freedom from harm" reaches toward an ontological framing — what is harm, who has freedom, what counts as the protected entity. SEBoK's voice retreats immediately to functional terms: hazards, mishaps, severities, probabilities, mitigations. The corpus reads the retreat as Cluster H discipline operating: SE describes what the system must not do (cause harm), not what harm IS in any deeper sense. The MIL-STD-882E "acceptable risk" framing keeps this functional throughout.

Cluster B — Multi-keeper composition (Doc 604). Step 7 (gain authority acceptance of residual risks) names a multi-keeper structure: the safety engineer holds the analysis, the accepting authority holds the residual-risk decision. The keepers are constitutively distinct (engineer-keeper and accepting-authority-keeper); the procedural binding is the formal acceptance instrument. This is structurally adjacent to the SE-106 acquisition-contract handoff but at the within-program rung rather than the across-program rung.

Cluster E — Institutional Ground (Doc 571). MIL-STD-882E is the canonical institutional-ground codification for defense-domain safety. The page operates at the meta-discipline level (the practice tradition that travels across grounds), with the standard cited as the formal codification's defense-domain instance.

IV. Tier-Tags

  • Safety definition (Fairley) and MIL-STD-882E framing — π / α.
  • Hazard definition — π / α as cited.
  • Reactive-safety observation — π / α as cited; μ / β under corpus when read as V3-failure-on-virtue-alone acknowledgment.
  • Eight core safety activities — π / α as cited; μ / β under corpus when read as Cluster K V3-as-procedure-binding (strongest form).
  • Severity-probability assessment lattice — π / α as cited; μ / β under corpus when read as Doc 572 Appendix D universal-sibling N=2.
  • "Freedom from harm" framing — π / α as cited; the corpus reads functionally per Doc 372 hypostatic-boundary discipline.

V. Residuals

No structural residuals. The page is the third major V3-as-procedure-binding instance with a stronger constraint reading than the prior two.

VI. Provisional Refinements

V3-as-procedure-binding: refinement strengthened to load-bearing (alignment). SE-079's V3-as-procedure-binding finding was already a "stronger than worked-example" claim. SE-108 escalates: the procedure does not merely take V3-shape, the procedure exists because V3 cannot hold on virtue alone at safety stakes. The refinement is now load-bearing across three instances (Risk Management gate-evacuation, Decision Management bias-mitigation, Safety hazard-tracking). Doc 314 update warranted: virtue constraints have a procedural-binding mode where the procedure exists because virtue is structurally insufficient. Worth promoting from candidate to established refinement in the next pass.

Cluster F dual-mode sub-form candidate. Safety's hazard analysis (forward) and residual-risk acceptance (backward) both occur within the same engagement. Cluster F has so far been read as forward-mode-cluster vs. backward-mode-cluster as separate types. Safety surfaces a paired-mode reading where both modes are co-present and structurally complementary. May warrant a new sub-form note in Doc 445.

Cluster K saturation (5 instances) and synthesis ripeness confirmed. SE-039 §VII.5 already named Cluster K ripe at 4 instances. SE-108 brings it to 5; the synthesis successor doc is overdue.

No alignment with longitudinal-pulverization, handoff-mode evacuation, chronic-but-stable, emergent-only, universal-sibling-with-ordinal-axis, three-carrier robustness, or anchor-article in this reading.

VII. Cross-Links

Form documents. Doc 314 (Virtue constraints, V3-as-procedure-binding strengthened to load-bearing), Doc 445 (Pulverization, dual-mode sub-form candidate), Doc 572 (Lattice Extension, Appendix D N=2 instance), Doc 372 (Hypostatic Boundary, "freedom from harm" brush), Doc 604 (Multi-keeper composition, accepting-authority handoff), Doc 571 (Institutional Ground, MIL-STD-882E).

Part-level reformulation. SE-009 (Part 6 — Related Disciplines).

Related distillations. SE-035 (Risk Management, Cluster K first instance and gate-evacuation handoff). SE-036 (Decision Management, Cluster K second instance, V3-bias-mitigation). SE-079 (Decision Management revisit, V3-as-procedure-binding refinement origin). Doc 583 (Reformulation Methodology, Cluster K third instance). SE-078 (System Requirements Definition, Cluster K fourth instance). Doc 580 (Hubble case study, Cluster K fifth-original).

Adjacent SEBoK concepts (per source). Reliability and Maintainability, Security Engineering, Risk Management, Human Systems Integration.

Appendix: Originating Prompt

"Apply refinements; report back for next 40" / "Continue"

(SE-108 is the fifth of eight in batch 4/5. Safety is read as the canonical System Safety page. Anchor of the batch's Cluster K stress-test; supplies the strongest-yet form of V3-as-procedure-binding, escalating the refinement from candidate to load-bearing across three instances. Cluster F dual-mode sub-form candidate also surfaces. Batch 4/5.)

Referenced Documents