Skip to content
Paula Livingstone writing · projects · tools

Attestable Design & Artefact

Authoring Demands: What They Attach To, Who Writes Them, and What Goes Stale

What a demand attaches to, who writes it, and what happens when the plant changes. Demands attach to classes of act rather than occurrences, which is what makes authoring finite: a plant performs unboundedly many acts and has boundedly many kinds, and only those it wants adjudicated need demands. Where a class is too coarse the remedy is a narrower class, not a variable requirement. The author is whoever is already accountable for the act, translating an existing judgement into the terms the record uses; the discipline supplies no view on what an act should require. Because silence on an axis does not constrain, the minimum viable demand is one axis, so a plant can start with the requirement it is confident about. Stale demands are an open problem: the artefact cannot detect a mismatch between a demand and a changed world, which is the strongest argument for treating the discipline as an addition to a plant's review processes rather than a substitute for them.

The admissibility method fixed what a demand is and who authors it: four requirements, one per axis of comparison, stated by whoever proposes the act rather than by the claim or its producer. The demand speaks on four comparisons — scope, freshness, production, and the standing of the voucher — rather than on the record's six fields directly, because a comparison such as production reads more than one field at once: what an act requires is stated at the level of these four judgements, and each draws on whichever record fields bear on it. It did not say what a demand attaches to, in what form it is written, or what happens to it when the plant changes. Those decide whether the discipline is usable, because a demand nobody can sustain is a demand nobody writes.

What a demand attaches to

A demand attaches to a class of act, not to an occurrence of one. Opening an isolation valve is a class; opening XV-204 at eleven o'clock is an occurrence. The requirement on evidence is a property of what the act does and what it risks, and two openings of the same valve under the same conditions demand the same basis, so attaching demands to occurrences would multiply identical statements and guarantee they diverge.

This is what makes authoring finite. A plant performs an unbounded number of acts and has a bounded number of kinds of act, and the bound is smaller still because only the acts a plant wants adjudicated need demands at all. A demand is written once per class and applies to every occurrence of it.

Where a class is too coarse, the remedy is a narrower class rather than a per-occurrence demand. If opening a valve under maintenance demands less than opening the same valve in service, those are two classes and not one class with a variable requirement. Splitting the class keeps the demand a fixed statement about a kind of act, which is what lets it be authored in advance and applied mechanically.

Who writes one

The author is whoever is accountable for the act, and this is deliberately an existing role rather than a new one. In an operational setting somebody already owns the decision that a valve may be opened under stated conditions, and that ownership is recorded in procedures, permits and interlock specifications. What the discipline asks is that the evidential half of that decision be stated in the same terms the record uses, which is a translation of an existing judgement rather than a new one.

The discipline does not supply the content. It has no view on whether opening a valve requires a measurement or will accept a report, and any such view would be a safety judgement the artefact is not entitled to make. What it supplies is that the judgement is stated once, in a form a machine can compare against a basis, rather than remade informally at each handover by whoever is present. That is the whole of the contribution on this axis, and claiming more would be claiming the discipline knows what acts ought to require.

The form of a demand, and its minimum

A demand is four optional requirements, and silence on an axis does not constrain. The consequence is that the minimum viable demand is one axis, and the minimum useful demand is often exactly that. An act that cares only about production, requiring a measurement and refusing a generation, is fully expressible without anyone deciding a staleness tolerance or a scope.

This matters more than it looks. A form that required all four axes would make the first demand as expensive as the complete set, and a plant would stall at the point of deciding a freshness tolerance it had never thought about. Allowing one-axis demands means a plant can begin by stating the requirement it is confident about and add axes when it has reason to, and each addition tightens the discipline rather than being needed to start it.

The cost is that a weak demand is satisfied easily, and a plant that writes only one-axis demands has a discipline that refuses little. That is a true statement about that plant's demands rather than about the artefact, and it is visible: the demand is recorded, so what an act requires can be read and disputed. A weak requirement stated in the open is a different thing from a weak requirement nobody wrote down, which is the situation the discipline is replacing.

What happens when the plant changes

A demand is written against an act as it was understood when authored, and plants are reconfigured, procedures revised, and instruments moved. A demand written two years ago may no longer describe what the act now does, and the discipline will apply it mechanically regardless. This is a real failure mode and the artefact does not solve it.

Two things can be said, and neither is a solution. A demand is a recorded artefact with an author and a date, so a stale demand is discoverable in a way an informal expectation is not; the discipline replaces an unwritten judgement with a written one, and written things can be reviewed. And the failure is not novel: interlock specifications, permits and safety cases have the same property and are handled by periodic revalidation rather than by any mechanism internal to them.

What the artefact cannot do is detect that a demand has gone stale, because staleness is a mismatch between the demand and the world rather than anything visible in the comparison. A demand requiring a measurement will keep requiring one after the instrument is removed, and the result will be refusals that look like the discipline working. That is recorded here as an open problem, and it is the strongest argument against treating the discipline as a substitute for the review processes a plant already runs rather than an addition to them.