Silent Expiry

Canonical reference · Rev3

Bibliography

References

What the concept descends from, what it is distinguished from, and the standards it refers to. The canonical definition states its lineage in Section 2; this page gives the full citations.

The ideas assembled in Silent Expiry are not new, and the definition does not claim they are. Its contribution is a configuration — a control that was right when built, whose premise fell with no decision and no drift in practice, whose loss of protection is hidden but not a failure of the device, in the routine controls of an operating management system — and a name. Every boundary of that configuration is borrowed from one of the works below.

Lineage — works the definition descends from §

  1. Turner, B. A. (1978). Man-Made Disasters. London: Wykeham Publications. Second edition with N. F. Pidgeon, Oxford: Butterworth-Heinemann, 1997. — The incubation period: the years before a disaster during which beliefs about hazards are at odds with the world and nothing signals it.
  2. Reason, J. (1990). Human Error. Cambridge: Cambridge University Press. — Latent conditions: dormant weaknesses in a defense, waiting for a trigger.
  3. Reason, J. (1997). Managing the Risks of Organizational Accidents. Aldershot: Ashgate.
  4. Rasmussen, J. (1997). Risk management in a dynamic society: a modelling problem. Safety Science, 27(2–3), 183–213. — Static rules in a dynamic environment lose validity faster than the rule structure adapts.
  5. Lehman, M. M. (1980). Programs, life cycles, and laws of software evolution. Proceedings of the IEEE, 68(9), 1060–1076.
  6. Lehman, M. M. (1996). Laws of software evolution revisited. In C. Montangero (ed.), Software Process Technology — EWSPT 1996, Lecture Notes in Computer Science 1149. Berlin: Springer, 108–124. — Assumptions embedded at implementation, valid at the time, become progressively invalid as the world changes.
  7. Dewar, J. A., Builder, C. H., Hix, W. M., & Levin, M. H. (1993). Assumption-Based Planning: A Planning Tool for Very Uncertain Times. Report MR-114-A. Santa Monica, CA: RAND. — Load-bearing and vulnerable assumptions; signposts; shaping and hedging actions.
  8. Dewar, J. A. (2002). Assumption-Based Planning: A Tool for Reducing Avoidable Surprises. Cambridge: Cambridge University Press.
  9. Leveson, N. G. (2015). A systems approach to risk management through leading safety indicators. Reliability Engineering & System Safety, 136, 17–34. — Leading indicators derived from the assumptions underlying a safety design, checked during operations; built explicitly on Dewar.
  10. Nowlan, F. S., & Heap, H. F. (1978). Reliability-Centered Maintenance. Report AD-A066579. San Francisco: United Airlines, for the U.S. Department of Defense. — Evident and hidden failures; failure-finding tasks at intervals set by the tolerable probability of a protection being failed on demand.
  11. Board of Governors of the Federal Reserve System & Office of the Comptroller of the Currency (2011). Supervisory Guidance on Model Risk Management. SR Letter 11-7; OCC Bulletin 2011-12. — Ongoing monitoring of whether changed conditions require a model’s assumptions to be adjusted.
  12. Project Management Institute (2017). A Guide to the Project Management Body of Knowledge (PMBOK® Guide), 6th edition. Newtown Square, PA: PMI. — The assumption log.
  13. Walsh, J. P., & Ungson, G. R. (1991). Organizational memory. Academy of Management Review, 16(1), 57–91.
  14. Nelson, R. R., & Winter, S. G. (1982). An Evolutionary Theory of Economic Change. Cambridge, MA: Belknap Press of Harvard University Press. — Routines carry knowledge without carrying its rationale.
  15. Moran, T. P., & Carroll, J. M. (eds.) (1996). Design Rationale: Concepts, Techniques, and Use. Mahwah, NJ: Lawrence Erlbaum Associates. — The field that exists because reasons are lost while artifacts persist.
  16. Nygard, M. (2011). Documenting architecture decisions. Blog post, 15 November 2011. — Architecture decision records: record the context with the decision, because the context is otherwise lost.

Neighbors — works the definition is distinguished from §

These describe adjacent phenomena in which something observable moves — a tolerated anomaly, a migrating practice. In Silent Expiry nothing observable moves; the world does (Section 4).

  1. Vaughan, D. (1996). The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA. Chicago: University of Chicago Press. — Normalization of deviance.
  2. Snook, S. A. (2000). Friendly Fire: The Accidental Shootdown of U.S. Black Hawks over Northern Iraq. Princeton, NJ: Princeton University Press. — Practical drift.
  3. Dekker, S. (2011). Drift into Failure: From Hunting Broken Components to Understanding Complex Systems. Farnham: Ashgate.
  4. Hollnagel, E. (2012). FRAM: The Functional Resonance Analysis Method. Farnham: Ashgate.
  5. Hollnagel, E. (2014). Safety-I and Safety-II: The Past and Future of Safety Management. Farnham: Ashgate.
  6. Weick, K. E., & Sutcliffe, K. M. (2007). Managing the Unexpected: Resilient Performance in an Age of Uncertainty, 2nd edition. San Francisco: Jossey-Bass.
  7. Argyris, C., & Schön, D. A. (1978). Organizational Learning: A Theory of Action Perspective. Reading, MA: Addison-Wesley. — Single-loop and double-loop learning.

Standards referred to §

  1. ISO 9001:2015. Quality management systems — Requirements. Geneva: International Organization for Standardization. — The canonical definition refers to the context clause (4.1), planning and control of changes (6.3, 8.5.6), internal audit (9.2) and management review (9.3) by harmonized-structure number; the argument does not depend on the numbering.

Narrative introduction §

  1. Bleigh, D. (2026). The Norwood Files. Independently published; paperback (Amazon ASIN B0HH6WBQFK) and Kindle (ASIN B0HH8PN7ND) editions. — The concept’s first demonstration at length; not its source of validity (Section 8).

Empirical basis of Rev3 §

The works above are the concept’s lineage: what it descends from. The sources below are its evidence: the primary investigation and regulatory documents against which the three conditions were tested before Rev3 was issued. Nine candidate cases were reconstructed from primary reports; seven were rejected, most of them because a signal attributable to the premise’s failure had in fact reached someone able to change the control. The cases themselves are set out on the Evidence page. The definition is on the Canonical Definition page; nothing here forms part of it.

  1. Transportation Safety Board of Canada (2021). Air transportation safety investigation report A20W0016: Loss of pitch control on landing, Bombardier CL-600-2B16 (Challenger 605), C-GKCP, Calgary, 23 February 2020. — The strongest validated case. Maintenance task interval of 2400 flight hours, set on an assumed utilization of 500 flight hours in 12 calendar months, against a fleet flying 275; the inspection “had not been carried out, nor was it required to have been”, and the shaft had never been inspected. Read against condition 3 in particular.
  2. National Transportation Safety Board (2004). Loss of Pitch Control During Takeoff, Air Midwest Flight 5481. Aircraft Accident Report NTSB/AAR-04/01. — A control of a different class — a standard parameter rather than an interval. The aircraft exceeded its centre-of-gravity limits “even though the flight crew adhered to Air Midwest’s weight and balance program”. The remedy adopted afterwards was to attach the premise to a verification loop.
  3. United States (2026). General Principles of Reliability-Based Maintenance Programs. 49 CFR Part 238, Appendix E. — The nearest existing treatment of muteness: failure-finding inspections for functional failures “not evident to the operating crew”. That is a failed item; a control in Silent Expiry has not failed. Also requires that a programme “must be dynamic” and respond to real data throughout the operating life.
  4. Federal Aviation Administration (2005). Aircraft Weight and Balance Control. Advisory Circular 120-27E. — The institutional response to the case above: standard weights re-based on national health-survey data, with review after each release and operator revalidation on a fixed cycle.

Standing of the evidence. Supported with limitations. Five domains were tested, not twenty-one; both validated incident cases are graded B rather than A, because investigation reports record what a control’s parameter is and rarely when it was set. Originality: Level 2 — partially distinct. The mechanism is recognised and mitigated in several regimes under different local names — useful-lifetime provisions in functional safety, safety-case maintenance and beyond-design-life work in nuclear regulation, dynamic reliability programmes in maintenance engineering, periodic revalidation of standard weights in aviation — and no term crosses domains. No claim of scientific novelty is made or intended. What the definition contributes is a single testable state with a unit of record, not a discovery.

Editions and page numbers are checked against publisher records at each revision of the canonical definition. To report an error, see About.