Independence Proof Obligation Template¶
Proof-obligation protocol — instantiates Independent Generator Validation
A fill-in-before-you-rely checklist that forces the claim 'these are independent' to name its combination rule and its pass/fail criterion up front, turning a vague assertion into a reviewable obligation.
Independence Proof Obligation Template is the upstream protocol that structures an independence claim as a set of obligations to discharge before a candidate set is relied upon. It produces no measurements. Its own contribution is to pin down the two things everyone otherwise leaves implicit — the combination rule (what counts as reconstructing one member from the others) and the independence criterion (the exact or approximate test, and what result passes) — and then to assign the remaining work to named mechanisms. Its distinctive move is to make the claim falsifiable: "these are independent" stops being a word and becomes a specific, reviewable obligation with a stated pass condition, so a reviewer can check it rather than trust it.
Example¶
An avionics design claims three "independent" airspeed channels for safety redundancy. The template refuses the word until the blanks are filled: independent under what combination — electrically, algorithmically, or physically? And by what criterion — here, that no single fault should drive more than one channel together. Working through it surfaces that all three channels share one heater power bus, a common-mode path (illustratively). On the criterion the design itself declared, the three channels fail the independence obligation despite carrying three separate part numbers. No signal was measured; the template converted an assumed independence into a checkable one — and, in this case, a failed one — before the assumption could reach a safety case.
How it works¶
- State the downstream claim. Name what actually depends on these being independent.
- Declare the set and the combination rule. Fix the candidates and what "reconstructing one from the others" means.
- Record the criterion and pass condition. Choose exact or approximate, and write down what result counts as independent.
- Assign the remaining obligations. Delegate the representation space, tolerance, witness format, retention rule, and downstream limits to the mechanisms that will discharge them.
- Gate sign-off on discharge. Require the filled sheet, with real witnesses, before the set is used.
It front-loads the definitions and delegates the testing — that division is the point.
Tuning parameters¶
- Exact vs. approximate criterion — an algebraic proof of independence, or a tolerance-based near-dependence bar; sets how strict "independent" must be.
- Combination-rule breadth — only linear combination, or any admissible transform; a wider rule is a harder independence bar to clear.
- Mandatory vs. waivable obligations — which blanks must be filled to sign off and which can be deferred with justification.
- Evidence bar — how strong a discharged witness must be before the obligation is considered met.
- Re-run triggers — the changes (to representation, preprocessing, the set, or tolerance) that force the whole screen to be re-done.
When it helps, and when it misleads¶
Its strength is killing the "they have different names, so they're independent" fallacy: it makes claims auditable and comparable, and it catches common-mode coupling that no per-member numerical test can see, because the coupling lives in a shared cause rather than in the data[n1].
Its failure modes are those of any checklist. It can decay into box-ticking theatre — filled but not honoured — and a criterion set too loosely will wave through a near-dependent set. Above all it proves nothing on its own: without the detectors actually discharging its obligations, it is just a form. The classic misuse is running it backwards — writing the criterion loose enough that the set you already built passes. The discipline is to set the criterion before seeing the set and to bind sign-off to genuinely discharged witnesses, not to a completed form.
How it implements the components¶
shared_combination_rule— its central act: declaring what combination counts as reconstruction, so that "independent" has a definite, testable meaning instead of an intuitive one.independence_criterion— it records the exact or approximate test and the explicit pass condition the set must meet to earn the label.
It declares but does not discharge. The representation space is chosen through Independent-Axis Design Review and instantiated by tools like Feature Collinearity Heatmap; the witnesses come from Gaussian Elimination Pivot Check and Nullspace Dependency Certificate; tolerance and downstream-stability limits from Condition-Number Dashboard; and retention decisions from Basis-Candidate Pruning Workflow.
Related¶
- Instantiates: Independent Generator Validation — the declaration layer that makes the whole screen auditable.
- Sibling mechanisms: Basis-Candidate Pruning Workflow · Independent-Axis Design Review · Gaussian Elimination Pivot Check · Feature Collinearity Heatmap · Condition-Number Dashboard · Nullspace Dependency Certificate · Residualization Contribution Test · Gram-Schmidt Orthogonalization Trace · Rank-Revealing Decomposition · Singular-Value Threshold Scan · Variance-Inflation Review
Editorial Notes¶
Form Classification¶
Form family: Representation, Specification & Plan
Rationale: The fill-in artifact externalizes the claimed combination rule, independence evidence, and precommitted pass-or-fail criterion before reliance.
Nearest alternative: Interface, Display & Cue — Checklist fields prompt completion, but the operative product is a durable reviewable proof-obligation specification.
Review outcome: Adjudicated after independent review; medium confidence.
Origin Attribution¶
Primary origin: Engineering & Design
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Multi-domain
Rationale: Explicitly demonstrating that redundant channels lack common-cause dependencies is reliability-engineering assurance practice.
Related originating lineages:
- Computer Science & Software Engineering — Distributed and security systems materially use independence assumptions for fault tolerance.
- Mathematics — Combination rules and exact or approximate independence criteria give the claim a formal pass condition.
- Statistics & Experimental Design — Statistical independence and declared combination rules supply part of the evidentiary obligation.
Review resolution: Both reviewers independently assign engineering_design as the primary originating domain, so that shared primary is retained. Alternate domains are the union of reviewer-identified formative or independently originating lineages; later application settings alone are excluded. The final form materially composes methods or concepts from more than one formative domain. It has established independent use across several domains, but that does not make it domain-free. The encyclopedia entry makes that composition explicit.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
The template proves nothing by itself — it is an obligation-setter, and a filled sheet is not evidence. Its entire value rides on whether the obligations are actually discharged by the detector mechanisms and whether sign-off is bound to real, reviewable witnesses. A reader who mistakes the completed form for a proof has reproduced exactly the overconfidence the archetype exists to prevent.
[n1] Common-mode (or common-cause) failure is the reliability-engineering fact that nominally redundant channels are not independent if a single shared cause — a common power supply, calibration source, or software defect — can affect them together. Because the dependence lives in the shared cause rather than in the output data, it is invisible to per-channel numerical tests and must be caught by an explicit design obligation. ↩