FORMAL
DOCUMENTATION SUITE
Why Formal PDF Deliverables
The FSG-A wiki is the living technical baseline — it captures the engineering reasoning, proofs, and architectural evolution. A real defence programme needs documents with specific structural characteristics that a wiki cannot provide: versioned identifiers on each page, prepared-by / reviewed-by / approved-by signature blocks, immutable revision history, and a format suitable for archival in organisational document-management systems (DOORS, IBM Rational, Sharepoint). NATO AQAP 2110 and Försvarsmakten's own quality assurance guidance specifically call out PDF deliverables as the canonical form for programme records.
The eight documents below follow that convention. Each is generated from a dedicated Python script (formal-docs/generate_*.py) so updates propagate deterministically from source data to the final PDF. The scripts are in the source archive; anyone with a reasonable Python + reportlab install can reproduce the documents bit-for-bit from the same input data, which also enables independent verification by evaluators.
The Eight Reference Documents
FSG-A-FMEA-001 — FAILURE MODE AND EFFECTS ANALYSIS
FSG-A-TEMP-001 — TEST & EVALUATION MASTER PLAN
FSG-A-ILS-001 — INTEGRATED LOGISTICS SUPPORT PLAN
FSG-A-RISK-001 — PROGRAMME RISK REGISTER
FSG-A-SAFETY-001 — SYSTEM SAFETY CASE
FSG-A-SBOM-001 — SOFTWARE BILL OF MATERIALS
FSG-A-THREAT-001 — THREAT AND VULNERABILITY ASSESSMENT
FSG-A-INTEROP-001 — INTEROPERABILITY MATRIX
Document Relationships
The eight deliverables are not independent — they reference each other in a structured way. The FMEA identifies failure modes; the Safety Case builds the top-level safety argument using evidence from the FMEA. The Risk Register captures programme risks that may prevent the Safety Case from being validated on schedule. The TEMP defines the test activities that generate evidence to close Risk Register items and validate Safety Case claims. The ILS addresses the sustainment of safety across the 15-year service life. The SBOM is an input to both the Safety Case (for cybersecurity arguments) and the Threat Assessment (for supply-chain risk). The Interop Matrix identifies external systems whose integration testing is scheduled in the TEMP.
This interlocking structure is how mature defence programmes document themselves — no single document stands alone, and changes in one propagate to the others through a documented review process. The structure is modelled on NATO programmes that have progressed successfully; FSG-A itself is not executing such a programme.
How to Use These Reference Designs
FOI / FMV / Försvarsmakten researcher adapting this into a real programme: Start with FSG-A-TEMP-001 to see the phase structure suggested; consult FSG-A-SAFETY-001 for the airworthiness argument; use FSG-A-INTEROP-001 to verify compatibility with specific systems of interest; escalate any concerns through the Risk Register cross-reference.
Defence prime contractor evaluating this architecture: FSG-A-ILS-001 provides 15-year TCO estimates and supply chain dependencies; FSG-A-SBOM-001 provides license compatibility analysis; FSG-A-FMEA-001 flags subsystems where partner expertise would most benefit the programme.
Safety engineer adapting the argument structure: FSG-A-SAFETY-001 presents the structured argument; the FMEA provides the hazard identification base; Article 36 IHL review is in Safety Case §6.
Academic researcher studying the approach: FSG-A-THREAT-001 section on adversarial ML documents the specific attacks considered; the SBOM identifies exact model versions for reproducibility; source code for all validated claims is in src/code/sdk/.
Reproducibility and Source
Every PDF in this suite is generated from Python scripts in formal-docs/. The generator infrastructure (formal_doc_base.py) handles cover page, revision history, classification banner, and page numbering. Per-document scripts (generate_fmea.py, generate_temp.py, etc.) encode the document-specific content as structured data that is rendered deterministically.
This reproducibility is intentional. An evaluator who wishes to verify that the PDF they received matches the claimed source data can clone the source archive, run python3 generate_fmea.py, and compare the output byte-for-byte (modulo timestamp). This defends against both accidental drift between source-of-truth and delivered PDF, and deliberate modification of the PDF between generation and delivery.
Related Chapters
Sources
Generation infrastructure: formal-docs/formal_doc_base.py uses ReportLab (BSD-3-Clause). Each document cites its governing standard on its cover page (MIL-STD-1629A, MIL-STD-1388-1A, MIL-STD-882E, DoD 5000.02, NATO AEP-02, AEP-7.3, STANAG 4586/4660/4609/4607/5525/4671/4795, NIST SP 800-30, ISO/IEC 5962:2021, ISO 31000:2018). Cross-references within the FSG-A wiki — technical changelog: technical-changelog.html; source archive: download.html; secure delivery of these PDFs via OpenPGP: secure-delivery.html.