o, there is no way to rank the relative importance of hazards of mixed type. Loss of the ability to compare risks of all hazards is a flagrant omission. Under correct physics, risks of multiple hazards are additive. This is not the case under MIL-STD-882.

The formal sense of *assurance* is lost by these definitional variants. Being quantitatively assured requires a limit value on proportion or mean deviation and a statement of statistical confidence for this limit; the Standard clearly lacks this characteristic. Properly assurance is a numeric quantity associated with statistical control of risk, not an engineering activity to further psychological confidence. Despite that its developers may express great confidence in the methodology, software built under the Standard is not quantitatively assured.

Repair of MIL-STD-882 {#S:REPAIR}
---------------------

Rehabilitation of MIL-STD-882 is straightforward. It must be amended to contain an engineering introduction to statistical risk for software, including allied procedures. This subject matter is covered here in mathematical language, but should be presented differently for engineers’ consumption. The revised Standard should distinguish between formal assurance and design confidence, and classify what procedures support either. Generally, the concerns associated with design risk align with developmental software engineering, while those of statistical risk align with responsibilities of system safety engineering, part of systems engineering. Software and Systems Engineering should not duplicate each other’s efforts.

Groundwork {#Ch:GROUNDWORK}
==========

This appendix examines ensembles, a fundamental structure in the theory of systems which formalizes the notion of stimulus and response. From this start, discussion proceeds into the Cartesian product, choice spaces and subspaces, and partitions of choice spaces into persistent and volatile components. Dyadic notation is introduced.

Ensemble {#S:ENSEMBLE}
--------

An ensemble is a special form of a more 