Chapter 16 — Systems engineering

Chapter 16 — Systems engineering

Lesson map

Lesson 16 published. Map, example, EX046.

flowchart TD
  N0["Learning outcomes"]
  N1["16.1 System of systems"]
  N2["16.2 Requirement traceability"]
  N3["16.3 Life cycle"]
  N4["16.4 Interfaces with vendors"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX046"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["16.1 System of systems"]
  N2["16.2 Requirement traceability"]
  N3["16.3 Life cycle"]
  N4["16.4 Interfaces with vendors"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX046"]

[Learning outcomes]
    |
    v
[16.1 System of systems]
    |
    v
[16.2 Requirement traceability]
    |
    v
[16.3 Life cycle]
    |
    v
[16.4 Interfaces with vendors]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX046]

Learning outcomes

You will (1) describe Pellmore's platform as a system of systems; (2) trace privacy requirements across interfaces; (3) manage privacy through the life cycle.

16.1 System of systems

Systems engineering treats a product as interacting parts. Zara draws Pellmore's platform: mobile app, booking service, video service run by a vendor, records system, laboratory interface, analytics and support desk. Each has its own owner, data and failure modes. Privacy properties such as retention or access control must hold across all of them. A property enforced in one part and ignored in another is effectively absent. She calls this the weakest-interface problem and uses it to justify end-to-end requirements rather than component-by-component promises.

16.2 Requirement traceability

Zara creates a traceability matrix linking each privacy requirement to the components that implement it and the tests that verify it. For example, the thirty-day video retention requirement traces to the vendor contract, the archive key schedule and a monthly deletion test. Gaps appear immediately: the analytics system has no requirement for retention at all. ISO/IEC 27701:2025, the privacy information management system standard, emphasises documented controls and evidence, and Zara's matrix provides exactly that kind of documentation at the engineering level. Each row cites its source.

16.3 Life cycle

Systems pass through concept, development, operation and retirement. Privacy concerns differ at each stage: at concept, whether to collect data at all; in development, how to protect it; in operation, how to monitor; at retirement, how to delete or migrate. Zara notices that Pellmore has no plan for retiring its old booking system, which still holds data. She adds a decommissioning checklist with data inventory, migration or deletion, and certificate of destruction. Retirement, she writes, is when forgotten data most often escape.

16.4 Interfaces with vendors

Many of Pellmore's components are run by vendors. Zara learns that systems engineering must include contracts as interfaces. The video vendor's contract specifies retention, sub-processors and breach notification times. She checks that these match Pellmore's own requirements and finds that the vendor may keep recordings for ninety days, longer than Pellmore's thirty-day rule. She flags the mismatch for contract renegotiation. The example shows that legal documents are part of the technical system and must be engineered with the same care. Contracts carry technical promises.

Worked example

Zara models Pellmore as a system of systems, builds a requirement traceability matrix, adds a decommissioning checklist and finds a ninety-day vendor retention clause that conflicts with the thirty-day rule.

Synthetic case. The platform and vendor are synthetic; ISO/IEC 27701:2025 is real.

Errors and limits

Traceability matrices go stale unless updated with each change.

Exercises

• EX046 — Weakest interface. What is the weakest-interface problem? Rubric: 3 = a privacy property ignored in one component is effectively absent;; 2 = mentions components;; 1 = vague;; 0 = none.
• EX047 — Analytics gap. What gap did the traceability matrix reveal? Rubric: 3 = analytics had no retention requirement;; 2 = mentions analytics;; 1 = vague;; 0 = none.
• EX048 — Contract mismatch. What vendor mismatch did Zara find? Rubric: 3 = vendor may keep recordings 90 days versus Pellmore's 30;; 2 = mentions retention;; 1 = vague;; 0 = none.

Synthesis

Chapter 16 engineers the whole system. Chapter 17 applies feedback control.

Continue studying — chapter 16 of 50

← Chapter 15 (draft) · Course chapter index · Chapter 17 (draft) →