SAFETYMAN INTERNATIONAL · SENTINEL
From first draft to controlled review · Working guide · Version 1.1.0
Product page · Client workspace
ONR principles guide regulatory judgement and are not sufficient design or operating standards. This edition requires specialist validation and an approved information-handling environment before operational use. These editions are available for controlled evaluation. Complete specialist review, security and hosting assessment, multi-user acceptance and backup/restore testing before operational reliance.
Incident and investigation findings challenge the argument. Bowtie provides risk and barrier context. Assure supplies verification evidence. Change, Compliance and Audit support continuing review. Relevant Observe and Competence evidence can be attached with permission. The case brings this material into explicit claims and accountable decisions.
Sign in to Sentinel. Open Safety & Assurance Case and choose your edition. Select your company. An administrator must allocate that edition; a current annual licence and company manager role are required for editing. Read/export access remains available to authorised managers after expiry.
Select New case for actual work or Create fictional draft for training. Keep training and operational records clearly labelled. Enter title, facility or service, lifecycle stage, boundaries, interfaces and accountable owner. Define what is excluded.
Record hazards or threats, consequences, operating restrictions, assumptions, applicable requirements and their current editions. Explain the risk-reduction argument and outstanding uncertainties. Reference approved response and recovery arrangements. The software does not establish operating limits.
Add a top-level claim and supporting claims. Give every claim a unique ID. Enter the parent claim ID to show which claim it supports. Explain the reasoning and retain contradictory evidence. The server rejects duplicate IDs, missing parents and cycles. Start as Unassessed; mark Supported only after competent evaluation.
Open Shared barriers to register a uniquely identified control, its safety or security function, owner, performance standard, verification evidence and review dates. Select it at case level and then against the relevant claim. Available requires complete verification information; degraded, unavailable, unknown or overdue controls create review gaps.
Select the relevant Sentinel assessment at case level and against the claim. Record the exact finding, action or control ID in the argument. The case retains a revision and fingerprint rather than copying the entire assessment. Use authorised exports for standalone Observe or Competence records. A source update creates a review gap when the case is refreshed.
Save the draft first. Drag files into Original evidence or use Upload evidence. Supported types include PDF, Word, Apple Pages and common images; export Google Docs as Word or PDF. Limits are 5 MB per file and 50 MB / 100 files per case. Link each attachment to the appropriate claim. Original bytes remain unchanged; add a new file for a revision. The module does not malware-scan files.
Set the next review date and select an independent company manager. Resolve listed completeness and dependency gaps. Replace all TRAINING PROMPT text with reviewed content. Completeness is not proof of technical sufficiency. Save deliberately: saving acknowledges the current versions of selected dependencies.
Submit for independent review with a meaningful reason. The assigned reviewer evaluates evidence, scope, uncertainties and conclusions. They may return the case to Draft or issue it when the checks allow. Every contributing author of that revision is excluded from issuing it. Regulatory acceptance, clinical authorisation and permission to operate remain separate decisions.
Refresh the case to see changed dependency versions, verification dates and conditions. Start a new revision after issue to make changes; retain the original issue. Withdrawal is a recorded decision. Draft and withdrawn cases can be archived and restored. Issued or in-review cases must first be withdrawn or returned.
Export JSON for the working record, use Printable report / PDF for an offline report and use Issued versions for retained issues. Download original attachments separately. A content checksum detects corruption; it is not an externally anchored signature. Back up the database and plugin files and test restoration.
If another contributor saves first, the server rejects your stale revision. Preserve your proposed changes separately, reload and reconcile deliberately. Do not repeatedly press Save. Licence expiry or removal of the edition allocation blocks writes while preserving authorised read/export access.
| Lifecycle, facility boundaries and permissioning context | Identify the lifecycle stage, facility boundaries, applicable licence conditions and required permissioning route with competent specialist input. |
|---|---|
| Safety functions and defence in depth | Record the identified safety functions, supporting systems, dependencies and limits of the argument. Do not infer independence from separate names. |
| Deterministic and probabilistic analysis references | Reference controlled analyses, assumptions, limitations and their applicability. Sentinel does not calculate reactor safety or validate those analyses. |
| Operating rules and limits references | Identify controlled operating rules, limits, conditions and responsible owners. No operating values are generated by this product. |
| Ageing, examination and surveillance evidence | Reference ageing management, inspection, examination and surveillance evidence and unresolved findings. |
| Independent review, periodic review and permissioning | Record independent review, periodic review, open matters and the separate regulator or dutyholder decisions required. |
A fictional non-operational facility documentation exercise reviews an ageing-management evidence gap. No reactor design, source inventory, security arrangement or operating instruction is supplied.
Ask learners to identify the accountable owner, the separate approving authority, the independent reviewer and the evidence that would change their conclusion. A strong answer explains relevance and limitations rather than treating the presence of a file as proof. The expected training outcome is a traceable draft with explicit unresolved gaps.
Use fictional or properly authorised evaluation records. Do not place classified defence information, nuclear-sensitive material, patient-identifiable data or cyber credentials in this launch environment. The sector label does not provide accreditation. Original evidence and approval records must not be rewritten by language conversion.
ONR - Safety Assessment Principles · checked 23 October 2026. This guide is an original product workflow, not a reproduction of a standard. Confirm current applicable requirements, scope and jurisdiction for every real case.
Included: sector prompts, claims, original evidence, company allocations, shared barrier references, assessment version references, independent review checks, controlled issues, archive/restore and exports. Not included: automatic engineering acceptance, quantitative risk calculation, externally anchored digital signatures, real-time case co-edit merging, classified hosting accreditation, case-specific alerting or desktop case synchronisation.
A contributor to the current revision can select Recall submitted case and record a reason. This returns an in-review case to Draft and retains the decision in history. Use it to correct evidence or reassign an unavailable reviewer. Recall does not approve a case and cannot alter a previously issued snapshot. Dependency checks compare both revision and content fingerprint.