Chapter 45 — Independent design review
Lesson map
Lesson 45 published. Map, example, EX089.
flowchart TD
N0["Learning outcomes and connection"]
N1["45.1 Independence and purpose"]
N2["45.2 Review criteria"]
N3["45.3 Writing findings"]
N4["45.4 Responding to review"]
N5["45.6 Practical activity"]
N6["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX089"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["45.1 Independence and purpose"]
N2["45.2 Review criteria"]
N3["45.3 Writing findings"]
N4["45.4 Responding to review"]
N5["45.6 Practical activity"]
N6["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX089"]
[Learning outcomes and connection]
|
v
[45.1 Independence and purpose]
|
v
[45.2 Review criteria]
|
v
[45.3 Writing findings]
|
v
[45.4 Responding to review]
|
v
[45.6 Practical activity]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX089]
Learning outcomes and connection
After this chapter you can (1) conduct an independent technical review of another team's design using structured criteria; (2) write findings that are specific, evidenced and actionable; (3) classify findings by severity and recommend dispositions; and (4) receive a review of your own design and respond. It applies Fagan-style rigour (Chapter 14) to whole designs and prepares Capstone II.
45.1 Independence and purpose
An independent reviewer has not worked on the design and does not report to its authors. Independence catches errors that authors cannot see — shared assumptions, blind spots, wishful verification. The purpose is to improve the design and the decision about it, not to score points.
For TMRP, the reviewer of the capstone dossier is someone who did not work on the gateway and does not report to its authors. That independence is why the reviewer noticed that the assurance case cited T3 as passed while the matrix still recorded it as failed, an inconsistency the authors had read past many times.
45.2 Review criteria
Review against: requirements (complete, verifiable, traced); architecture (consequence-driven, failure and attack behaviour analysed); controls (specified with performance, independent layers); analyses (assumptions stated, numbers consistent); verification (plan covers requirements, failures handled honestly); operations (procedures, training, recovery); maintainability; and the assurance case (claims supported, defeaters stated).
Each criterion maps to a chapter of this book: requirements to Chapter 21, architecture to Chapter 26, controls to Chapter 27, verification to Chapters 30 and 40, operations to Chapter 37 and the assurance case to Chapter 35. Reviewers of the TMRP dossier used this list as their checklist.
45.3 Writing findings
A finding states: what was observed (with a reference to the document or evidence), why it matters (consequence), the criterion it fails, and a recommendation. Severity: critical (claim cannot be supported, or safety risk), major (significant gap needing change before approval), minor (improvement), observation (no change required). Avoid vague findings ("security seems weak") and design-by-reviewer (prescribing your favourite solution when several would do).
The TMRP findings in the worked example below follow this form. F4, on the battery fraction, is minor because the claim survives with a source added.
45.4 Responding to review
Authors respond to each finding: accept (with change), reject (with reasoning and evidence), or defer (with owner and date). The reviewer checks responses and closes or escalates findings. Disagreements that cannot be resolved go to the decision owner with both positions recorded.
For TMRP, the authors accepted F2 and added the stale-station alarm, and accepted F3 by reporting R6 as not met and costing options in ADR-015. Each response named an owner, and the reviewer checked the re-run campaign before closing F2.
45.5 Worked example: findings on the TMRP dossier (synthetic)
- F1 (critical): Assurance case sub-claim C2 cites T3 as passed, but the traceability matrix (Lab 14) records T3 failed and the v2 re-test is not recorded. Recommendation: record re-test evidence or downgrade the claim.
- F2 (major): Receiver does not alarm on missing data (Lab 15 drops silent); R7 cannot be claimed for loss-of-data events. Recommendation: add stale-station alarm and re-run campaign.
- F3 (major): Restoration trial (Chapter 47) shows 12 h against R6's 8 h; the dossier states R6 as met. Recommendation: report R6 as not met and present options.
- F4 (minor): Battery sizing uses 0.6 usable fraction without a source; cite the battery manufacturer's data.
- F5 (observation): The weighted concept evaluation (§25.4) is sensitive to operability weight; the decision is still defensible.
45.6 Practical activity
Exchange capstone dossiers with another student, review against §45.2 criteria, and write at least six findings with severities.
Choose a reviewer who has not helped with your design. For each finding, include the observation with its reference, the consequence, the criterion it fails and a recommendation. Use the four severity levels honestly. Then exchange roles and respond to the findings on your own dossier with accept, reject or defer, giving evidence for each rejection. Keep both logs for your dossier. Keep it to evidence.
45.7 Common errors and limits
- Reviews by people who helped design.
- Vague or unevidenced findings.
- Severity inflation or deflation.
- Authors rejecting findings without evidence.
The TMRP review avoided these: the reviewer was independent, each finding cited a document, severities matched consequences, and the authors' responses were backed by evidence and checked before closing. F5 was kept as an observation, not inflated. F1 was rated critical because the claim could not be supported as written, not because the error was embarrassing, and the authors did not reject any finding without evidence to support the rejection.
Exercises — chapter 45
EX089 — Rewrite weak findings. Objective: write actionable findings. Inputs: "the key management is not great"; "testing seems incomplete"; "I would use OPC UA instead". Steps: rewrite each as a proper finding or explain why it should be withdrawn. Expected evidence: three rewrites. Rubric: 3 = specific observation, consequence, criterion, recommendation; third withdrawn or reframed to a requirement-based concern; 2 = one vague; 1 = rewording; 0 = none.
EX090 — Respond to F2 and F3. Objective: respond to review. Inputs: §45.5. Steps: write author responses to F2 and F3 with dispositions, changes, owners and dates. Expected evidence: two responses. Rubric: 3 = F2 accepted with design change and re-test, F3 accepted with honest reporting and options (parallelise recovery, pre-built images, revise requirement with stakeholder agreement); 2 = defensive; 1 = rejects; 0 = none.
Chapter synthesis
Independent review finds what authors cannot see. Review against explicit criteria, write specific, evidenced, actionable findings with honest severities, and respond to each finding with accept, reject or defer — recorded and checked.
Continue studying — chapter 45 of 50
← Chapter 44 · Course chapter index · Chapter 46 →
Continue to the next authored lesson.