Chapter 44 — Engineering capstone I
Lesson map
Lesson 44 published. Map, example, EX130.
flowchart TD
N0["Learning outcomes"]
N1["44.1 Proposal"]
N2["44.2 Non-goals"]
N3["44.3 Milestone 1"]
N4["Practice note"]
N5["44.1b Success metrics and checkpoints"]
N6["Field note — ethics early"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX130"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["44.1 Proposal"]
N2["44.2 Non-goals"]
N3["44.3 Milestone 1"]
N4["Practice note"]
N5["44.1b Success metrics and checkpoints"]
N6["Field note — ethics early"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX130"]
[Learning outcomes]
|
v
[44.1 Proposal]
|
v
[44.2 Non-goals]
|
v
[44.3 Milestone 1]
|
v
[Practice note]
|
v
[44.1b Success metrics and checkpoints]
|
v
[Field note — ethics early]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX130]
Learning outcomes
You will (1) propose a capstone that ships a measurable CNHP improvement; (2) define scope and non-goals; (3) set a verification plan mapped to Lab I rows.
44.1 Proposal
A CNHP capstone proposal gives the problem, users, requirements (process safety first), architecture sketch, milestones, verification lab plan and ethics paragraph. Capstones that need exploit work are rejected.
Lena's Capstone I proposal was the policy compiler described in the worked example below. Its requirements put safety first: SIS-B must stay unreachable from every routed zone. Her milestones, lab plan and ethics paragraph were reviewed before coding began. The project needed no exploit work, because its job was to prove that rules match the design, not to break into anything on the plant.
44.2 Non-goals
Explicitly list what you will not build (exploit modules, live plant scanning, ML risk oracles, empty scores).
Lena's non-goals were written into her proposal and signed by her supervisor: no live deployment, no configuration of SIS-B and no active scanning. When a classmate suggested adding automatic scanning to check deployed rules, she pointed to the frozen list and kept the compiler's checks working on exports instead. Writing the non-goals down early gave her a clear answer for every tempting extension during the term.
44.3 Milestone 1
Something demoable on synthetic plant data in week 3: e.g. the monitor honouring the kill-switch file in ≤30 s, with a test.
Synthetic case — Ashford Batch Plant. Capstone I proposals that mentioned auto-pwn were returned; signed allow-list distribution with fail-closed advanced.
Other proposals in Lena's cohort built signed allow-list distribution. Lena's own milestone 1 for the compiler met reachability for all nine of ABP's conduits but produced test vectors for only seven rules. The demo ran entirely on synthetic exports, and the gap became the opening item for milestone 2.
44.4 Errors and limits
Scope creep is the main killer — freeze non-goals.
During Lena's capstone, reviewers suggested adding a dashboard, live firewall pushes and support for a second plant. Each would have taken weeks and none was needed to prove the compiler matched the design. She answered each suggestion with the frozen non-goals and placed them in a future-work list instead. The two missing vectors from milestone 1 became her first milestone 2 task, so the remaining time went to finishing what she had promised. Her final scope matched the proposal.
Practice note
Proposals that cannot name a Lab I row for each Must requirement return to draft.
44.1b Success metrics and checkpoints
Define two metrics you will show at defense (e.g. time for the monitor to deny all writes when its policy is missing, percent of allow-list merges that cite a work permit). Capstone I has three mandatory checkpoints on the CNHP calendar: proposal accepted, milestone 1 demo on the bench, mid ethics check. Missing a checkpoint freezes coding until recovered.
Risk register for the capstone: scope creep, dependency delay, reviewer unavailability, ethics boundary confusion — each with early warning and mitigation. Milestone demos that skip fail-closed are graded zero for that checkpoint.
Lena's two metrics were conduit reachability and vector coverage. Both appear in her defense.
Field note — ethics early
A proposal that included a live plant scan was rejected at the ethics checkpoint before any code was written. Mapping Must requirements to Lab I rows in the same review prevented a beautiful design that could not show fail-closed.
A missed checkpoint is recovered with a written plan agreed with the advisor before coding resumes.
Each metric is measured with the same script at milestone 1 and at defense, so the numbers are comparable.
44.5 Worked example — capstone milestone 1 (synthetic ABP)
Lena's capstone builds a verified zone-and-conduit policy compiler: it reads a zone model and emits firewall rules plus conformance vectors. Non-goals: no live deployment, no SIS-B configuration, no active scanning. Milestone 1 success metric: for ABP's nine-conduit model, the compiler produces rules whose reachability (checked with the Chapter 2 graph code) exactly equals the design, and every rule has at least one pass and one block vector. At the checkpoint it met reachability for 9/9 conduits but produced vectors for only 7/9 rules; the gap is the milestone 2 opening item.
Exercises
- EX130 — Non-goal. Three non-goals for a coverage-board capstone. Rubric: 3 = three clear; 2 = two; 1 = one; 0 = none.
- EX131 — Milestone. Week-3 milestone with acceptance test. Rubric: 3 = demo + test; 2 = demo only; 1 = vague; 0 = none.
- EX132 — Ethics. Four-sentence ethics paragraph. Rubric: 3 = auth, synthetic, dual-use, disclosure; 2 = partial; 1 = weak; 0 = none.
Synthesis
Ship safety-relevant programme value; freeze non-goals early.
Continue studying — chapter 44 of 50
← Chapter 43 (draft) · Course chapter index · Chapter 45 (draft) →