Chapter 46 — Engineering capstone II
Lesson map
Lesson 46 published. Map, example, EX136.
flowchart TD
N0["Learning outcomes"]
N1["46.1 Freeze"]
N2["46.2 Verify"]
N3["46.3 Docs"]
N4["Practice note"]
N5["46.1b Demo script and handover"]
N6["Field note — silent run stall"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX136"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["46.1 Freeze"]
N2["46.2 Verify"]
N3["46.3 Docs"]
N4["Practice note"]
N5["46.1b Demo script and handover"]
N6["Field note — silent run stall"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX136"]
[Learning outcomes]
|
v
[46.1 Freeze]
|
v
[46.2 Verify]
|
v
[46.3 Docs]
|
v
[Practice note]
|
v
[46.1b Demo script and handover]
|
v
[Field note — silent run stall]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX136]
Learning outcomes
You will (1) finish implementation against the frozen proposal; (2) run Verification Lab II; (3) deliver operator docs and ops ownership.
46.1 Freeze
Feature freeze date is real: after it, only safety fixes. New ideas go to a sequel proposal.
Lena's capstone froze at v1.0 of her compiler. After the freeze, she fixed only the silent stall in the vector loader, because it could hide a failure, and logged every new idea, such as support for a second plant, in a sequel proposal. The freeze date was agreed with her supervisor at the proposal stage, so nobody could treat it as a soft target when the last weeks became busy.
46.2 Verify
The capstone counts as verified only after it passes Lab II (Chapter 40) on synthetic plant fixtures.
Lena reran Lab II for the compiler on a clean machine built from the v1.0 tag, using only synthetic fixtures. The clean machine had no cached build artefacts, so every result came from the tagged source. The checklist was signed by Lena and her reviewer, and the report listed every skipped test with its reason. Lena kept the clean-machine build log beside the v1.0 tag, and it records the stalled vector-loader run as well as the passing one.
46.3 Docs
Runbook section, ADR, operator tutorial with screenshots of synthetic UI — no plant data. Ops signature required before tag.
"""Lab: alarm load per operator hour before and after rationalisation (synthetic counts)."""
before = {"T-1 high": 140, "T-2 high": 95, "R-101 temp": 30, "pump trip": 6, "comm loss PLC-A": 210, "door open": 75}
remove = {"comm loss PLC-A": 200, "door open": 70, "T-1 high": 110} # chattering/duplicate alarms removed
hours = 24 * 7
tb = sum(before.values()); ta = tb - sum(remove.values())
print(f"week alarms before={tb} after={ta}")
print(f"per operator-hour before={tb/hours:.2f} after={ta/hours:.2f}")
top = max(before, key=before.get)
print(f"worst source before: {top} ({before[top]/tb:.0%} of load)")
Expected output:
week alarms before=556 after=176
per operator-hour before=3.31 after=1.05
worst source before: comm loss PLC-A (38% of load)
Synthetic case — Ashford Batch Plant. One Capstone II team in Lena's cohort delivered signed allow-list distribution; Lab II green; runbook updated the same day.
That team's project was separate from Lena's capstone, the compiler. Her documentation for the compiler was signed by operations before tagging, and its operator tutorial uses screenshots from the synthetic nine-conduit model only. An operations engineer followed the tutorial once on the bench copy of the nine-conduit model before signing.
46.4 Errors and limits
A laptop demo that only describes fail-closed behaviour, without removing the policy on the bench, does not pass.
At Lena's capstone review, a classmate's demo showed a policy tool working on a laptop but could not show what happened when the policy file was missing. The examiners marked the fail-closed requirement as not met. Lena's demo deleted the policy on the bench and showed the denial with its reason code, then restored it, because claims about safe failure must be shown under failure rather than described while everything is working.
Practice note
Silent runbook test: a second engineer follows the runbook cold on synthetic data while the author is silent. Places they stall become doc fixes.
46.1b Demo script and handover
Capstone II demo follows a script on synthetic data: show fail-closed, show coverage denominator, show SIS reachability. The demo ends by restoring the policy and showing traffic allowed again. Link the silent-run recording hash in the Lab II report for advisor audit.
Advisor review watches the silent-run recording and files doc issues before sign-off. Capstone code without an ops owner at merge is unfinished. Doc issues from the recording carry the timestamp where the engineer stalled.
Lena's demo followed this script exactly. Her ops owner signed at merge.
Field note — silent run stall
The peer silent-run stalled on missing test policy key documentation. The doc fix shipped the same day. Capstone II is not done until someone who did not write the code can operate the stop path from the runbook alone.
Handover to ops names the owning squad in README and CODEOWNERS before Lab II sign-off.
A demo that departs from its script is rerun from the start.
46.5 Worked example — freeze and verify (synthetic ABP)
At capstone II freeze, Lena tags the compiler at v1.0 and reruns all verification on a clean machine from the tag: 214 unit tests, 18 conformance vector sets, the reachability equivalence check and the bench firewall replay. One run stalled silently because the bench firewall's API rate-limited the vector loader; the fix is a timeout with an explicit failure message rather than a retry loop. Documentation includes the demo script, the list of non-goals, and a handover note naming which tests require bench hardware so a successor does not mistake skipped tests for passes.
Exercises
- EX136 — Freeze. What is allowed after feature freeze? Rubric: 3 = safety fixes only; 2 = bugs; 1 = features; 0 = none.
- EX137 — Artefacts. Five delivery artefacts. Rubric: 3 = five; 2 = three; 1 = code only; 0 = none.
- EX138 — Ops. Why is ops signature required beside Lab II? Rubric: 3 = ownership/runbook readiness; 2 = vague; 1 = bureaucracy; 0 = none.
Synthesis
Freeze, verify, document, name ops — then operate.
Continue studying — chapter 46 of 50
← Chapter 45 (draft) · Course chapter index · Chapter 47 (draft) →