Chapter 50 — Final defense
Lesson map
Lesson 50 published. Map, example, EX148.
flowchart TD
N0["Learning outcomes"]
N1["50.1 Talk structure"]
N2["50.2 Likely questions"]
N3["50.3 Reflection"]
N4["Practice note"]
N5["50.1b Examiner packet and aftercare"]
N6["Field note — ninety-day review"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX148"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["50.1 Talk structure"]
N2["50.2 Likely questions"]
N3["50.3 Reflection"]
N4["Practice note"]
N5["50.1b Examiner packet and aftercare"]
N6["Field note — ninety-day review"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX148"]
[Learning outcomes]
|
v
[50.1 Talk structure]
|
v
[50.2 Likely questions]
|
v
[50.3 Reflection]
|
v
[Practice note]
|
v
[50.1b Examiner packet and aftercare]
|
v
[Field note — ninety-day review]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX148]
Learning outcomes
You will (1) present the claim and evidence in 20 minutes; (2) answer safety and measurement questions; (3) state what you would not do again.
50.1 Talk structure
Claim; demo on the synthetic plant model; verification results; one failure-trial lesson; limits; questions. No live plant hacking demo.
Lena's defense followed this order. She stated her claim about the compiler, showed it on ABP's synthetic nine-conduit model, presented the equivalence and vector results, and then gave her reflection on one failure. She closed with her limitations slide and one sentence on what the evidence supports: rules equivalent to the design for nine of nine conduits, and three errors that manual review missed. Nothing in the talk touched a live system, and every number on her slides pointed to an artefact in the dossier.
50.2 Likely questions
Fail-closed proof? Denominator choice? Dual-use boundary? SIS independence? What broke in Lab II? Practice answering with pointers to artefacts.
Lena practised each question with her supervisor, answering with a pointer to an artefact rather than an opinion. For fail-closed behaviour, she pointed to the trial results; for SIS independence, to the reachability check showing SIS-B unreachable from every routed zone. For Lab II, she described the clock-skew defect and its fix. The hardest question, what happens if the design is wrong, received the most practice of all.
50.3 Reflection
End with one design mistake in the monitor or the policy compiler and its fix — examiners trust engineers who saw their own failures.
# Lab 1 - tank hold-up after feed pump stop (Ashford Batch Plant, synthetic)
import math
V0, VMIN = 12.0, 2.0 # m3 in feed tank T-1
def outflow(t): # m3/h to reactor; t hours after stop of makeup
return 1.8 + 0.4*math.sin(2*math.pi*t/6)
def drawn(t):
return 1.8*t - (0.4*6/(2*math.pi))*(math.cos(2*math.pi*t/6)-1)
lo,hi=0.0,24.0
for _ in range(50):
mid=(lo+hi)/2
lo,hi=(mid,hi) if drawn(mid)<V0-VMIN else (lo,mid)
print(f"time to min level: {lo:.2f} h")
print(f"average-rate estimate: {(V0-VMIN)/1.8:.2f} h")
Expected output:
time to min level: 5.53 h
average-rate estimate: 5.56 h
Synthetic case — Ashford Batch Plant. Lena's defense led with the fail-closed lab and SIS reachability, not a slide of logos. When asked for a risk score, she refused and showed SIS reachability, critical opens and coverage denominators.
Lena's reflection was the silent stall during the freeze rerun: her vector loader had retried forever when the bench firewall rate-limited it, so a failed run looked like a slow one.
50.4 Errors and limits
Defense is not a sales pitch for a scanner vendor.
Lena's defense mentioned no product names and recommended no tools. When an examiner asked which commercial scanner she would buy, she explained that her work produced rules and evidence for any firewall and that the choice of product belonged to ABP's procurement process. Her slides showed results and limitations, not logos, so examiners judged her work on its evidence rather than on any vendor's marketing. She kept that line throughout.
Practice note
Twenty minutes means rehearsal with a timer. Cutting the limits slide to fit one more bench demo is the wrong cut — examiners need your honesty more than a fourth demo click.
50.1b Examiner packet and aftercare
The examiner packet holds the claim sentence, the Lab II summary for the compiler, the failure-trial measure and the ethics paragraph, and goes out one day ahead. After defense, schedule a maintenance review in ninety days: owning squad, pins, corrective tickets. Archive the talk deck next to the dossier with matching hashes.
Keep a parking lot for examiner ideas and process it within a week. Thank the ABP operators who ran the synthetic trials; a defense without their logs is storytelling. The compiler and the monitor stay in service at ABP after the degree ends, so the defense also starts the work of maintaining them.
Lena sent her packet a day early.
Field note — ninety-day review
Ninety days after defense, the owning squad, pins and corrective tickets were reviewed. One corrective had reopened; it was re-filed with a tighter SLO. Stewardship begins when the applause ends.
50.5 Worked example — answering the hardest defence question (synthetic ABP)
An examiner asks: "Your compiler proves reachability equals the design. What if the design is wrong?" Lena's prepared answer: the compiler verifies implementation against intent, not intent against threats; the design itself came from the consequence-driven assessment and was independently reviewed (Chapter 45); and the validation re-test (Chapter 38) found a real drift the compiler would have prevented. She closes by naming the limitation — a flawed zone model would be faithfully compiled — and the ninety-day plan to compare compiler output with a second team's independent design.
Exercises
- EX148 — Outline. Six-bullet talk outline. Rubric: 3 = claim to demo to verify to failure to limits to Q; 2 = partial; 1 = vendor pitch; 0 = none.
- EX149 — Answer. 3-4 sentences answering what's your risk score? Rubric: 3 = refuse empty score + alternatives; 2 = partial; 1 = invents score; 0 = none.
- EX150 — Mistake. One real (synthetic-story) mistake and fix. Rubric: 3 = specific; 2 = vague; 1 = minimal attempt; 0 = none.
Synthesis
Defend the engineering, the measures and the refusals.
Continue studying — chapter 50 of 50
← Chapter 49 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →