Chapter 44 — Engineering capstone I

Lesson map

Lesson 44 published. Map, example, EX130.

flowchart TD
  N0["Learning outcomes"]
  N1["44.1 Capstone scope"]
  N2["44.2 Requirements"]
  N3["44.3 Risks"]
  N4["44.4 Verification plan"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX130"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["44.1 Capstone scope"]
  N2["44.2 Requirements"]
  N3["44.3 Risks"]
  N4["44.4 Verification plan"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX130"]

[Learning outcomes]
    |
    v
[44.1 Capstone scope]
    |
    v
[44.2 Requirements]
    |
    v
[44.3 Risks]
    |
    v
[44.4 Verification plan]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX130]

Learning outcomes

You will (1) scope an engineering capstone in privacy; (2) set requirements and acceptance criteria; (3) plan risk and verification.

44.1 Capstone scope

Zara's capstone project is to design and build a privacy-preserving research data service for Pellmore. Researchers should be able to analyse consultation outcomes without receiving identifiable records. The service must support approved studies, enforce purpose and time limits, and publish only safe outputs. She limits the scope to one type of analysis, outcome counts and rates by condition and region, so that the project can be completed and verified properly within the year rather than spread thinly across many features. Narrow scope allows deep verification.

44.2 Requirements

Zara writes requirements: analyses run inside the service, never on exported records; each study has an approved protocol with an expiry date; outputs pass automatic checks for small counts and are released with differential privacy where they will be published; every query is logged; and patients who opted out of research are excluded. She traces each requirement to GDPR provisions on research safeguards in Article 89 and to the LGPD's provisions on research bodies, recording which requirements are legal duties and which are design choices.

44.3 Risks

Zara lists capstone risks: researchers combining outputs to reconstruct individuals, implementation bugs in noise generation, opt-out lists not synchronised, and scope creep from researchers wanting record-level access. For each she defines controls and tests. For reconstruction she uses the release budget from Chapter 36 per study. For opt-outs she reuses the consent service. She also lists project risks, such as delays in approval, and schedules buffer time, because a capstone that runs late tends to cut verification first. The approval risk is mitigated by booking the ethics committee early.

44.4 Verification plan

Zara plans verification before building. Tests will check that no query returns records, that small counts are blocked, that budget limits stop excess queries, that opt-outs are excluded and that expired studies cannot run. An independent classmate will attempt reconstruction attacks. She sets acceptance criteria: all tests pass and the attack recovers no individual's data. Prof. Holm approves the plan, noting that defining verification first is the best protection against a capstone that works in demonstrations but fails under real use. Test cases precede code.

Worked example

Zara scopes a research data service for outcome counts, writes requirements traced to GDPR Article 89 and LGPD, lists technical and project risks and plans verification with acceptance criteria.

Synthetic case. The service is synthetic; GDPR Article 89 and the LGPD are real.

Errors and limits

Narrow scope limits usefulness; plan extensions after verification.

Exercises

• EX130 — Capstone limit. Why limit the capstone to outcome counts and rates?
  Show marking criteria

  Rubric: 3 = to complete and verify properly within the year;; 2 = mentions time;; 1 = broad scope;; 0 = none.
• EX131 — Reconstruction control. How does the design limit reconstruction attacks?
  Show marking criteria

  Rubric: 3 = a per-study differential privacy budget;; 2 = mentions noise;; 1 = vague;; 0 = none.
• EX132 — Verification first. Why plan verification before building?
  Show marking criteria

  Rubric: 3 = it prevents a system that only works in demonstrations;; 2 = mentions quality;; 1 = after;; 0 = none.

Synthesis

Chapter 44 plans the capstone. Chapter 45 holds an independent design review.

Continue studying — chapter 44 of 50

← Chapter 43 (draft) · Course chapter index · Chapter 45 (draft) →