ASSIGNMENT 3 · CHAPTER 12
Trace the hazard to a control
Read the named source pages, check the five objectives, apply the concepts, then reassess your decision when new evidence appears. The total-time estimate includes preparation; report your actual time.
Practical hour. This build is this chapter’s practical hour. The assignment is not submitted without it. Running the tests is a separate row in the rubric; longer writing does not make up for it.
الساعة التطبيقية. هذا البناء هو الساعة التطبيقية لهذا الفصل. لا يُسلَّم الواجب بدونه. تشغيل الاختبارات صف مستقل في السلّم، لا يُعوَّض بطول الكتابة.
Course learning outcome 4: Design safety in safety-critical systems, practised by building and testing the fault tree. The tests and the coverage step practise outcome 11: design and implement test cases across testing strategies.
مخرج التعلم 4: تصميم السلامة في الأنظمة الحرجة، ويُمارَس ببناء شجرة الخطأ واختباره. والاختبارات وخطوة التغطية تمارس المخرج 11: تصميم حالات الاختبار وتنفيذها.
- Warm-up
- FIT → TRACE → BOUND → ACT + EVIDENCE
- Commit Part A
- STRESS → REFIT
- AI declaration + human review
- Export and submit in LMS
1 · WARM-UP · 5 MINUTES · NOT GRADED
A barrier controller follows every programmed command correctly. Does that establish that it cannot strike a pedestrian?
Show / hide warm-up answer
No. The requirements or sensing assumptions may be unsafe. Identify the hazardous situation, an appropriate control and the evidence needed to verify it.
Lecture guide
X03, X05, X06, D12 and B01; original slides 15–32 and 44–58.
FIT identifies the relevant problem. TRACE builds this chapter’s artifact. BOUND states the limits. ACT + EVIDENCE records the action, owner and verification. STRESS then tests your reasoning before REFIT.
Chapter map · Relevant mechanism · 20-rule map · Practice card. Source and chapter-unit identifiers are not canonical rule numbers.
CURRENT EDITION · MASTERY V2
Required preparation and assessment scope
Read: Fault-tree reasoning and reduction: slides 25–30; Static analysis: slides 50–53.
Complete the five-objective preparation check after the assigned reading before you start.
Scope notes and earlier editions
Blackboard supplies the calendar deadline. All five chapter objectives, the classroom concepts and named reading are in assessment scope. Optional toolkit activities are enrichment unless assigned.
One assigned source application and one short transfer answer are included below, within the existing 5-point rubric. A reading click or a practice score is not proof of mastery.
Already started the previous edition? Resume or export your previous work using the same ID and browser. Previous drafts stay separate. Completed submissions do not need repeating unless the instructor requests it.
READ BEFORE ANSWERING
How your work is assessed · 5 points
| Criterion | Scoring |
|---|---|
| FIT · 1 point | 1: Defines the chapter-specific problem accurately, distinguishes facts from assumptions and connects it to the proposed action. The short transfer answer must correctly apply the second concept; FIT and transfer together earn this single point.Partial credit: 0.75 · 0.5 · 00.75: The right concept and mechanism, but one link is thin: a fact and an assumption are not separated, or the transfer answer applies the second concept only partly.0.5: A relevant concept is named but applied generically or to the wrong mechanism, or the transfer answer is missing or incorrect. 0: No chapter concept is applied, the case is misread, or the answer depends on invented facts. A generic “hold and test” statement does not satisfy this criterion. |
| TRACE · 1 point | 1: A coherent hazard-to-requirement-to-control-to-verification trace, with existing and proposed evidence clearly separated. Apply one named required source concept to the artifact and explain the connection. Build: every course check passes, your own tests catch every known bug (mutation test), and you can make your micro-viva change and explain which tests change; the text uses what the build showed.Partial credit: 0.75 · 0.5 · 00.75: A complete trace with one weak link—for example, a requirement that does not quite control the hazard, or evidence whose status (existing or proposed) is unclear.0.5: A missing or incorrect link between hazard, requirement, control and verification, or proposed evidence presented as completed. Or the build fails course checks that the written record does not explain. 0: No coherent trace, or a safety claim that rests on invented test results or probabilities. |
| TESTS RUN · required | Required for submission: a recorded run of your own tests and the course checks on your final code, a second run after you change one test input, and the coverage sentence. Part A cannot be committed without them. Not replaceable: longer writing does not make up for a missing run. A run with failing checks is accepted when your text explains it. The build itself is marked in TRACE. |
| BOUND · 1 point | 1: States relevant operating assumptions, scope and an observable trigger to reconsider the claim. Partial credit: 0.75 · 0.5 · 00.75: A relevant boundary and trigger, but one is imprecise—for example, a trigger that cannot be observed as written.0.5: The boundary is generic (“if problems occur”) or does not match the claim and the plan. 0: No boundary, or a boundary that contradicts the case facts. |
| ACT + EVIDENCE · 1 point | 1: Gives a feasible bounded action, named responsibility and inspectable evidence, while distinguishing completed from proposed verification. Partial credit: 0.75 · 0.5 · 00.75: A feasible action and useful evidence, but one element is missing—for example, the responsible role, or whether the evidence is completed or proposed.0.5: The action is vague or not feasible in the case, or the evidence cannot be inspected by someone else. 0: No action, or evidence that is invented or reported as completed when it is only proposed. |
| REFIT · 1 point | 1: Explains how the new evidence affects the initial claim and justifies RETAIN, REVISE or REPLACE with a coherent final record. Partial credit: 0.75 · 0.5 · 00.75: The effect of the new evidence and the RETAIN / REVISE / REPLACE choice are justified, but the final record leaves one inconsistency with the new boundary.0.5: A choice is stated but not justified from the new evidence, or the final record repeats Part A without addressing the change. 0: No REFIT, or a response that ignores or contradicts the new evidence. |
Five points use the same familiar structure. The chapter artifact changes; the LMS determines how assignment points contribute to the course grade.
Learning-outcome alignment
This task supports CLO 4 of the course specification (section B). The Python build, its tests and the coverage step also support CLO 11. It is course-written practice, not an official national readiness assessment or an approved item-weight mapping.
Strong and weak answers for each criterion · how other answers are accepted
| Criterion | Strong example | Weak example |
|---|---|---|
| FIT | Strong: Hazard: the barrier closes on an occupied zone. Facts given: one camera, no second sensor. Assumption, marked: the camera sees the whole zone. Why: Names the chapter concept, separates a fact from a marked assumption and links both to the action. | Weak: The barrier is a safety-critical system, so it must be safe. Why: Repeats a definition; no case fact and no assumption. |
| TRACE | Strong: Hazard → requirement “do not close while the zone is occupied or the camera is blind” → interlock control → proposed test with a covered camera. Why: Every link is present and the test is marked proposed, not done. | Weak: The hazard is handled by testing. Why: No requirement, no control, and the test is not named. |
| BOUND | Strong: The claim holds while the camera reports a frame every second. A missing frame for two seconds is the trigger to reopen the decision. Why: An observable trigger that another engineer could watch for. | Weak: The claim holds unless something goes wrong. Why: The trigger cannot be observed as written. |
| ACT + EVIDENCE | Strong: Action: hold the barrier open when no frame arrives. Owner: the site safety engineer. Evidence: a recorded test with the camera covered, proposed. Why: Feasible action, a named role and inspectable evidence with its status. | Weak: Run more tests and make sure it is safe. Why: No specific action, no owner, no evidence anyone could inspect. |
| REFIT | Strong: The new evidence shows a missing frame was treated as “clear”. I replace my action: the default on a missing frame is hold. My first boundary assumed the camera failed loudly; it did not. Why: Says what the new evidence changed, chooses REPLACE with a reason and keeps the record consistent. | Weak: I keep my answer because it was already careful. Why: Ignores the new evidence and gives no reason. |
Other answers are accepted when: the answer uses a chapter concept correctly, rests only on the facts given in the task, separates done from proposed evidence, and names a trigger that someone could observe. A different decision that meets these conditions earns the same marks as the model answer.
The examples are about a different practice case. They show the kind of reasoning that earns the mark, not the answer to this task.
What distinguishes an unsupported answer from a stronger one?
Different practice example · weak: “The barrier is safe because tests passed.”
Stronger: For a different machine, a trapped-hand hazard is linked to an interlock requirement and a proposed obstruction test. A passing daylight test would not establish behavior with the sensor disconnected.
The stronger answer names a mechanism, its scope and inspectable evidence. It does not certify a real system. Your assessed answer must address this task’s own facts.
The assignment in nine steps الواجب في تسع خطوات
- 115 minPrepareLecture, the two readings, the five practice questionsاحضر المحاضرة، اقرأ المصدرين، وحلّ الأسئلة الخمسة
- 21 minOpenOpen it with your Student ID, in the same browser every timeافتح الواجب برقمك الجامعي، ومن نفس المتصفح دائماً
- 320 minPart AFIT · artifact · BOUND · ACT + EVIDENCE, 120–180 wordsاكتب حكمك الأول: المشكلة، المهمة، الحدود، القرار والدليل
- 430 minBuildPlan, complete the code, write 3+ tests, Runاكتب الخطة، أكمل الكود، 3 اختبارات على الأقل، ثم Run
- 51 minCommitReview & commit Part A: it becomes read-onlyثبّت الجزء A: يصبح للقراءة فقط
- 62 minNew evidenceIt opens on the page right after you commit. Read itيظهر الدليل الجديد في الصفحة مباشرة بعد التثبيت: اقرأه
- 710 minPart BBoundary status, then RETAIN / REVISE / REPLACE and whyهل تغيّر قرارك؟ اختر وبرّر، ثم اكتب القرار النهائي
- 82 minSignDeclare AI use, type your name, tick the boxصرّح بالذكاء الاصطناعي، اكتب اسمك، وضع العلامة
- 93 minSubmitPrint / PDF, then upload the PDF in Blackboardصدّر PDF وارفعه في Blackboard
Select a step to see it on a picture of this page. Online guide: How to do an assignment.
Before you start
- Save often. Use Save draft while working and download a backup before leaving a shared device.
- Commit, then the new evidence. Part A becomes read-only when you commit, and the new evidence opens on this page straight away. Complete Part B, export the PDF and upload it in Blackboard.
- Ownership check. Your instructor may ask you to explain your Part A and REFIT in a two-minute conversation. Your written work and your explanation should agree. AI may help you practise; the reasoning you submit must be your own.
New to this format? Read the step-by-step guide. The sequence preserves your first judgment; it is not a secure examination system.
Identity
Loaded from the entry page. Drafts are separated by Student ID in this browser.
Submission details
Check the current deadline and submission instructions in the LMS.
How this assignment connects to the lecture and the five objectives
ONE METHOD · TWO DIFFERENT CASES
From the classroom card to this assignment
The lecture has 20 slides and three short practice stations: claim + evidence; mechanism + limits; changed condition + revised decision. Here you transfer that reasoning to the separate assessed scenario below. Do not copy the practice answer or submit another full classroom report.
Unchanged: 5 raw points, existing deadline, local draft identity, confirmed Part A commitment, STRESS then REFIT, AI declaration and Blackboard submission. Already completed work does not need repeating merely because the lecture was updated.
Five chapter objectives → existing evidence opportunities
These are local chapter objectives. They do not renumber the approved syllabus outcomes or establish an official national mapping. The lecturer judges correctness and sufficiency; a field being filled is not attainment.
| Chapter objective | Where it is practised / evidenced within this task |
|---|---|
| Objective 12.1 Separate hazard, accident and risk. | FIT |
| Objective 12.2 Explain avoidance, detection/removal and damage limitation. | TRACE + source application |
| Objective 12.3 Read a fault tree and identify its assumptions. | transfer question + TRACE |
| Objective 12.4 Link a safety requirement to a verification method. | TRACE + EVIDENCE |
| Objective 12.5 Explain a safety case and the limits of formal/static analysis. | BOUND + REFIT |
2 · PART A · 20 MINUTES
Assessed scenario · fictional teaching case
A fictional campus is evaluating an automatic loading-bay barrier. The proposed safety requirement is: the barrier must not close while the monitored zone is occupied. A prototype has passed the recorded daylight tests with an unobstructed camera. The test report does not include low light, rain or a covered lens. A separate stop button exists, but no drill report shows how quickly an operator can recognize a hazard and use it. Deployment is proposed for both day and night. You advise the service owner: release, restrict the pilot, or hold.
Keep the written response to about 120–180 focused words; use compact tables or notation. Include the source application and transfer answer in that budget. Your Python code, tests and build record are not counted in it. State facts, assumptions and proposed evidence separately. Quote or cite the assigned source precisely; explain its role. Report actual study time at the end.
A1 · FIT · 1 POINT
Identify one concrete hazard, the possible accident and who could be harmed. Distinguish these from an ordinary software failure.
PYTHON BUILD · ASSESSED IN TRACE
Build the fault tree
Model the hazard “the barrier closes while the zone is occupied” as two fault trees built from the case facts: current (the design as described) and revised (with your proposed control or test). Tag every event as fact, assumption or proposed. The revised tree must leave no single event that causes the hazard on its own. Use its minimal cut sets in your TRACE.
First time? Try the not-assessed practice build and a complete worked example on How to do an assignment.
Budget about 30 minutes. Python runs in your browser: nothing to install, and nothing is uploaded. The first run downloads Python once (about 10 MB, internet needed). Passing every check is necessary, not sufficient: your written record must use what the build shows.
Your build record names a micro-viva change request chosen from your Student ID. Be ready to make that change in front of your instructor and explain which tests change and why.
Primary source · about 15 minutes: W. E. Vesely, F. F. Goldberg, N. H. Roberts and D. F. Haasl, Fault Tree Handbook (NUREG-0492), U.S. Nuclear Regulatory Commission, 1981. Read it for the AND and OR gates and minimal cut sets. Which cut set of one event does your revised tree remove? Use the answer in your build plan.
The course checks your build must pass
- both trees are complete: three or more events, no placeholders
- current rests on case facts
- revised: no single event causes the hazard
- revised labels new controls or tests as proposed
- revised keeps every case fact from current
- your own tests: at least three, all passing
Keep the given names. Write at least three functions whose names start with test_. Tab inserts four spaces.
Write your plan, then run.
COVERAGE STEP · COURSE OUTCOME 11 · DESIGN AND IMPLEMENT TEST CASES ACROSS TESTING STRATEGIES
The build record measures which lines and branches of your code your own tests run. The course checks are not counted.
- Make your three tests pass and read the coverage lines in the build record.
- Change one input in one of your tests (in this build, the set of events you pass to
occurs). Run again: the record shows Run 2. - Write one sentence: which gate outcome is still not tested, and which input would test it.
A2 · TRACE · 1 POINT
Write one trace: hazard → safety requirement → design control → verification activity. Label each element already supported by the supplied evidence and each that is only proposed. Do not invent a numerical risk rating.
A3 · BOUND · 1 POINT
State the operating conditions supported by the evidence and a condition that would require a new safety decision.
A4 · ACT + EVIDENCE · 1 POINT
Choose release, restricted pilot or hold. Name one responsible role and the evidence that must support the chosen boundary.
Name the relevant test/log/audit, the conditions it must cover, who checks it, and what evidence is still missing. Do not describe requested evidence as if it already exists.
ASSIGNED SOURCE APPLICATION · INCLUDED IN THE EXISTING RUBRIC
Write the source slide number, explain the concept in your own words, and identify the specific part of your artifact it supports or challenges. Use the assigned pages above. A citation alone is insufficient.
TRANSFER CHECK · SCORED WITH FIT
For a hazard with two AND-connected causes, explain why multiplying their probabilities may be invalid. Identify one possible common cause; no probability calculation is required.
Commit is not LMS submission. Confirmation freezes FIT, TRACE, BOUND, ACT and EVIDENCE before the new information appears.