The Kiosk That Passed Its Test
A national border agency is procuring 240 self-service biometric kiosks. The requirements specification contains: 'The kiosk shall process travellers quickly and reliably' and 'The kiosk shall be accessible to all travellers.' The vendor's verification report shows a mean transaction of 12 seconds for 30 cooperative adults in a laboratory, and an accessibility checklist completed by the design team. The regulator's operational requirement is that 95% of travellers are processed within 25 seconds at a biometric match rate of at least 98%, measured at a busy land border in peak season. Wheelchair users, children under 12 and travellers with worn passports were excluded from the trial. One requirement still reads 'Data retention period: TBD'. Design freeze is in four weeks.
1. Rewrite the two vague requirements into a verifiable set, stating verification methods and why each change matters.
Read the worked answer
Replace 'quickly and reliably' with: 'The kiosk shall complete a standard traveller transaction within 25 seconds for 95% of travellers in the defined operational profile at peak-season arrival rates, with a biometric match rate of at least 98%, verified by test at a production-representative site using a stratified sample of at least 300 travellers.' A mean hides the tail, and the tail is what creates queues. Naming the profile prevents a laboratory sample of cooperative adults from standing in for families, wheelchairs and worn passports.
Replace 'accessible to all travellers' with a requirement referencing the applicable accessibility standard and specifying functional outcomes: a wheelchair user can complete the transaction from a seated position without assistance beyond that available at staffed lanes; a child aged 6 to 11 accompanied by an adult can complete it; a traveller with a worn passport receives a defined fallback within 30 seconds. Verify by test with representative users and by inspection against the standard. 'All travellers' is untestable; a defined population with defined assistance is testable.
2. How should the 'Data retention period: TBD' be handled before design freeze?
Read the worked answer
Treat the TBD as an unresolved stakeholder requirement owned by the border agency's legal and data-protection authority, not by the vendor. Record it with an owner, a resolution date, the design elements it constrains (storage capacity, encryption, deletion mechanism, audit logging) and the consequence if it is resolved late. Run a privacy impact assessment alongside it, because retention affects lawfulness, not just disk size.
Before design freeze, decouple what can be decoupled: specify a configurable retention parameter with a tested deletion function, so the design is not blocked by the policy value. Do not allow the TBD to be silently closed by a vendor default. At the design review, present the TBD status as a conditional item with an accepted risk if it remains open. If retention could change the architecture materially, for example requiring in-country storage, that is a gate issue, not a parameter.
3. What should the acceptance trial look like, and what would make the vendor's current evidence insufficient?
Read the worked answer
The trial must mirror the operational profile. Stratify by traveller type, including wheelchair users, children with adults, worn or damaged passports, groups and non-native speakers. Run at peak arrival rates, at a real border site, with the actual lighting and network latency. Pre-register the sample size and acceptance thresholds; 30 adults cannot demonstrate a 95th-percentile time or a 98% match rate with useful confidence. Measure the distribution and report the 95th percentile, failure modes and fallback rates, not only the mean.
The current evidence is insufficient because it uses a mean, an unrepresentative sample, a laboratory environment and a self-assessed accessibility checklist. The SE lead should require an independent trial witnessed by the authority, with defect severity definitions agreed in advance. If the trial cannot run before design freeze, accept the design conditionally and make the trial a contractual acceptance gate.