System

{{entity:Railway Signalling System}} — full QC review at first-pass-complete. Project holds 240 requirements across 8 documents with 13 block diagrams, 11 subsystems decomposed, and 100 facts in namespace SE:railway-signalling. This session assessed requirement quality, traceability coverage, and spray patterns before advancing to qc-reviewed status.

Findings

Spray patterns. {{sys:SYS-REQS-FUNC-003}} (redundant processing / single-failure tolerance) had accumulated 26 downstream links to SUB and IFC requirements — the worst spray pattern in the project. Inspection of link rationales revealed 5 links whose targets are monitoring and diagnostic functions ({{sub:SUB-REQS-FUNC-060}} lamp status reporting, {{sub:SUB-REQS-FUNC-070}} condition monitoring aggregation, {{sub:SUB-REQS-FUNC-071}} remote diagnostic read-only access, {{ifc:IFC-CBIINTERFACES-023}} optical fiber parameters, {{ifc:IFC-CBIINTERFACES-027}} SNMP diagnostic polling). These requirements contribute to system maintainability rather than deriving from the redundancy mandate. Their rationale text forced a connection through preventive-maintenance reasoning, but the derivation direction is inverted — these exist because of maintainability needs, not because the system requires redundant processing.

Orphan subsystem requirements. 9 SUB-REQS from the {{entity:Signaller Workstation}} and {{entity:Traffic Management System}} subsystems (sessions 308–309) had no upward trace to any SYS requirement. These included display rendering performance ({{sub:SUB-REQS-FUNC-074}}), command acknowledgement timing ({{sub:SUB-REQS-FUNC-076}}), audit trail generation ({{sub:SUB-REQS-FUNC-077}}), alarm presentation ({{sub:SUB-REQS-FUNC-078}}), emergency authentication override ({{sub:SUB-REQS-FUNC-082}}), inactivity lockout ({{sub:SUB-REQS-FUNC-083}}), conflict detection ({{sub:SUB-REQS-FUNC-086}}), timetable import ({{sub:SUB-REQS-FUNC-089}}), and TMS-CBI connectivity loss handling ({{sub:SUB-REQS-FUNC-090}}).

Traceability gap. {{sub:SUB-REQS-FUNC-089}} (timetable import and validation) has no valid SYS-level parent. No system requirement exists for traffic management capability — the entire TMS subsystem derives its functional authority from {{sys:SYS-REQS-FUNC-001}} (interlocking) only by extension. A dedicated SYS requirement for automated traffic management should be created in a future session.

Lint. 7 findings: 1 medium (missing statistical context for MTBF operating-hour references in {{stk:STK-NEEDS-OPS-001}} and {{sys:SYS-REQS-FUNC-004}}), 5 low-severity ontological ambiguity findings (expected: system-level entity {{hex:50F77A59}} is correctly abstract while physical components like {{entity:Signalling Uninterruptible Power Supply}} {{hex:D5F71218}} are correctly physical), 1 low (91 reqs lack SHALL — all are ARC decisions or VER test procedures, correctly non-normative). VER coverage stands at 81/135 SUB+IFC requirements (60%), above the 50% threshold.

Corrections

Trace links added (8). Linked all orphan SUB-REQS except {{sub:SUB-REQS-FUNC-089}} to appropriate SYS parents: {{sub:SUB-REQS-FUNC-074}} → {{sys:SYS-REQS-PERF-002}} (display performance drives aspect visibility); {{sub:SUB-REQS-FUNC-076}}, {{sub:SUB-REQS-FUNC-077}}, {{sub:SUB-REQS-FUNC-082}}, {{sub:SUB-REQS-FUNC-083}}, {{sub:SUB-REQS-FUNC-086}} → {{sys:SYS-REQS-FUNC-001}} (interlocking safety and control); {{sub:SUB-REQS-FUNC-078}}, {{sub:SUB-REQS-FUNC-090}} → {{sys:SYS-REQS-FUNC-003}} (redundancy and fault handling).

Spray links pruned (5). Removed {{sub:SUB-REQS-FUNC-060}}, {{sub:SUB-REQS-FUNC-070}}, {{sub:SUB-REQS-FUNC-071}}, {{ifc:IFC-CBIINTERFACES-023}}, {{ifc:IFC-CBIINTERFACES-027}} from {{sys:SYS-REQS-FUNC-003}} derivation chain. SYS-003 now has 23 downstream links — still high, but each remaining link has a genuine redundancy/failover derivation rationale.

Baseline. Created QC-2026-03-18 baseline. Status advanced to qc-reviewed.

flowchart TB
  n0["Railway Signalling System"]
  n1["Computer-Based Interlocking"]
  n2["Train Detection Subsystem"]
  n3["ETCS Radio Block Centre"]
  n4["Colour-Light Signalling Output"]
  n5["Points and Crossing Drive System"]
  n6["Level Crossing Protection System"]
  n7["Traffic Management System"]
  n8["Signaller Workstation"]
  n9["Signalling Communication Network"]
  n10["Signalling Power Supply System"]
  n11["Signalling Diagnostic and Monitoring System"]
  n2 -->|Track occupancy data| n1
  n1 -->|Signal aspect commands| n4
  n1 -->|Point drive commands| n5
  n5 -->|Point detection feedback| n1
  n1 -->|Crossing activation trigger| n6
  n1 -->|Route status for MA computation| n3
  n7 -->|Automatic route requests| n1
  n1 -->|Interlocking state display| n8
  n8 -->|Signaller commands| n1
  n9 -->|Data transport| n1

Residual

Three requirements ({{sub:SUB-REQS-FUNC-060}}, {{sub:SUB-REQS-FUNC-070}}, {{sub:SUB-REQS-FUNC-071}}) became orphans after spray pruning — they need a maintainability SYS requirement that does not yet exist. {{sub:SUB-REQS-FUNC-089}} remains orphaned pending a traffic management SYS requirement. {{sys:SYS-REQS-FUNC-003}} retains 23 links; further reduction requires splitting the requirement into separate redundancy and fault-tolerance statements, which is a design decision beyond QC scope. The statistical context finding on operating-hour MTBF references is valid but requires engineering judgement on appropriate confidence intervals.

Next

Validation session should assess whether 23 links on SYS-003 is justified or whether the requirement should be split. Two new SYS requirements are needed: one for traffic management capability (parent for TMS subsystem) and one for system maintainability (parent for diagnostic/monitoring requirements). The 4 remaining orphan SUB-REQS should be linked once those parents exist.