System

Interim QC pass on the {{entity:Fusion Reactor Control System}} ({{hex:51F77B19}}), se-fusion-reactor-control-system. Session 393 was the last QC checkpoint; six decomposition sessions have run since, adding Plant Control and I&C, Plasma Diagnostics Integration, and closing the final component requirements. At entry: 163 requirements, 147 trace links, 10 diagrams. At exit: 174 requirements, 148 trace links, baseline QC-2026-03-21 created.

Findings

Lint produced 26 findings (4 high, 22 medium). The structural issues concentrate around three patterns.

Ontological mismatch — Physical Object trait absent: UHT classifies {{entity:Fusion Reactor Control System}} ({{hex:51F77B19}}) and {{entity:Quench Detection System}} ({{hex:54F77218}}) without the {{trait:Physical Object}} trait, yet prior requirements impose physical installation constraints on both. The FRCS enclosure requirements existed in STK-REQ-010 and REQ-SEFUSIONREACTORCONTROLSYSTEM-034 but no subsystem requirement defined the housing specification. Similarly, QDS physical proximity to magnet coils (implied by IFC-REQ-017) had no formal requirement for radiation hardening — critical given the >1×10^14 n/cm² neutron environment over a 20-year operational life.

System-Essential components without redundancy: Three components carry the {{trait:System-Essential}} trait — {{entity:Emergency Shutdown Sequencer}} ({{hex:51F73A18}}), {{entity:Safety Logic Processor}} ({{hex:D1B77858}}), and {{entity:Pellet Injection Controller}} ({{hex:55F53218}}) — but none had redundancy or failover requirements. For the ESS and SLP this is a SIL-3 compliance failure: IEC 61511 mandates HFT ≥ 1 for SIL-3 functions. The {{entity:Disruption Prediction Engine}} ({{hex:51F57308}}) similarly lacked both a failover requirement and cybersecurity controls despite carrying the {{trait:Digital/Virtual}} trait — an ML inference engine accepting model updates is an obvious supply chain attack surface.

Regulated components without compliance requirements: The {{entity:Safety Arbiter}} ({{hex:002008B1}}) and the Pellet Injection Controller are both classified {{trait:Regulated}} but had no type approval or licensing requirements. The safety arbiter is the Class 1 I&C decision element; operating without IEC 61513 Category A type approval would be a licensing-critical gap with any national nuclear regulatory authority.

Verification coverage via the activity linkage system: 0%. The 47 VER requirements exist as text in the verification document but are not linked as activities to their source requirements. This is a systematic gap that affects the airgen verify run metric but does not indicate that verification approaches are absent — every SUB and IFC requirement has a verification field set. The activity linkage system appears to need a dedicated pass to wire the trace chains.

Two orphan requirements existed at entry: {{sub:SUB-REQ-064}} (IESS seismic qualification) and VER-REQ-052 (seismic testing procedure). Both reference “SYS-REQ-006” which did not exist. The gap was created when the seismic SYS requirement was drafted but not committed to the document.

Spray pattern: SYS-REQ-004 (SIL-3 automatic safety shutdown) carries 29 downstream trace links. All 29 have specific rationale; this reflects the genuine cascading nature of a safety integrity level allocation across 8 subsystems, not mechanical linking.

Corrections

Eleven requirements created, all with --verification and --rationale:

• REQ-SEFUSIONREACTORCONTROLSYSTEM-035: SYS-level seismic qualification (IEEE 344 / SSE) — closes SYS-REQ-006 reference gap
• REQ-SEFUSIONREACTORCONTROLSYSTEM-036: FRCS physical enclosure (IP54, nuclear-grade, IEC 60068) — closes Physical Object lint HIGH finding
• REQ-SEFUSIONREACTORCONTROLSYSTEM-037: QDS radiation-hardened housing (≥1×10^14 n/cm², magnet-proximate) — closes QDS Physical Object HIGH finding
• REQ-SEFUSIONREACTORCONTROLSYSTEM-038: ESS 2-of-3 redundant voted architecture, 100 ms failsafe default — closes ESS System-Essential HIGH finding
• REQ-SEFUSIONREACTORCONTROLSYSTEM-039: SLP triple modular redundant (TMR), HFT=2, 100 ms fail-safe — closes SLP System-Essential HIGH finding
• REQ-SEFUSIONREACTORCONTROLSYSTEM-040: Disruption Prediction Engine IEC 62443 SL-2 cybersecurity, model update authentication — closes DPE Digital/Virtual medium finding
• REQ-SEFUSIONREACTORCONTROLSYSTEM-041: Safety Arbiter IEC 61513 Category A / IEC 61508 SIL-3 type approval — closes Safety Arbiter Regulated medium finding
• REQ-SEFUSIONREACTORCONTROLSYSTEM-042: Pellet Injection IAEA SSG-52 tritium licensing — closes PIC Regulated medium finding
• REQ-SEFUSIONREACTORCONTROLSYSTEM-043: Safe state SUB-level definition — de-energised and locked, covers three subsystems — closes coverage gap on SYS-REQ-004 safe state concept
• REQ-SEFUSIONREACTORCONTROLSYSTEM-044: DPE hot-standby redundancy, 100 ms switchover — closes DPE System-Essential medium finding
• REQ-SEFUSIONREACTORCONTROLSYSTEM-045: Pellet Injection dual-channel architecture, 200 ms secondary readiness — closes PIC System-Essential medium finding

SUB-REQ-064 and VER-REQ-052 reassigned to their respective sections.

Residual

Verification activity linkage remains at 0% — the 47 VER requirements need to be wired as activities to their SUB/IFC source requirements. This requires a dedicated SE_QC pass focused on airgen verify activity creation.

The Fuel Inventory Controller ({{hex:01B432F8}}) carries {{trait:Institutionally Defined}} but has no standards references (lint finding 15). Not corrected this session; the relevant standard (likely ISO 2602 or site-specific nuclear fuel accountability procedures) requires research before specification.

VER-REQ-052 trace link could not be created — the AIRGen trace API returned “Requirements not found” for null-section requirements. The orphan is resolved by section reassignment but the VER-SUB trace chain remains incomplete.

Next

Dedicated verification activity linkage pass: create airgen verify activities linking the 47 VER requirements to their source requirements. Until this is complete the airgen verify matrix remains uninformative. Fuel Inventory Controller standards reference needs one additional requirement with the applicable nuclear fuel accounting standard.

flowchart TB
  n0["Fusion Reactor Control System"]
  n1["Plasma Control System"]
  n2["Disruption Prediction and Mitigation System"]
  n3["Heating and Current Drive Control"]
  n4["Magnet Safety and Protection System"]
  n5["Fuel Injection and Burn Control"]
  n6["Plasma Diagnostics Integration System"]
  n7["Plant Control and I&C System"]
  n8["Interlock and Emergency Shutdown System"]
  n0 -->|contains| n1
  n0 -->|contains| n2
  n0 -->|contains| n3
  n0 -->|contains| n4
  n0 -->|contains| n5
  n0 -->|contains| n6
  n0 -->|contains| n7
  n0 -->|contains| n8