System

{{entity:Fusion Reactor Control System}} — {{hex:51F77B19}} — interim QC pass, session 432. The project carries 328 requirements (10 new this session) across 6 documents, with 384 trace links and 0 orphans. The previous QC baseline (BL-048, QC-2026-03-20) left 19 lint findings: 8 high-severity ontological mismatches and 11 medium-severity coverage gaps. This session addresses the coverage gaps and the highest-impact medium findings; the Physical Object ontological mismatches are residual, requiring classification architecture discussion.

Findings

Coverage gaps (7 medium, all partially or fully addressed): The lint engine identified five concepts present in STK or SYS requirements but absent from SUB: maintenance management system fault reporting ({{stk:STK-REQ-006}}), heating systems EMC ({{stk:STK-REQ-010}}), safe state definition ({{sys:SYS-REQ-004}}), sensor cycle timing ({{sys:SYS-REQ-017}}), and parameter upload function ({{sys:SYS-REQ-018}}). Each lacked a traceable SUB decomposition.

System-Essential without redundancy (1 medium): {{entity:gas puffing valve controller}} ({{hex:55F57A18}}) carries the {{trait:System-Essential}} trait but had no redundancy or failover requirements despite the trait implying loss-of-function criticality.

Ethically Significant without ethical requirements (3 medium): {{entity:Fusion Reactor Control System}}, {{entity:emergency shutdown system}}, and {{entity:safety arbiter}} ({{hex:D6A51858}}) all carry {{trait:Ethically Significant}} without requirements addressing safety-function suppression protection, dual-authorisation, or prohibition on convenience-motivated inhibition.

Biological/Biomimetic classification (1 high): {{entity:disruption prediction engine}} was semantically classified with the {{trait:Biological/Biomimetic}} trait by the lint engine, reflecting its LSTM neural network architecture. The entity had no biocompatibility or sterilisation requirements — nor should it. The entity was reclassified with an explicit context confirming its FPGA-based digital implementation in a non-biological environment; new hex {{hex:51F73308}} removes the Biological/Biomimetic trait.

Physical Object mismatches (7 high — residual): Seven subsystems — including {{entity:Plasma Control System}}, {{entity:emergency shutdown system}}, {{entity:quench detection system}}, and {{entity:plant operations sequencer}} — are classified without the {{trait:Physical Object}} trait despite requirements imposing physical constraints. These components are implemented as distributed embedded systems across equipment racks; their physical embodiment is implicit in the architectural decisions (ARC-REQ-001 through ARC-REQ-009) rather than explicit in SUB requirements. Flagged for architectural review in next session.

Corrections

Five coverage gap SUB requirements created and traced:

• {{sub:REQ-SEFUSIONREACTORCONTROLSYSTEM-137}}: I&C diagnostic module MMS fault push within 10 seconds (traces from SYS REQ-147 → STK-REQ-006)
• {{sub:REQ-SEFUSIONREACTORCONTROLSYSTEM-138}}: I&C channel EMC signal integrity during heating system operation (traces from SYS REQ-148 → STK-REQ-010)
• {{sub:REQ-SEFUSIONREACTORCONTROLSYSTEM-139}}: Safe state operational definition — four measurable end-conditions (traces from SYS-REQ-004)
• {{sub:REQ-SEFUSIONREACTORCONTROLSYSTEM-140}}: 50 ms sensor cycle budget for 200 ms display latency compliance (traces from SYS-REQ-017)
• {{sub:REQ-SEFUSIONREACTORCONTROLSYSTEM-141}}: Parameter upload → validation → report delivery within 120 seconds (traces from SYS-REQ-018)

Two SYS-level bridge requirements (REQ-147: I&C self-diagnostics, REQ-148: EMC compliance) created to complete the STK→SYS→SUB chain where SYS lacked coverage.

Gas puffing valve controller redundancy: {{sub:REQ-SEFUSIONREACTORCONTROLSYSTEM-142}} added — dual-channel valve drive with 10 ms fail-safe closure and 50 ms secondary channel recovery. Verification by fault injection test (REQ-145).

Ethical safety obligations formalised: {{sub:REQ-SEFUSIONREACTORCONTROLSYSTEM-143}} — no single software failure suppresses SCRAM, dual authorisation for safety parameter modification, no convenience inhibit path. Derives from SYS-REQ-004; verified by FMEA review and audit log inspection (REQ-146).

flowchart TB
  IESS["Interlock and Emergency Shutdown System"]
  TPM["Trip Parameter Monitor"]
  SLP["Safety Logic Processor"]
  ESS["Emergency Shutdown Sequencer"]
  SPD["Safety Parameter Display"]
  TPM -->|trip signal 24VDC| SLP
  SLP -->|trip actuation| ESS
  SLP -->|safety status data| SPD

Residual

Seven high-severity Physical Object mismatches remain. The FRCS subsystems are distributed control systems instantiated in equipment racks and LRUs; their physical embodiment is described in ARC documents but not in traceable SUB requirements. Closing these findings requires either (a) dedicated physical specification requirements for each subsystem’s hardware form factor, or (b) a project-level convention acknowledging that embedded control systems classified as software entities need not carry Physical Object traits. The latter is the architecturally honest position and aligns with how ITER design documentation treats I&C subsystems.

Next

Add physical embodiment requirements for the highest-criticality subsystems ({{entity:emergency shutdown system}} and {{entity:safety arbiter}}) to close the most safety-significant Physical Object mismatches. Then advance to SE_VALIDATION.