System

{{entity:Industrial Elevator Control System}} — 4-car group, EN 81-20/50, IEC 61508 SIL 3 peak. Session 447 performs full V-model verification and validation: 171 requirements across 6 documents, 27 VER entries at entry, baseline VALIDATED-2026-03-22 at close.

flowchart TB
  n0["Industrial Elevator Control System"]
  n1["Traction Drive Subsystem"]
  n2["Safety Controller Subsystem"]
  n3["Door Operator Subsystem"]
  n4["Group Dispatch Controller"]
  n5["Power Distribution Subsystem"]
  n6["Building Integration Gateway"]
  n7["Building Management System"]
  n8["Fire Alarm Panel"]
  n2 -->|Brake permit, STO| n1
  n2 -->|Interlock status| n3
  n4 -->|Target floor| n1
  n4 -->|Door commands| n3
  n5 -->|3-phase power| n1
  n6 -->|BMS commands| n4
  n6 -->|Fire relay| n2
  n7 -->|BACnet/IP| n6
  n8 -->|Hardwired relay| n6

Verification Audit

Ten VER requirements sampled. All use Test verification with quantified acceptance criteria — well-formed. One method mismatch found and corrected: {{sys:VER-REQ-028}} verified {{sub:SUB-REQ-001}} (dual-channel SIL 3 architecture) using the procedure “review design documentation and obtain assessor sign-off”, which is Inspection/Analysis, not Test. The verification field has been corrected to Inspection with rationale aligned to IEC 61508-2 Clause 7.4.7.

The more significant finding was coverage: 34 of 51 SUB requirements had no VER entry, including 17 carrying SIL tags. Eleven new VER entries were added this session targeting the most critical gaps:

• {{entity:Safety Chain Interface Module}} scan rate and fault assertion timing ({{sub:SUB-REQ-004}}, {{trait:System-Essential}}, SIL 3)
• {{entity:Motor Control Unit}} velocity accuracy ±0.05 m/s and stopping ±5 mm ({{sub:SUB-REQ-010}}, SIL 3)
• MCU independent overspeed detection at 115% rated speed, verified independently from Safety CPU path ({{sub:SUB-REQ-012}}, SIL 3)
• {{entity:Electromagnetic Brake}} mechanical engagement under 150% overload, displacement ≤2 mm ({{sub:SUB-REQ-013}}, SIL 3)
• Encoder fault detection within 20 ms, correct Degraded vs Emergency mode transition ({{sub:SUB-REQ-015}}, SIL 3)
• ATS mains-to-UPS transfer within 20 ms, no spurious safety events ({{sub:SUB-REQ-018}}, SIL 2)
• UPS 30-minute holdup at full safety load with controlled safe-state exit ({{sub:SUB-REQ-019}}, SIL 2)
• EMC immunity at 10 V/m with function-specific pass criteria derived from H-004 safe-state margin ({{sub:SUB-REQ-048}}, SIL 2)
• GDC fault reassignment within 100 ms including 2-car fault critical degraded case ({{sub:SUB-REQ-031}}/{{sub:SUB-REQ-032}})
• Fire Service Phase II hold-to-run and key-removal return-to-Phase-I (EN 81-72)
• Maintenance mode speed cap 0.3 m/s and car-top stop interlock cannot be bypassed from machine room

Scenario Validation

Six ConOps scenarios walked end-to-end:

Morning Rush Hour: {{stk:STK-REQ-001}} → {{sys:SYS-REQ-001}} → {{sub:SUB-REQ-030}} → VER-REQ-022 (30-min traffic simulation, 3 runs). Chain complete. Non-critical gap: energy peak monitoring during up-peak has no SYS requirement.

Single Car Failure During Peak: {{sys:SYS-REQ-009}} → {{sub:SUB-REQ-031}}/{{sub:SUB-REQ-032}} → new VER (GDC reassignment test including 2-car fault case). Previously entirely unverified. The critical degraded mode requiring lobby attendant stair redirect is now explicitly exercised.

Power Failure With Passengers Trapped: SYS-REQ-006/018 → SUB-REQ-018/019/045 → three new VER entries (ATS transfer, UPS holdup, ARD battery). Residual gap: no explicit ARD travel-time test confirms wheelchair-user rescue from floor 18 completes within the time limit implied by 0.15 m/s speed constraint.

Fire Alarm Recall: Phase I chain ({{sys:SYS-REQ-007}} → {{sub:SUB-REQ-044}} → VER-REQ-029) covered. Gap: Phase II firefighter exclusive manual control had no VER anywhere in the project. New VER added covering hold-to-run, hall-call inhibit, and 30-second return-to-Phase-I on key removal per EN 81-72 Clause 5.6.

Quarterly Preventive Maintenance: Maintenance mode VER was absent. New VER added for 0.3 m/s speed enforcement and car-top stop interlock non-bypassability — the highest-consequence gap in the project: a technician on a car top moving at rated speed is catastrophic, and EN 81-20 Annex F requires the car-top stop to be non-bypassable from the machine room.

Seismic Event: {{sys:SYS-REQ-008}} → {{sub:SUB-REQ-047}} → VER-REQ-031 (10 s stop, 60 s hold, 4 cars). Covered. Gap: post-seismic low-speed inspection trip before Normal mode re-entry has no VER.

Mode Coverage

All seven operating modes checked against entry/behaviour/exit requirements. Three partial gaps:

• Maintenance mode: entry (keyed switch) and speed limit covered; car-top interlock coverage added this session. Exit re-initialisation sequence has no explicit VER.
• Seismic Operation mode: entry and hold-phase covered; low-speed post-event inspection trip is stated in the ConOps but not in any requirement or VER.
• Fire Service mode: Phase I covered; Phase II VER added this session. Normal mode re-entry sequence after key removal now addressed.

Safety Argument

All eight hazards walked from hazard register through SYS → SUB → VER:

H-001 (Uncontrolled movement, SIL 3): Complete — UCMP detection chain and dual-channel architecture both verified. VER-REQ-028 method corrected to Inspection.

H-002 (Overspeed, SIL 3): Both channels now independently verified — Safety CPU path via VER-REQ-005 and MCU path via new VER. Residual: overspeed governor mechanical trip force has no VER (governor is a mechanical safety device per EN 81-20, typically verified at commissioning).

H-003 (Door zone entrapment, SIL 2): Complete — three protection mechanisms verified independently.

H-004 (Levelling failure, SIL 1): Partially closed — stopping accuracy VER added; active re-levelling control not decomposed to subsystem level.

H-005 (Power failure entrapment, SIL 2): Substantially closed — ATS, UPS, and ARD battery all now verified. Emergency intercom under power failure (EN 81-28) remains unverified.

H-006 (Hoistway flooding/fire, SIL 2): Fire recall covered. Pit sump pump activation (stated in safe state description) has no SYS requirement or VER.

H-007 (Counterweight derailment, SIL 3): Seismic stop covered. Hoistway access lock after seismic event (stated in safe state) has no requirement or VER.

H-008 (VFD EMI, SIL 2): Closed — EMC immunity VER added with function-specific pass criteria.

Cross-domain analog: nuclear dockyard Safety Interlock and Trip System ({{hex:50F77859}}, SIL 3) defines a proof test interval as part of its PFD calculation. The elevator SIL 3 functions have VER acceptance tests but no proof test period is specified anywhere in the project — a gap in the IEC 61508 safety case that must be addressed before certification submission.

Gaps Closed

11 VER requirements added. 1 VER method corrected. DECOMPOSITION_STATUS set to validated. Baseline BL-SEINDUSTRIALELEVATOR-014 (VALIDATED-2026-03-22) created.

Verdict

Pass with residual items. All six ConOps scenarios have adequate requirement chains, though three have single-link gaps documented above. Five of eight hazards are fully verified; three have documented residual gaps that do not prevent validation passage but must be addressed before certification submission: (1) proof test interval for SIL 3 PFD, (2) pit sump pump and hoistway access lock requirements, (3) post-seismic inspection trip VER. The Morning Rush and Seismic scenarios are fully end-to-end covered. The Single Car Failure scenario, previously entirely without verification, now has a full chain.