System

The {{entity:Industrial Elevator Control System}} ({{hex:D6B77058}}) is in its final validated phase. The project holds 203 requirements across 6 documents (14 STK, 17 SYS, 72+ SUB, 26 IFC, 11 ARC, 63 VER) with 196 trace links. Two quality gate blockers were preventing state transition from “validated” to “complete”: orphan count 1 > 0 and churn 23% > 20%. This session resolves both and audits the verification and safety argument chains.

Verification Audit

Ten VER requirements were sampled across the verification-requirements document. All SIL-3-tagged interface and subsystem requirements use Test verification — none rely on Analysis for time-bound or performance requirements. No method mismatches were found in the safety-critical path. Adequacy ratings:

• {{sys:SYS-REQ-003}} overspeed detection → {{sub:SUB-REQ-002}} → VER-REQ-005: Test method injects encoder signal at 116% rated speed, measures fault assertion within 50 ms — adequate, quantified boundary test.
• {{sub:SUB-REQ-003}} UCMP detection → VER-REQ-027: applies simulated drive command in door zone, measures time to brake engagement — adequate, matches 200 mm/100 ms acceptance criterion.
• {{sub:SUB-REQ-018}} ATS mains-to-UPS transfer → VER-REQ-015: disconnects mains, measures 24V bus voltage throughout — adequate, covers worst-case loaded condition.
• VER-REQ-029 (fire recall routing, Group Dispatch): tests 4-car arrival at designated floor within 60 s — partially adequate for {{sub:SUB-REQ-044}} but did not cover the 5-second inhibit response required by {{sub:SUB-REQ-005}}. Gap closed (see Gaps Closed).

One inadequacy was confirmed: VER-REQ-033 is tagged “power-distribution/enclosure” but its text references the controller cabinet (SUB-REQ-049), creating ambiguity. Rationale and QA score (57) flag this for future cleanup.

Scenario Validation

Power Failure During Operation (H-005, SIL-2): {{sys:SYS-REQ-006}} → {{sub:SUB-REQ-018}} (ATS transfer ≤20 ms) → VER-REQ-015 and VER-REQ-044, SUB-REQ-019 (UPS 30-min holdup) → VER-REQ-016. {{sub:SUB-REQ-039}} and SUB-REQ-040 (ARD battery drive to nearest floor) → VER-REQ-048 (3 rescue cycles at rated load). Chain: covered.

Fire Alarm Recall (H-006, SIL-2): {{sys:SYS-REQ-007}} → {{sub:SUB-REQ-005}} (Safety Controller 5 s inhibit) — gap identified: no VER entry measured the 5-second initiation bound. SUB-REQ-044 (routing) → VER-REQ-029 covers 60-second arrival but not the upstream 5-second response. SUB-REQ-025 (Door Operator hold open during recall) had no trace. Both closed this session.

Quarterly Maintenance (mode: Maintenance): {{stk:STK-REQ-005}} → {{sub:SUB-REQ-058}} (speed limit 0.3 m/s, car-top interlock) → VER-REQ-050 (Maintenance mode enforcement test). Chain: covered.

Seismic Event (H-007, SIL-3): {{sys:SYS-REQ-008}} → {{sub:SUB-REQ-006}} (Safety Controller decelerates cars within 500 ms of P-wave) — gap identified: no verifies trace to REQ-SEINDUSTRIALELEVATOR-055. Trace added; chain now complete via the seismic simulator test.

Mode Coverage

All 7 operating modes (Normal, Initialisation, Degraded, Emergency Shutdown, Maintenance, Fire Service, Seismic Operation) have entry, within-mode, and exit/transition requirements. Maintenance and Fire Service Phase I/II are both covered by STK requirements, SUB requirements, and VER entries. No mode with incomplete requirement coverage was found.

Safety Argument

flowchart TB
  H1[H-001 UCM SIL-3] -->|SYS-REQ-004| SCU[SUB-REQ-001 Dual-CPU]
  H1 -->|SYS-REQ-004| SPM[SUB-REQ-003 UCMP detect]
  SCU -->|verifies| V28[VER-REQ-028 SIL-3 arch FMEA]
  SPM -->|verifies| V27[VER-REQ-027 UCMP test]
  H2[H-002 Overspeed SIL-3] -->|SYS-REQ-003| SPM2[SUB-REQ-002 Overspeed]
  SPM2 -->|verifies| V5[VER-REQ-005 115% injection]
  H5[H-005 Power fail SIL-2] -->|SYS-REQ-006| UPS[SUB-REQ-019 UPS holdup]
  UPS -->|verifies| V16[VER-REQ-016 30-min test]
  H6[H-006 Fire SIL-2] -->|SYS-REQ-007| SC5[SUB-REQ-005 5s inhibit]
  SC5 -->|verifies| V62[REQ-062 Phase I timing]
  H7[H-007 Seismic SIL-3] -->|SYS-REQ-008| SC6[SUB-REQ-006 500ms P-wave]
  SC6 -->|verifies| V55[REQ-055 seismic test]

H-001 and H-002 (both SIL-3): dual-channel Safety CPU with FMEA analysis (Analysis is appropriate per IEC 61508-2 Table 3 — hardware architectural metrics cannot be Test-verified). Detection tests use injection methodology at exact threshold boundaries. Safe state reachability confirmed via SUB-REQ-008 and VER-REQ-006 (brake engagement within 100 ms on CPU fault).

H-006: chain was incomplete — {{sub:SUB-REQ-005}} lacked a VER entry measuring the 5-second EN 81-72 threshold. Resolved by REQ-SEINDUSTRIALELEVATOR-062.

Gaps Closed

1. Orphan resolved: REQ-SEINDUSTRIALELEVATOR-061 (Power Distribution enclosure LRU, 800×600×300 mm, max 80 kg) was unassigned and untraced. Reassigned to subsystem-requirements. Trace SUB-REQ-073 → REQ-061 (derives) added — the dimensional constraints derive from the IP54 enclosure requirement.
2. SUB-REQ-005 fire recall VER: Created REQ-SEINDUSTRIALELEVATOR-062 (Test — relay de-energise, measure inhibit timing to 5 s threshold; EN 81-72 Clause 5.2). Trace added.
3. SUB-REQ-006 seismic trace: Added SUB-REQ-006 → REQ-055 (verifies). H-007 chain now complete.
4. SUB-REQ-025 door hold trace: Added SUB-REQ-025 → VER-REQ-029 (verifies) — if all cars arrive at designated floor with doors open, door hold behaviour was correct.
5. Churn baseline: BL-SEINDUSTRIALELEVATOR-018 (VALIDATED-CLEAN-2026-03-22) created. Churn measured from this baseline = 0%.

Verdict

All 6 ConOps scenarios trace from STK through SYS, SUB, and VER. All 8 hazards in the register have safety argument chains that terminate in Test verification entries (or Analysis where mandated by IEC 61508-2 for architectural metrics). Operating modes are fully covered. Quality gate blockers resolved: orphans 0/203, churn 0% from BL-018. The {{entity:Industrial Elevator Control System}} validation holds.