System

The {{entity:Vertical Farm Environment Controller}} moves from concept to scaffold. The concept session established the mission (closed-loop multi-zone environmental control for commercial vertical farming), 7 stakeholders, 5 ConOps scenarios, 7 hazards (SIL 1–3), and 5 external interfaces. This session derives requirements from that foundation, performs functional analysis to identify 8 system functions, and maps them to 8 physical subsystems justified by trait clustering, safety boundaries, and failure independence.

Stakeholder Requirements

16 STK requirements derived from all 7 stakeholders and their ConOps scenarios. Each traces to a specific scenario:

• Grower Technician (2): zone dashboards with 5s latency, recipe modification within 60s — from Daily Growing Cycle scenario
• Facility Manager (2): yield impact estimation within 10 minutes of excursion, per-zone maintenance scheduling — from HVAC Failure and Crop Changeover
• Maintenance Technician (2): guided sensor calibration with reference comparison, lockout/tagout per zone — from Sensor Drift and Maintenance mode
• Harvest Crew Worker (2): CO2 <5000ppm TWA and temp <35°C during occupancy, worker-comfort mode with entry/exit interlock — from Changeover and CO2 Emergency
• Food Safety Auditor (2): tamper-evident 2-year retention logs retrievable in 4 hours, HACCP deviation reports — from regulatory compliance
• Energy Utility (2): OpenADR 2.0 DR response within 5 minutes, 15-minute load forecasts — from energy management
• Controls System Integrator (2): version-controlled configuration interfaces, remote firmware updates with rollback — lifecycle maintenance
• Environment (2): EN 61326-1 EMC compliance, 72-hour autonomous operation without network — from constraints

System Requirements

16 SYS requirements derived from STK, each with quantified acceptance criteria. Safety requirements tagged with SIL levels from the hazard register:

• {{sys:SYS-REQ-001}} through {{sys:SYS-REQ-002}}: Climate control ±1°C temp, ±5% RH
• {{sys:SYS-REQ-003}}: CO2 ±50ppm with 3000ppm software ceiling ({{trait:System-Essential}}, SIL 3)
• {{sys:SYS-REQ-004}}: Hardware CO2 interlock at 5000ppm, 2-second response — H-001 drives SIL 3
• {{sys:SYS-REQ-006}}/{{sys:SYS-REQ-007}}: Nutrient pH ±0.2, runaway dosing protection — H-003 drives SIL 2
• {{sys:SYS-REQ-008}}/{{sys:SYS-REQ-009}}: HVAC degraded mode with LED reduction, thermal protection at 85°C/38°C — H-004 drives SIL 2
• {{sys:SYS-REQ-013}}: Emergency shutdown in 3 seconds with two-person reset
• {{sys:SYS-REQ-015}}: Safety functions hardware-independent, MTTFd >150 years

12 trace links created between STK→SYS pairs with selective rationale.

Functional Analysis

Eight system functions classified in UHT, revealing natural groupings:

Function	Hex	Key Trait Pattern
Climate Regulation	{{hex:51F73A00}}	{{trait:Powered}}, {{trait:Processes Signals/Logic}}, {{trait:State-Transforming}}
Horticultural Lighting	{{hex:51F73A08}}	Near-identical to Climate — same control pattern, different physical domain
Nutrient Delivery	{{hex:55F73A08}}	Adds {{trait:Physical Medium}} — fluid handling distinguishes from pure signal control
CO2 Enrichment	{{hex:51F73A18}}	Adds {{trait:Regulated}} — safety-critical regulatory dimension
Safety Interlock	{{hex:44F73858}}	{{trait:Normative}}, {{trait:Regulated}} — distinct from operational control functions
Supervisory Control	{{hex:41FD7B08}}	{{trait:Human-Interactive}}, {{trait:Meta}} — coordination layer
Data Logging	{{hex:40A73358}}	{{trait:Symbolic}}, {{trait:Temporal}} — information/compliance oriented
Energy Optimisation	{{hex:41F77B18}}	Similar to Supervisory — confirms grouping rationale

Cross-domain search found {{entity:Safety Interlock and Trip System}} ({{hex:50F77859}}) and {{entity:Fire and Gas Detection System}} ({{hex:55F77A19}}) as closest analogs to the safety interlock function.

Decomposition

Eight subsystems with function-to-subsystem mapping justified by safety boundaries, failure independence, and technology base:

flowchart TB
  n0["Vertical Farm Environment Controller"]
  n1["Climate Management Subsystem"]
  n2["Horticultural Lighting Subsystem"]
  n3["Nutrient Management Subsystem"]
  n4["CO2 Enrichment Subsystem"]
  n5["Safety Interlock Subsystem"]
  n6["Supervisory Control Subsystem"]
  n7["Data Acquisition and Compliance Subsystem"]
  n8["Zone Controller Network"]
  n0 --> n1
  n0 --> n2
  n0 --> n3
  n0 --> n4
  n0 --> n5
  n0 --> n6
  n0 --> n7
  n0 --> n8
  n8 -->|setpoints/feedback| n1
  n8 -->|PWM commands| n2
  n8 -->|dose/irrigate| n3
  n8 -->|valve commands| n4
  n6 -->|recipes/modes| n8
  n8 -->|sensor data| n7
  n5 -.->|CO2 trip| n4
  n5 -.->|thermal trip| n2

Key architecture decisions: CO2 enrichment separated from climate management due to SIL 3 safety boundary ({{arc:ARC-REQ-003}}). Safety interlock implemented as hardware-independent chain per IEC 61508 ({{arc:ARC-REQ-001}}). Energy optimisation grouped with supervisory control — both require facility-wide state visibility ({{arc:ARC-REQ-004}}).

5 external interface requirements created covering BACnet/IP (BMS), REST/HTTPS (ERP), OpenADR 2.0b (grid), MQTT/TLS (cloud), and 4-20mA (CO2 supply).

Next

First subsystem decomposition should target the {{entity:CO2 Enrichment Subsystem}} ({{hex:54F53019}}) — it carries the highest safety integrity (SIL 3 from H-001) and has the tightest interface constraints with the safety interlock subsystem. After CO2, the {{entity:Safety Interlock Subsystem}} ({{hex:D4E77818}}) should be decomposed to complete the safety-critical pair.