System

{{entity:Emergency Diesel Generator}} for a UK nuclear licensed site — interim QC pass covering changes since session 572. Project entered this session with 48 requirements, all of which were HOMELESS (no document assignment), 2 orphan {{entity:Architecture Decisions}} requirements, 9 reversed trace links, and 2 duplicate diagrams. Baseline BL-003 labelled QC-2026-03-26 created at close; project now at 50 requirements, 38 trace links, 0 orphans.

Findings

Homeless requirements: 48/48. Every requirement in the project — STK, SYS, SUB, IFC, VER, ARC — was unassigned to any document section. This is the primary structural defect: without section assignment the traceability linksets cannot resolve and the document export is empty. All 48 were reassigned in bulk using airgen reqs reassign.

Orphan ARC requirements: 2/2. {{sub:ARC-REQ-001}} (Starting and Control architecture) and {{sub:ARC-REQ-002}} (Electrical Protection architecture) had no trace links. No system-requirements → architecture-decisions linkset existed. Created the linkset, then added 4 selective trace links: SYS-REQ-004 and SYS-REQ-005 to ARC-REQ-001 (hardwired relay boundary and dual-channel ALC driven by SIL 3 PFD), SYS-REQ-003 and SYS-REQ-005 to ARC-REQ-002 (LOOP detection sensing/switching separation).

Reversed trace links: 9/9 fixed. All VER links were stored in the wrong direction (IFC/SUB/SYS→VER instead of VER→IFC/SUB/SYS). airgen trace validate --fix corrected all 9 automatically. Affected: VER-REQ-001 through VER-REQ-009.

Missing trace link rationale: 23/23 links. All 14 SYS→SUB links, all 9 STK→SYS links had no rationale. Added specific engineering justification to each. SYS-REQ-004 spray pattern (5 SUB links) was reviewed and confirmed justified: the five trip conditions in that requirement genuinely cascade to three different subsystems (ECP for engine parameters, GPR for generator electrical faults, starting subsystem for lockout logic), and each link’s rationale now documents the specific causal derivation.

High-severity lint: isochronous governor has no safety override. UHT classifies the {{entity:isochronous governor system}} (hex 55F77A18) as {{trait:Functionally Autonomous}}, but the requirement set had no watchdog or fail-safe. Created {{sub:SUB-REQ-016}}: hardware watchdog ≤100ms timeout with fuel-off (0% rack) fail-safe state. Traced to SYS-REQ-004 (overspeed trip). A governor CPU lockup without a watchdog is a credible path to Hazard H-003 (uncontrolled overspeed) that the ECP trip chain in SUB-REQ-004 cannot reliably detect.

High-severity lint: ALC interface has no power source requirement. UHT classifies the {{entity:interface between the automatic load controller}} (hex 50B46908) as {{trait:Powered}}, but no requirement addressed the 24VDC supply. Created {{ifc:IFC-REQ-007}}: dedicated seismically-qualified Class 1E battery-backed 24VDC supply, 22–28VDC for ≥2 hours post-LOOP. Traced to SYS-REQ-005. This closes a single-point failure in the LOOP detection chain — loss of interface power at the initiating event is a failure-on-demand by definition.

Duplicate diagram deleted. diagram-1774496087400 (Electrical Protection and Switchgear, 0 blocks, empty placeholder) was deleted. diagram-1774496092255 (same name, 6 blocks, substantive content) retained.

Corrections

Action	Count	Detail
Homeless → assigned	48	All STK/SYS/SUB/IFC/VER/ARC reassigned
Orphan ARC linked	2	ARC-REQ-001, ARC-REQ-002
Reversed traces fixed	9	VER-REQ-001 through -009
Trace rationale added	29	14 SYS→SUB, 9 STK→SYS, 6 IFC→VER
New requirements	2	SUB-REQ-016 (governor watchdog), IFC-REQ-007 (24VDC Class 1E)
Diagram deleted	1	Empty EPS duplicate

flowchart TB
  n0["component - Generator Protection Relay"]
  n1["component - Main Generator Circuit Breaker"]
  n2["component - Safety Bus Transfer Contactor"]
  n3["component - Voltage Sensing and Monitoring Unit"]
  n4["external - Automatic Load Controller"]
  n5["external - Class 1E Safety Bus"]
  n3 -->|4-20mA voltage signals| n0
  n0 -->|110VDC trip signal| n1
  n4 -->|24VDC bus transfer cmd| n2
  n2 -->|safety bus supply| n5
  n1 -.->|anti-paralleling interlock| n2

Residual

The 44 medium-severity lint findings (ontological mismatches: Synthetic components lacking material requirements, Regulated components without certification requirements) are noted but deferred — these are pattern-level gaps that would require 20+ new requirements and are better addressed in a dedicated IFC/SUB expansion session. The verification matrix still shows no test activities linked to STK/SYS requirements directly (only via VER document), which is expected given the project uses a separate verification-requirements document rather than inline test cases.

Next

Project is structurally sound at QC-2026-03-26 baseline: 0 orphans, 0 homeless, 0 reversed links, all trace links have rationale. Ready for validation pass. Priority for validation: confirm SIL 3 safety argument chain (STK-REQ-003 → SYS-REQ-005 → SUB-REQ-006/SUB-REQ-016 → VER) is complete and that ConOps LOOP scenario is fully covered end-to-end through the trace network.