System

Session 600 is the first validation pass on the {{entity:Emergency Diesel Generator for a UK Nuclear Licensed Site}}. The project entered this session at qc-reviewed state with 200 requirements across 6 documents and 10 named baselines. Three quality gate blockers were outstanding: verCoverage 0% < 90%, ambiguousReqs 5 > 3, and silWithoutVer 17 > 0. The session ran Flow D (System Verification and Validation) against 6 ConOps scenarios, 7 operating modes, and 10 hazards.

Verification Audit

Ten VER requirements ({{ver:VER-REQ-001}} through {{ver:VER-REQ-010}}) were sampled for test adequacy. All ten are adequate: each specifies equipment configuration, a step-by-step procedure, quantified pass/fail criteria, and uses Test verification. Key safety verifications — {{ver:VER-REQ-079}} (safety trip timing, ≤2s to fuel solenoid de-energisation), {{ver:VER-REQ-080}} (PFD_avg ≤1×10⁻³ via fault tree with 10-year dataset), {{ver:VER-REQ-081}} (seismic analysis, ONR-approved 0.25g PGA), and {{ver:VER-REQ-066}} (CCF architecture analysis against IEC 61508-2 (Functional safety of electrical/electronic/programmable electronic safety-related systems — Part 2) SIL-4 constraints) — are all appropriately method-matched. Analysis verification is used correctly for PFD, seismic, and CCF requirements where physical demonstration at SIL-4 is not achievable during pre-commissioning.

The root cause of the verCoverage 0% gate blocker was identified: all 257 trace links were created without a type field. The quality gate counts only typed verifies links. This session created 7 new trace links with --type verifies for the newly added VER entries. The systemic null-type fix across existing links is a residual task for the next QC session.

Scenario Validation

Six ConOps scenarios were walked end-to-end through the requirement chain.

LOOP Response (STK-REQ-001 → {{sys:SYS-REQ-001}}, {{sys:SYS-REQ-003}}, {{sys:SYS-REQ-007}} → SUB → VER): Gap identified. {{sys:SYS-REQ-007}} (load sequencing: ≤15% voltage dip, ≤3Hz deviation, 3s recovery) had no VER entry. The scenario requires load sequencing to complete in 60 seconds; an unverified voltage transient threshold risks contactor dropout. Closed: VER-REQ-090 added (Test method, 200Hz data logger, 3 representative load blocks).

Failure to Start ({{sys:SYS-REQ-004}} → SUB-REQ-004,005,009 → {{ver:VER-REQ-079}}): Covered. Gap identified: {{sub:SUB-REQ-035}} (first-out alarm annunciation, 500ms) had no VER. Operator cannot identify stuck fuel solenoid without first-out display. Closed: VER-REQ-094 added (Test, trip injection at 1ms resolution, latching confirmed).

Monthly Surveillance Test ({{stk:STK-REQ-004}} → {{sys:SYS-REQ-009}} → SUB-REQ-059, 056, 007): Gap. {{sys:SYS-REQ-009}} (30-minute test, 10-minute hot standby return) had no VER entry. Closed: VER-REQ-092 added (Demonstration, as-installed load bank, end-to-end timing).

Planned Overhaul ({{stk:STK-REQ-006}} → {{sys:SYS-REQ-010}} → {{sub:SUB-REQ-029}}, {{sub:SUB-REQ-060}}, {{sub:SUB-REQ-061}}): Three gaps closed. VER-REQ-093 (Inspection, stores inventory and maintenance records for SYS-REQ-010), VER-REQ-095 (Demonstration, witnessed servicing event for SUB-REQ-029), VER-REQ-096 (Inspection, DSEAR and CIRIA C736 containment records for SUB-REQ-061) all added.

EDG Trip During Extended LOOP: Covered. {{sys:SYS-REQ-004}} chain to {{ver:VER-REQ-079}} is complete.

Station Blackout ({{sys:SYS-REQ-011}}, SIL-4 CCF → {{ver:VER-REQ-066}}): Analysis-only chain. VER-REQ-066 relies on a safety analysis review with no Test-method check of DC battery 8-hour coping time or passive decay heat removal availability. Residual gap: IEC 61508-2 SIL-4 requires Hardware Fault Tolerance =1 demonstrated, not just analysis-reviewed.

Mode Coverage

Of 7 operating modes, 5 are adequately covered. Cooldown Shutdown has no mode-specific requirements for entry conditions, cooldown duration, or parameter limits during the cooldown transient — only shutdown initiation requirements ({{sub:SUB-REQ-004}}, {{sub:SUB-REQ-019}}) exist. This is a residual gap. Emergency Start and Running Loaded modes are covered implicitly by {{sys:SYS-REQ-001}} and {{sys:SYS-REQ-002}} but have no explicit mode-entry/exit requirements using the mode names.

Cross-Domain Findings

The {{entity:isochronous governor system}} ({{hex:55F77A18}}) lacks the {{trait:Physical Object}} trait but governs a physical actuator — a lint finding confirmed by this session. The {{entity:fuel oil system}} ({{hex:DE851018}}) has {{trait:System-Essential}} classification but no redundancy or failover requirements at requirement level; the duty/standby transfer pump arrangement in ARC-REQ-006 is architecture-only. Analogous gas turbine auxiliary fuel systems carry explicit duty/standby changeover requirements; this gap is noted for the next QC pass.

Gaps Closed

Seven VER requirements added (VER-REQ-090 through VER-REQ-096) with properly typed verifies trace links:

• VER-REQ-090 — {{sys:SYS-REQ-007}} load sequencing transient test
• VER-REQ-091 — {{sys:SYS-REQ-008}} EMC immunity (BS EN IEC 61000, Level 4 fast transient)
• VER-REQ-092 — {{sys:SYS-REQ-009}} 30-minute surveillance test demonstration
• VER-REQ-093 — {{sys:SYS-REQ-010}} maintainability inspection (stores and schedule)
• VER-REQ-094 — {{sub:SUB-REQ-035}} first-out alarm timing and latching test
• VER-REQ-095 — {{sub:SUB-REQ-029}} diesel engine minor servicing demonstration
• VER-REQ-096 — {{sub:SUB-REQ-061}} DSEAR and CIRIA C736 compliance inspection

Two ambiguous requirements reworded: {{ifc:IFC-REQ-004}} and {{ifc:IFC-REQ-012}} replaced “normally-energised” and “normally-open” with explicit fail-safe direction statements.

flowchart TB
  n0["system<br>Emergency Diesel Generator for a UK Nuclear Licensed Site"]
  n1["actor<br>DC Battery System"]
  n2["actor<br>Emergency AC Bus"]
  n3["actor<br>Plant Protection System"]
  n4["actor<br>Main Control Room"]
  n5["actor<br>National Grid"]
  n6["actor<br>Ultimate Heat Sink"]
  n7["actor<br>Fuel Supply"]
  n3 -->|Start/stop command| n0
  n1 -->|110V DC control power| n0
  n0 -->|6.6kV Class 1E power| n2
  n0 -->|Status and alarms| n4
  n5 -->|LOOP detection signal| n0
  n7 -->|Diesel fuel| n0
  n6 -->|Cooling water| n0

Verdict

Conditional pass. Five of six ConOps scenarios have complete STK→SYS→SUB→VER chains after this session’s additions. The project is not yet eligible for final validation sign-off due to two residual gaps: (1) Station Blackout CCF scenario — {{sys:SYS-REQ-011}} has no SUB-level decomposition of the diverse backup systems required for IEC 61508-2 SIL-4 HFT=1 compliance; (2) H-010 Cyber attack hazard — no VER requirement for air-gap or hardwired trip cyber security verification exists. The verCoverage gate will improve once the 7 new typed links are counted; full resolution of the systemic null-type issue across all 257 existing links requires a targeted trace-link QC pass.