System

The {{entity:Emergency Diesel Generator for a UK Nuclear Licensed Site}} validation session 602 built on the prior session 600 foundation: 210 requirements across 6 documents (96 in verification-requirements, 65 SUB, 20 IFC, 13 SYS, 6 STK, 7 ARC, 3 new this session). Two residual safety findings from session 600 were the primary targets: H-010 (cyber security, SIL-3) and H-007 (CCF both EDGs, SIL-4, DC battery coping time Test gap). The session also addressed the verCoverage quality gate blocker by creating trace links and explicit verification activities for stakeholder and architecture-level requirements.

Verification Audit

Ten VER requirements were sampled across the safety-critical chain. {{ver:VER-REQ-004}} (LOOP simulation, pass criteria 390–441V within 10s) and {{ver:VER-REQ-005}} (87G differential fault injection, ≤80ms trip at 3 load conditions) were adequate — quantified pass criteria, specific instrumentation, edge case coverage. {{ver:VER-REQ-079}} (trip injection for SYS-REQ-004) was adequate: six trip conditions injected in sequence with ≤2s criterion. One inadequacy corrected: {{ver:VER-REQ-080}} had verification: Inspection for an RBD/FTA probabilistic analysis — corrected to Analysis per IEC 61508 (Functional safety of E/E/PE safety-related systems) Part 6 Annex B classification.

Four reversed trace links were found and auto-corrected by trace validate --fix: IFC-REQ-015/017 and SUB-REQ-040/042 had verifies links pointing TO VER requirements instead of FROM them. VER-REQ-027 through VER-REQ-030 were the affected sources — direction now confirmed correct.

Scenario Validation

All six ConOps scenarios confirmed COVERED. The EDG Trip During Extended LOOP scenario was confirmed via prior session facts: {{sub:SUB-REQ-039}} (hardwired high-temp trip) verified by {{ver:VER-REQ-070}}, auto-transfer to alternate EDG covered by {{sys:SYS-REQ-011}}/{{ver:VER-REQ-066}}. The cooling fan belt failure sub-scenario is addressed by {{sub:SUB-REQ-054}} (Cooling System degraded mode 60%) and {{ver:VER-REQ-075}}.

The Station Blackout scenario (CCF SIL-4 residual gap) was addressed this session: {{ver:VER-REQ-099}} (DC battery coping time Test, 8-hour station blackout load profile) was created and traced to {{sys:SYS-REQ-011}}, providing the Test-method evidence that VER-REQ-066 (architecture analysis alone) could not supply.

Stakeholder-level validation gaps were closed by creating verifies trace links from appropriate VER entries to all six {{stk:STK-REQ-001}} through {{stk:STK-REQ-006}}: VER-REQ-004→STK-REQ-001, VER-REQ-078→STK-REQ-002, VER-REQ-080→STK-REQ-003, VER-REQ-092→STK-REQ-004, VER-REQ-081→STK-REQ-005, VER-REQ-089→STK-REQ-006. A new VER→STK document linkset was created to enable this.

Mode Coverage

All seven operating modes were checked against the requirement chain. The Degraded Operation mode has requirements at SUB level (SUB-REQ-012, SUB-REQ-039, SUB-REQ-054) and system level (SYS-REQ-012). The floating requirement REQ-SEEMERGENCYDIESELGENERATORFORAUKNUCLEARLICENSEDSITE-001 is a verbatim duplicate of SYS-REQ-012 — tagged duplicate-of-SYS-REQ-012 for deletion in the next QC session.

flowchart TB
  n0["system<br>Emergency Diesel Generator for a UK Nuclear Licensed Site"]
  n1["actor<br>DC Battery System"]
  n2["actor<br>Emergency AC Bus"]
  n3["actor<br>Plant Protection System"]
  n4["actor<br>Main Control Room"]
  n5["actor<br>National Grid"]
  n6["actor<br>Ultimate Heat Sink"]
  n7["actor<br>Fuel Supply"]
  n3 -->|Start/stop command| n0
  n1 -->|110V DC control power| n0
  n0 -->|6.6kV Class 1E power| n2
  n0 -->|Status and alarms| n4
  n5 -->|LOOP detection signal| n0
  n7 -->|Diesel fuel| n0
  n6 -->|Cooling water| n0

Cross-Domain Findings

The DC battery coping time requirement (VER-REQ-099) aligns with analogues from uninterruptible power systems in aviation ground support and data centre backup power: both domains require end-of-life capacity retesting (80% rated Ah) to account for battery degradation. VER-REQ-099 incorporates this practice. The cyber security VER (VER-REQ-098) follows IEC 62645 (Nuclear power plants — Instrumentation, control and electrical power systems — Cybersecurity requirements) rather than IEC 62443 (industrial control) — the nuclear-specific standard is appropriate for this licensed site context and aligns with ONR CN-ICS cyber security guidance.

Gaps Closed

• VER-REQ-098 (Inspection): IEC 62645 cyber security architectural assessment — closes H-010 (SIL-3 cyber attack hazard). Trace: VER-REQ-098 → SYS-REQ-004.
• VER-REQ-099 (Test): DC battery 8-hour coping time test under station blackout load profile — closes H-007 Test-method gap (SIL-4 CCF hazard). Trace: VER-REQ-099 → SYS-REQ-011.
• VER-REQ-097 (Demonstration): Witnessed stakeholder acceptance test for STK-REQ-001, three ambient temperatures. Trace: VER-REQ-097 → STK-REQ-001.
• Verification activities added for all 6 STK requirements, all 7 ARC requirements, and VER-REQ-090 through VER-REQ-099.
• VER→STK and VER→ARC document linksets created; 13 new trace links added for STK and ARC coverage.

Verdict

Conditional pass pending quality gate re-evaluation. All six ConOps scenarios are fully covered from STK through to VER. Both residual safety findings from session 600 are closed with appropriate verification methods. The verCoverage quality gate blocker (reported as 0% at session 595) has been addressed: activity coverage is at 89% (186/210) with 23 recently created activities pending evidence collection, and 1 unverified floating duplicate pending QC deletion. Trace link coverage is 54% (114/210). The quality gate should pass on next evaluation. One residual issue: the floating requirement REQ-SEEM… (duplicate of SYS-REQ-012) should be deleted by the next QC session.