System

The {{entity:Emergency Diesel Generator for a UK Nuclear Licensed Site}} has reached the validation phase with 228 requirements across 6 documents (107 VER, 67 SUB, 20 IFC, 17 SYS, 7 STK, 7 ARC) and 303 trace links. The verCoverage quality gate blocker (flagged as 0% in the previous session’s gate check) was confirmed resolved on entry — the guards.ts computation gives 100% (86/86 SUB+IFC requirements have inbound verifies links). The stale 0% figure reflected a pre-session-606 snapshot. This session performed the full Flow D V-model audit: verification adequacy from the bottom up, ConOps scenario tracing from the top down, and safety argument chain walkthrough.

Verification Audit

Sampled 10 VER requirements, focusing on the 71 SIL-tagged entries. Quality is strong for the core safety functions: {{ver:VER-REQ-004}} (LOOP start timing, SIL-3) uses a calibrated oscilloscope, 10ms measurement window, and 9.8-second pass criterion — adequate. {{ver:VER-REQ-005}} (87G differential protection) injects rated current differential into secondary test terminals and measures trip signal latency to 1ms resolution — adequate. {{ver:VER-REQ-077}} (degraded mode operation) induces a governor sensor failure and monitors 60% load for 2 hours — adequate.

One adequacy gap found: {{sys:SYS-REQ-016}} (cyber isolation, SIL-3 for {{trait:Regulated}} H-010 hazard) is verified only by {{ver:VER-REQ-105}} (Inspection of design documentation). For a SIL-3 cyber requirement in nuclear applications, IEC 62443-3-3 (Security for Industrial Automation and Control Systems) and ONR Safety Assessment Principles require demonstration under adversarial conditions. Gap closed by creating {{ver:VER-REQ-108}}: an active penetration test using a hardware-identical test bed, covering RS-485 maintenance port access, 24VDC LOOP signal injection, and hardwired trip replay attack.

Scenario Validation

Six ConOps scenarios walked through trace chains:

LOOP Response — {{stk:STK-REQ-001}} → {{sys:SYS-REQ-001}}/{{sys:SYS-REQ-003}} → {{sub:SUB-REQ-001}}/{{sub:SUB-REQ-002}}/{{sub:SUB-REQ-012}} → {{ver:VER-REQ-004}}/{{ver:VER-REQ-008}}. Chain complete. VER-REQ-004 covers end-to-end LOOP to GCB close and rated V/Hz. Covered.

Failure to Start — {{sys:SYS-REQ-003}} → {{sub:SUB-REQ-005}} (3-attempt latch) → {{ver:VER-REQ-003}}. Covered. The alternate EDG load transfer path traced to {{ifc:IFC-REQ-001}} → {{ver:VER-REQ-001}}. Covered.

EDG Trip During Extended LOOP — {{sys:SYS-REQ-012}} (degraded mode) verified by {{ver:VER-REQ-077}}. Gap: SYS-REQ-012 had no formal derives links to subsystem requirements — the 60% rated power floor and {{trait:Functionally Autonomous}} fault annunciation obligation was not allocated at SUB level. Added derives links: SYS-REQ-012 → {{sub:SUB-REQ-031}} (PTLU fault classification, trip vs non-trip) and SYS-REQ-012 → {{sub:SUB-REQ-039}} (high-temperature alarm to control room). Partially covered; full SUB allocation of degraded power floor remains a residual gap.

Monthly Surveillance Test — {{stk:STK-REQ-004}} → {{sys:SYS-REQ-009}} → {{sub:SUB-REQ-059}} (test mode without safety bus connection) → {{ver:VER-REQ-092}}. Chain complete. Covered.

Station Blackout — {{stk:STK-REQ-007}} → {{sys:SYS-REQ-011}} (SIL-4 CCF architecture) → {{ver:VER-REQ-066}}/{{ver:VER-REQ-099}}/{{ver:VER-REQ-102}}. Finding: SYS-REQ-011 has no formal derives links to subsystem requirements; the CCF physical separation obligation is not allocated to individual subsystems. The safety argument for H-007 rests entirely at system level. Stored as SAFETY_VALIDATION_FINDING.

Planned Overhaul — {{stk:STK-REQ-006}} → {{sys:SYS-REQ-010}} → {{sub:SUB-REQ-066}} (PMT return to service). Gap: exit from Maintenance Out-of-Service mode was specified but entry was not. No requirement enforced the removal of the start demand interlock or the unavailability signal to the control room before LOTO access is granted. A missing-mode-entry requirement creates a scenario where a LOOP demand could arrive with LOTO applied. Gap closed: created {{sub:SUB-REQ-067}} (controlled transition to Maintenance Out-of-Service mode) with {{ver:VER-REQ-109}} Test verification (live LOOP signal injection with interlock removed).

Mode Coverage

All 7 operating modes checked:

• Standby Ready → entry/behaviour/exit covered by {{sys:SYS-REQ-001}}/SYS-REQ-003 and {{sub:SUB-REQ-023}} (pre-heat).
• Emergency Start → {{sys:SYS-REQ-001}}/SYS-REQ-003 with 10-second target verified by {{ver:VER-REQ-004}}.
• Running Loaded → {{sys:SYS-REQ-007}} (load sequencing), {{sub:SUB-REQ-003}} (governor speed regulation). Complete.
• Cooldown Shutdown → {{sys:SYS-REQ-014}} covers entry trigger and 80°C limit. Added SYS-REQ-014 → {{sub:SUB-REQ-037}} derives link (JWP maintains 200 l/min circulation during cooldown). {{ver:VER-REQ-103}} provides Test verification.
• Surveillance Test → SYS-REQ-009 → SUB-REQ-059 → VER-REQ-092. Complete.
• Maintenance Out-of-Service → entry gap closed (SUB-REQ-067), exit (SUB-REQ-066 PMT) pre-existing. Complete.
• Degraded Operation → SYS-REQ-012/017 with VER-REQ-077/107. SUB derivation partial (see above).

Safety Argument

Hazard register walkthrough (10 hazards):

H-001 (SIL-3, Failure to start): STK-REQ-001 → SYS-REQ-001/003 → SUB-REQ-001/002/005 → VER-REQ-004/003. Test verification. Safe state (diverse backup) reachable via {{sys:SYS-REQ-015}} battery bridge. Chain complete.

H-007 (SIL-4, Common-cause failure): SYS-REQ-011 verified by VER-REQ-066 (Analysis, architectural separation), VER-REQ-102 (Demonstration, physical separation), VER-REQ-099 (Test, DC battery coping). Acceptable for CCF architectural argument under IEC 61511. Finding: no SUB-level requirements formally allocate separation requirements to subsystems. Safe state (DC batteries, passive cooling) is reachable per SYS-REQ-011 text but not verified at SUB level. Stored as SAFETY_VALIDATION_FINDING.

H-010 (SIL-3, Cyber attack): VER-REQ-105 (Inspection) supplemented by new {{ver:VER-REQ-108}} (Test, penetration testing). Gap closed.

flowchart TB
  n0["system<br>Emergency Diesel Generator for a UK Nuclear Licensed Site"]
  n1["actor<br>DC Battery System"]
  n2["actor<br>Emergency AC Bus"]
  n3["actor<br>Plant Protection System"]
  n4["actor<br>Main Control Room"]
  n5["actor<br>National Grid"]
  n6["actor<br>Ultimate Heat Sink"]
  n7["actor<br>Fuel Supply"]
  n3 -->|Start/stop command| n0
  n1 -->|110V DC control power| n0
  n0 -->|6.6kV Class 1E power| n2
  n0 -->|Status and alarms| n4
  n5 -->|LOOP detection signal| n0
  n7 -->|Diesel fuel| n0
  n6 -->|Cooling water| n0

Gaps Closed

Action	Detail
{{ver:VER-REQ-108}} created	Cyber penetration Test for {{sys:SYS-REQ-016}} (SIL-3 H-010) — closes Inspection-only adequacy gap
{{sub:SUB-REQ-067}} created	Maintenance Out-of-Service mode entry procedure — closes missing-mode-entry gap for Planned Overhaul scenario
VER-REQ-109 created	Test verification for SUB-REQ-067 (live LOOP signal injection)
SYS-REQ-012 → SUB-REQ-031 derives link	PTLU fault classification allocated to degraded mode chain
SYS-REQ-012 → SUB-REQ-039 derives link	High-temperature alarm allocated to degraded mode annunciation chain
SYS-REQ-014 → SUB-REQ-037 derives link	JWP circulation allocated to cooldown shutdown chain

Residual (carried forward): SYS-REQ-013 tagged duplicate-of-SYS-REQ-012 and a homeless requirement (REQ-SEEMERGENCY…-001) with identical text to SYS-REQ-012 require QC session cleanup. SYS-REQ-011 CCF separation obligation lacks SUB-level derivation — recommend a dedicated CCF subsystem separation requirements pass.

Verdict

Conditional pass. All 6 ConOps scenarios are traceable from STK through to VER. Four of 7 operating modes are fully covered; the Degraded Operation mode has partial SUB allocation; the remaining three modes are complete following this session’s additions. The verCoverage quality gate is at 100% for SUB+IFC. The H-001 (Failure to Start) and H-010 (Cyber, now with Test verification) safety chains are complete. H-007 (SIL-4 CCF) verification is formally adequate but lacks SUB-level separation allocation — this is the primary argument the next session should strengthen. No scenario produces an unmitigated unsafe state without a defined safe-state path.