System

The {{entity:Remote Weapon Station (RWS)}} is at first-pass-complete, entering Flow D (Verification and Validation). The project carries 266 requirements across 6 documents (17 STK, 18 SYS, 84 SUB, 29 IFC, 104 VER, 13 ARC) with 263 trace links. This session performed a V-model audit: bottom-up verification adequacy sampling, top-down ConOps scenario walkthrough, operating mode coverage check, and safety argument chain inspection for all 7 registered hazards. Six system-level VER gaps were identified and closed.

Verification Audit

Ten VER requirements sampled from a spread across the 100-entry set. Quality is generally strong at subsystem level: requirements specify test configuration, measurement method, pass/fail threshold, and temperature range where appropriate. Examples: {{sub:VER-REQ-041}} mounts the RWS on a 6-DOF motion simulator to verify {{sub:SUB-REQ-049}} EOSA stabilisation with 0.1 mrad RMS pass criterion; {{sub:VER-REQ-063}} measures azimuth slew rate at shaft encoder output with 60 deg/s criterion; {{sub:VER-REQ-084}} tests DCSC-to-SSOD independence via signal monitoring.

The structural gap was at SYS level: 17 of 18 {{sys:SYS-REQ}} entries had zero direct VER traces. Only {{sys:SYS-REQ-018}} (target identification at 1500m) was covered by a system-level test ({{sub:VER-REQ-105}}). Sub-component tests verified individual timing budgets and component behaviours but left no system-level acceptance tests demonstrating emergent properties — the critical gap in a V-model safety case.

One method concern: {{sub:VER-REQ-001}} uses Analysis to verify {{sub:SUB-REQ-001}} (1oo2D PFD ≤ 1×10⁻⁴/hr) by reviewing the PFD calculation. This is appropriate for architectural integrity analysis under IEC 61508 (Functional safety of E/E/PE safety-related systems); IEC 61508 does not require a failure-rate test for an architecture claim. No change needed.

Scenario Validation

Urban Patrol Engagement — STK-REQ-001 → {{sys:SYS-REQ-001}} → {{sub:SUB-REQ-063}}/{{sub:SUB-REQ-049}} chain is complete at subsystem level. Gap: {{sys:SYS-REQ-002}} (≤8s detection-to-fire) had no system-level VER. Sub-component tests cover auto-tracker acquisition (≤3s), FCC solution latency (≤200ms), and ARM sequence individually, but no test validates the complete human-in-the-loop sequence with OCU menu interaction. Added {{sub:VER-REQ-109}}: 20 trials with two qualified crews, ≥90% within 8s pass criterion.

IED Strike / Control Link Loss — STK-REQ-013 → {{sys:SYS-REQ-009}} chain reached {{sub:SUB-REQ-005}} (watchdog asserts safe-state trigger within 200ms) but stopped there. End-to-end 500ms chain spanning watchdog module, DCSC, and SSOD relay was untested. Added {{sub:VER-REQ-107}}: CAN bus disconnect with current probe, 13 trials including cold soak, plus sporadic dropout case (300ms intermittent then total loss) to validate the scenario where vibration or EMI causes transient link interruption without triggering false safe-state.

Emergency Stop / Uncommanded Motion — {{sys:SYS-REQ-010}} (200ms E-STOP) lacked system-level timing test. VER-REQ-009 covers SSOD de-energisation timing and VER-REQ-084 covers DCSC signal independence, but neither measures end-to-end from OCU button press to mechanical brake engagement. Added {{sub:VER-REQ-106}}: 25 trials (20 ambient + 5 at −46°C), instrumented current probes, 200ms criterion for drives + brakes.

Degraded Sensor Operation — {{sys:SYS-REQ-011}} chain to {{sub:SUB-REQ-065}}/{{sub:SUB-REQ-045}} is complete; {{sub:VER-REQ-074}} tests thermal imager fault → day-camera mode switch in ≤5s. Covered.

Field Maintenance / Barrel Change — {{sys:SYS-REQ-015}} → {{sub:SUB-REQ-048}}/{{sub:SUB-REQ-081}} chain including automated boresight verification is complete. Covered.

Mode Coverage

8 operating modes audited. Engagement, Surveillance, Degraded Operation, and Emergency Stop modes have requirement coverage at SYS and SUB level. Maintenance mode has interlocks ({{sub:SUB-REQ-007}}) and boresight verification ({{sub:SUB-REQ-067}}). BIT mode: {{sys:SYS-REQ-012}} existed but had no VER — added {{sub:VER-REQ-110}} (90-second BIT completion at −46°C, plus fault injection case to verify BIT does not pass with open-circuit servo drive fault). Gap residual: Stowed/Travel mode has no SYS or SUB requirements for turret lock engagement/disengagement. The mode definition specifies mechanical locking of the turret but no requirement governs this in any document.

Cross-Domain Findings

Substrate search against “{{entity:Weapon Safety Interlock Manager}}” (Jaccard 0.86) — naval CMS equivalent. The naval analog includes no-fire sector enforcement and multi-level authorization chain. The RWS has two-action arming and E-STOP but no geographic no-fire sector. This is appropriate given different operational context (vehicle-mounted vs. shipborne) and the RWS ROE requirement is operator-controlled not geofenced. No gap.

Gaps Closed

Six system-level VER requirements added:

VER Ref	Target SYS Req	Hazard Coverage	Test Method
{{sub:VER-REQ-106}}	{{sys:SYS-REQ-010}}	H-002, H-003	E-STOP end-to-end timing, 25 trials
{{sub:VER-REQ-107}}	{{sys:SYS-REQ-009}}	H-006	Link-loss end-to-end + sporadic dropout
{{sub:VER-REQ-108}}	{{sys:SYS-REQ-017}}	H-001, H-007	MIL-STD-461G RS103 with weapon armed
{{sub:VER-REQ-109}}	{{sys:SYS-REQ-002}}	—	Detection-to-fire sequence, 2-crew trial
{{sub:VER-REQ-110}}	{{sys:SYS-REQ-012}}	H-001/H-002 gate	BIT timing + fault injection
{{sub:VER-REQ-111}}	{{sys:SYS-REQ-008}}	H-001, H-007 (SIL-3)	FCS fault injection, HW interlock independence

The {{trait:Regulated}} and {{trait:Ethically Significant}} character of this system makes VER-REQ-111 the most critical addition: the IEC 61508 architectural independence argument for SIL-3 — that the hardware firing interlock prevents discharge independently of FCS software state — now has a direct system-level test specification.

flowchart TB
  n2["component<br>Arming Key Switch Assembly"]
  n3["component<br>E-stop and Link Watchdog Module"]
  n0["component<br>Dual-Channel Safety Controller"]
  n1["component<br>Hardware Firing Interlock Relay"]
  n4["component<br>Safe State Output Driver"]
  n2 -->|arm-key-status 28VDC hardwired| n0
  n3 -->|safe-state-trigger hardwired| n0
  n0 -->|fire-enable digital| n1
  n0 -->|brake+inhibit command| n4

Verdict

Conditional pass with residuals. The 5 ConOps scenarios each have a complete STK→SYS→SUB→VER trace chain after this session’s additions. The 7-hazard safety argument now has system-level test evidence for H-001/H-003/H-006/H-007 — the four SIL-3/SIL-2 catastrophic hazards. Residuals: 12/18 SYS requirements still lack direct system-level VER entries (SYS-REQ-003 slew rate, SYS-REQ-004 sensor IFOV, SYS-REQ-013 BMS data link, SYS-REQ-014 recoil load, SYS-REQ-015 barrel change 15min, SYS-REQ-016 MTBCF 400hr, and others); Stowed/Travel mode has no turret lock requirements. A second validation pass is recommended to close the remaining SYS-level gaps before baseline.