Radiochemistry Laboratory for a UK Nuclear Dockyard v2

Rationale: Criticality detection is the highest-consequence safety function requiring physical neutron source demonstration before commissioning per ONR guidance.

Rationale: SIL 3 safety function demands proof test and FMEDA evidence that PFDavg meets target per IEC 61511.

Rationale: 500 ms trip time and independent UPS paths must be demonstrated under fault conditions per LC28 defence-in-depth.

Rationale: CAM sensitivity at 0.2 DAC-hours is the primary protection against plutonium inhalation; false alarm rate governs operational confidence.

Rationale: Emergency power continuity must be proven before commissioning; battery autonomy times drive evacuation and diesel start-up windows.

Rationale: Ductwork integrity and material are most efficiently verified by inspection and pressure test during construction, before radioactive commissioning precludes access.

Rationale: Functional integration test during commissioning validates the control loop timing that underpins the 2-second cascade response requirement.

Rationale: Full-load commissioning test validates manifold sizing under worst-case simultaneous demand from all containment devices.

Rationale: Physical measurement of straight-run distances confirms ISO 2889 compliance. This is a construction verification that cannot be repeated after active commissioning.

Rationale: Independence of emergency override from PLC must be demonstrated by testing with PLC in failed state. This validates the common-cause failure defence required for SIL 2.

Rationale: End-to-end tracer test validates the complete containment chain from primary containment device through extract ductwork, both HEPA banks, and stack discharge. This is the definitive active commissioning test confirming that the ventilation system performs its safety function as an integrated whole, not just at component level.

Rationale: Integration test verifying the primary data path from distributed CAMs to central display. Tests both routine data and alarm state propagation.

Rationale: Diversity test confirming both data paths function independently. The analogue path independence test is critical because it is the SIL 1 safety function path.

Rationale: Verifies real-time contamination data path including latency under operational conditions. Statistical approach (95th percentile) accounts for network variability.

Rationale: End-to-end test of dosimetry-to-central interface under realistic conditions with multiple simultaneous EPDs. Alarm notification timing is critical for RPS situational awareness.

Rationale: This is the most safety-critical interface in the RP subsystem. The test must demonstrate deterministic hardwired operation independent of digital infrastructure. Network-disabled test proves the safety function does not rely on software.

Rationale: End-to-end system integration test exercising the complete detection-alarm-display chain under realistic conditions. Uses Tc-99m (6-hour half-life) for safe aerosol release testing. Tests both the RP subsystem's detection function and its integration with the ventilation containment system. This is the definitive acceptance test for the radiation protection safety function.

Rationale: Integration test at the drain-to-tank boundary using inactive simulant to verify hydraulic performance before active commissioning.

Rationale: Validates sample line purge effectiveness and cross-contamination isolation using different tracers per tank.

Rationale: SIL 2 proof test validating the complete safety function chain from detection through logic to final element. Tests all three trip conditions (high activity, signal loss, power loss).

Rationale: End-to-end treatment loop verification using surrogate radionuclides during inactive commissioning.

Rationale: Validates both the functional data path and the security/integrity mechanisms of the OPC UA interface.

Rationale: System-level integration test exercising the complete effluent management chain from waste generation to authorised discharge. 48-hour target includes 24-hour hold period plus processing time.

Rationale: Verification of the waste transfer interface by inspection of the physical package and accompanying documentation.

Rationale: Integration test at system boundaries to verify hardwired interface timing and isolation.

Rationale: Integration test verifying fire-to-ventilation interface timing and fire survivability of cabling.

Rationale: Power interface test ensuring zero detection gap during UPS feed changeover.

Rationale: System integration test verifying partial isolation maintains containment where no fire exists.

Rationale: Physical inspection and dye trace test to verify drainage segregation integrity.

Rationale: System-level integration test exercising the full criticality response chain from sensor to actuator. Tests the interfaces between CWS, SIT, ECAS, and ventilation systems as an integrated safety function.

Rationale: Integration test to verify the characterization-to-packaging data flow meets the 5-minute latency and data completeness requirements at the system boundary.

Rationale: Integration test at the packaging-to-store boundary ensuring positive identification, contamination verification, and criticality-safe placement are all functioning as a chain.

Rationale: Integration test verifying the curing-period hold, strength verification, and criticality-safe placement operate as a controlled sequence. Tests the most safety-significant interface in the waste management chain.

Rationale: Verifies the critical environmental protection boundary between waste conditioning and the active drain system. Tests both the decontamination performance and the hold-and-release safety function.

Rationale: Verifies the information system integration that underpins regulatory record-keeping. Both directions must work because LIMS is the analytical authority and the Waste Records system is the waste package authority — each needs access to the other's data.

Rationale: Tests the safety interlock that prevents uncontrolled transfer of radioactive concentrates to an unprepared system. The interlock is a credited safety function in the liquid waste safety case.

Rationale: End-to-end integration test exercising both solid and liquid waste streams through the entire RWMF. This test verifies that the individual interface tests (IFC-REQ-024 through IFC-REQ-029) function as a coherent system and that no data is lost across the waste lifecycle chain.

Rationale: Integration test to verify physical interface compliance at the C2/C3 containment boundary.

Rationale: Integration test verifying both the electronic data interface and the physical sample routing paths function as designed.

Rationale: Integration test proving the Registration System can operate independently during LIMS outage and resynchronise without data loss — a key architectural decision.

Rationale: System-level integration test exercising the complete sample receipt chain from physical arrival to prepared aliquot. The 4-hour target is the operational throughput requirement for routine dockyard samples.

Rationale: Acid matrix compatibility is critical for downstream chromatography performance — feed outside 2-8 M HNO3 causes actinide breakthrough on TEVA resin.

Rationale: Source quality directly determines measurement performance — this test verifies the hand-off point between separations and counting.

Rationale: Waste segregation failure has regulatory and safety consequences — inspection during operational simulation is the appropriate verification method for procedural compliance.

Rationale: Integration test confirms cable plant and connector quality after installation. Noise floor measurement validates electromagnetic compatibility in the nuclear facility environment.

Rationale: Concurrent transfer from all channels represents worst-case network load during high-throughput campaigns.

Rationale: End-to-end demonstration validates the automated result transfer chain that eliminates transcription errors.

Rationale: System-level integration test validates that the combined performance of detector, shielding, MCA, and analysis software meets SYS-REQ-001. Exercises the full chain from photon detection to certified result.

Rationale: Positional repeatability determines counting geometry reproducibility. Identification legibility ensures chain-of-custody integrity throughout sample lifetime.

Rationale: Independent vacuum interlock per channel ensures a single chamber service event does not halt all alpha counting operations.

Rationale: System-level integration test validates the complete alpha analysis chain against SYS-REQ-004. Valley-to-peak ratio confirms adequate source quality and detector resolution for the most demanding peak separation in the analysis.

Rationale: Interface testing at the separations-LSC boundary validates the physical handover process that ensures sample integrity and traceability.

Rationale: Sample changer interface testing ensures mechanical compatibility and barcode system reliability under realistic batch sizes.

Rationale: Data transfer integrity testing ensures the analysis workstation receives complete, uncorrupted spectral data for accurate activity calculation and QA review.

Rationale: LIMS interface testing validates the regulated data path from analysis to system of record, including positive and negative testing of integrity controls.

Rationale: End-to-end integration test exercises the full LSC measurement chain under realistic conditions. The 10% accuracy criterion against known spikes validates measurement traceability. 48-hour turnaround validates operational throughput during dockyard campaigns.

Rationale: Interface testing validates physical and chemical compatibility between separation chemistry output and ICP-MS sample introduction.

Rationale: Data transfer testing validates the measurement data pipeline integrity and resilience for the complete analytical batch workflow.

Rationale: Comprehensive interface testing validates the LIMS integration with all instrument types under normal and degraded conditions.

Rationale: Integration test to verify interface compliance and protection response timing at system boundaries.

Rationale: Duty/standby changeover is the primary resilience mechanism for maintaining laboratory temperature stability during chiller plant faults.

Rationale: Fire safety case critical test. Gas isolation timing is a fire safety case claim that must be demonstrated before facility commissioning.

Rationale: Power changeover timing is critical to UPS autonomy margin. Test must confirm the entire chain from detection through generator start to load transfer operates within design envelope.

Rationale: System-level integration test exercising the most critical utility failure scenario. Confirms that the utility subsystem components interact correctly under the highest-consequence failure mode to maintain analytical capability.

Rationale: Proof testing validation ensures the claimed SIL is maintained throughout the facility operational life. The complete chain test verifies sensor, logic solver, and final element integrity rather than partial testing which could miss degraded components.

Rationale: CCF defence adequacy cannot be demonstrated by testing alone. Design review confirms diversity is implemented as specified. The beta factor analysis per IEC 61511 quantifies residual CCF vulnerability and must meet SIL 3 targets to validate the safety case claims.

Rationale: Cybersecurity controls must be validated by independent testing, not self-assessment alone. Penetration testing is required under NIS Regulations assessment framework. The combination of configuration verification and active testing provides confidence that controls are both configured and effective against realistic attack scenarios.