STEP Fusion Power Plant

Rationale: IFC-REQ-024 requires a 1 ms hardwired quench interlock response, a SIL-3 safety-critical timing constraint. Direct oscilloscope measurement is the only method that verifies actual propagation time against the 1 ms threshold with adequate confidence.

Rationale: IFC-REQ-027 specifies both a 50 ms digital latency and a hardwired analogue interlock for plasma vessel pressure monitoring. The digital path must be verified under realistic network load because PCS uses pressure data at 10 Hz control bandwidth; the hardwired path must be verified separately because the SIL-2 interlock in SUB-REQ-030 cannot rely on a shared Ethernet network.

Rationale: BTES hold-up limit of 1 g is a radiological limit set by the site safety case; tritium permeation from in-vessel hold-up into coolant streams constitutes a credible accident sequence. Continuous calorimetric accountability during the full pulse cycle is required because hold-up accumulates dynamically and cannot be inferred from steady-state measurements.

Rationale: ISS fuel purity directly sets plasma fuel quality: D:T ratio drift beyond ±2% reduces fusion reactivity by up to 8% per percentage point, and isotopic impurities (HH, HT) dilute the plasma and reduce Q. Residual gas analyser with certified reference standard is the only laboratory method that meets the required ±0.01% purity measurement uncertainty.

Rationale: TSDS hold-up limit of 100 g tritium equivalent is driven by site tritium inventory limit in the safety case; exceeding it changes site radiological consequence category. The 60-second delivery response is required to maintain plasma fueling continuity during pellet injection replenishment cycles, which have a minimum inter-pellet period of 100 seconds.

Rationale: 4.5 K ± 0.1 K operating temperature with 1.5 K thermal margin together define the superconducting operating point for the NbTi or Nb3Sn conductor. Thermal margin below 1.5 K means a transient heat pulse from AC loss, nuclear heating, or beam interception can cause a quench that requires a 12-hour recovery cycle, reducing plant availability by the specified 80% requirement.

Rationale: CS flux swing sets the available ohmic heating volt-seconds for plasma startup and ramp-up. Below 100 V·s, the plasma cannot reach ignition current in the specified pulse; this is a mission-critical threshold. The 2 V/m ramp rate limit is a winding insulation stress constraint, not a functional one, and must be verified to prevent insulation fatigue over the planned 100,000-pulse plant lifetime.

Rationale: PMS accuracy of ±10% over 6 decades is required for plasma operation feedback and safety interlock reliability. The 200 ms interlock threshold is a SIL-2 safety function: vessel pressure above 1e-4 Pa risks plasma disruption from impurity ingress, and the 200 ms budget is derived from plasma energy dissipation time at full burn power assuming disruption is initiated before vessel reaches critical impurity level.

Rationale: TF coil ramp time under 2 hours bounds the plant startup time and sets minimum interval between operational pulses; exceeding it risks thermal cycling fatigue. CS ramp time under 30 minutes is required to maintain plasma setup synchronisation with TF. Current ripple of 10 ppm is a plasma quality constraint: higher ripple introduces field error harmonics that drive MHD instabilities at Q=5 burn.

Rationale: Manual override and watchdog are SIL-classified safety functions for the ISS autonomous separation process; testing both at the system interface level against the specified timing thresholds (10 s valve closure, 60 s watchdog) is required to demonstrate compliance with the dual-barrier safety argument in SUB-024.

Rationale: SUB-023 single-component failure tolerance at 50% throughput is the minimum operability margin for the Tritium Plant; verification by fault injection at component level is required because partial throughput behaviour is not predictable from component-level tests alone.

Rationale: Integration test for RHS control failover under realistic in-vessel activity. 15-minute switchover under live sequence conditions is the key failure mode; bench test is insufficient because actuator state preservation during handover must be demonstrated with representative payload.

Rationale: FAT test at 80 percent rated current validates converter module load-sharing and switchover topology under near-operational conditions. Full-current test would require complete magnet infrastructure; 80 percent is sufficient to validate failure-mode response and switchover timing.

Rationale: Functional test of N+1 pump redundancy under representative operating pressure. 5e-6 Pa threshold is derived from SUB-REQ-075; 60-second activation time must be measured against the torus outgassing rate at operational temperature to confirm compliance.

Rationale: Three-condition qualification test is required because each mode imposes a different stress regime: bake-out causes thermal expansion relaxing flange preload; OBE imposes dynamic bending loads on penetration nozzles; ambient baseline establishes initial condition. ISO 20485 is the applicable standard for vacuum leak testing of nuclear installations.

Rationale: DBA isolation time and ADS activation are safety-critical functions (SIL-3); only functional test provides adequate evidence. Type-test on a representative vessel at tracer-level concentration satisfies the nuclear safety case requirement for functional validation without actual tritium release.

Rationale: Passive 72-hour cooling performance cannot be validated by full-scale test before plant completion; validated thermal-hydraulic analysis is the accepted ONR submission evidence for DBA scenarios not amenable to direct testing.

Rationale: N+1 redundancy at module level must be functionally demonstrated rather than asserted by design; test at partial throughput during commissioning is the lowest-risk environment for this validation before full tritium loading.

Rationale: Full-energy quench with deliberate channel failure cannot be tested at full scale without destructive risk; validated electromagnetic model with type-tested component data is the accepted verification approach for quench protection adequacy in large superconducting magnet systems (IEC 61511 and magnet safety standards).

Rationale: Conductor critical current density is a directly measurable material property; IEC standards for superconducting magnet qualification require short-sample testing at service conditions. The 60,000-cycle fatigue test is the only reliable method to verify lifetime electromagnetic performance of CICC conductors, which can degrade through strand movement and filament fracture under cyclic loading.

Rationale: UK IRR 2017 compliance is a legal pre-condition for tritium operation; inspection by an independent auditor is the ONR-accepted verification method for regulatory compliance before nuclear material handling begins. Test cannot replace documentary evidence for regulatory compliance.

Rationale: Vacuum boundary integrity following maintenance is the primary risk period for seal failures. Post-intervention RGA is the standard verification method in tokamak operations; requiring it as a pass criterion before plasma operations resume prevents undetected seal degradation from being carried into a plasma shot, which could damage in-vessel components.

Rationale: Environmental and nuclear site licencing are legal pre-conditions for radioactive operations; documentary inspection by the relevant authorities is the prescribed verification method. Third-party ISO 14001 certification cannot be replaced by internal audit for the nuclear regulatory purposes of SYS-REQ-019.

Rationale: This interface carries both electromagnetic and structural loads. Direct measurement of field strength and ripple is needed to confirm confinement quality per IFC-REQ-001. Structural load test must be performed before first plasma operation.

Rationale: Cryogenic interface failure is the initiator for H-003 (magnet quench). Acceptance test at full cryogenic load before magnet energisation provides evidence that IFC-REQ-002 flow and temperature parameters are met and quench protection operates within timing budget.

Rationale: Pellet injection velocity determines fuel deposition depth in plasma; failure to meet IFC-REQ-003 limits would result in surface fuelling instead of core fuelling, degrading plasma performance and TBR. Exhaust duct test confirms tritium plant can process divertor gas load.

Rationale: Thermal interface compliance is the direct evidence that SYS-REQ-002 net electrical output is achievable. Primary coolant temperature and flow rate measurements at full fusion power provide the ground truth for the heat balance. Failure to achieve 500 MW thermal transfer would make 100 MW net electrical output unachievable.

Rationale: 1 ms latency drives the controller sampling loop: disruption precursor signals at 1 kHz must complete sensing→processing→actuation within one sample period. Exceeding this budget means the PCS cannot execute the disruption mitigation response required by SYS-REQ-004 within the 10 ms window.

Rationale: Current regulation accuracy and response time directly set the bandwidth of the plasma position and shape control loop. 0.1% accuracy and 10 ms response are derived from plasma equilibrium sensitivity analysis: larger errors or slower response lead to locked modes and disruptions (H-001).

Rationale: Base pressure below 1e-6 Pa is required for plasma initiation by ECR breakdown. Effective pumping speed of 50 m3/s is derived from the helium ash production rate at rated fusion power and the requirement that helium concentration in the plasma remains below 5% to avoid fuel dilution. Failure would prevent plasma startup.

Rationale: Port clear bore and load capacity are fundamental to the remote maintenance campaign duration (STK-REQ-006). If any port fails to meet 1.5 m bore, the remote handling tool design is invalidated and the maintenance schedule cannot be achieved. Demonstration with full-scale dummy validates the physical interface before activation.

Rationale: Grid export parameters are contractual with the Grid Transmission Operator and regulatory. 100 MW at rated power quality is the primary mission performance metric. Fault ride-through test is required by ONR and the grid connection agreement prior to commercial operation.

Rationale: Hardware-in-the-loop test on production controller under realistic load is the only reliable way to verify real-time timing compliance. Software simulation cannot capture NUMA cache effects, OS jitter, or PCIe interrupt latency that determine worst-case cycle time on the target hardware.

Rationale: Detection probability of 0.99 is a SIL-3 safety function target. Database replay is the accepted verification method for disruption prediction algorithms (per ITER CODAC standards) because controlled plasma disruptions cannot be deliberately induced on STEP for testing. The false positive criterion prevents spurious mitigation triggers that would waste divertor components.

Rationale: SIL-3 safety function (IEC 61508): safe-state initiation on PCS internal fault must be verified by Test, not Demonstration. A repeatable, instrumented test with recorded stimuli (fault injection), measured response times, and documented pass/fail criteria is required for regulatory sign-off. The existing procedure (fault injection while plasma is sustained, measure gas injection timing and plasma current extinction within 30 s) constitutes a Test — the method label is corrected accordingly.

Rationale: System-level integration test for the SIL-3 disruption mitigation chain. Individual component tests of SUB-REQ-001 and SUB-REQ-002 verify subsystem behaviour; this end-to-end test verifies that the chain of interfaces IFC-REQ-005 and the internal PCS data path together meet the 10 ms SYS-REQ-004 system requirement under combined load.

Rationale: 10e22 atoms in 50 ms is a SIL-3 safety function for runaway electron suppression (H-006). Bench test on the production injection system is required because in-vessel testing during actual disruptions is not feasible: the injection parameters must be characterised and qualified before first plasma.

Rationale: 1 microsecond synchronisation is a SIL-3 data integrity requirement for equilibrium reconstruction. Hardware injection of known-phase pulses is the only reliable method to measure actual timestamping latency including interrupt service routines and PCIe transfer time, which simulation cannot capture.

Rationale: Updated from Demonstration to Test: SUB-REQ-003 is SIL-3 (controller redundancy claim for disruption mitigation chain). The 20-repetition protocol with quantified pass/fail criteria (500ms switchover, 5cm excursion limit, zero failures) meets the Test standard under IEC 61508. Demonstration understates the rigour of this verification procedure.

Rationale: In-situ measurement is required because heat flux distribution depends on plasma shape and edge transport which cannot be predicted with sufficient accuracy for this safety-critical acceptance criterion. Tungsten erosion inspection after 100 pulses provides the basis for extrapolating to the 1 mm/year limit over the campaign.

Rationale: Full-current magnet test is required to verify both field uniformity and quench protection timing as SYS-REQ-006 safety functions. Heater-induced quench is the accepted commissioning test method for superconducting magnets; testing at full stored energy (50 GJ) in the final configuration is needed for sign-off.

Rationale: Detritiation factor and accountancy are regulatory requirements (STK-REQ-013, STK-REQ-004). Integrated commissioning test on the full production system is required because detritiation factor depends on CECE column loading and interface conditions not replicable on sub-scale test rigs.

Rationale: 48-hour steady-state test at full load is the accepted factory acceptance test for helium refrigerators of this class. 4.8 K maximum during switchover corresponds to 90% of the HTS current-sharing temperature margin, ensuring no quench risk during the transition.

Rationale: Net electrical output and efficiency are the primary commercial performance metrics (SYS-REQ-002). Measurement at the grid connection point during actual sustained plasma operation is the only valid method: auxiliary loads vary with plasma conditions and cannot be accurately modelled without operational data.

Rationale: Full-scale demonstration on a representative mock-up is required because RHS performance depends on tool stiffness, joint clearances, and visual feedback conditions that cannot be verified on sub-scale or software models alone. 500-hour endurance run is required to validate the MTBF claim before deployment in the radioactive environment.

Rationale: Base pressure measurement by calibrated ion gauge is the primary vacuum acceptance criterion for plasma operation. Pumping speed measurement by gas injection is the ITER-standard method for characterising divertor pumping performance; effective pumping speed cannot be derived from cryopump specifications alone due to duct conductance uncertainties.

Rationale: In-situ measurement on the as-built plant is required because dose rates depend on as-installed shielding configuration which cannot be verified on design drawings. Interlock response timing test is needed for the SIL classification of the access control function.

Rationale: IFC-REQ-010 specifies LN2 supply conditions; this integration test confirms the Cryogenic Plant can maintain those conditions under representative tritium process load, preventing isotope separation column warm-up.

Rationale: IFC-REQ-011 specifies exhaust gas transfer; this test confirms the vacuum-tritium interface maintains throughput without tritium escape, which is the basis of the containment safety case.

Rationale: IFC-REQ-012 defines the vacuum diagnostics data path to PCS; latency and accuracy are critical because the PCS uses divertor neutral gas pressure to detect MARFE events and trigger plasma density control responses.

Rationale: IFC-REQ-013 specifies the fuelling command interface; pellet velocity and latency determine fuelling depth and timing relative to ELM phase, directly affecting plasma density control and burn performance.

Rationale: IFC-REQ-014 defines the coil power supply command path; tracking accuracy and quench alarm latency determine whether PCS can execute controlled plasma shutdown in response to a magnet event.

Rationale: IFC-REQ-015 specifies remote handling compatibility of tritium plant internals; demonstration on a representative mock-up verifies that no manual entry is required, which is mandatory under ALARP and tritium contamination control.

Rationale: IFC-REQ-016 specifies the cryo-vacuum pumping interface; cold head temperature directly determines achievable vacuum pressure — failure to reach 4.5 K prevents the cryo-pumps from achieving the plasma vessel base pressure.

Rationale: IFC-REQ-017 specifies the plasma-RHS safety interlock; the timing requirements prevent RHS tool damage and port contamination if a disruption occurs during maintenance access, making this a SIL-3 safety test.

Rationale: IFC-REQ-018 specifies TCA auxiliary power; voltage and frequency tolerances must be met to ensure instrumentation, cooling valve actuators, and diagnostic heaters operate within specification during plasma pulses.

Rationale: IFC-REQ-019 specifies the station load import limit; exceeding the contracted import capacity triggers grid penalty clauses and may cause voltage sag affecting adjacent grid users.

Rationale: IFC-REQ-020 specifies the bakeout heating interface; uniform heating removes water vapour and hydrocarbons from the first wall, which is a prerequisite for achieving the plasma vessel base vacuum pressure.

Rationale: SUB-REQ-015 specifies vessel leak tightness; helium leak testing at commissioning is the only method capable of detecting micro-leaks at the required sensitivity before plasma operations begin.

Rationale: SUB-REQ-016 specifies blanket TBR; direct measurement requires operating the reactor, so analysis validated by experimental benchmarks is the appropriate and standard verification method for tritium breeding performance.

Rationale: VER-REQ-038 already incorporates a physical Test component: post-disruption vacuum leak check during integrated commissioning (helium leak test confirming vessel integrity after a real or simulated disruption event). ANSYS FEA provides the primary conservatism baseline; the physical leak check is the acceptance Test. For SIL-3 (IEC 61508), the primary verification method must be Test not Analysis. Changed from Analysis to Test in validation session 520 to resolve quality gate blocker silWithoutVer.

Rationale: Full-throughput test on a representative facility is required because PEPS is SIL 3 and the separation performance cannot be verified by analysis alone. ITER and JET experience shows that real-gas behaviour at high throughput differs from bench-scale predictions. Test must be sustained for 4 hours to verify steady-state performance.

Rationale: Three-criteria pass gate ensures the complete safety function chain is verified: detection, actuation, and performance. SIL 3 classification requires the safety function to be demonstrated under representative conditions rather than by analysis or component-level inspection. Test uses calibrated tracer rather than tritium to manage personnel dose during testing.

Rationale: Interface must be verified at integration level because PEPS and ISS are manufactured as separate modules. The purity and pressure specifications are critical for ISS column performance and cannot be verified by component inspection alone. Double-wall integrity requires an integrated leak test. Derives from IFC-REQ-021.

Rationale: Batch transfer latency and purity are the two operational requirements driving the ISS-TSDS interface design. Integrated test at commissioning is required because buffer vessel performance depends on real thermal and pressure dynamics that cannot be captured in component-level tests. Derives from IFC-REQ-022.

Rationale: 72-hour continuous demonstration is required to verify the fuel cycle closing property: that bred and recycled tritium is correctly routed through all components without accumulation or loss. This cannot be verified by individual component tests because the fuel cycle is a closed-loop system with time constants of 12-24 hours. The 1% accountancy closure criterion is the SYS-level tritium confinement KPI. Derives from SYS-REQ-005 and STK-REQ-004.

Rationale: Physical injection test on real hardware is required for SIL 2 safety function. Simulation is insufficient because the quench detection algorithm must be verified against the actual electrical and thermal behaviour of the Nb3Sn conductor at 4.5 K. ITER experience shows simulation-only validation has missed quench events caused by conductor non-uniformity.

Rationale: Direct field measurement is the only reliable verification method for magnet performance. Analysis alone cannot capture manufacturing tolerances and coil positioning errors. Hall probe calibration traceable to national standards.

Rationale: Active timing test required to verify hardwired SIL-2 response time. Cannot be verified by analysis alone — relay and contactor response times must be measured under load conditions. Test shall be performed at 80% of full coil current to represent realistic stored energy.

Rationale: Interface verification requires measurement of all specified parameters under operational conditions. Rogowski coil accuracy must be validated against a traceable reference since it directly feeds the plasma control loop. GOOSE latency verification confirms deterministic message delivery.

Rationale: Voltage tap bandwidth and impedance are critical quench detection parameters — if bandwidth is insufficient or impedance too low, the resistive quench signature will be attenuated below the 100 mV detection threshold. Hipot test verifies isolation required to prevent coil current diversion through the measurement circuit.

Rationale: Direct vacuum measurement is the only reliable method to verify pumping performance. Calibrated gauge with traceable calibration is required because impurity partial pressures are calculated from total pressure and require accurate absolute measurement.

Rationale: Single-train failure mode test is the acceptance criterion for SIL-2 redundancy requirement. Calorimetric measurement is the only traceable method for verifying 4.5K refrigeration capacity.

Rationale: Nitrogen surrogate is used for commissioning safety — actual helium quench cannot be induced safely at full scale during acceptance testing. Equivalence has been demonstrated at LHC cryoplant and ITER partial cold tests.

Rationale: Static heat ingress measurement prior to magnet cool-down eliminates the magnet heat load contribution, allowing precise isolation of transfer line performance.

Rationale: Thermal gradient acceptance test must be performed with production control software to validate the actual cool-down algorithm, not a simulation.

Rationale: Safe state timing verification must be performed on production hardware to capture actual relay response times and I/O scan latency; simulation cannot validate SIL-2 timing requirements.

Rationale: Interface acceptance test verifies both HRS output performance and CTLN connector integrity at rated conditions.

Rationale: Tests both normal-operation bandwidth and the SIL-2 independence of the safety channel; the two pass criteria are mutually independent and must both be satisfied.

Rationale: Confirms HMS output meets HRS compressor inlet specification after a quench event — the highest-stress scenario for the gas supply interface.

Rationale: Direct measurement of the interface constraint under simulated operational conditions. The 125 Hz test frequency exercises the worst-case bandwidth margin. Gamma irradiation of the cable run validates radiation-hardness of the transmission medium without requiring full in-vessel test facility.

Rationale: Helium mass spectrometer testing is the industry standard for high-vacuum sealing verification per ISO 20485. 20 docking cycles simulate a 5-year maintenance programme (4 campaigns × 5 dockings). Structural load test must be performed before any in-vessel access to confirm port integrity.

Rationale: End-to-end latency must be measured under radiation to detect dose-induced performance degradation of fibre transceivers and DSP hardware. Stereo synchronisation <5 ms is required for depth perception; higher values cause perceived depth offset exceeding 10 mm, impairing 1 mm positioning capability.

Rationale: ASME BPVC Section III is the applicable code for nuclear pressure-containing components. Leak testing at commissioning is mandatory before introducing tritiated primary coolant. Per-tube leak rate limit prevents systematic cumulative contamination of the secondary circuit over the plant lifetime.

Rationale: Grid code compliance and transformer efficiency must be verified at commissioning before commercial operation begins. The heat run test is the IEC 60076-1 standard for confirming transformer loss guarantees and is a contractual requirement for National Grid connection agreement.

Rationale: The 100-event statistical test provides confidence that the hardwired relay meets the <100 ms latency requirement in the presence of contact bounce, relay delays, and cable capacitance. SCADA disconnection test confirms the interlock operates independently as required. Missed events would directly degrade operational availability by causing turbine trips per disruption event.

Rationale: Laser tracker provides traceable reference measurement at 10 μm accuracy, orders of magnitude better than the 1 mm requirement, eliminating measurement uncertainty from the assessment. 50-point distribution covers joints at limit and mid-range positions to detect kinematic singularities. Thermal soak test is essential as thermal expansion of the arm structure is the largest single error contributor.

Rationale: Net electrical output can only be demonstrated with actual fusion plasma at rated conditions. Simulated load banks cannot reproduce the plasma heating power profile. Three repeat measurements across different pulses provide statistical confidence and rule out measurement artefacts from any single measurement event.

Rationale: End-to-end integration testing validates the complete maintenance workflow, which cannot be verified by testing individual components in isolation. The 4.5-day per module pacing is derived from the 90-day campaign target. Smear surveys are the standard radiological contamination check per IAEA RPT-100.

Rationale: The energy chain integration test cannot be completed without actual plasma operation. Individual component tests (steam generator pressure test, turbine runback trial) verify boundary conditions but not overall energy balance. The ±3% measurement tolerance is achievable with calibrated NMAS instrumentation and accounts for thermodynamic averaging over the 30-minute steady state window.

Rationale: Radiation hardening cannot be verified by analysis alone — the combined gamma and neutron environment degrades polymers, lubricants, and electronics in ways that simulation under-predicts. Co-60 plus fission neutron irradiation replicates the D-T plasma environment at 1×10^6 Gy total dose, the cumulative limit in SUB-REQ-038, providing a conservative acceptance gate before in-vessel deployment.

Rationale: Biological shielding effectiveness of the Transfer Cask in SUB-REQ-039 must be verified against the actual gamma emission spectrum of irradiated blanket material. Analysis using Monte Carlo (MCNP or FLUKA) provides design assurance but cannot account for manufacturing tolerances, shield material density variations, or port geometry. Physical measurement with a calibrated source per ISO 2919 is the regulatory acceptance standard for activated-material transport.

Rationale: RHS safe-state behaviour in SUB-REQ-040 is safety-critical — a failed halt or joint slip during in-vessel maintenance could damage plasma-facing components or trap activated hardware in the vessel. Hardware-in-the-loop testing at the test facility is the only means to confirm that the ≤500 ms halt requirement and 30-minute load hold are met across all fault pathways, since software timing simulations do not capture hardware actuator latency.

Rationale: Grid code compliance for the PCS export interface in SUB-REQ-043 requires witnessed measurement at the actual 400 kV connection point under live grid conditions. Simulation cannot replicate grid impedance interactions that affect harmonic content; compliance requires National Grid ESO sign-off on real measurements as a condition of the Connection and Use of System Code (CUSC) commercial connection agreement.

Rationale: Steam generator thermal performance in SUB-REQ-044 must be verified under actual plasma heating conditions because the primary coolant flow rate and inlet temperature profile are coupled to the tritium breeding blanket thermal response, which cannot be reproduced in isolation. The 180°C primary outlet limit protects blanket structural materials (reduced-activation ferritic-martensitic steel) from creep damage and determines the Rankine cycle thermal input.

Rationale: Turbine runback response on disruption signal (SUB-REQ-045) is a combined PCS-control systems test that must be validated on hardware — turbine governor dynamics, steam valve response times, and generator electrical stability under rapid load rejection cannot be fully predicted by simulation. The 60-second runback window is set by the minimum plasma restart preparation time; faster runback risks turbine overspeed, slower runback causes grid instability from frequency deviation.

Rationale: The TCA/SMS magnetic interface is safety-critical: field geometry errors prevent plasma confinement and cause disruptions. Direct measurement under rated conditions validates the combined electromechanical interface between coil geometry and plasma vessel positioning.

Rationale: The helium coolant interface defines the thermal margin for superconducting operation. Any degradation beyond ±0.1 K risks thermal runaway and quench. Testing under representative conditions is required to validate the cryogenic plant control system and transfer line thermal performance.

Rationale: The fuel injection interface is the boundary between the tritium-bearing plant and the plasma vessel. Verifying pellet injection rate, integrity, and confinement of any backflow validates both the fuelling performance and the tritium confinement integrity of this interface.

Rationale: The thermal power interface is the energy extraction boundary of the plant. Verification at rated fusion power is required to confirm the primary heat removal capacity, which determines gross electrical output and efficiency. This cannot be analytically substituted — actual thermal performance depends on tritiated water chemistry and neutron-activated material properties.

Rationale: The PCS/TCA data interface is the real-time control loop for plasma stability. Latency and bandwidth violations cause control lag that precipitates or worsens disruptions. Testing with synthetic signals allows controlled validation of the interface without requiring a live plasma.

Rationale: The PCS/SMS coil current command interface controls plasma position and shape. Incorrect slew rates or command latencies cause loss of plasma position control and potentially disruption. The quench interlock path must be verified as a hardwired, not software, safety function.

Rationale: The vacuum interface defines the plasma environment: contamination and fuel dilution at pressures above 1×10⁻⁶ Pa prevents ignition. The leak detection test is safety-critical — an undetected vacuum breach during operations would quench plasma and could release tritiated gas to the building.

Rationale: The maintenance access interface between RHS and TCA is the physical boundary for in-vessel maintenance. Position accuracy must be demonstrated before remote handling of radioactive components; incorrect positioning can cause component damage or contamination spread. Shielding verification is a regulatory requirement for any maintenance access to an activated vessel.

Rationale: The grid export interface is the primary commercial output boundary of the plant. Grid Code compliance requires direct measurement at rated power — analytical prediction from component efficiencies is insufficient for compliance sign-off by the grid operator. The load rejection test verifies grid stability, which is a licence condition.

Rationale: IFC-REQ-023 defines the tritium concentration and flow rate envelope at the BTES-ISS boundary. The precise T/He ratio and flow range must be confirmed by direct measurement because downstream ISS column separation efficiency degrades outside this envelope, risking fuel cycle disruption and tritium inventory accumulation. Test is required — Analysis cannot account for real permeator and compressor pressure-drop behaviour at commissioning conditions.

Rationale: SUB-REQ-049 governs ISS electrical supply sizing and UPS capacity — safety-critical because loss of process power during tritium operations risks column flooding or uncontrolled tritium release. The 30-minute UPS duration is the design basis for operator-supervised safe shutdown after a grid outage; this must be demonstrated on the as-built system.

Rationale: SUB-REQ-050 is SIL-3 safety-critical: ISS must respond to emergency isolation within 30 seconds to prevent tritium release escalation. The 4-hour passive safe state ensures safety during extended loss of control power. Both timings must be demonstrated on the as-built system — analytical prediction is insufficient at SIL-3 confidence level.

Rationale: SUB-REQ-051 specifies turbine hall structural and maintenance access provisions. Floor load rating is a structural certificate; clearances are dimensional attributes. Inspection is appropriate because both can be directly verified against design drawings and physical measurement without dynamic testing.

Rationale: The Tritium Plant building is the physical confinement barrier preventing tritium release — a catastrophic hazard (H-002, SIL-3). Wall thickness and volume are geometric properties verifiable by measurement and inspection. Seismic qualification requires a formal certificate of conformance per nuclear-grade standards.

Rationale: Cryogenic Plant building dimensions, structural provisions, and dewar capacity are physical constraints on operational safety and maintenance. These are documentary and dimensional attributes verifiable by measurement and document review — no operational performance testing is required at building level.

Rationale: Vacuum system pump count, enclosure structural integrity, and shielding presence are physical configuration attributes verified by inspection. Flange pressure testing at 1.5× design differential confirms structural containment integrity prior to plasma operations. Manifold volume compatibility is a design parameter checked against as-built drawings.

Rationale: SYS-REQ-004 is SIL-3: disruption mitigation failure can deposit > 100 MJ onto first-wall panels in < 1 ms causing tungsten melting and plasma-facing component loss. Test verification is mandatory for SIL-3 safety requirements per IEC 61508 — Analysis alone cannot validate the actuation latency or thermal load mitigation under realistic disruption energy. The 10 ms window and 0.5 MJ/m² limit are the design basis values that prevent first-wall damage; a test must demonstrate these under worst-case Q=5 conditions. This VER was absent from the project; added in validation session 519 to close silWithoutVer blocker.

Rationale: SYS-REQ-005 is SIL-3: uncontrolled tritium release above 0.1 g can exceed the regulatory release limit and public dose constraint (1 mSv/year off-site). Test verification is mandatory for SIL-3 safety requirements. The dual-barrier test must be performed at system level to verify the complete containment chain including all penetrations, seals, and isolation valves — subsystem-level leak tests alone cannot demonstrate the system-level release bound. Added in validation session 519 to close silWithoutVer gate blocker.

Rationale: SYS-REQ-006 is SIL-2: quench protection failure in a 50 GJ magnet can cause catastrophic quench propagation, coil burnout, or cryogenic explosion. Test verification is required for SIL-2 to validate both the detection algorithm and the energy extraction circuitry; Analysis alone cannot capture voltage arc faults, busbar resistance faults, or quench propagation delays that only manifest in hardware testing. The 30-second extraction window and 300 K hot-spot limit are derived from NbTi/Nb3Sn damage thresholds. Added in validation session 519 to close silWithoutVer gate blocker.

Rationale: SYS-REQ-007 is SIL-2: passive decay heat removal is the ultimate safety function for loss-of-power events. If decay heat removal fails, first wall temperature rises above tungsten recrystallisation temperature (1200°C) within 2-4 hours, causing structural failure and potential loss of confinement. Test verification is needed because natural circulation flow rates depend on pipe routing geometry, fluid thermophysical properties, and local heat sources that can only be validated in hardware — computational analysis alone has ±30% uncertainty in natural circulation prediction. The 72-hour window covers the period of significant decay heat (first 72 hours, radioactive decay drops to < 1% of peak rate). Added in validation session 519.

Rationale: SYS-REQ-011 is SIL-3: seismic event during plasma burn can induce halo currents if shutdown is delayed beyond 100 ms, causing asymmetric electromagnetic loads that exceed the structural design basis for the vacuum vessel. Test verification is mandatory for SIL-3 per IEC 61508. Both the 100 ms shutdown window and the 10-second subsystem safe-state transition must be measured on integrated hardware — simulation cannot capture hardwired relay latencies, PLC scan times, or valve actuation dynamics that determine the actual trip-to-safe-state timeline. The seismic sensor shake-table test is required to confirm instrument reliability at the 0.1g OBE level. Added in validation session 519.

Rationale: SYS-REQ-012 is SIL-1: neutron streaming above 10 µSv/hr in occupied areas would violate UK IRR 2017 designation requirements for supervised areas and compromise worker dose budgets. While MCNP analysis can predict streaming, actual penetrations (cable trays, cooling pipes, diagnostic ports) have installation tolerances and local gaps that analysis may underestimate. In-situ measurement at full power is the only definitive verification method. 10 µSv/hr limit is consistent with ONR-supervised area boundary during continuous occupancy (40 hr/week × 50 weeks × 10 µSv/hr = 20 mSv/year, the legal limit). Added in validation session 519.

Rationale: SUB-REQ-014 requires as-built zone classification and access interlock response; MCNP analysis alone cannot account for as-built boundary conditions. In-situ measurement is required. Created in validation session 525 to close verification gap on radiation protection zoning.

Rationale: SUB-REQ-037 mandates a 90-day calendar-time constraint on blanket exchange — this can only be verified by a full-duration demonstration on representative equipment, as analysis cannot account for tool jams, shift changeover inefficiencies, or real-time repair of minor handling failures. Demonstration at 1:1 scale is required rather than test-bench because the constraint spans the full robotic task sequence. Created in validation session 525.

Rationale: SUB-REQ-042 mandates ≥25% gross-to-net efficiency, which depends on total auxiliary load at full-power plasma conditions — these loads (cryo plant, plasma heating systems) cannot be reliably estimated from component efficiencies alone and must be measured at integrated plant level. The 30-minute hold criterion ensures steady-state is reached before reading. Created in validation session 525 to close verification gap.

Rationale: SYS-REQ-001 is the primary performance requirement for STEP and the ultimate demonstration of the plant's purpose. Only in-situ measurement during actual D-T plasma operation can verify Q>=5 with the required plasma current — no analysis or sub-system test can substitute for integrated first-plasma verification. Created in validation session 525 to close SYS-REQ-001 gap identified in S-001 scenario walkthrough.

Rationale: SUB-REQ-055 is an Analysis-verified requirement per ASCE 4-16 (seismic analysis of nuclear safety-related structures). Physical test at 0.1g ground acceleration is not practicable for civil structures of this scale; industry-accepted practice (confirmed by ONR licensing precedent for fusion facilities) is validated structural analysis with factor-of-safety margins.

Rationale: SUB-REQ-056 is SIL-2 (H-004 LOCA): full-power passive cooling test with representative afterheat profile is required by IEC 61513 for safety function qualification. 350 degrees C limit derived from tungsten first wall material limit under gamma heating. Test extends VER-REQ-093 (system level) with the specific SUB-level passive path verification.

Rationale: SYS-REQ-003 specifies TBR ≥ 1.1 and 1 kg reserve within 12 months — the only demonstrable way to confirm this is measurement of bred tritium vs consumed tritium over an extended full-power campaign. Test verification is required because TBR is sensitive to as-built blanket geometry, tritium leakage, and material transmutation effects not fully captured by neutronic analysis alone. IEC 61508 and ONR fuel cycle licensing requires demonstration of tritium fuel sufficiency before extended D-T operation.

Rationale: SYS-REQ-008 specifies vacuum performance as < 1×10⁻⁶ Pa and total leak rate < 1×10⁻⁹ Pa·m³/s per seal. These are directly testable values requiring physical measurement — analysis of vacuum pumping speed and geometry cannot account for as-built seal surface finish, fastener torque, and weld porosity. Vacuum integrity is a prerequisite for first plasma; failure would contaminate the plasma and trigger disruptions.

Rationale: SYS-REQ-009 specifies 4-month full replacement campaign and 2 mm positioning accuracy. Demonstration on the full-scale RHS integration facility is required because maintenance campaign duration and positioning accuracy depend on tooling reliability, human factors, and remote dexterity that cannot be established by analysis alone. This matches the demonstration verification method in SYS-REQ-009 and aligns with ITER RH qualification programme precedent.

Rationale: SYS-REQ-010 specifies ≥ 50% operational availability over a 6-month campaign. Availability is a statistical property that can only be determined post-hoc from operational records; no pre-operational test can demonstrate it. Analysis of operational logs against the defined formula is the appropriate and only practical verification method. ONR nuclear site licensing for STEP requires demonstrating operational availability as part of the environmental statement.

Rationale: SYS-REQ-013 requires ≥ 40 plasma diagnostics with calibrated time-synchronised measurements. Demonstration is the appropriate method because it requires physical enumeration of commissioned systems and verification of timing synchronisation via an instrumented test pulse — analysis cannot confirm as-built diagnostic health or actual jitter performance. Derives from STK-REQ-017 (comprehensive plasma characterisation for burning DT plasma research).

Rationale: SYS-REQ-014 specifies ≥ 80% of waste volume as LLW within 100 years. This is a design-time analysis requirement — it cannot be physically tested at decommissioning (100+ years away). Nuclear activation analysis using validated codes (e.g., FISPACT-II) against the as-built material inventory is the standard method accepted by ONR for waste classification planning. The 2× conservatism margin ensures the threshold is robust against modelling uncertainties.

Rationale: SYS-REQ-015 mandates compliance with National Grid ESO Grid Code for power quality. Physical test using IEC 61000-4-30 Class A instrumentation is required by Grid Code connection agreement — National Grid will not accept simulated or analysis-based compliance for 400 kV connection. The test parameters (voltage, frequency, THD) are directly measurable at first grid synchronisation.

Rationale: SYS-REQ-016 specifies 1 mSv/year dose limit in supervised areas and ALARA compliance under UK IRR 2017 and ONR licence conditions. Analysis verification is appropriate because annual occupational dose is calculated from measured dose rates and occupancy models, not a single testable event. ONR nuclear site licence requires a Radiation Protection Programme and formal dose assessment report — these constitute the analysis record. Physical dose measurement alone cannot verify the annual projection without the time-integration model.

Rationale: Supplements VER-REQ-100 with explicit acceptance criteria for the structural qualification analysis. Analysis method is appropriate per IEC 61513 for civil/structural seismic compliance where full-scale test is infeasible.

Rationale: SUB-REQ-057 is the planned shutdown mode coverage requirement. Test is required to confirm the actual timing margins for heating ramp-down, current ramp-down, and fuel injection cessation — these depend on non-linear plasma response and OH coil dynamics that analysis cannot predict with sufficient confidence. The repeat at DT current confirms that the hydrogen plasma commissioning data scales to operational conditions.

Rationale: Physical single-pump isolation test is required to verify the N+2 redundancy claim. Simulation cannot capture inter-pump flow redistribution or turbomolecular pumping speed changes at partial load. 120-second monitoring window covers the transient response and steady-state re-equilibration.

Rationale: Fail-safe sensor fault behaviour requires hardware-in-loop testing because the alarm and interlock logic interact. Software-only analysis cannot verify that the hardwired interlock line remains de-asserted on sensor fault. All three fault types must be tested because the detection mechanism differs: signal-loss uses watchdog timeout, out-of-range uses threshold comparator, calibration drift uses moving-average validation.

Rationale: Verification at actual Q=3 operating conditions requires integrated system test during commissioning. Partial-load performance cannot be extrapolated from rated-load measurements because thermal efficiency is non-linear with steam flow and condenser back-pressure. National Measurement Accreditation Service calibration is required for a commercially significant milestone.

Rationale: Degraded configuration testing cannot be performed by analysis alone because condenser back-pressure, cooling tower performance, and turbine admission valve settings change under reduced steam flow in ways that are difficult to model accurately. A 4-hour test at reduced load confirms thermal equilibrium is reached and sustained. The 72-hour endurance is verified via operational log during a planned maintenance window.

Rationale: Steam generator tube leak isolation is a SIL-3-adjacent function (tritium transport through tube leak) requiring Test verification. Physical test on a tube bundle loop is necessary to verify the leak detection sensitivity and isolation timing; analysis overestimates detection time because secondary water turbulence near the leak varies with local flow conditions.

Rationale: First-wall and divertor thermal endurance is a safety-relevant function: excessive erosion degrades tritium inventory control and produces activated dust (H-007). Test on a representative plasma device is mandatory because finite-element analysis cannot account for synergistic effects of neutron embrittlement, sputtering, and thermal shock in combination. 10 MW/m2 is the design basis from SUB-REQ-007; 1 mm/FPY is the accountability threshold.

Rationale: TF coil performance is the primary H-003 (superconducting magnet quench) mitigation. SIL-2 requires Test verification. The 100 ms detection and 200 ms extraction timeline derive from energy density calculations: >50 GJ stored energy with detection delay beyond 100 ms risks coil winding insulation damage. Field ripple affects plasma stability margin and is a direct driver of burn performance at Q>=5.

Rationale: Cryogenic plant single-train redundancy is required for H-008 (loss of cryogenic cooling) mitigation at SIL-2. Loss of all cryogenic cooling simultaneously causes uncontrolled whole-system quench and asphyxiation risk from helium boil-off. Demonstrating continued magnet operation on one cold box train verifies the redundancy allocation in SUB-REQ-009.

Rationale: Tritium accountability is a direct H-002 (tritium release) mitigation and a regulatory prerequisite under GB nuclear site licence conditions. Plus or minus 1 g per 24 hours is the IRCP-recommended minimum for accountancy of inventories in the kg range. Test with actual tritium is mandatory because model predictions of CECE separation factors have uncertainty bands of 15-30% that only integrated testing resolves.

Rationale: Net power export of 100 MW and 25% efficiency are the commercial mission success criteria in SYS-REQ-002. Analysis alone cannot account for parasitic losses from plasma heating systems and cryogenic plant at full load. 90% availability must be demonstrated over the full 6-month campaign to confirm design margins.

Rationale: 21-day cassette replacement is the critical path activity in the 4-month maintenance campaign. Demonstration is appropriate because the acceptance evidence is observational: the replacement is either completed within schedule or it is not. MTBF of 500 hours and 2 mm accuracy are safety-relevant because incorrect positioning creates a first-wall gap concentrating heat flux.

Rationale: Base vacuum of 1e-6 Pa is required for plasma breakdown. Failure to reach this within 24 hours increases air ingress risk (H-005, SIL-2). Testing is mandatory because modelled pumping speeds have uncertainties of 20-40% from surface condition and geometry effects that only commission-time testing can resolve.

Rationale: Personnel radiation protection interlocks must be demonstrated by Test at full power because shielding effectiveness depends on actual source terms. 100 ms interlock response is a safety-critical timing requirement (H-010, SIL-1) where analysis cannot account for communication delays in hardwired interlock circuits under industrial noise conditions.

Rationale: ISS power continuity is a H-002 (tritium release) mitigation: loss of ISS power during separation causes uncontrolled tritium inventory redistribution in the column system. The 5% separation factor criterion ensures tritium balance accountability is maintained through a supply changeover event.

Rationale: PPS emergency isolation of ISS is the primary tritium confinement response for column leak events (H-002). The hardwired pathway independence from software is a SIL-3 architecture requirement under IEC 61511. Demonstration verification is appropriate as the acceptance criterion is binary: isolation either completes within 10 s or it does not.

Rationale: Turbine hall structural adequacy is a Inspection verification because it is established by design certification and physical review of as-built construction, not by test. Floor load rating of 50 kN/m2 is the minimum derived from steam turbine rotor and generator stator mass distribution. Structural deficiency would prevent safe equipment installation or maintenance.

Rationale: Nuclear-grade confinement building classification is established by regulatory inspection and structural certification, not by test. Category 1 confinement is required by H-002 (tritium release) safety case. Physical inspection of penetration seals is the only practical verification method for building-scale confinement.

Rationale: Cryogenic Plant building adequacy is a design compliance matter verifiable by inspection of construction documentation and physical measurement. The area and height specifications ensure adequate working clearances for cold box installation and maintenance. Helium venting capacity is safety-relevant (H-008, asphyxiation risk).

Rationale: Vacuum system physical configuration compliance is verifiable by inspection of installed equipment against design drawings. The 12 turbo-molecular pump count derives from pumping speed calculations for 50 m3/s aggregate throughput. Physical installation inspection is more reliable than test for configuration compliance.

Rationale: Seismic structural integrity is verified by Analysis because physical seismic testing of full-scale tokamak structures is not practicable. The OBE 0.1g and SSE 0.2g values are site-specific inputs. Analysis must include the combined LOCA and quench scenario (H-009, SIL-3) because these events are coupled through common-cause seismic initiation.

Rationale: Passive decay heat removal is the primary H-004 (loss of coolant accident) mitigation following plasma termination. Test is mandatory for SIL-2 functions because natural circulation flow behaviour has strong non-linear dependence on geometry and temperature that analysis cannot bound conservatively. 350 degrees C is the maximum coolant temperature before zirconium-steam reaction risk for beryllium-clad components.

Rationale: Controlled plasma shutdown is the primary planned transition out of Steady-State Burn mode. Failure to execute a smooth ramp-down can trigger a disruption (H-001, SIL-3) with 400 MJ thermal quench. Test is required to verify the actual plasma response to the ramp-down sequence because plasma instability thresholds during current ramp-down are not precisely predictable from MHD analysis alone.

Rationale: Single-failure tolerance for tritium accountability and confinement is a SIL-3 requirement derived from H-002 (tritium release). The regulatory limit of 0.1 g release per event requires that a single component failure cannot cause loss of accountancy (which could mask a leak) or loss of both confinement barriers simultaneously.

Rationale: Hardwired manual override is the last-resort tritium confinement action for operators when automated systems fail. Independence from software is essential for SIL-3 defense-in-depth. Demonstration verification is appropriate because the test is observational: either the manual override functions independently of software or it does not.

Rationale: LN2 supply at 77 K is required for Tritium Plant cold trap operation. Incorrect LN2 temperature degrades detritiation factor, risking tritium accountability loss (H-002). Cross-contamination check is essential because a tritium-contaminated LN2 circuit would create an uncontrolled release pathway.

Rationale: Vacuum-to-tritium exhaust interface is the primary tritium process pathway during burn. Insufficient throughput limits fusion power; inadequate isolation on confinement loss creates H-002 release pathway. 200 Pa.m3/s is the rated DT exhaust throughput. 5 s isolation time is derived from maximum tolerable tritium inventory at-risk during an exhaust line failure.

Rationale: PCS control of vacuum pumping speed is required for plasma density control during burn. Response time of 100 ms is derived from the plasma confinement time and density control bandwidth needed to respond to ELM events. Test is required because interface latency depends on actual communication stack implementation and cannot be verified by inspection alone.

Rationale: PCS command of pellet injection rate is the primary fuel control mechanism during Steady-State Burn. 50 ms latency and 5% rate accuracy are derived from plasma density control requirements: larger lag or error can cause plasma density to drift outside the burn window, triggering density-limit disruption (H-001, SIL-3). Test is required as actual latency depends on network and actuator implementation.

Rationale: Coil power supply to superconducting magnet interface is the primary H-003 (magnet quench) mitigation pathway. Fast discharge within 10 seconds is required to extract stored energy below the coil damage threshold. Test at full rated current is mandatory because impedance mismatch at the busbar connection cannot be predicted from design alone and affects discharge timing.

Rationale: RHS-tritium confinement boundary compatibility is verified by Inspection of material certifications and design documentation because tritium permeation through materials is a property established at manufacturing, not demonstrable without destructive sampling. Double-seal mechanisms are required by H-002 confinement barrier policy.

Rationale: Cryogenic supply to vacuum cryopumps is required for maintaining divertor pumping speed during burn. Loss of cryopumping reduces vacuum quality and risks plasma contamination. The 0.2 K temperature stability during regeneration cycles verifies that cryopump regeneration does not disrupt plasma operations in adjacent sectors.

Rationale: Hardwired prevention of RHS access during plasma operations is a personnel safety requirement: entry to the tokamak hall during burn would result in lethal neutron dose (H-010). Independence from software is required because software failures must not defeat this barrier. Demonstration is the appropriate method as the test is binary: access is prevented or it is not.

Rationale: Auxiliary AC supply from PCS to tokamak supports diagnostics, control systems, and cryogenic instrumentation during plasma operations. Supply quality affecting plasma diagnostics can trigger false disruption events. The 30-second restoration time after outage is required to avoid a plasma termination on loss of diagnostic power.

Rationale: Grid import for station loads is required for plant commissioning before first plasma (no self-generation available). Automatic transfer to on-site generation on grid loss within 5 seconds ensures continued cryogenic cooling during grid disturbances (H-008 mitigation). Test at full load is required because transformer impedance and cable voltage drop cannot be calculated without site-specific grid impedance data.

Rationale: Vessel bake-out is required to achieve the 1e-6 Pa base vacuum needed for plasma operations. Insufficient bake-out temperature or non-uniform wall heating can leave water ice in crevices that outgasses into the plasma, contaminating the first wall. Test is required because heat transfer in the complex vessel geometry cannot be precisely modelled.