SYSE.14:5 - Worked Case: Cold-Start Protection for Ten Pump Controllers
A pump manufacturer must decide which of ten installed controllers may enter monitored service with a cold-start
protection change. The configuration basis from SYSE.13 distinguishes four groups:
| Installed units | Current finding | Consequence for this release |
|---|---|---|
| S001–S004 | IO-A input board; candidate package supports IO-B. | Outside the candidate’s hardware compatibility claim. |
| S005 | IO-B and the required sensor; current calibration evidence is missing. | Withheld until the missing evidence is obtained. |
| S006–S008 | IO-B, current calibration evidence, installed candidate realization, and chamber-test evidence. | Eligible for the current service-release comparison. |
| S009–S010 | IO-B; database says installed, but current calibration and cold-start evidence are absent. | Trial or service release is not supported by the current evidence. |
The original request asked for release to all ten units. The engineering team retained three real options: withhold the change; release it to monitored service on S006–S008; or extend a trial to S006–S010. The last option failed the stated calibration-evidence threshold. Withholding avoided change risk but left an observed cold-start failure mode uncorrected on the three eligible units.
The release board acts as the deciding Agent and has authority for this service-release decision. An independent safety team acts as the permission-granting Agent; its permission covers only S006–S008, the named temperature envelope, and the monitoring interval. Assignment to either team is recorded separately from authority.
The controller-integration team had already performed the installation Work on S006–S008. The firmware package description, installation record, software attestation, and physical inspection are separate sources for the resulting configuration claim. A revised calibration source had reopened only the cold-start claim. Chamber tests for S006–S008 restored that evidence. A maintenance observation showed restored pump-train functioning for S006 under one load and temperature interval; it added evidence for S006 only and established neither safety nor the state of S007–S008.
The release decision therefore admits S006–S008 to monitored service under the stated conditions. S005 and S009–S010 remain withheld pending calibration and cold-start evidence; S001–S004 remain outside hardware compatibility. The next Work is monitored service, not another installation inferred from the decision. A sensor replacement, firmware change, calibration-source change, cold-start failure, or operating-envelope change reopens only the affected unit and claim.
The decision can supply bounded evidence to SYSE.4, whose assurance Work may still find an unsupported claim or
return a blocker. The release decision itself establishes no assurance conclusion.
When the full pattern is unnecessary. A reversible internal script has one known configuration, no physical effectivity question, and an established deployment Method that already supplies the needed choice, evidence, permission, Work, and rollback results. Use those direct patterns instead of constructing a connected engineering release case.