Safety Feature View

This document provides a vertical, feature-level view of the safety functionality in the BrewMaster Pro 3000. While the architecture document presents a horizontal, layer-by-layer decomposition, this view cuts through all layers to show how the safety feature is realised end-to-end — from the system-level safety requirement down to architectural components, interfaces, and verification tests.

This perspective is particularly relevant for functional safety engineers performing impact analysis: any change to a safety-related element can be traced upward to the customer need it protects, and downward to every component and test that must be reviewed.

Full Safety Chain

The following diagram shows the complete vertical traceability of the safety feature — from the system requirement through software requirements, architectural components, interfaces, and test cases.

System-Level Safety Requirement

The safety feature originates from a single system-level requirement that mandates automatic shutdown under hazardous conditions:

Safety System Requirements

ID	Title	Status	Tags
REQ_HEAT_WATER	Heat Water	open	heating; safety
REQ_SAFETY_SHUTDOWN	Safety Shutdown	open	safety; critical

Software Safety Requirements

The system-level safety requirement is decomposed into two independent software requirements — one addressing thermal hazards and one addressing dry-run prevention:

Safety SW Requirements

ID	Title	Status	Traces to System Req
SWREQ_OVERTEMP_SHUTDOWN	Over-Temperature Shutdown	open	REQ_HEAT_WATER; REQ_SAFETY_SHUTDOWN
SWREQ_TEMP_REGULATION	Temperature Regulation	open	REQ_HEAT_WATER
SWREQ_WATER_LEVEL	Water Level Monitoring	open	REQ_SAFETY_SHUTDOWN

The following diagram shows how these software requirements refine the system requirement:

Safety Architecture

The software requirements are implemented by the Safety Monitor Module, which resides in its own dedicated Safety Layer — isolated from application and control logic. The Safety Monitor observes all other subsystems through status interfaces and can override them via the Safety Command Interface.

The table below summarises the safety-relevant architectural elements and their roles:

Safety Architecture Elements

ID	Title	Type	Status
COMP_SAFETY_MON	Safety Monitor Module	Component	open
COMP_TEMP_CTRL	Temperature Controller Module	Component	open
INTF_BREW_CTRL_STATUS	Brew Controller Safety Status Interface	Interface	open
INTF_SAFETY_CMD	Safety Command Interface	Interface	open
INTF_TEMP_CTRL_STATUS	Temperature Controller Safety Status Interface	Interface	open

Safety Verification

The following test cases verify the safety requirements. Each test is linked back to the software requirements it covers:

Safety Test Cases

ID	Title	Status	Verifies
TEST_SAFETY_SHUTDOWN	Test Safety Shutdown	open	SWREQ_OVERTEMP_SHUTDOWN; SWREQ_WATER_LEVEL
TEST_TEMP_CONTROL	Test Temperature Control	open	SWREQ_TEMP_REGULATION

Safety Shutdown Sequence

The following sequence diagram shows the runtime behaviour when the Safety Monitor detects an over-temperature condition. It issues an EMERGENCY_STOP command on INTF_SAFETY_CMD to all controlled subsystems. All modules must respond within 100 ms.

Safety Shutdown Sequence

Complete Safety Traceability

The diagram below shows the full vertical chain from system requirement through to test verification, demonstrating complete bidirectional traceability of the safety feature:

Coverage Summary