SPP-BOILER-01 — A complete safety graph with unfinished business
From the food bowl to the boiler drum
In PURR-SWARM-01, the kittens needed to reach the food bowl. This time, the water needs to stay in the drum, the steam needs somewhere to go, and the turbine needs to resist becoming a centrifuge with ambitions.
Our next public dataset, SPP-BOILER-01, exports the WCGW work item SPP-BOILER: an illustrative hazard-analysis sketch for a roughly 100 MWe drum-boiler steam unit. Its scope includes the boiler, fuel and feedwater systems, turbine-generator, safety valves, burner management and turbine protection. The work item is tagged IEC 61508 and SIL 2; those are model attributes, not a certification claim.
The sketch links safety concepts to recorded results from a lumped-parameter simulation of pressure, water level and turbine speed. All plant figures are illustrative. The published files contain the graph and result narratives, but not the referenced steam_plant_sim.py, so the export alone does not let a reader rerun those results.
Ever since we plugged our MCP server into the system, we've been able to crank up the auditability of work items produced through WCGW. We can even make illustrative physics simulations!
Observations
Things that are pleasing in this work item:
- 51 concepts, 83 relations, no orphans. Every concept participates in the argument.
- Ten concept types, with normalised entropy of 0.894. Twelve constraints sit alongside ten hazards, eleven requirements, four safety goals, tests, results and assumptions. The graph has room for the conditions under which its claims hold.
- Six relation types. Alongside derivation, refinement, validation and mitigation, 26
DEPENDS_ONand 14VIOLATESlinks make dependencies and broken constraints explicit. - Reported completeness of 1. Requirement-to-test coverage is 11/11, system-behaviour-to-safety-goal coverage 4/4, and hazard-to-mitigation coverage 10/10. These are traceability measures: they establish that links exist.
Things that remain troublesome:
- A requirement can be linked to a test that has no recorded result.
- A proposed constraint can carry an
APPROVEDrevision status while its text still says it is unimplemented and unverified. - Twelve of the 29 refinement suggestions have not been acted on. The other seventeen split into thirteen acted on and four discarded.
A well-connected graph is a pleasant thing. It also gives unfinished work fewer places to hide.
A small story in pressure
The recorded pressure simulation, SPP-TR-01, is the most revealing example. With the pressure trip working, the reported peak is 150.1 bar. With that trip failed and only the safety valves available, it is 153.5 bar against the sketch's 154 bar acceptance threshold: half a bar of margin.
Both cases are marked as passing in the result text. Yet the same text observes that the fuel trip still allows safety-valve lift under the assumed residual heat. It calls for review of the setpoint, a possible turbine bypass, or confirmation of the heat-decay assumption.
That is useful engineering content: a passing result accompanied by an explanation of how little comfort it offers. The numbers are recorded simulation claims, not measurements from a commissioned plant.
Three sensors and one shared mistake
SPP-HAZ-08 describes a common-cause error in the drum-level channels: multiple instruments can agree because they share the same faulty reference or compensation input. SPP-TSR-06 proposes a diverse level channel; SPP-CON-11 then asks whether that channel is physically independent of the others.
The constraint makes a particularly useful distinction. Matching an ontology property tells us that two channels concern the same kind of physical quantity. It does not establish which installed tapping, line or power supply they use.
Its text leaves independence unverified, calls for a human check against the piping and instrumentation diagram and installation, and notes the missing result for SPP-TC-07. The graph records the question clearly enough for somebody to answer it.
The valve must also close
The later constraint SPP-CON-12 addresses reseating and leakage after a safety valve lifts. Its leakage limit is still undefined. It also draws a useful boundary: a proof test can detect a failure; the existence of that test does not itself prevent the failure.
This is where the boiler sketch earns its place beside the kittens. The interesting result is a safety model that exposes its own dependencies, thin margins and missing evidence. Full traceability makes those questions easier to inspect. Resolving them remains engineering work.
Open the artifact
This note uses the 10 November 2026 dataset snapshot. Its data.json contains the work item, metrics, refinement counts, latest concept revisions and relations. Read the result narratives and constraint status sections alongside the scores; that is where the boiler becomes interesting.