Treatise 15: Reliability & Safety Critical Items Lists (RCIL / SCIL) for Reinsurance

J. McKenney

This is a working-group treatise in WG-01-UI (Underwriter & Insurance), cited by the group's Concept of Operations and Minimum Operating Requirements treatise as one of the two engineering foundations it builds on. It shares its Gordon-Loeb capital allocation approach and its worked financial figures with the group's ALE/ROSI decision-framework treatise.

Licence: CC BY 4.0. 17 September 2026.

Executive Abstract#

Knowing that equipment can fail is not the same as knowing what to stock, buy, or insure against that failure. This paper sorts every asset in a hyperscale facility into two registers: a Reliability Critical Items List for equipment whose failure degrades uptime, and a stricter Safety Critical Items List whose members can destroy hardware, start a fire, or cause an environmental release. The second register is non-negotiable, requiring physical, hardwired safety interlocks that keep working even if every piece of software in the facility is compromised at once.

The financial argument turns on spare parts and lead times rather than purchase price. A pump that costs little to replace can still be a multi-million-dollar liability when it takes months to obtain and the facility loses revenue daily, and business interruption, not the hardware, dominates the loss. The standard spares math also breaks in a specific way: the usual model assumes each unit fails independently, and a coordinated cyber attack that takes out several redundant units at once violates that assumption by construction, not because of fitted data.

The paper translates both registers into reinsurance treaty language: what a facility with an audited RCIL and SCIL can expect in retention deductibles, business interruption terms, and probable maximum loss against one without either, while stating which of those terms Lloyd's Market Bulletin Y5381 constrains and which it does not.

Abstract#

FMECA and HAZOP identify failure modes but do not procure equipment, establish inventory buffers, or underwrite business interruption policies. The bridge between engineering risk analysis and balance-sheet resilience is formal classification of components into the Reliability Critical Items List (RCIL) and the Safety Critical Items List (SCIL). This paper establishes both registers for hyperscale compute infrastructure, drawing the boundary between reliability-critical components (whose failure degrades availability below contractual SLAs) and safety-critical components (whose failure produces irreversible hardware destruction, arc-flash explosions, or environmental catastrophes). SCIL items are Table B (Extremistan) assets requiring independent, hardwired SIL-3 analog interlocks that operate outside software networks. The paper formalizes the actuarial relationship between long-lead replacement timelines, such as 52-week substation transformer queues and 30-week custom Coolant Distribution Unit (CDU) lead times, and unhedged business interruption exposure. Modeling adversarial common-cause cyber interdictions that destroy redundant units simultaneously, the paper shows where classical Poisson spares models break: the failure is structural, since Poisson sizing assumes independent unit failures and a common-cause interdiction violates that by construction, outside the model's stated domain. We formulate the dynamics of cyber-physical spares optimization, derive optimal capital inventory buffers under Gordon-Loeb constraints, and establish reinsurance treaty structuring criteria that account for Lloyd's Y5381.

1. The Operational Divide Between Reliability and Safety#

Industrial facility managers frequently conflate reliability with safety:

• Reliability Engineering Focus: Reliability aims to maximize Mean Time Between Failures (MTBF) and minimize unplanned downtime. A component is reliability-critical if its degradation drops facility availability below four-nines ($99.99\%$).
• Safety Engineering Focus: Safety aims to prevent catastrophic physical destruction, fire, personnel injury, and environmental release. A component is safety-critical if its unmitigated failure creates an irreversible physical hazard.

The Structural Taxonomy: RCIL vs. SCIL#

The total industrial facility asset inventory (pumps, valves, switchgear, relays, BMS controllers, inverters, breakers) passes through two successive filters, each of which yields a register:

1.1 The Fundamental Rule of Critical Items Hierarchy#

Every SCIL item is inherently an RCIL item, but not all RCIL items are SCIL items. While an EPMS power monitor failure degrades energy optimization (RCIL), it does not physically rupture high-pressure piping. In contrast, commanding a CDU motorized isolation valve closed while compute silicon dissipates $100\text{ kW}$ per rack destroys millions of dollars of compute hardware within seconds (SCIL).

2. Multi-BOM and DEXPI Asset Topology Integration#

To establish an auditable supply-chain and reliability graph, every RCIL and SCIL component is cross-referenced between the DEXPI 2.0 plant piping schematic, classed against the ISO 15926-4 reference data library, and the CycloneDX 1.6+ multi-BOM specification:

Supply Chain and Topology Mapping Graph#

DEXPI 2.0 physical piping and instrumentation diagram

• Tag: CDU-PUMP-01A (primary centrifugal variable speed pump)
• Hydraulic specs: 122 L/min PG25, 4.5 bar head, flanged 316L stainless

CycloneDX 1.6+ multi-BOM component record

Logistics and reinsurance parameters

• Replacement lead time: 28 weeks (custom titanium plate heat exchanger)
• Single-source foundry exposure: TSMC Fab 18 / Infineon Dresden
• On-site critical spares inventory buffer: 2x complete redundant units

By connecting physical piping nodes to CycloneDX bills of materials, the reliability digital twin identifies supply-chain bottlenecks and component single-source vulnerabilities before procurement contracts are finalized.

3. The Definitive RCIL Register for High-Density Facilities#

The following register documents the critical operational components whose failure threatens facility availability, detailing their target security levels (SL-T) and lead-time replacement exposures:

Table 17.1#

Reliability Critical Items Register (RCIL)

4. The Definitive SCIL Register: High-Consequence Safety Assets#

Components on the Safety Critical Items List are categorized as Table B Extremistan assets. Their failure produces catastrophic loss. Consequently, they are subjected to mandatory hardwired safety invariants:

Table 17.2: Safety Critical Items Register (SCIL)#

5. Mathematical Formulations Governing Critical Spares#

Classical inventory theory models component failure as a Poisson process. However, targeted cyber-physical attacks introduce correlated common-cause failures, breaking classical spares equations.

5.1 Bimodal Failure Probability Density Function#

In an adversarial operating environment, total component failure probability density $f_{\text{total}}(t)$ is a mixture of stochastic mechanical wear and deterministic cyber exploitation:

Where:

• $\lambda_{\text{mech}}$ is the constant mechanical failure rate ($\text{failures/hour}$).
• $p_{\text{attack}}$ is the probability of a targeted cyber campaign against the facility.
• $\delta(t - t_{\text{exploit}})$ is the Dirac delta function representing simultaneous failure across all identical devices sharing a common firmware vulnerability.

5.2 Actuarial Business Interruption Single Loss Expectancy ($\text{SLE}_{\text{BI}}$)#

When a critical component fails, the Single Loss Expectancy is dominated by the replacement lead time $T_{\text{lead\_time}}$:

For a 100 MW high-density AI facility:

• Unserved compute SLA revenue loss rate: $\dot{L}_{\text{BI}} = 18{,}500\text{ USD/hour} = 444{,}000\text{ USD/day}$.
• Custom 4.5 MW chiller compressor lead time: $T_{\text{lead\_time}} = 42\text{ weeks} = 294\text{ days}$.

The physical asset replacement cost ($1.8\text{M USD}$) represents only 1.36 percent of the total loss. The remaining 98.64 percent of loss is pure business interruption, demonstrating why managing the RCIL and maintaining on-site strategic spares is the primary actuarial priority.

5.3 Optimal Capital Spares Buffer under Gordon-Loeb Limits#

The optimal capital expenditure dedicated to on-site critical spares inventory $S^*_{\text{spares}}$ is bounded by the Gordon-Loeb theorem:

Where maintaining on-site cold-standby spares reduces restoration lead time from 42 weeks down to 48 hours ($T_{\text{restore}} = 2\text{ days}$), slashing Single Loss Expectancy from $132.3\text{M USD}$ to $2.68\text{M USD}$.

5.4 Thermal Catastrophe Velocity Governing Component Trip#

When a CDU pump stops (SCIL-02), the heat transfer rate collapses while high-density accelerator ASICs dissipate intense heat flux:

Where:

• $P_{\text{die}} = 1{,}200\text{ W}$ per accelerator package, the configurable maximum NVIDIA publishes for a GB200-class Blackwell GPU.
• Volumetric flow collapses from $122\text{ L/min}$ PG25 coolant to zero.
• Heat flux is $75\text{ W/cm}^2$ across the $1{,}600\text{ mm}^2$ dual-die package.
• $C_{\text{thermal}} = 800\text{ J/K}$ thermal capacitance of the stagnant cold plate assembly, dominated by the coolant retained in the channels once flow stops.

Junction temperature surges at $1.46^\circ\text{C/s}$ from a nominal $72.5^\circ\text{C}$. Within $14.8\text{ seconds}$, silicon junction temperature reaches the $94.0^\circ\text{C}$ emergency hardware shutdown trip point. Only an analog, hardwired bi-metallic switch operating in $< 100\text{ milliseconds}$ can cut electrical power quickly enough to stop the package climbing on toward the $150^\circ\text{C}$ organic substrate glass transition region, where irreversible damage begins.

5.5 Return on Security Investment (ROSI) for Strategic Spares#

The financial return on establishing an on-site strategic critical spares depot is quantified as:

For a dedicated spares depot containing two complete CDU pump assemblies and one chiller compressor ($C_{\text{inventory}} = 650{,}000\text{ USD}$), the annual expected loss reduction is taken as $7,200,000 USD, giving a modeled $\text{ROSI} = 1{,}007\%$ (modeled: the loss reduction and the inventory cost are both working-group estimates, and this paper does not derive the $7{,}200{,}000$ figure from the registers above; treat it as an assumed input to the ratio).

6. Procurement Assurance and Life-Cycle Quality Gates#

To ensure that components placed on the RCIL and SCIL do not introduce persistent vulnerabilities into the operational plant, procurement teams must enforce four mandatory quality gates:

Four-Stage Procurement Systems Assurance Gates#

6.1 Gate 1: Mandatory CycloneDX Multi-BOM Ingestion#

Vendors delivering equipment on the RCIL or SCIL must provide certified CycloneDX 1.6+ manifests. The delivery must include an HBOM specifying every microchip, an SBOM listing all firmware libraries, and a CBOM identifying cryptographic certificate algorithms. Equipment delivered without machine-readable BOMs is rejected at the loading dock.

6.2 Gate 2: Silicon Root of Trust Verification#

All programmable controllers and network interface cards must incorporate an immutable hardware root of trust conforming to the OCP S.A.F.E. specification. The controller must execute authenticated firmware verification via Caliptra 2.0 or DICE protocols before initializing network interfaces.

6.3 Gate 3: Physical Safety Function Attestation#

For SCIL assets, the manufacturer must demonstrate physical, non-software fail-safe functionality. Safety interlocks must be verified by an accredited testing laboratory (TUV, UL) under IEC 61508 to achieve Safety Integrity Level 3 (SIL-3) with a Probability of Failure on Demand:

7. Actuarial and Reinsurance Treaty Structuring#

Registers that a syndicate can audit, line by line and against the physical plant, alter the underwriting terms of property catastrophe and business interruption reinsurance treaties. The register is the auditable object; the terms in the table below are a proposed structure for negotiation, and the percentages in the right-hand column are the working group's estimates rather than filed rates:

8. Summary of Engineering Principles#

Reliability and Safety Critical Items management establishes five immutable engineering principles:

1. Separate Reliability from Safety: RCIL protects uptime; SCIL protects physical existence. Never treat safety-critical hazards with mere software reliability controls.
2. Software Must Never Hold Exclusive Safety Authority: Table B assets demand analog, hardwired physical invariants that mechanically enforce safety when software is compromised.
3. Business Interruption Dwarfs Physical Asset Value: Lead time is the primary driver of loss. An inexpensive pump with a 30-week lead time is a multi-million-dollar financial liability.
4. Common-Cause Defeats Classical Spares Models: Redundant units that share network firmware are not independent. Spares inventory models must account for simultaneous adversarial interdiction.
5. Contractual Rigor Drives Balance-Sheet Resilience: Enforcing CycloneDX bills of materials and on-site spares buffers transforms uninsurable cyber-physical tail-risk into an affirmative, underwritten asset class.

9. References#

The method applies IEC 62443-3-2 security level targets, the CycloneDX bill-of-materials specification, the Gordon-Loeb model, and Lloyd's Market Bulletin Y5381. The per-accelerator power figure in section 5 is NVIDIA Corporation's own published figure, given in its Datasheet for NVIDIA Blackwell Architecture, product datasheet.