Formal Verification of Safety Automation Logic Designs

In safety critical processes, especially in nuclear power plants, the new digitalized automation (I&C) systems have brought out new needs for safety evaluation. The programmable digital logic controllers can perform complicated control tasks and, thus, their comprehensive verification against safety requirements is a difficult task. Model checking is a promising approach that enables complete verification of a logic design when a finite state machine model of the control logic is available. The paper describes the use of model checking for the verification of an arc protection system and summarizes experiences of utilizing model checking in automation design and verification. For the verification of the arc protection system, it was necessary to model the overall design of the system and its operation environment. The environment model could be kept relatively simple while covering the essential behaviour of the environment. The results show that it is possible to reliably verify the presence of a desired or the absence of an undesired behaviour of the system. The possibility of complete verification makes model checking different from simulation based testing where only selected schemes can be simulated and one can never be sure that all the possible sequences are examined.