Formal Verification of Safety I&C System Designs: Two Nuclear Power Plant Related Applications

Janne Valkonen, Matti Koskimies, Ville Pettersson, Keijo Heljanko, Jan-Erik Holmberg, Ilkka Niemelä, Jari Hämäläinen

    Research output: Chapter in Book/Report/Conference proceedingConference article in proceedingsScientificpeer-review

    Abstract

    Instrumentation and control (I&C) systems play a crucial role in the operation of nuclear power plants (NPP) and other safety critical processes. An important change is the replacement of the old analogue I&C systems with new digitalised ones. The programmable digital logic controllers enable more complicated control tasks than the old analogue systems and thus the validation of the control logic designs against safety requirements has become more important. In order to diminish the subjective component of the evaluation there is a need to develop new formal verification methods. A promising approach is a method called model checking, which enables the complete verification of requirements when a finite state machine model of the system is available. The use of model checking to verify two nuclear power plant related systems is described: an arc protection system and a reactor emergency cooling system. For the verification, it was also necessary to model the operation environment of the device and the larger system it is part of. The environment models could be kept relatively simple, but it is important that the essential behaviour of the environment is covered. The reactor emergency cooling system is in use in an operating nuclear power plant and the arc protection system model included a typical realistic operation environment. The results showed that it was possible to reliably verify the presence of desired behaviour as well as the absence of an undesired behaviour of the system. The possibility for complete verification makes model checking different from simulation-based testing where only a number of selected scenarios can be simulated and one can never be sure that all the possible behaviour is covered. The challenges for future research are to develop more dedicated methods for the verification of safety critical automation and safety critical embedded software.
    Original languageEnglish
    Title of host publicationEnlarged Halden Programme Group Meeting
    Subtitle of host publicationProceedings of the Man-Technology-Organisation Sessions
    Publication statusPublished - 2008
    MoE publication typeA4 Article in a conference publication
    EventEnlarged Halden Programme Group Meeting, EHPG 2008 - Loen, Norway
    Duration: 18 May 200823 May 2008

    Conference

    ConferenceEnlarged Halden Programme Group Meeting, EHPG 2008
    CountryNorway
    CityLoen
    Period18/05/0823/05/08

    Fingerprint

    Nuclear power plants
    Model checking
    Systems analysis
    Cooling systems
    Logic design
    Embedded software
    Finite automata
    Automation
    Controllers
    Formal verification
    Testing

    Keywords

    • model checking
    • formal verification
    • I&C system

    Cite this

    Valkonen, J., Koskimies, M., Pettersson, V., Heljanko, K., Holmberg, J-E., Niemelä, I., & Hämäläinen, J. (2008). Formal Verification of Safety I&C System Designs: Two Nuclear Power Plant Related Applications. In Enlarged Halden Programme Group Meeting: Proceedings of the Man-Technology-Organisation Sessions [C4.2]
    Valkonen, Janne ; Koskimies, Matti ; Pettersson, Ville ; Heljanko, Keijo ; Holmberg, Jan-Erik ; Niemelä, Ilkka ; Hämäläinen, Jari. / Formal Verification of Safety I&C System Designs : Two Nuclear Power Plant Related Applications. Enlarged Halden Programme Group Meeting: Proceedings of the Man-Technology-Organisation Sessions. 2008.
    @inproceedings{e91e55882b9b4af1b9abee43e1181c8a,
    title = "Formal Verification of Safety I&C System Designs: Two Nuclear Power Plant Related Applications",
    abstract = "Instrumentation and control (I&C) systems play a crucial role in the operation of nuclear power plants (NPP) and other safety critical processes. An important change is the replacement of the old analogue I&C systems with new digitalised ones. The programmable digital logic controllers enable more complicated control tasks than the old analogue systems and thus the validation of the control logic designs against safety requirements has become more important. In order to diminish the subjective component of the evaluation there is a need to develop new formal verification methods. A promising approach is a method called model checking, which enables the complete verification of requirements when a finite state machine model of the system is available. The use of model checking to verify two nuclear power plant related systems is described: an arc protection system and a reactor emergency cooling system. For the verification, it was also necessary to model the operation environment of the device and the larger system it is part of. The environment models could be kept relatively simple, but it is important that the essential behaviour of the environment is covered. The reactor emergency cooling system is in use in an operating nuclear power plant and the arc protection system model included a typical realistic operation environment. The results showed that it was possible to reliably verify the presence of desired behaviour as well as the absence of an undesired behaviour of the system. The possibility for complete verification makes model checking different from simulation-based testing where only a number of selected scenarios can be simulated and one can never be sure that all the possible behaviour is covered. The challenges for future research are to develop more dedicated methods for the verification of safety critical automation and safety critical embedded software.",
    keywords = "model checking, formal verification, I&C system",
    author = "Janne Valkonen and Matti Koskimies and Ville Pettersson and Keijo Heljanko and Jan-Erik Holmberg and Ilkka Niemel{\"a} and Jari H{\"a}m{\"a}l{\"a}inen",
    year = "2008",
    language = "English",
    booktitle = "Enlarged Halden Programme Group Meeting",

    }

    Valkonen, J, Koskimies, M, Pettersson, V, Heljanko, K, Holmberg, J-E, Niemelä, I & Hämäläinen, J 2008, Formal Verification of Safety I&C System Designs: Two Nuclear Power Plant Related Applications. in Enlarged Halden Programme Group Meeting: Proceedings of the Man-Technology-Organisation Sessions., C4.2, Enlarged Halden Programme Group Meeting, EHPG 2008, Loen, Norway, 18/05/08.

    Formal Verification of Safety I&C System Designs : Two Nuclear Power Plant Related Applications. / Valkonen, Janne; Koskimies, Matti; Pettersson, Ville; Heljanko, Keijo; Holmberg, Jan-Erik; Niemelä, Ilkka; Hämäläinen, Jari.

    Enlarged Halden Programme Group Meeting: Proceedings of the Man-Technology-Organisation Sessions. 2008. C4.2.

    Research output: Chapter in Book/Report/Conference proceedingConference article in proceedingsScientificpeer-review

    TY - GEN

    T1 - Formal Verification of Safety I&C System Designs

    T2 - Two Nuclear Power Plant Related Applications

    AU - Valkonen, Janne

    AU - Koskimies, Matti

    AU - Pettersson, Ville

    AU - Heljanko, Keijo

    AU - Holmberg, Jan-Erik

    AU - Niemelä, Ilkka

    AU - Hämäläinen, Jari

    PY - 2008

    Y1 - 2008

    N2 - Instrumentation and control (I&C) systems play a crucial role in the operation of nuclear power plants (NPP) and other safety critical processes. An important change is the replacement of the old analogue I&C systems with new digitalised ones. The programmable digital logic controllers enable more complicated control tasks than the old analogue systems and thus the validation of the control logic designs against safety requirements has become more important. In order to diminish the subjective component of the evaluation there is a need to develop new formal verification methods. A promising approach is a method called model checking, which enables the complete verification of requirements when a finite state machine model of the system is available. The use of model checking to verify two nuclear power plant related systems is described: an arc protection system and a reactor emergency cooling system. For the verification, it was also necessary to model the operation environment of the device and the larger system it is part of. The environment models could be kept relatively simple, but it is important that the essential behaviour of the environment is covered. The reactor emergency cooling system is in use in an operating nuclear power plant and the arc protection system model included a typical realistic operation environment. The results showed that it was possible to reliably verify the presence of desired behaviour as well as the absence of an undesired behaviour of the system. The possibility for complete verification makes model checking different from simulation-based testing where only a number of selected scenarios can be simulated and one can never be sure that all the possible behaviour is covered. The challenges for future research are to develop more dedicated methods for the verification of safety critical automation and safety critical embedded software.

    AB - Instrumentation and control (I&C) systems play a crucial role in the operation of nuclear power plants (NPP) and other safety critical processes. An important change is the replacement of the old analogue I&C systems with new digitalised ones. The programmable digital logic controllers enable more complicated control tasks than the old analogue systems and thus the validation of the control logic designs against safety requirements has become more important. In order to diminish the subjective component of the evaluation there is a need to develop new formal verification methods. A promising approach is a method called model checking, which enables the complete verification of requirements when a finite state machine model of the system is available. The use of model checking to verify two nuclear power plant related systems is described: an arc protection system and a reactor emergency cooling system. For the verification, it was also necessary to model the operation environment of the device and the larger system it is part of. The environment models could be kept relatively simple, but it is important that the essential behaviour of the environment is covered. The reactor emergency cooling system is in use in an operating nuclear power plant and the arc protection system model included a typical realistic operation environment. The results showed that it was possible to reliably verify the presence of desired behaviour as well as the absence of an undesired behaviour of the system. The possibility for complete verification makes model checking different from simulation-based testing where only a number of selected scenarios can be simulated and one can never be sure that all the possible behaviour is covered. The challenges for future research are to develop more dedicated methods for the verification of safety critical automation and safety critical embedded software.

    KW - model checking

    KW - formal verification

    KW - I&C system

    M3 - Conference article in proceedings

    BT - Enlarged Halden Programme Group Meeting

    ER -

    Valkonen J, Koskimies M, Pettersson V, Heljanko K, Holmberg J-E, Niemelä I et al. Formal Verification of Safety I&C System Designs: Two Nuclear Power Plant Related Applications. In Enlarged Halden Programme Group Meeting: Proceedings of the Man-Technology-Organisation Sessions. 2008. C4.2