Formal Verification of Safety I&C System Designs

Two Nuclear Power Plant Related Applications

Janne Valkonen, Matti Koskimies, Ville Pettersson, Keijo Heljanko, Jan-Erik Holmberg, Ilkka Niemelä, Jari Hämäläinen

Research output: Chapter in Book/Report/Conference proceedingConference article in proceedingsScientificpeer-review

Abstract

Instrumentation and control (I&C) systems play a crucial role in the operation of nuclear power plants (NPP) and other safety critical processes. An important change is the replacement of the old analogue I&C systems with new digitalised ones. The programmable digital logic controllers enable more complicated control tasks than the old analogue systems and thus the validation of the control logic designs against safety requirements has become more important. In order to diminish the subjective component of the evaluation there is a need to develop new formal verification methods. A promising approach is a method called model checking, which enables the complete verification of requirements when a finite state machine model of the system is available. The use of model checking to verify two nuclear power plant related systems is described: an arc protection system and a reactor emergency cooling system. For the verification, it was also necessary to model the operation environment of the device and the larger system it is part of. The environment models could be kept relatively simple, but it is important that the essential behaviour of the environment is covered. The reactor emergency cooling system is in use in an operating nuclear power plant and the arc protection system model included a typical realistic operation environment. The results showed that it was possible to reliably verify the presence of desired behaviour as well as the absence of an undesired behaviour of the system. The possibility for complete verification makes model checking different from simulation-based testing where only a number of selected scenarios can be simulated and one can never be sure that all the possible behaviour is covered. The challenges for future research are to develop more dedicated methods for the verification of safety critical automation and safety critical embedded software.
Original languageEnglish
Title of host publicationEnlarged Halden Programme Group Meeting
Subtitle of host publicationProceedings of the Man-Technology-Organisation Sessions
Publication statusPublished - 2008
MoE publication typeA4 Article in a conference publication
EventEnlarged Halden Programme Group Meeting, EHPG 2008 - Loen, Norway
Duration: 18 May 200823 May 2008

Conference

ConferenceEnlarged Halden Programme Group Meeting, EHPG 2008
CountryNorway
CityLoen
Period18/05/0823/05/08

Fingerprint

Nuclear power plants
Model checking
Systems analysis
Cooling systems
Logic design
Embedded software
Finite automata
Automation
Controllers
Formal verification
Testing

Keywords

  • model checking
  • formal verification
  • I&C system

Cite this

Valkonen, J., Koskimies, M., Pettersson, V., Heljanko, K., Holmberg, J-E., Niemelä, I., & Hämäläinen, J. (2008). Formal Verification of Safety I&C System Designs: Two Nuclear Power Plant Related Applications. In Enlarged Halden Programme Group Meeting: Proceedings of the Man-Technology-Organisation Sessions [C4.2]
Valkonen, Janne ; Koskimies, Matti ; Pettersson, Ville ; Heljanko, Keijo ; Holmberg, Jan-Erik ; Niemelä, Ilkka ; Hämäläinen, Jari. / Formal Verification of Safety I&C System Designs : Two Nuclear Power Plant Related Applications. Enlarged Halden Programme Group Meeting: Proceedings of the Man-Technology-Organisation Sessions. 2008.
@inproceedings{e91e55882b9b4af1b9abee43e1181c8a,
title = "Formal Verification of Safety I&C System Designs: Two Nuclear Power Plant Related Applications",
abstract = "Instrumentation and control (I&C) systems play a crucial role in the operation of nuclear power plants (NPP) and other safety critical processes. An important change is the replacement of the old analogue I&C systems with new digitalised ones. The programmable digital logic controllers enable more complicated control tasks than the old analogue systems and thus the validation of the control logic designs against safety requirements has become more important. In order to diminish the subjective component of the evaluation there is a need to develop new formal verification methods. A promising approach is a method called model checking, which enables the complete verification of requirements when a finite state machine model of the system is available. The use of model checking to verify two nuclear power plant related systems is described: an arc protection system and a reactor emergency cooling system. For the verification, it was also necessary to model the operation environment of the device and the larger system it is part of. The environment models could be kept relatively simple, but it is important that the essential behaviour of the environment is covered. The reactor emergency cooling system is in use in an operating nuclear power plant and the arc protection system model included a typical realistic operation environment. The results showed that it was possible to reliably verify the presence of desired behaviour as well as the absence of an undesired behaviour of the system. The possibility for complete verification makes model checking different from simulation-based testing where only a number of selected scenarios can be simulated and one can never be sure that all the possible behaviour is covered. The challenges for future research are to develop more dedicated methods for the verification of safety critical automation and safety critical embedded software.",
keywords = "model checking, formal verification, I&C system",
author = "Janne Valkonen and Matti Koskimies and Ville Pettersson and Keijo Heljanko and Jan-Erik Holmberg and Ilkka Niemel{\"a} and Jari H{\"a}m{\"a}l{\"a}inen",
year = "2008",
language = "English",
booktitle = "Enlarged Halden Programme Group Meeting",

}

Valkonen, J, Koskimies, M, Pettersson, V, Heljanko, K, Holmberg, J-E, Niemelä, I & Hämäläinen, J 2008, Formal Verification of Safety I&C System Designs: Two Nuclear Power Plant Related Applications. in Enlarged Halden Programme Group Meeting: Proceedings of the Man-Technology-Organisation Sessions., C4.2, Enlarged Halden Programme Group Meeting, EHPG 2008, Loen, Norway, 18/05/08.

Formal Verification of Safety I&C System Designs : Two Nuclear Power Plant Related Applications. / Valkonen, Janne; Koskimies, Matti; Pettersson, Ville; Heljanko, Keijo; Holmberg, Jan-Erik; Niemelä, Ilkka; Hämäläinen, Jari.

Enlarged Halden Programme Group Meeting: Proceedings of the Man-Technology-Organisation Sessions. 2008. C4.2.

Research output: Chapter in Book/Report/Conference proceedingConference article in proceedingsScientificpeer-review

TY - GEN

T1 - Formal Verification of Safety I&C System Designs

T2 - Two Nuclear Power Plant Related Applications

AU - Valkonen, Janne

AU - Koskimies, Matti

AU - Pettersson, Ville

AU - Heljanko, Keijo

AU - Holmberg, Jan-Erik

AU - Niemelä, Ilkka

AU - Hämäläinen, Jari

PY - 2008

Y1 - 2008

N2 - Instrumentation and control (I&C) systems play a crucial role in the operation of nuclear power plants (NPP) and other safety critical processes. An important change is the replacement of the old analogue I&C systems with new digitalised ones. The programmable digital logic controllers enable more complicated control tasks than the old analogue systems and thus the validation of the control logic designs against safety requirements has become more important. In order to diminish the subjective component of the evaluation there is a need to develop new formal verification methods. A promising approach is a method called model checking, which enables the complete verification of requirements when a finite state machine model of the system is available. The use of model checking to verify two nuclear power plant related systems is described: an arc protection system and a reactor emergency cooling system. For the verification, it was also necessary to model the operation environment of the device and the larger system it is part of. The environment models could be kept relatively simple, but it is important that the essential behaviour of the environment is covered. The reactor emergency cooling system is in use in an operating nuclear power plant and the arc protection system model included a typical realistic operation environment. The results showed that it was possible to reliably verify the presence of desired behaviour as well as the absence of an undesired behaviour of the system. The possibility for complete verification makes model checking different from simulation-based testing where only a number of selected scenarios can be simulated and one can never be sure that all the possible behaviour is covered. The challenges for future research are to develop more dedicated methods for the verification of safety critical automation and safety critical embedded software.

AB - Instrumentation and control (I&C) systems play a crucial role in the operation of nuclear power plants (NPP) and other safety critical processes. An important change is the replacement of the old analogue I&C systems with new digitalised ones. The programmable digital logic controllers enable more complicated control tasks than the old analogue systems and thus the validation of the control logic designs against safety requirements has become more important. In order to diminish the subjective component of the evaluation there is a need to develop new formal verification methods. A promising approach is a method called model checking, which enables the complete verification of requirements when a finite state machine model of the system is available. The use of model checking to verify two nuclear power plant related systems is described: an arc protection system and a reactor emergency cooling system. For the verification, it was also necessary to model the operation environment of the device and the larger system it is part of. The environment models could be kept relatively simple, but it is important that the essential behaviour of the environment is covered. The reactor emergency cooling system is in use in an operating nuclear power plant and the arc protection system model included a typical realistic operation environment. The results showed that it was possible to reliably verify the presence of desired behaviour as well as the absence of an undesired behaviour of the system. The possibility for complete verification makes model checking different from simulation-based testing where only a number of selected scenarios can be simulated and one can never be sure that all the possible behaviour is covered. The challenges for future research are to develop more dedicated methods for the verification of safety critical automation and safety critical embedded software.

KW - model checking

KW - formal verification

KW - I&C system

M3 - Conference article in proceedings

BT - Enlarged Halden Programme Group Meeting

ER -

Valkonen J, Koskimies M, Pettersson V, Heljanko K, Holmberg J-E, Niemelä I et al. Formal Verification of Safety I&C System Designs: Two Nuclear Power Plant Related Applications. In Enlarged Halden Programme Group Meeting: Proceedings of the Man-Technology-Organisation Sessions. 2008. C4.2