Model-checking I&C logics — insights from over a decade of projects in Finland

Model checking is a formal, computer-assisted verification method, used to prove that a model of a (hardware or software) system fulfills stated properties. In Finland, VTT has successfully applied the method in practical nuclear projects since 2008, verifying instrumentation and control (I&C) design in the Olkiluoto 3 EPR, Loviisa 1&2 I&C renewal, and Hanhikivi-1 projects. By 2020, we have detected 66 confirmed design issues, in some cases leading to design changes. In this paper, we first discuss the practical impact model checking has had in Finnish NPP projects. We then discuss statistics and characteristics of the detected design issues. Of particular interest is the fact that the method can in practice reveal I&C application logic design issues that could lead to spurious actuation of I&C. With the permission of our clients, we have collected hundreds of industry project models, thousands of formal properties, the detected issues, as well as the counterexamples that revealed them. We have used this data for different experiments in the Finnish Research Programme on Nuclear Power Plant Safety (SAFIR). In the second part of the paper, we present an overview of the past and current research activities, to demonstrate the state of the art. A recent example is the work on verifying the I&C application logics’ tolerance to failures of the underlying hardware architecture.