Verification of safety logic designs by model checking

In nuclear power plants, novel digitalized I&C systems have brought out new needs for safety evaluation. The programmable digital logic controllers enable complicated control functionalities and, thus, their comprehensive verification is a difficult task. Model checking is a promising method that enables complete verification of the logic design when a finite state machine model of the control logic is available. The paper investigates the verification of a power plant related safety logic system which combines real-time aspects through the use of timers with control logic. Because of the involved combination a comprehensive and reliable analysis by manual inspection and testing is challenging. For analyzing the logic design of the system, we employed two model checking tools. The Uppaal model checker was selected for its good handling of real time aspects while the NuSMV model checker was selected because it is tailored for the analysis of large systems. The safety logic system was modeled using NuSMV and Uppaal and the model checking capabilities of the systems were studied by analyzing whether the key requirements for safety are satisfied. Then three increasingly challenging failure models were created for NuSMV to check the fulfillment of the single failure criterion. The analysis clearly demonstrates the benefits of model checking in the verification and licensing of digital automation. The analysis also demonstrates strengths and limitations of the two model checking tools.