VERIFICATION OF AN INDUSTRIAL SAFETY FUNCTION USING COLOURED PETRI NETS AND MODEL CHECKING

Abstract:The veri“cation of embedded, safety-critical industrial systems is important, since a failure ofthese systems may have catastrophic consequences. Formal methods guarantee not only thecorrectness, but also the completeness of the analysis. However, even moderately complexindustrialsystemshavestatespacessolargethatformeranalysistechniquescouldnothandle.In this paper we model and analyse a small, but important part of a safety-critical industrialsystem: a safety function initiating an emergency procedure in a nuclear power plant. Wemodel safety function using a proprietary coloured Petri net formalism, and perform the analy-sis by symbolic model checking based on the saturation algorithm. The analysis results werecomputed by the model checking tool developed at our department . Although this particularsafety function has been analysed in earlier research [11], this is the “rst time the full behaviourof this system could be examined without any restrictions.Keywords:safety systems, formal methods, coloured Petri net, model checking, saturation1 INTRODUCTIONEmbedded controllers are now a standard and prevalent part of industrial systems. They pro-vide rich functionality and easy programmability. Still, these advantages also create a problem:the veri“cation and validation (V&V) of these devices and their programs is becoming increas-ingly dif“cult. Testing is the traditional approach to V&V in industrial control systems. However,their behaviour is typically complex enough to make it impossible to achieve a complete testcoverage for an even moderately complex controller. Hence, formal modelling and analysis isgaining wider acceptance in the industry, especially in the safety-critical application areas.A frequently mentioned weakness of formal methods is that they often bite off more than theycan chewŽ, meaning that the formal models of real systems are susceptible to state explosion .While this is a valid argument, the aim of our paper is to demonstrate that recent developmentin the “eld of model checking, advanced state space exploration algorithms and storage datastructures make us possible to solve problems that older methods could not handle. Our ap-plication example is a small, but important safety-critical industrial system: the safety functioninitiating an emergency procedure in a nuclear power plant.The contributions of this paper are twofold: theoretical and practical. On the theoretical side,we have adapted and extended the so-called saturation algorithm [3] to be able to represent