Verification Of Safety Requirements Research Articles

Empowering Domain Experts With Formal Methods for Consistency Verification of Safety Requirements

Empowering Domain Experts With Formal Methods for Consistency Verification of Safety Requirements

On the role of simulation codes in regulatory activities. Challenges and R&D needs

Simulation codes are essential tools in Nuclear Safety. Calculations are needed to assess the safety of nuclear power plants and to verify compliance with safety requirements. Nuclear regulatory bodies must assess the codes, the methodologies for their use, and the calculations performed with them by licensees in support of their safety analyses. One important way for assessing the validity, quality, consistency, and conclusions of licensee assessments is for regulators and Technical Support Organizations (TSO) alike to resort to independent analysis, including detailed TH calculations. This regulatory task requires high technical expertise and capabilities, such as the ones needed for the development of simulation codes and computerized diagnostic tools specific for regulatory assessment. These tools are not to have the same focus and scope as their industry counterparts, since the objective is shifted from design (for the licensees) to verification of safety requirements. (for regulators/TSOs). This paper has been written by members of the technical staff of Spain’s Nuclear Safety Council, with a double purpose:-To review challenges and needs for Regulatory Bodies concerning the licensing processes where thermohydraulic system codes and related methodologies and calculations are involved.-To review new and advanced methodologies, mainly related to Risk-Informed Regulations, where TH simulation codes are used.

Evaluación de seguridad radiología para el transporte terrestre de fuentes categoría 1 (60Co) en virtud de arreglo especial aplicando el método de matriz de riesgo

El transporte de material radiactivo es una de las prácticas más seguras gracias a la regulación y a las medidas de seguridad y protección radiológica aplicadas. Tal como ocurre en otras prácticas implementadas cuando hay radiaciones ionizantes, también requiere la verificación de los requisitos de seguridad; por eso es determinante una adecuada evaluación de seguridad. En las evaluaciones de seguridad se aplican diferentes metodologías, como, por ejemplo, el método de matriz de riesgo, usado en radioterapia, radiología industrial, medicina nuclear, perfilaje, y por primera vez en el transporte de material radiactivo. En el marco de la consolidación de desechos radiactivos de alta peligrosidad, en Colombia se identificó la necesidad de confinar las fuentes categoría 1 de 60Co, catalogadas como extremadamente peligrosas, usadas en radioterapia, que deben ser reexportadas o trasladadas para su disposición final. Por las características de las fuentes y el tiempo transcurrido para su gestión, y en virtud de un arreglo especial, se requiere transportarlas en bultos con un nivel total de seguridad, un adecuado control operacional y algunas medidas adicionales. Teniendo en cuenta la peligrosidad de las fuentes y las características del transporte, era necesario aplicar el método de matriz de riesgo para evaluar la seguridad del transporte terrestre, prestando especial atención a la defensa en profundidad, los análisis cuantitativos y la aplicación de un enfoque diferenciado para el transporte de fuentes de 60Co categoría 1. La evaluación de seguridad concluyó que, en cualquier caso, como producto de la ocurrencia de sucesos iniciadores, las consecuencias son altas; sin embargo, la robustez de las barreras de seguridad, los reductores de consecuencia y los reductores de frecuencia mantienen la práctica en riesgos bajos.

Simplifying the Formal Verification of Safety Requirements in Zone Controllers Through Problem Frames and Constraint-Based Projection

Formal methods have been applied widely to verifying the safety requirements of communication-based train control (CBTC) systems, while the problem situations could be much simplified. In industrial practices of CBTC systems, however, huge complexity arises, which renders those methods nearly impossible to apply. In this paper, we aim to reduce the state space of formal verification problems in zone controller, a sub-system of a typical CBTC. We achieve the simplification goal by reducing the total number of device variables. To do this, two projection methods are proposed based on problem frames and constraints, respectively. The problem frame-based method decomposes the system according to sub-properties through functional decomposition, while the constraint-based projection method removes redundant variables. Our industrial case study demonstrates the feasibility through an evaluation, confirming that these two methods are effective in reducing the state spaces of complex verification problems in this application domain.

Model Based Safety Analysis with smartIflow †

Verification of safety requirements is one important task during the development of safety critical systems. The increasing complexity of systems makes manual analysis almost impossible. This paper introduces a new methodology for formal verification of technical systems with smartIflow (State Machines for Automation of Reliability-related Tasks using Information FLOWs). smartIflow is a new modeling language that has been especially designed for the purpose of automating the safety analysis process in early product life cycle stages. It builds up on experience with existing approaches. As is common practice in current approaches, components are modeled as finite state machines. However, new concepts are introduced to describe component interactions. Events play a major role for internal interactions between components as well as for external (user) interactions. Our approach to the verification of formally specified safety requirements is a two-step method. First, an exhaustive simulation creates knowledge about a great variety of possible behaviors of the system, especially including reactions on suddenly occurring (possibly intermittent) faults. In the second step, safety requirements specified in CTL (Computation Tree Logic) are verified using model checking techniques, and counterexamples are generated if these are not satisfied. The practical applicability of this approach is demonstrated based on a Java implementation using a simple Two-Tank-Pump-Consumer system.

A methodology for model-based verification of safety contracts and performance requirements

The verification of safety requirements becomes crucial in critical systems where human lives depend on their correct functioning. Formal methods have often been advocated as necessary to ensure the reliability of software systems, albeit with a considerable effort. In any case, such an effort is cost-effective when verifying safety-critical systems. Often, safety requirements are expressed using safety contracts, in terms of assumptions and guarantees. To facilitate the adoption of formal methods in the safety-critical software industry, we propose a methodology based on well-known modelling languages such as the unified modelling language and object constraint language. The unified modelling language is used to model the software system while object constraint language is used to express the system safety contracts within the unified modelling language. In the proposed methodology a unified modelling language model enriched with object constraint language constraints is transformed to a Petri net model that enables us to formally verify such safety contracts. The methodology is evaluated on an industrial case study. The proposed approach allows an early safety verification to be performed, which increases the confidence of software engineers while designing the system.

Verification of safety requirements for program code using data abstraction

Large systems in modern development consist of many concurrent processes. To prove safety properties formal modelling techniques are needed. When source code is the only available documentation for deriving the system's behaviour, it is a difficult task to create a suitable model. Implementations of a system usually describe behaviour in too much detail for a formal verification. Therefore automated methods are needed that directly abstract from the implementation, but maintain enough information for a formal system analysis. This paper describes and illustrates a method by which systems with a high degree of parallelism can be verified. The method consists of creating an over-approximation of the behaviour by abstracting from the values of program variables. The derived model, consisting of interface calls between processes, is checked for various safety properties with the mCRL2 tool set.

Translating STATEMATE models into FNLOG for the verification of safety requirements in reactive systems

In this paper, the authors explore the usefulness of a combination of semi-formal and formal methods in specifying reactive systems and verifying their properties. The authors propose an approach combining STATEMATE and the temporal logic FNLOG. STATEMATE is a semi-formal method, which has been used for the development of large industrial applications. It pertains to the specification and design of complex reactive systems and builds simulations and prototypes rapidly. Though STATEMATE provides rigorous specifications, these are not verifiable to ensure and guarantee the reliability of the system being developed. To fulfil the verification objective, a STATEMATE specification is translated into a logic based specification language FNLOG, which allows its verification. This paper describes the cross reference between STATEMATE and FNLOG features. Systematic derivation schemes from STATEMATE models to FNLOG specifications and different steps of the proposed translation procedure.

Integration of safety analysis in model-driven software development

Safety critical software requires integrating verification techniques in software development methods. Software architectures must guarantee that developed systems will meet safety requirements and safety analyses are frequently used in the assessment. Safety engineers and software architects must reach a common understanding on an optimal architecture from both perspectives. Currently both groups of engineers apply different modelling techniques and languages: safety analysis models and software modelling languages. The solutions proposed seek to integrate both domains coupling the languages of each domain. It constitutes a sound example of the use of language engineering to improve efficiency in a software-related domain. A model-driven development approach and the use of a platform-independent language are used to bridge the gap between safety analyses (failure mode effects and criticality analysis and fault tree analysis) and software development languages (e.g. unified modelling language). Language abstract syntaxes (metamodels), profiles, language mappings (model transformations) and language refinements, support the direct application of safety analysis to software architectures for the verification of safety requirements. Model consistency and the possibility of automation are found among the benefits.

A Formal Verification Environment for Railway Signaling System Design

A fundamental problem in the design and development of embedded control systems is the verification of safety requirements. Formal methods, offering a mathematical way to specify and analyze the be...

Simulating and analyzing railway interlockings in ExSpect

This study evaluates the ability of ExSpect, a toolkit for simulating and analyzing complex distributed systems using colored Petri nets, to analyze ISL specifications for railway interlockings.A railway interlocking--which is designed to guarantee the safety of train movements--is an extremely complex distributed system. The behavior of such a system - and thus its correctness - is hard to understand and even more difficult to analyze. Recognizing that verification of safety requirements in such a system would not be possible without a way to formally describe system behavior, the Dutch railway company, Nederlandse Spoorwegen, designed a set of formal languages, called the Interlocking Specification Language, also known as Euris.Engineers at NS envisioned that ISL would let them describe and simulate interlocking behavior, verify safety requirements, and optimize interlocking behavior. This in turn could lead to the creation of an infrastructure that would allow more flexible train schedules.However, although ISL is an important step toward a more formal approach to building and maintaining interlockings, it is not suitable for verifying safety requirements because it lacks a firm mathematical basis. The study described here, conducted by the Eindhoven University of Technology in cooperation with NS, is a first step toward the simulation and verification of ISL specifications that is grounded in mathematical theory.As part of the study, we translated a small part of an ISL specification into the graphical and functional language used by the ExSpect toolkit. ExSpect, which is short for Executable Specification tool, is a graphical specification and simulation package developed at the university and commercially available from Bakkenist Management Consultants. It is a general-purpose tool, based on the theory of Petri nets, that combines a graphical user interface for specifying and simulating many types of distributed systems with analysis tools for verifying the properties of such systems.The goals of the study were to investigate to what extent NS engineers could use ExSpect to improve simulation and verification in ISL and to evaluate the strengths and weaknesses of ExSpect in an interesting real-world application. Many constructs in ISL map almost directly to ExSpect constructs. Thus, the study also laid the foundation for an ISL-to-ExSpect compiler.The study revealed that ExSpect has many advantages over ISL in simulation. It also revealed that we cannot yet verify any safety properties of an interlocking. First, it is not clear exactly what the safety requirements of an interlocking are, as they are described in ISL. Second, and more compelling, a railway interlocking specification is far too complex for formal verification with current technology.We did, however, learn some interesting things about ExSpect's abilities and gained much insight into possible extensions.