Model-checking infinite-state nuclear safety I&C systems with nuXmv

For over a decade, model checking has been successfully used to formally verify the instrumentation and control (I&C) logic design in Finnish nuclear power plant projects. One of the practical challenges is that the model checker NuSMV forces the user to abstract the way analog signals are processed in the model, which causes extra manual work, and could mask actual design issues. In this paper, we experiment with the newer tool nuXmv, which supports infinite-state modelling. Using actual models from practical industrial projects, we show that after changing the analog signal processing to be based on real number math, the analysis times are still manageable. The disadvantage is that certain useful types of formal properties are not supported by the infinite-state algorithms. We also discuss the nuclear industry specific features of I&C programming languages, which cause significant constraints on domain-specific formal verification method and tool development.