Compositional Verification of Nuclear Safety I&C Systems with OCRA

Model checking is a powerful formal verification method. However, due to the complexity of instrumentation and control (I&C) system logics-even in critical applications like nuclear power plant safety systems-the challenge of state space explosion means that the analyses cannot always be performed in reasonable time. In compositional verification, this challenge is overcome by reasoning over the system subcomponents sepa-rately, and then resolving proof claims for the composite system as a whole. In this paper, I present my experiments with OCRA, a tool for the verification of contract requirement. Together with the model checker nuXmv, OCRA can be used for compositional model checking. My industrial case study relates to three legacy I&C systems of the Finnish Olkiluoto nuclear power plant, about to be renewed using (mostly) software-based logic. I concretize the challenges in verifying complex nuclear I&C logics, prove the capabilities of OCRA, and discuss the practical limitations.