Logic Verification System for Power Plant Sequence Diagrams

Transcription

1 Journal of Nuclear Science and Technology ISSN: (Print) (Online) Journal homepage: Logic Verification System for Power Plant Sequence Diagrams Mitsuko FUKUDA, Naoyuki YAMADA, Toshiaki TESHIMA, Ken'ichi KAN & Mitsugu UTSUNOMIYA To cite this article: Mitsuko FUKUDA, Naoyuki YAMADA, Toshiaki TESHIMA, Ken'ichi KAN & Mitsugu UTSUNOMIYA (1994) Logic Verification System for Power Plant Sequence Diagrams, Journal of Nuclear Science and Technology, 31:2, , DOI: / To link to this article: Published online: 15 Mar Submit your article to this journal Article views: 323 View related articles Citing articles: 1 View citing articles Full Terms & Conditions of access and use can be found at

2 Journal of NUCLEAR SCIENCE and TECIINOLOGY, 31121, pp (February 1994). Logic Verification System for Power Plant Sequence Diagrams Mitsuko FUKUDA, Naoyuki YAMADA, Energy Research Laboratory, Hitachi, Ltd. * Toshiaki TESHIMA, Ken'ichi KAN and Mitsugu UTSUNOMIYA Oinika Works, Hitachi, Ltd.* Received November A logic verification system for sequence diagrams of power plants has been developed. The system's main function is to verify correctness of the logic realized by sequence diagrams for power plant control systems. The verification is based on a symbolic comparison of the logic of the sequence diagrams with tbe logic of the corresponding IBDs (Interlock Block Diagrams) in combination with reference to design knowledge. The developed system points out the sub-circuit which is responsible for any existing mismatches between the IBD logic and the logic realized by the sequence diagrams. Applications to the verification of actual sequence diagrams of power plants confirmed that the developed system is practical and effective. KEY WORDS: verification, verification system, sequence diagram, control systems, nuclear power plants, logic, relay circuit I. INTRODUCTION Design verification is one of the key techniques for improving reliability of engineering design; for large scale plants, assuring design correctness is absolutely necessary. Sequence diagrams of power plant control systems are produced in the detailed design process and amount to more than 15,000 sheets. In order to confirm their correctness, they are inspected and verified regarding many aspects including component connectivity, control logic, control characteristics etc. Currently, this verification is performed manually in almost all cases and therefore, time-consuming and prone to human error. Then, the final goal of the research is to develop a total design verification system for power plant control systems which is efficient and also free from human error. As a main part of the total design veriecation system, a logic verification system was developed. In design of power plant control systems, CAD (Computer Aided Design) systems are now widely used to draw sequence diagrams. These CAD systems, specialized for sequence diagrams, have advanced functions of checking design integrity and provide automatic detection of disconnections, short circuits and so on. However, they have no function for verifying design correctness against the design specifications. The developed system serves to the logic verification of sequence diagrams of power plant control systems. In the field of VLSI (Very Large Scale Integrated circuit), design, various automated verification methods have been developed. Generally, there are two approaches for verification of design correctness. One is to verify the function of the circuit. The function is first extracted from circuit diagrams and then compared with the functional specification") ('I. The other is to verify the equivalence of connectivities of two diagrams such as VLSI * Omika-cho. Hitachi-shi

3 Vol. 31, No. 2 (Feb. 1994) 103 mask-patterns and their transistor-level circuit c4). Because a sequence diagram is a kind of logical circuit diagram and its specifications are given by IBDs (Interlock Block Diagrams), the former approach is also applicable to the verification of sequence diagram. However, sequence diagrams are complicated circuit diagrams and they differ from the IBDs in their description. If there is no information about where and what the design flaw is, it is very difficult to correct large sequence diagrams. Therefore, two methods, one is to verify design correctness and the other to identify design flaws, are necessary for practical verification. After a brief discussion of the verification problem of sequence diagrams, a logic verification method, which includes a new method to identify design flaws, is described in detail along with the system configuration. Some examples of logic verification are also demonstrated. II. SEQUENCE DIAGRAMS DESIGN Practical design flow of sequence diagrams in power plant control systems may change according to the characteristics of the objective plant, the design organization, and so on. However, the skeletal design process which starts from specification documents and the master plan, and advances to sequence diagrams via some intermediate documents is commonly applied. Sequence diagrams, which are the objective diagrams to be verified in this paper, are designed on the basis of an intermediate document called IBD. An IBD and its corresponding sequence diagram are shown in Figs. 1 and 2, respectively. Both figures describe the same logic to control plant equipment, but in different styles. In IBDs, the logic is represented by a logical diagram that relates an control output to inputs which are signals of switches and detectors. On the other hand, sequence diagrams describe a circuit to generate electrical signals according to the given control logic. Real control circuits are constructed by referring to these sequence diagrams. <Input AND 0 Output D O R 09 NOT Fig. 1 Example of interlock block diagram Lower Bus Fig. 2 0 Lamp o Relay o I Contact Manual z t Switch 0 Relay Coil I A-contact g B-contact Example of sequence diagram Usually, sequence diagrams are designed by expert designers utilizing the following information : (1) The control logic and 1/0 signal names given in the IBDs. (2) The design knowledge which includes hardware knowledge of the plant components, control devices, and fundamental knowledge about electrical and other engineering areas. An IBD represents a logic by using 1/0 signal symbols and logical operator symbols. Figure 1 represents the logic, 1 (ClAC2)V C3=+X. In IBDs, signals are transmitted only in the direction specified by the arrows through logical operator symbols. Figure 2 realizes the logic given by Fig. 1. The inputs C1, C2 and C3 in Fig. 1 correspond to the contacts C1, C2 and C3 respectively, and the output X in Fig. 1 is realized by the coil of relay X. In Fig. 2, C1 and C2 are relay contacts and C3 is a manual switch. Relay contacts behave according to the excitation state of their corresponding relay coils. There are several contact types. An A-contact is a popular type; it closes if its corresponding coil is excited. Contacts C1 and C2 are A-contacts. For example, contact C1 closes if coil C1 is excited. Contact C3 is also an A-contact

4 104 J. Nucl. Sci. Technol., which closes when the switch button is pushed. Contact XX is a B-contact; its behavior is opposite to that of the A-contact. A B- contact closes if its corresponding coil is not excited. For example, contact XX is closed if coil XX is not excited. A relay coil is excited when a current path is realized between the upper and the lower buses. For example, coil XX is excited when both C1 and C2 are closed. In sequence diagrams, the control logic is realized by the condition to trigger excitation of one relay coil. For example, the logic required for the output X in Fig. 1 is realized by the condition to trigger excitation of coil X in Fig. 2. Operators AND and OR in IBDs are realized by connections between the contacts. For example, connectivity between contacts C1 and C2 realizes an AND operator, and connectivity between contact XX and C3 realizes an OR operator. The NOT operator is realized by using a B-contact. Also detectors and switches have some contacts. A detector is a device which has a sensor unit and one or more associated contacts. A switch has one or more contacts which move asynchronously. In sequence diagrams, the logic is often realized by using many auxiliary relays. In Fig. 2, XX is such an auxiliary relay. Contacts and coils of an auxiliary relay may appear in different sheets. In addition to auxiliary relays, lamps, diodes, resisters and test-terminals for testers are also added for maintenance and protection of the circuit. But they are not used to realize the logic. Due to these differences in description, extraction and comparison of the two logics specified by IBDs and sequence diagrams involve rather complicated processing. In order to verify the logic, designers have to find every possible current path in the sequence diagrams, and have to interpret each component s behavior and each connectivity. It is difficult and time-consuming to verify large sequence diagrams. Thus, the necessity and importance of automating the verification of the sequence diagrams against the IBDs become readily apparent. III. LOGIC VERIFICATION SYSTEM 1. System Configuration The configuration of the verification system is shown in Fig. 3. The logic verification system consists of two main programs, a verification program and a conversion program, and databases containing IBDs, sequence diagrams and design knowledge. Sequence diagrams are inputted through a sequence CAD program. The sequence CAD program used is a conventional one, which provides expert designers with functions for inputting sequence diagrams interactively. The sequence diagram data consists of component properties including names, types, connectivity with other components and other items specific to each component. The conversion program translates the CAD data format, and adds compositional information to switches and detectors of the sequence diagram by referring to the specification data. The specification data contains compositional information of each device Sequence + Diagram GAD Dat* CAD Data Conversion Program + Logic Extraction Unit

5 Vol. 31, No. 2 (Feb. 1994) 105 type. The verification program extracts and verifies the logic realized by sequence diagrams. As for the design knowledge, it is impractical to store all the knowledge that expert designers utilize during the design process. The developed system contains only the knowledge to interpret the sequence diagrams as control logic. The verification is performed for each output signal which the user specifies by the name in the IBD. 2. Logic Verification Method As mentioned earlier, there are two approaches to verify design correctness. One is to extract functions from each diagram and compare them. The other is to select or generate comparable connectivities from each diagram and compare them(4). The former approach is used for logic design verification of relay circuits''). The correctness of sequence diagrams can be proved by the former approach, but the design flaw cannot be identified. Because details of the sequence diagram design are left to the discretion of the designers, there are many different sequence diagrams that realize the same logic. Therefore, the latter approach is seldom applied to sequence diagrams. The present verification method is based on the former approach. The developed verification method extracts the control logic realized by the sequence diagrams and compares it with the logic given by the IBD. The two logical expressions are the same if the sequence diagrams are designed correctly. Though this approach can provide a way to judge the correctness of the sequence diagrams, it cannot identify the design flaws. Therefore, a new method to identify the design flaw is developed and introduced to the logic verification system. The overall flow of the logic verification is shown in Fig. 4. One of the key features of the developed system is the design flaw identification. The developed system finds the flaw-responsible sub-circuit, which contains the connectivities or components that cause the logical mismatch. Verification results contain information on how the flaw-responsible sub-circuit Fig. 4 V 4 Input IBD and sequence diagram CAD data Convert CAD data 4 Extract the logic realized bv the circuit 4 * Transform the extracted logic into the DNF exdression Compare the extracted logic with the IBD's logic atched? Identify the sub-circuit which is responsible for the mismatch of the logic types Display verification results IBD : Interlock Bhk D ram DNF : Disjunclive Nor~&%orm Flow chart of logic verification differs from the correct one, and suggests how to correct it. After inputting both IBDs and sequence diagrams data, verification starts by user input. In the following, each step is described in detail : ( 1 ) Data Conversion The conversion program translates the format of the CAD data files to the format of the verification system's data file, and adds compositional information to switches and detectors of the sequence diagram by referring to the specification database. A detector has a sensor unit and one or more contacts connected to the sensor unit, and a switch has some constructed contacts. But they are often simplified in CAD data. For example, a detector is often drawn as a simple box with some terminals, a switch is represented by some independent contact symbols. The conversion program adds compositional infor

6 106 J. Nucl. Sci. Technol., mation to the simplified components using the specification data and facilitates the subsequent logic extraction. The specification data contain information about the internal composition of each device type. For example, they include information about correspondence between the switch position and the contacts behavior. The conversion program refers to the type of switch and generates information about how to interpret each contact. If a switch has three positions, information telling at which position the contact closes is added. As for a detector, the program selects the corresponding internal composition form and adds contact type information to each pair of the detector s terminals. ( 2) Logic Extraction A logic extraction program extracts logic from sequence diagrams by searching for connectivities and interpreting connected components. The program starts from the specified relay coil and traces the connectivities toward the upper and lower buses respectively. According to each component type and connectivity, sequence diagrams are interpreted to a logical expression. The interpretation rules assigning a logical value to a device are prepared for each device type. A loigcal value is a logical constant : true/false, or a logical variable. A logical value is assigned to each component according to its type, e.g. true for a lamp, false for a large impedance resistor, a logical variable for a relay contact, and so on. Generally, there are two ways to design sequence diagrams. One is a commonly used in which the logic is realized as the conditions to excite the specified relay coil. That is to say, the coil is not excited usually, and excited when the condition is true. The other is its opposite. The coil is excited ordinarily, and not excited when the condition is true. The latter is mainly used for the most important circuits, such as the reactor protection circuits. In this paper, only procedures for the former way are described, though the verification system handles diagrams of the latter way similarly. Each relay coil is interpreted to a logical -16- variable, which takes the logical value true when the coil is excited, but is false otherwise. Relay contacts are interpreted according to the variable assigned to their coil. An A-contact, which is normally open, is interpreted as the logical variable assigned to its coil. A B-contact, which is normally closed, is interpreted as the inverse of the variable assigned to its coil. A time delay contact is interpreted as a variable with a timer operator. Each contact of the switches and detectors is interpreted similarly. Connectivities between components are interpreted to logical operators,,4 (AND) and V(0R). As shown in Fig. 5(a), if a relay coil and other components are connected in series, the program interprets them as an AND expression. If the components, except for the relay coil, are connected in parallel, they are interpreted as an OR expression as shown in Fig. 5(b). The logic extraction program searches every possible current path through the relay coil which corresponds to the output signal name specified by the user. If the path contains any auxiliary relay contact, the extraction program searches the current path from the auxiliary relay coil too. For example, in Fig. 2, relay XX is an auxiliary relay, whose contact is contained in the current path of relay X. The extraction program searches the current path through XX after searching the current paths through X. (a) Series connection (b) Series connection representing an representing an AND expression OR expression (ClACZ)=IX (ClVCZ)+X Fig. 5 Examples of series and parallel connections In many cases, sequence diagrams contain a large number of components including those components for only maintenance and protection of circuits. Then, to reduce the search

7 Vol. 31, No. 2 (Feb. 1994) 107 space, while searching the current path, the program checks the component behavior and eliminates any unnecessary search path which cannot trigger excitation. For example, when the connected component is a large impedance element or the B-contact of the specified relay, it intercepts the current through this path. Then, the program eliminates the path containing this component from the search space so that the unnecessary path is omitted in the logic extraction and the following processes. ( 3 ) Logic Comparison The extracted logic and the logic given by the IBD can be transformed into exactly the same expression if the sequence diagrams are designed correctly. To facilitate comparison, the logic is transformed into a DNF (Disjunctive Normal Form) expression. A DNF expression is a logical OR of AND clauses such as (xay)v(w,r\z) where x, y, w and z are logical variables. An AND clause is a logical AND of terms. One term can also be one AND clause. A term is one variable, a negation of a variable, a variable with a timer operator or a negation of that. For example, xay, xa(1 y), 1 x and y are AND clauses. The verification program compares the two logical expressions. If they are the same, the sequence diagrams are found to be correct. And the program gives a message telling of their correctness. Otherwise, the program compares each AND clauses of the two expressions to find the sub-circuit which is responsible for the logical mismatch. In sequence diagrams, a series circuit usually realizes an AND clause as shown in Fig. 5. One current path between buses corresponds to a series circuit. The verification program regards one current path as one subcircuit. Then each current path corresponds to an AND clause. So every AND clause which contains the mismatched part of the logical expression becomes a candidate for the sub-circuit responsible for the flaw. ( 4 ) Design Flaw Identification a. Flaw types The verification program defines five flaw types for the flaw identification process. The five types are classified into two categories. In the first category the sequence diagrams realize redundant conditions besides the whole IBD logic. In this case, an undesirable output can be produced by the redundant condition. This flaw type is called turn around. An example is the sequence diagram which realizes the logic (xay)v(xaz) when the IBD requires xay. Sometimes, using the same contacts and/or lines produces an unexpected current path, i.e. turn around. Figure 6 shows a circuit containing a turn around caused by using contacts a and b in common. The sequence diagrams can be corrected by interception of the redundant current path. Fig. 6 Turn around path ii glx.p QQ IBD : (shahe)v(sabhf)jw2 Example of turn around flaw The second category includes the other four flaw types. In this category sequence diagrams realize unnecessary conditions and the IBD logic is not completed. The flaw types are as follows: (1) Unsuitable contact type is a mismatch of terms of AND clauses. An example is realizing aab when the IBD requires aa(timer b 1s). It is caused by misuse of contact types. A delayed contact should be used. (2) Unsuitable device name is a mismatch of variable names in the clauses. It is caused by misuse or mis-writing of similar devices. (3) Excess is the case in which a clause of the extracted logic includes extra terms besides the IBD clause. To realize aabac when the IBD requires aab is an example. This is caused by mis-connec- -17-

8 108 J. Nucl. Sci. Technol.. tion or using the same contacts and lines. (4) Lack is the case in which a clause of the extracted logic lacks one or more terms of the IBD clause. The identification program generates design flaw hypotheses according to the five flaw types. b. Pre-processing for flaw identification To facilitate flaw identification, the verification program restructures the path data from the search history data that are stored during logic extraction. The search history data are given to each relay coil and they consist of relay contacts, switches, and the components interpreted as true. The program removes the components interpreted as true from searched paths because they do not change the logic realized by the paths. Then the restructured path data contain the components that may cause logical mismatches. For instance, a small impedance resistor is in a search history, but it does not appear in a restructured path data. The program links each relay contacts of the reduced paths to its coil so that the restructured path data represent the relations of contacts and their corresponding parts of the logic. Figure 7(a) shows an example of a sequence diagram and (b) illustrates its restructured path data. The contacts of each path are represented in Fig. 7(b) by the identifiers written in parentheses in Fig. 7(a). In the restructured path data, each coil is linked to its trigger paths. For example, coil X is linked to Path-1 and -2 which respectively correspond to the current path through C1 and the relay XX s contact and the current path through contacts C1 and C2. Every trigger path, Path-1, -2 and -3, is also linked to the clauses realized by the corresponding current paths. Path-1 contains an auxiliary relay contact XX-001, so the clause linked to Path-1 includes the terms of the clause linked to Path-3. Each auxiliary relay contact, XX-001 for example, is linked to its coil. Path-1 includes XX-001. Next, the program examines whether the paths realize a certain part of the IBD logic. When a path realizes an IBD clause, every The condition realized by Path- 7 \ Fig. 7 Small Impedance Resistor IBD = (ahbhci)v(cl hc2) (a) Sequence diagram YaAbAcl & Ac2 its coil XX - = link (b) Restructured path data Example of sequence diagram and its restructured path data contact of the path is marked correct. In Fig. 7(b), Path-2 realizes the second clause of the IBD logic. Then C1-002 and C2-003 are marked correct. Here, the trigger paths may use the same contact, so that the marked contact can be contained in incorrect paths. The contacts of the auxiliary coil s trigger paths are marked similarly. To identify the incorrect part of the diagrams, the verification program assumes that the marked contacts cannot be replaced or removed. c. Identification process When the extracted logic is not the same as the IBD logic, the verification program identifies the design flaw. The flow of the flaw identification is shown in Fig. 8. First, the program checks whether the extracted logic subsumes the IBD logic. A hypothesis turn around is set if every IBD clause is realized and extra clauses are found in the extracted logic. In this case, the redundant paths that realize the unnecessary clause are

9 Vol. 31, No. 2 (Feb. 1994) 109 Restructure the path data II and mark correct contacts.c Explain the flaw according to the hypothesis Couple each mismatched clause with the IBDs clause - Generates the flaw hypothesis according to the mismatch pattern of the clauses I I Modifythetriggerpath Reject the hypothesis that realize the identified and judged to be responsible for turn around. Otherwise, the program checks other characteristics. The program examines every path linked to the flaw candidate clauses nominated in the logic comparison. Each linked clause is compared with the unrealized clause of the IBD logic and is coupled with the most similar IBD clause that has highest rate of the matched terms. Based on the mismatch pattern of the clauses, the program generates flaw hypothesis according to the following rules : (1) When both clauses have the same variable set, but different operators, unsuitable contact type is hypothesized. The program finds the contact to be replaced among the unmarked contacts. (2) When both clauses have the same operators, but some variable names are different, unsuitable device name is hypothesized. The program infers which contact should be replaced or which device name should be corrected. (3) When the term set of the realized clause implies that of the IBD clause, excess is hypothesized. The program Fig. 8 Flow chart of identification process -19- finds the contact corresponding to the excessive term. (4) Lack is the opposite case of excess. One or more contacts should be added to realize the missing terms of the IBD clause. To confirm the hypotheses, the trigger path including the unmarked contacts is modified and checked. For unsuitable contact type or unsuitable device name, a proper contact type or a device name is inferred. Then the unmarked contacts are temporarily replaced by the inference results. For excess, the unnecessary contacts are removed. Here, only the unmarked contacts can be replaced or removed. If the path does not contain any unmarked contact, the program examines the path from the auxiliary relay coil whose contact is contained in the main path. If the auxiliary path contains some unmarked contacts, the program tries to modify them in the same way. The verification program extract the logic from the modified path. If a clause of the newly extracted logic is equal to the corresponding IBD clause, the hypothesis is adopted as the explanation of the flaw. The program

10 110 J. Nucl. Sci. Technol., outputs where and what the design flaw is. Otherwise, the hypothesis is rejected and the verification program generates another hypothesis. Using hypothetical reasoning, the program identifies a design flaw by any mismatch of logical expressions. As for complex flaws, the combined hypotheses can be generated from combination of characteristics of each flaw type. However, the program only makes flaw identifications within the predetermined categories and unexpected flaw types may not be identified correctly. But even in that case, the verification program properly detects that the diagram contains some flaws. IV. EXAMPLES The verification program is implemented by Common Lisp and is running on an engineering workstation. The CAD program is running on a main frame computer, since it handles large databases. These machines are connected by a network for data transfer. The logic verification system is applied to the sequence diagram shown in Fig. 6. The corresponding IBD requires that w2 is true when s, a and Q, or s, b and f are true. The circuit contains two turn around paths. The path data for flaw identification are shown in Fig. 9. The IBD logic is (saaae)v(sabaf) and the extracted logic is (saaae)v(sabaf) Fig. 9 (shahe) V(shahchdhf) V (shbhchdhe) V (shbhf) Path-2 ath-3 \.ath-4# J Path data for turn around flaw identification V(s A a A c Ad Af) V (s A b A c A d A el. Every clause of the IBD logic is contained in the extracted logic. So, the program tries to find the redundant path. In this case, both the necessary clause and the unnecessary clause are realized by Path-0. Hence, Path-0 is excluded from candidates of redundant paths. Next, the program tries to find unnecessary paths from the auxiliary paths ; Path-1.v-4. Every contact of Path-1 and -4 has been marked correct, so Path-1 and -4 :annot be the flaw-responsible sub-circuit. Then, Path-2 and -3 are found to be redundant paths responsible for turn around. Figure 10 shows the verification result of the circuit shown in Fig. 6. The last line in *Turn around by following paths # Path : upper-bus => ( 1 A 2 ) ( 1 C 2 ) ( 2 D 1 ) ( 1 F 2 ) [Yl (= lower-bus Path : upper-bus =) ( 1 B 2 ) < 1 D 2 ) ( 2 C 1 ) ( 1 E 2 ) [YI <= lower-bus ***** Intercept above paths. / I t Relay contact or switch ; ( terminal-id devicename terminal-id ) Relay coil : [ devicename I I $I It=rI@l@ l*lm Fig. 10 Verification result

11 Vol. 31, No. 2 (Feb. 1994) 111 Fig. 10 is an advisory message telling that the sequence diagram can be corrected by interception of the redundant paths. Figure 11 shows another example of a sequence diagram. It is a part of a circuit of an actual power plant with deliberately imposed design flaws. (The sequence diagrams without the imposed design flaws are verified correctly.) Coil 86G1 in the left corner is to be triggered. The leftmost path from coil High impe lamp 86G1 contains three components, a lamp, a test-terminal and a contact of 86G1. In this case, the lamp is eliminated from the search space during the logic extraction since it is specified to have a large impedance. Testterminals are always closed during normal operation. So the test-terminal is always interpreted as true. Also the B-contact of 86G1 is interpreted as true because it cannot be open before the coil is excited. Manual switch Time delayed wntacl Hand-reset relay wntacl Resistor Contacts of detectors Lamp Test terminal The coil specified to be triggered Fig. 11 Part of sequence diagram Deliberately imposed flaw An example display of verification results is shown in Fig. 12. Line 6 from the top show the messages for unsuitable device name. These include the flaw type, the mismatched clause of the sequence diagram, the corresponding clause of the IBD and the responsible sub-circuit of the sequence diagram. The sixth line is an advisory message telling that the contact of relay 40x1 specified by terminal-id 1 and 2 should be changed. * Unsuitable device name SEQUENCE : (AND 40X 52G (NOT 60G)) I B D : (AND 40G 52G (NOT 60G)) Path : upper-bus =) ( 11 52GX2 12 ) ( 10 6OGFiX 2 ) ( 1 40x1 2 ) ( C G1 C4 ) ( 5 86G1 6 ) I86Gll<<= lower-bus ***** Change contact (1-2) of 40x1. *Unsuitable contact type c fifypel 1-1 SEQUENCE 64G1 I B D : (TIMER 64G1 1s) Path : upper-bus =) ( 1 64G1 2 ) ( 1 64G1X 2 ) ( 1c lt01 11 ) ( 5 86G1 6 ) [86G11 <= lower-bus ***** Unsuitable contact (1-2) of 64-4GlX. Change type : Acontact -) timing relay Acontact *Following IBD s clauses are not realized. 87MT (R) \ Fig. 12 Verification result

12 112 J. Nucl. Sci. Technol., The 7th-13th lines are for unsuitable contact type. These show the sub-circuit responsible for the flaw, and an advisory message telling that the unsuitable contact name, and the contact type to be replaced. The last two lines show the missing clause by disconnection. The program detects this flaw, though it does not identify where it is disconnected. The user can find this out by using the disconnection checking function provided by the CAD program. V. DISCUSSION Though logic realized in sequence diagrams is basically a kind of sequential logic, the developed system verifies it as a combinational logic, because sequential logic can be regarded as a series of combinational logics. Cenerally, a relay circuit realizes the logic that depends on the existing inputs and the preceding output. Then the logic realized in sequence diagrams can be converted to a short series of combinational logics. So that the whole series of combinational logics can be verified. Most of the logic realized in sequence diagrams can be verified as the condition to trigger excitation of the specified coil. As for the sequence diagrams designed in the opposite way, the developed system provides another logical value assigning rule set for logic extraction. The extracted logic is transformed into another standard form called a CNF (Conjunctive Normal Form) expression instead of a DNF expression. A CNF expression is a logical AND of OR clauses. Each OR clause corresponds to a current path of sequence diagrams in the other way. The developed system has been applied to the verification of sequence diagrams of actual power plant electric systems etc. The sequence diagrams of the second verification example contained about 140 components and 250 connectivities. The verification was performed with deliberately imposed design flaws. The developed system found all the flaws correctly. The elapsed time for verification (data conversion to flaw identification) was about 3min per logical expression realized in the sequence diagrams. It is shorter than 1/3 of the manual verification time needed by a skilled designer. This is acceptable from the viewpoint of practical use. Though the logic verification system is developed for the verification of the sequence diagrams describing relay circuits, it is expected to be applicable to the verification of the sequence diagrams describing plant control software as well. Because the diagram for software is rather simple than that for relay circuits. VI. CONCLUSION A logic verification system for power plant control system design has been developed. It pertains to the verification of the logic of sequence diagrams against their corresponding IBDs. The verification is performed by extraction and comparison of two logical expressions. Logic is extracted from sequence diagrams based on the connectivities and behaviors of the components. This extracted logic and the logic given by the corresponding IBDs are transformed to DNF expressions and compared. If any mismatch is detected, the responsible path is pointed out, based on the mismatched pattern of the two clauses. Also the developed system identifies the design flaws and generates some advisory messages to help in their correction. The developed system has been applied to the verification of an actual power plant electric system and all deliberately imposed design flaws were found correctly. These application studies confirmed that the developed system is useful and effective. -REFERENCB- (1) BARROW, H.G.: Artif. Intelligence, 24, 437 (1984). (2) WOJCIIC, A.S., et al.: Proc. of 21st Design Automation Conf., p. 641 (1984). (3) WONG, Y. : Proc. of 22nd Design Automation Conf., p. 695 (1985). (4) SAKATA, T., et al. : ibid., p (5) YAMADA, N., et ~ l :. J. Inform. Process., 14 [23, 126 (1991)