Gary J. Powers's research while affiliated with Carnegie Mellon University and other places

The area of formal methods offers improved fault detection for hybrid processes, such as chemical ones. Verification of a chemical process requires the construction of a finite state representation from the phenomena exhibited by the control system, physical process, operating procedures, and human behavior. The exhibited phenomena are modeled as a set of states, the transitions between these states, and their triggering events. In particular, the states and transitions are based upon landmarks and their relative position while the triggering events are based upon the actions in the system. This methology capitalizes on the importance of relational properties instead of absolute ones in verifying a chemical process. The proposed methodology was applied to two industrial examples: a leak test procedure and a thermal oxidation process.

Symbolic model checking has been used to formally verify safety and operability specifications on an industrial solids handling process. The fundamental principles behind symbolic model checking are presented along with techniques used to model process hardware, relay ladder logic control instructions, and human operating procedures for verification purposes. The computational resources required to check the example process are presented, and faults detected in this process through symbolic verification are documented.

A leak test procedure for a combustion system which is used in the chemical industry was verified. This procedure is important since it reduces the probability of explosions. Both government and internal company standards where employed in creating the initial leak test procedure. Several major faults were discovered by the verification of a logic model of the procedure and equipment using SMV. This paper describes the leak test procedure with its corresponding combustion system pipe network, the approach employed in modeling the process, failure modes included in the process model, computational challenges, and verification results. This study indicates that the formal method, SMV, is an appropriate tool for verification of industrial processes of modest complexity

The application of Symbolic Model Verification, SMV, to the fault analysis of chemical processing systems was investigated. The objective was to measure the ability of the modeling language, employed by SMV, to capture significant logical and dynamic behaviors present in the processing systems. These behaviors originated from continuous dynamic chemical processing equipment, failure prone human operators, and control systems that are composed of relay ladder logic executed by programmable logic controllers. Also, the study measured the time and effort required to build models of the processing systems, assemble appropriate specifications for these systems, verify the system models, interpret the results, and revise the system model or original process design. We have verified systems for the transportation of multi-component solids in a conveying process for the manufacture of aluminum, leak testing of a fuel gas piping network, and batch reaction to produce fertilizer. Verification of each of these systems revealed numerous faults that lead to improved designs.

We have developed a symbolic verification method for determining the safety and operability of chemical process sequential control systems, The number of test cases required to verify a system grows exponentially as the number of components of the system increases, This state explosion problem limits our previous automatic verification method (Moon et al., 1992, Moon, 1994) to testing small systems, To mitigate this problem, we have adopted the Symbolic Model Verifier (SMV) which was originally developed by McMillan to test VLSI circuits. The method uses Boolean formulas to represent sets and relations in order to avoid building an explicit state transition graph which occupies most of the computer memory consumed for the computation. Ordered Binary Decision Diagrams are employed to manipulate the formulas efficiently in the model checking process. As a result, the SMV can verify large alarm systems including 10(121) reachable states, The input language of SMV also makes the modeling of chemical processing systems as easy and less error prone processes. The method is demonstrated and the performance of the verifier is studied in a series of multiple alarm designs.

The application of Symbolic Model Verification, SMV, to the fault analysis of chemical processing systems was investigated The objective was to measure the ability of the modeling language, employed by SMV, to capture significant logical and dynamic behaviors present in the processing systems. These behaviors originated from continuous dynamic chemical processing equipment, failure prone human operators, and control systems that are composed of relay ladder logic executed by programmable logic controllers. Also, the study measured the time and effort required to build models of the processing systems, assemble appropriate specifications for these systems, verify the system models, interpret the results, and revise the system model or original process design. We have verified systems for the transportation of multi-component solids in a conveying process for the manufacture of aluminum, leak testing of a fuel. gas piping network, and batch reaction to produce fertilizer. Verification of each of these systems revealed numerous faults that lead to improved designs.

A unified risk reduction strategy that uses fault tree analysis, proposes modifications in chemical operations that include the process flowsheet, control system, and operating procedures. The modifications commonly involve the establishment of stationary states. These states allow for longer process time constants and support intermediate-state verification. Relative importance is used to identify quantitatively the dominant causes of risk, which are modified to produce safer and more reliable processes. The strategy is tested on the design of a pump system startup, and risk reduction of several orders of magnitude is achieved.

The safe and reliable operation of chemical plants depends on high-integrity operating procedures. Such procedures often involve process transition through stationary states. The stability of these states is an important part of the integrity evaluation. The methodology presented in this paper qualitatively identifies families of inherently stable chemical operations and establishes design rules for the synthesis of stable stationary states. These rules have been developed using the Routh-Hurwitz conditions for three qualitative levels of dynamic system models. These levels represent the gains of the dynamic system by the signs of the gains (+, 0, -), the signs and their equality (+, 0, -, =), and finally the gains represented by their order of magnitude values (+, 0, -, =, <, <<, >, >>). Example design rules have been developed during the synthesis of operating procedures for a series of vessels with composition control and temperature control of an exothermic chemical reaction. The most robust design rules apply to systems that can be proven stable by the sign level of gain representation. Less robust rules with a wider range of applicability to dynamic systems have been developed using the equality and order of magnitude representations.

Input Variable Expansion (IVE) is a domain-independent, algorithmic methodology for generating new designs. These designs are based on a known design which is cast as an optimization problem, described by its first principle equations. IVE performs design space expansion by replicating the topology of the initial design, assigning independent properties to each region, and distributing a selected input to the newly created regions. Optimization information is employed in the selection of the distributed input. The resulting design is optimized, using symbolic optimization techniques when possible. In more complex and industrially relevant problems where symbolic methods are more difficult, numerical methods are used to optimize the resulting designs. Trends over generations of designs are observed and the limiting designs are induced. These designs incorporate new features, and may exhibit either an improved objective or a feasible design space replacing an infeasible one. IVE is a complementary expansion technique to Dimensional Variable Expansion (DVE), developed by Cagan and Agogino (1991a). Together, IVE and DVE initiate a library of design space expansion techniques which, in some cases, eliminate the need for prepostulated superstructures for finding the optimal solution. IVE is demonstrated in the designs of a catalyst bed, a set of columns under axial load, and a chemical reactor network.

Clarke et al. (1986) have developed a model-based verification method and have applied it to validation of VLSI circuits. We have used the method to test automatically the safety and operability of discrete chemical process control systems. The technique involves: (1) a “system model” describing the process and its software; (2) “assertions” in temporal logic expressing user-supplied questions about the system behavior with respect to safety and operability; and (3) a “model checker” that determines if the system model satisfies each of the assertions and provides a counterexample to locate the error if one exists. Temporal logic is used for reasoning about occurrence of events over time. To reveal discrete event errors, we have applied the verification method to a simple combustion system and an alarm acknowledge system.