A User-Friendly Verification Approach for IEC 61131-3 PLC Programs

Xiong, Jiawen; Zhu, Gang; Huang, Yanhong; Shi, Jian

doi:10.3390/electronics9040572

Cited by 13 publications

(2 citation statements)

References 37 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…PLCInspector [20] mines either linear temporal logic (LTL) specification using Texada or data invariants using Daikon from runtime traces of PLC programs. PLCInspector does not combine Texada with Daikon to detect data-temporal properties.…”

Section: Discussionmentioning

confidence: 99%

Dynamically Detecting Invariants for Automatic Testing PLC Programs (S)

Lu¹

2021

Proceedings of the 33rd International Conference on Software Engineering and Knowledge Engineering

View full text Add to dashboard Cite

Since programmable logic controllers (PLCs) control safety-critical infrastructures, examining the PLC software satisfies the high-reliability specifications necessary to ensure the safeness of PLCs. However, prior works have limitations in finding defects in the PLC source code. Static verification techniques suffer from notable false positives without capturing runtime behavior. The symbolic execution and conformance testing technique captures the relations of inputs and outputs. It is not sufficient to consider only the data constraints as the PLC operates in real-time. In this paper, we propose a novel approach in the detection of the runtime behavior of PLC programs with incorporated time constraints. This testing approach automatically finds implementation errors in PLC programs by mining invariants from runtime traces. As the existing tools mine only data or time invariants which are inadequate to test PLC programs, our approach focuses on the interplay of data and time invariants. Dynamically detected datatime invariants are then checked with the safety specifications. We evaluate the usefulness of our approach in a real-life case. The experimental results show that the proposed approach can find errors in PLC programs effectively.

show abstract

Section: Discussionmentioning

confidence: 99%

Dynamically Detecting Invariants for Automatic Testing PLC Programs (S)

Lu¹

2021

Proceedings of the 33rd International Conference on Software Engineering and Knowledge Engineering

View full text Add to dashboard Cite

show abstract

“…В [17] предложен способ автоматического получения спецификаций по заданным шаблонам LTL формул путём прогона циклов исполнения IEC 61131-3 программ. В работе [18] осуществлён перевод кода ПЛК на входной язык верификатора SMV для проверки моделей согласно выявленным инвариантам.…”

Section: Introductionunclassified

Temporal Logic for Programmable Logic Controllers

Garanina

Anureev

Зюбин

et al. 2020

Model. anal. inf. sist.

View full text Add to dashboard Cite

We address the formal verification of the control software of critical systems, i.e., ensuring the absence of design errors in a system with respect to requirements. Control systems are usually based on industrial controllers, also known as Programmable Logic Controllers (PLCs). A specific feature of a PLC is a scan cycle: 1) the inputs are read, 2) the PLC states change, and 3) the outputs are written. Therefore, in order to formally verify PLC, e.g., by model checking, it is necessary to describe the transition system taking into account this specificity and reason both in terms of state transitions within a cycle and in terms of larger state transitions according to the scan-cyclic semantics. We propose a formal PLC model as a hyperprocess transition system and temporal cycle-LTL logic based on LTL logic for formulating PLC property. A feature of the cycle-LTL logic is the possibility of viewing the scan cycle in two ways: as the effect of the environment (in particular, the control object) on the control system and as the effect of the control system on the environment. For both cases we introduce modified LTL temporal operators. We also define special modified LTL temporal operators to specify inside properties of scan cycles. We describe the translation of formulas of cycle-LTL into formulas of LTL, and prove its correctness. This implies the possibility ofmodel checking requirements expressed in logic cycle-LTL, by using well-known model checking tools with LTL as specification logic, e.g., Spin. We give the illustrative examples of requirements expressed in the cycle-LTL logic.

show abstract