Verification of PLC Programs Given as Sequential Function Charts

Bauer, Nanette; Engell, Sebastian; Huuck, Ralf; Lohmann, Sven; Lukoschus, Ben; Remelhe, Manuel; Stursberg, Olaf

doi:10.1007/978-3-540-27863-4_28

Cited by 73 publications

(34 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…+EM indicates that an environment model has been used. [3] translate SFCs into timed automata to be used with UPPAAL [5]. This model checker is also used to verify properties of continuous function charts (CFC) in [37].…”

Section: Related Workmentioning

confidence: 99%

Regression Verification for Programmable Logic Controller Software

Beckert

Ulbrich

Vogel‐Heuser

et al. 2015

Formal Methods and Software Engineering

View full text Add to dashboard Cite

Abstract. Automated production systems are usually driven by Programmable Logic Controllers (PLCs). These systems are long-living -yet have to adapt to changing requirements over time. This paper presents a novel method for regression verification of PLC code, which allows one to prove that a new revision of the plant's software does not break existing intended behavior. Our main contribution is the design, implementation, and evaluation of a regression verification method for PLC code. We also clarify and define the notion of program equivalence for reactive PLC code. Core elements of our method are a translation of PLC code into the SMV input language for model checkers, the adaptation of the coupling invariants concept to reactive systems, and the implementation of a toolchain using a model checker supporting invariant generation. We have successfully evaluated our approach using the Pick-and-Place Unit benchmark case study.

show abstract

Section: Related Workmentioning

confidence: 99%

Regression Verification for Programmable Logic Controller Software

Beckert

Ulbrich

Vogel‐Heuser

et al. 2015

Formal Methods and Software Engineering

View full text Add to dashboard Cite

show abstract

“…Some approaches choose the environment of model checking: e.g., to formalize a subset of the language of instruction lists (ILs) using timed automata, and to verify real-time properties in Uppaal [15]; to automatically transform SFC programs into the synchronous data flow language of Lustre, amenable to mechanized support for checking properties [12]; to transform FBD specifications to Uppaal formal models to verify safety applications in the industrial automation domain [23]; to provide the formal operational semantics of ILs which is encoded into the symbolic model checker Cadence SMV, and to verify rich behavioural properties written in linear temporal logic (LTL) [5]; and to provide the formal verification of a safety procedure in a nuclear power plant (NPP) in which a verified Coloured Petri Net (CPN) model is derived by reinterpretation from the FBD description [17]. There is also an integration of SMV and Uppaal to handle, respectively, untimed and timed SFC programs [2].…”

Section: Related Workmentioning

confidence: 99%

Formalizing and Verifying Function Blocks Using Tabular Expressions and PVS

Pang

Wang

Lawford

et al. 2014

Communications in Computer and Information Science

View full text Add to dashboard Cite

Abstract. Many industrial control systems use programmable logic controllers (PLCs) since they provide a highly reliable, off-the-shelf hardware platform. On the programming side, function blocks (FBs) are reusable components provided by the PLC supplier that can be combined to implement the required system behaviour. A higher quality system may be realized if the FBs are pre-certified to be compliant with an international standard such as IEC 61131-3. We present an approach to formalizing FB requirements using tabular expressions, and to verifying the correctness of the FBs implementations in the PVS proof environment. We applied our approach to the example FBs of IEC 61131-3 and identified issues in the standard: ambiguous behavioural descriptions, missing assumptions, and erroneous implementations.

show abstract

“…The scheme for translating a controller given as SFC into TA according to (Bauer et al, 2004b) can be summarized as follows: The SFC is first partitioned into syntactical units that represent either sequential chains (alternating sequences of steps and transitions) or parallel chains (two or more sequential chains that are enclosed by a parallel branching). The units are translated into separate TA which communicate via synchronization.…”

Section: Verification Based On Transformation Of Sfc Into Tamentioning

confidence: 99%

“…Since Sequential Functions Charts (SFC) become increasingly popular to specify industrial logic controllers, a number of recent investigations aim at making model checking applicable to SFC. While the approaches in (Bornot et al, 2000;Lampérière and Lesage, 2000) transform the SFC into (purely discrete) automata to apply verification subsequently, the methods in (L'Her et al, 1998;Remelhe et al, 2004;Bauer et al, 2004b) convert SFC into verifiable timed automata (TA), and thus make the inclusion of quantitative time into the analysis possible. The drawback of the latter method is, however, that the cyclic execution mode of PLC is explicitly transferred to the TA model, resulting in a rather complex model and thus a high verification effort (see Sec.…”

Section: Introductionmentioning

confidence: 99%

Improving Dependability of Logic Controllers by Algorithmic Verification

Stursberg

Lohmann

Engell

2005

IFAC Proceedings Volumes

View full text Add to dashboard Cite

Functional safety, as addressed in the standard IEC 61508, is a key requirement for a high dependability of controlled systems. In order to guarantee that the function of programmable logic controllers (PLC) complies with given safety specifications, the use of verification has proven to be useful. This contribution builds upon a recently proposed approach to verify PLC programs with time specifications. It starts from a controller design given as sequential function chart (SFC), transforms the SFC into timed automata (TA), and applies model checking to verify (or falsify) functional safety. Since the explicit representation of the cyclic operation mode of PLC can lead to complex TA models, this paper investigates to which extent the cyclic mode can be omitted, to obtain simplified models for which the verification effort is considerably smaller.

show abstract

Verification of PLC Programs Given as Sequential Function Charts

Cited by 73 publications

References 16 publications

Regression Verification for Programmable Logic Controller Software

Regression Verification for Programmable Logic Controller Software

Formalizing and Verifying Function Blocks Using Tabular Expressions and PVS

Improving Dependability of Logic Controllers by Algorithmic Verification

Contact Info

Product

Resources

About