An overview of model checking practices on verification of PLC software

Abstract

Programmable logic controllers (PLCs) are heavily used in industrial control systems, because of their high capacity of simultaneous input/output processing capabilities. Characteristically, PLC systems are used in mission critical systems, and PLC software needs to conform real-time constraints in order to work properly. Since PLC programming requires mastering low-level instructions or assembly like languages, an important step in PLC software production is modelling using a formal approach like Petri nets or automata. Afterward, PLC software is produced semiautomatically from the model and refined iteratively. Model checking, on the other hand, is a well-known software verification approach, where typically a set of timed properties are verified by exploring the transition system produced from the software model at hand. Naturally, model checking is applied in a variety of ways to verify the correctness of PLC-based software. In this paper, we provide a broad view about the difficulties that are encountered during the model checking process applied at the verification phase of PLC software production. We classify the approaches from two different perCommunicated by Prof. Einar Broch Johnsen and Luigia Petre. spectives: first, the model checking approach/tool used in the verification process, and second, the software model/source code and its transformation to model checker's specification language. In a nutshell, we have mainly examined SPIN, SMV, and UPPAAL-based model checking activities and model construction using Instruction Lists (and alike), Function Block Diagrams, and Petri nets/automata-based model construction activities. As a result of our studies, we provide a comparison among the studies in the literature regarding various aspects like their application areas, performance considerations, and model checking processes. Our survey can be used to provide guidance for the scholars and practitioners planning to integrate model checking to PLC-based software verification activities.

A User-Friendly Verification Approach for IEC 61131-3 PLC Programs

“…However, since deductive verification requires strong professional knowledge and heavy manual work, it is still not widely used in practice. Therefore, most research works focus on model checking of PLC [3][4][5][6][7][8][9][10][11][12]. Almost all of them follow the following pattern: firstly, transforming the PLC program written in one specific PLC language into some formal model; secondly, expressing the system property in a specific formal language which is not ambiguous (The formal expression of the property is usually called formal specification.…”

SE-LTL Model-checking on Timed GRAFCETS via ε-TPN

“…However, GRAFCET and SFC semantics are only semi-formal, and so contain some ambiguities to clarify via a translation of the chart into another formalism, such as SMV textual language [5], timed automata [6] or time Petri nets (TPN) [7]: timed automata are used in [8] for SFC, and in [6] for GRAFCET. TPNs are structurally and historically closer to the GRAFCET than the other formalisms, and are adopted here.…”

Construction of CFC-Programs by LTL-Specification

“…Информация о других подходах к построению и анализу FBD/CFC-программ ПЛК может быть найдена, например, в работах [15][16][17].…”