Bringing Automated Model Checking to PLC Program Development — A CERN Case Study —

Abstract

Verification of critical software is a high priority but a challenging task for industrial control systems. Model checking appears to be an appropriate approach for this purpose. However, this technique is not widely used in industry yet, due to some obstacles. The main obstacles encountered when trying to apply formal verification techniques at industrial installations are the difficulty of creating models out of PLC programs and defining formally the specification requirements. In addition, models produced out of real-life programs have a huge state space, thus preventing the verification due to performance issues. Our work at CERN (European Organization for Nuclear Research) focuses on developing efficient automatic verification methods for industrial critical installations based on PLC (Programmable Logic Controller) control systems. In this paper, we present a tool generating automatically formal models out of PLC code. The tool implements a general methodology which can support several input languages, like the PLC programming languages defined in the IEC 61131 standard, as well as the model formalisms of different model checker tools. The tool supports the three main stages of model checking: system modelization, requirement formalization and counterexample analysis. In addition, a verification case study of a PLC program, written in Structured Text (ST) language implemented at CERN is described. The paper shows that the verification process is automatized and supported by the proposed tool, thus its difficulty is completely hidden for the control engineer.

Intrusion Detection in PLC-Based Industrial Control Systems Using Formal Verification Approach in Conjunction with Graphs

“…One of the main prior works we based our methodology on is a research done at CERN (Conseil Européen pour la Recherche Nucléaire/European Organization for Nuclear Research) [16]. Adiego et al performed the research to Fig.…”

“…Adiego et al performed the research to Fig. 3 Fernandez's methodology [16] apply formal verification on PLC program to make sure that the program is in accordance with its specification [16].…”

“…The overall methodology followed in [16] crafts formal models from PLC programs that are mainly written in Structured Control Language (SCL). The work in [16] can also translate other PLC languages, like Sequential Function Chart (SFC) and Structured Text (ST).…”

PLC Program Translation for Verification Purposes

“…The original PLCverif workflow [13] is based on an ST' (STr') implementation and some filled requirement patterns. Based on these artefacts an intermediate model (IM) is generated, which is then reduced and translated to the concrete syntax of the chosen model checker.…”

“…nuXmv), and presents the results in a simple, self-contained format to the user. The tool is in use at the European Organization for Nuclear Research (CERN) to check critical control programs [13]. While most of the PLC programs are written in ST at CERN, in special cases (e.g.…”