Modelling and Formal Verification of Timing Aspects in Large PLC Programs

Abstract

One of the main obstacle that prevents model checking from being widely used in industrial control systems is the complexity of building formal models out of PLC programs, especially when timing aspects need to be integrated. This paper brings an answer to this obstacle by proposing a methodology to model and verify timing aspects of PLC programs. Two approaches are proposed to allow the users to balance the trade-off between the complexity of the model, i.e. its number of states, and the set of specifications possible to be verified. A tool supporting the methodology which allows to produce models for different model checkers directly from PLC programs has been developed. Verification of timing aspects for real-life PLC programs are presented in this paper using NuSMV.

A User-Friendly Verification Approach for IEC 61131-3 PLC Programs

“…Many works attempted to apply formal methods to the verification of PLC programs, mainly adopting model checking [2][3][4]6,7,9,11,[24][25][26][27][28][29][30][31][32][33]. Most of the work focused on the formal representation and verification of PLC programs written in one of the languages of the IEC 61131-3 standard.…”

“…However, since deductive verification requires strong professional knowledge and heavy manual work, it is still not widely used in practice. Therefore, most research works focus on model checking of PLC [3][4][5][6][7][8][9][10][11][12]. Almost all of them follow the following pattern: firstly, transforming the PLC program written in one specific PLC language into some formal model; secondly, expressing the system property in a specific formal language which is not ambiguous (The formal expression of the property is usually called formal specification.…”

Applying Model Checking to Industrial-Sized PLC Programs

“…Compared to this previous work, the present paper (a) extends and refines the rules presented previously, (b) encompasses other languages than ST, and (c) presents an application of the approach to a real-life case study. The model reduction techniques and the representation of time-related behavior is not in the main scope of this paper, but the methods used in [4], [5] can be applied here as well.…”

“…T6 will only fire if S2 and S6 are both active. 5 Note that it is a directed graph, but in Siemens notation the arrows are only shown if direction is not top to bottom. For each step Si the corresponding F V (Si) variable is denoted by si.x, the corresponding F V (Si) variable is denoted by si.x .…”

“…The simulation relation must preserve the properties to be verified (the choice of the employed abstractions influences the classes of properties that are preserved [27]). One such complete proof of the correctness of abstraction rules that we used can be found in [5].…”