Opportunities and challenges of static code analysis of IEC 61131-3 programs

Abstract

Static code analysis techniques analyze programs by examining the source code without actually executing them. The main benefits lie in improving software quality by detecting potential defects and problematic code constructs in early development stages. Today, static code analysis is widely used and numerous tools are available for established programming languages like C/C++, Java, C# and others. However, in the domain of PLC programming, static code analysis tools are still rare. In this paper we present an approach and tool support for static code analysis of PLC programs. The paper discusses opportunities static code analysis can offer for PLC programming, it reviews techniques for static analysis, and it describes our tool that implements a rule-based analysis approach for IEC 61131-3 programs.

Evolution of software in automated production systems: Challenges and research directions

“…CoDeSys Static Analysis 4 , logi.Lint 5 by Logicals and PLC Checker 6 by Itris. Nevertheless, in Fuchs et al (2014) and Prähofer et al (2012) the benefits of static code analysis for IEC 61131-3 software quality improvement are highlighted and an approach for improving compliance to programming conventions and guidelines is proposed, e.g. by identifying incorrect naming conventions, deviating program element complexity or detecting bad code fragments.…”

Identification of Design Patterns for IEC 61131-3 in Machine and Plant Manufacturing

“…CoDeSys Static Analysis 1 , logi.Lint 2 by Logicals and PLC Checker 3 by Itris. Nevertheless, in (Prähofer et al, 2012) the benefits of static code analysis for IEC 61131-3 software quality improvement are highlighted and an approach for improving compliance with programming conventions and guidelines is proposed, e.g. by identifying incorrect naming conventions, deviating program element complexity or detecting bad code fragments.…”

Model-based testing of PLC software: test of plants' reliability by using fault injection on component level

“…If the model of the TSD is complete, the TSD represents one of these paths. For the generation of the test cases a CFG of the source code of the stamp module is created extracting an abstract syntax tree beforehand as also implemented by Prähofer et al (2012) and Biallas et al (2012) for the purpose of static analysis. Using control and data flow analysis techniques the CFG path that corresponds to the test case is extracted from the model (in this example:…”