Two CEGAR-based approaches for the safety verification of PLC-controlled plants

Nellen, Johanna; Driessen, Kai; Neuhäuβer, Martin R.; Ábrahám, Erika; Wolters, Benedikt

doi:10.1007/s10796-016-9671-9

Cited by 17 publications

(12 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Safety Verification of PLC Code. Many prior efforts [24], [28], [30], [31], [42], [44], [57], [58], [61], [63], [65] have been made to statically verify logic code using model checkers [15], [21]. Further efforts have also been made to conduct runtime verification in an online [39], [45] or offline manner [35], [62].…”

Section: Related Workmentioning

confidence: 99%

“…While there exists work [24], [28], [30], [31], [42], [44], [57], [58], [61], [63], [65] that aims to statically verify PLC logic in a formal manner, such static analysis techniques suffer from significant false positives since they are unable to reason about runtime execution contexts. For instance, they may detect potential problematic paths in the code that are infeasible at runtime.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Towards Automated Safety Vetting of PLC Code in Real-World Plants

Zhang

Chen

Kao

et al. 2019

2019 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

Safety violations in programmable logic controllers (PLCs), caused either by faults or attacks, have recently garnered significant attention. However, prior efforts at PLC code vetting suffer from many drawbacks. Static analyses and verification cause significant false positives and cannot reveal specific runtime contexts. Dynamic analyses and symbolic execution, on the other hand, fail due to their inability to handle real-world PLC programs that are event-driven and timing sensitive. In this paper, we propose VETPLC, a temporal context-aware, program analysisbased approach to produce timed event sequences that can be used for automatic safety vetting. To this end, we (a) perform static program analysis to create timed event causality graphs in order to understand causal relations among events in PLC code and (b) mine temporal invariants from data traces collected in Industrial Control System (ICS) testbeds to quantitatively gauge temporal dependencies that are constrained by machine operations. Our VETPLC prototype has been implemented in 15K lines of code. We evaluate it on 10 real-world scenarios from two different ICS settings. Our experiments show that VETPLC outperforms state-of-the-art techniques and can generate event sequences that can be used to automatically detect hidden safety violations.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Towards Automated Safety Vetting of PLC Code in Real-World Plants

Zhang

Chen

Kao

et al. 2019

2019 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

show abstract

“…It provides a good compromise between reliability of checking and complexity of use. In (Nellen et al 2016), an approach is presented to reduce the verification effort through a counterexample-guided abstraction refinement method. The refinement is embedded into the reachability analysis process in order to prevent it from repeatedly re-checking the same model behavior.…”

Section: Papers In the Special Issuementioning

confidence: 99%

Towards common reusable semantics

Bouabana-Tebibel

Rubin

2016

Inf Syst Front

View full text Add to dashboard Cite

“…ere are works on formal verification of PLC [15][16][17]; the target PLC application such as single-task and multitask PLC programs [18] is first converted into formal model using code translation from source code to C code; then symbolic execution is performed on the C code, and after that verification is done.…”

Section: Introductionmentioning

confidence: 99%

Infeasible Path Detection Based on Code Pattern and Backward Symbolic Execution

Yang

Zhang

Gong

2020

Mathematical Problems in Engineering

View full text Add to dashboard Cite

This paper sets out to reveal the relationship between code pattern and infeasible paths and gives advices to the selection of infeasible path detection techniques. Lots of program paths are proved to be infeasible, which leads to imprecision and low efficiency of program analysis. Detection of infeasible paths is required in many areas of software engineering including test coverage analysis, test case generation, and security vulnerability analysis. The immediate cause of path infeasibility is the contradiction of path constraints, whose distribution will affect the performance of different program analysis techniques. But there is a lack of research on the distribution of contradict constraints currently. We propose a code pattern based on the empirical study of infeasible paths; the statistical result proves the correlation of the pattern with contradict constraints. We then develop a path feasibility detection method based on backward symbolic execution. Performance of the proposed technique is evaluated from two aspects: the efficiency of detecting infeasibility paths for specific program element and the improvement of applying the technique on code coverage testing.

show abstract

Two CEGAR-based approaches for the safety verification of PLC-controlled plants

Cited by 17 publications

References 44 publications

Towards Automated Safety Vetting of PLC Code in Real-World Plants

Towards Automated Safety Vetting of PLC Code in Real-World Plants

Towards common reusable semantics

Infeasible Path Detection Based on Code Pattern and Backward Symbolic Execution

Contact Info

Product

Resources

About