Verification of Reactive Programs from Industrial Automation - PowerPoint PPT Presentation

Verification of Reactive Programs from Industrial Automation Dimitri Bohlender

Programmable Logic Controller (PLC) ◮ Tailored to the domain of industrial automation ◮ Realise reactive systems, repeatedly executing the same task Single Cycle actuators sensors PLC Verification of Reactive Programs from Industrial Automation 1 / 1 Dimitri Bohlender

Programmable Logic Controller (PLC) ◮ Tailored to the domain of industrial automation ◮ Realise reactive systems, repeatedly executing the same task Single Cycle actuators sensors Input Variables PLC Verification of Reactive Programs from Industrial Automation 1 / 1 Dimitri Bohlender

Programmable Logic Controller (PLC) ◮ Tailored to the domain of industrial automation ◮ Realise reactive systems, repeatedly executing the same task Single Cycle Program actuators sensors Input Variables PLC Verification of Reactive Programs from Industrial Automation 1 / 1 Dimitri Bohlender

Programmable Logic Controller (PLC) ◮ Tailored to the domain of industrial automation ◮ Realise reactive systems, repeatedly executing the same task Single Cycle Program actuators sensors Input Output Variables Variables PLC Verification of Reactive Programs from Industrial Automation 1 / 1 Dimitri Bohlender

Programmable Logic Controller (PLC) ◮ Tailored to the domain of industrial automation ◮ Realise reactive systems, repeatedly executing the same task Single Cycle Program actuators sensors Input State Output Variables Variables Variables PLC Verification of Reactive Programs from Industrial Automation 1 / 1 Dimitri Bohlender

PLC Software ◮ Programming languages standardised in IEC 61131-3 ◮ Combination of several languages typical Ladder Diagram Function Block Diagram Sequential Function Chart i 0 i 1 o 0 Initial & Step A Step B Final i 2 Instruction List Structured Text Vendor Specific Dialects ... IF=input0+50=>=100=THEN LD input0 output0 :==1; ADD 50 ELSE GT 100 output0 :==0; JMPC label ENDIF; Verification of Reactive Programs from Industrial Automation 2 / 1 Dimitri Bohlender

Verification of Domain-Specific Specifications ◮ Specification automata used by the PLCopen reset answered 1 1 DiagCode = 0x0000 DiagCode = 0x8000 DiagCode = 0xC001 1 2 R _ TRIGatQuery ( CLK := Query ) R _ TRIGatQuery ( CLK := Query ) ⇒ Characterisation in terms of Constrained Horn-Clauses ✓ ◮ Analysis of Reset-Behaviour • Certain variables may retain their value after restart/power cut. • Restarting shall not affect the set of observable states, i. e. ! Reach nominal ( s 0 ) ⊇ Reach reset ( s 0 ) Verification of Reactive Programs from Industrial Automation 3 / 1 Dimitri Bohlender

Verification of Domain-Specific Specifications ◮ Specification automata used by the PLCopen reset answered 1 1 DiagCode = 0x0000 DiagCode = 0x8000 DiagCode = 0xC001 1 2 R _ TRIGatQuery ( CLK := Query ) R _ TRIGatQuery ( CLK := Query ) ⇒ Characterisation in terms of Constrained Horn-Clauses ✓ ◮ Analysis of Reset-Behaviour • Certain variables may retain their value after restart/power cut. • Restarting shall not affect the set of observable states, i. e. ! Reach nominal ( s 0 ) ⊇ Reach reset ( s 0 ) Verification of Reactive Programs from Industrial Automation 3 / 1 Dimitri Bohlender

Verification of Domain-Specific Specifications ◮ Specification automata used by the PLCopen reset answered 1 1 DiagCode = 0x0000 DiagCode = 0x8000 DiagCode = 0xC001 1 2 R _ TRIGatQuery ( CLK := Query ) R _ TRIGatQuery ( CLK := Query ) ⇒ Characterisation in terms of Constrained Horn-Clauses ✓ ◮ Analysis of Reset-Behaviour • Certain variables may retain their value after restart/power cut. • Restarting shall not affect the set of observable states, i. e. ! Reach nominal ( s 0 ) ⊇ Reach reset ( s 0 ) Verification of Reactive Programs from Industrial Automation 3 / 1 Dimitri Bohlender

Exploiting Domain-Specifics in Existing Techniques s = 0, c = input() s = 0, c = input() c = [ c = input() ◮ Consider bug-finding via c � = [ s � = 0 s = 0 symbolic execution s := 1 ⇒ CFG-based guidance fails c = ( ◮ Bad choices hard to identify c � = ( s � = 1 s = 1 (due to cyclicity) s := 2 c = { ◮ Implicit state machine (over s ) ◮ Typical pattern in PLC program c � = { s � = 2 s = 2 modules s := 3 s � = 3 s = 3 bad() Verification of Reactive Programs from Industrial Automation 4 / 1 Dimitri Bohlender

Exploiting Domain-Specifics in Existing Techniques s = 0, c = input() s = 0, c = input() c = [ c = input() ◮ Consider bug-finding via c � = [ s � = 0 s = 0 symbolic execution s := 1 ⇒ CFG-based guidance fails c = ( ◮ Bad choices hard to identify c � = ( s � = 1 s = 1 (due to cyclicity) s := 2 c = { ◮ Implicit state machine (over s ) ◮ Typical pattern in PLC program c � = { s � = 2 s = 2 modules s := 3 s � = 3 s = 3 bad() Verification of Reactive Programs from Industrial Automation 4 / 1 Dimitri Bohlender

Exploiting Domain-Specifics in Existing Techniques s = 0, c = input() s = 0, c = input() c = [ c = input() ◮ Consider bug-finding via c � = [ s � = 0 s = 0 symbolic execution s := 1 ⇒ CFG-based guidance fails c = ( ◮ Bad choices hard to identify c � = ( s � = 1 s = 1 (due to cyclicity) s := 2 c = { ◮ Implicit state machine (over s ) ◮ Typical pattern in PLC program c � = { s � = 2 s = 2 modules s := 3 s � = 3 s = 3 bad() Verification of Reactive Programs from Industrial Automation 4 / 1 Dimitri Bohlender