ESBMC-PLC: Formal Verification of IEC 61131-3 Ladder Diagram Programs Using SMT-Based Model Checking
Pierre Dantas, Lucas Cordeiro, Waldir Junior
Ladder diagram (LD) is the relay-circuit language of IEC 61131-3 in which many PLC safety interlocks are written, and model checkers built on SMT solvers do not read it. A verdict reached through a translation is only as good as that translation. We present ESBMC-PLC, which verifies LD programs with the ESBMC model checker, and argue that its translation is faithful. It encodes the scan cycle as a single loop with nondeterministic inputs, resolves graphical PLCopen XML networks into ordered rungs, models timers in milliseconds, and rejects programs outside an explicit subset. We prove, under eight stated hypotheses, that one iteration of the emitted loop agrees with one scan of a semantics for the subset, so scan-count verdicts on programs without user function blocks hold on that semantics. For timing-mode verdicts, a refinement theorem for MATIEC's timers gives evidence, not proof. One SMT query per program also compares the emitted loop with the C that MATIEC generates. On the 241 labeled LD variants of a public benchmark suite, ESBMC-PLC returns no wrong verdict against the current labels and proves 127 variants safe; ESBMC on MATIEC's C for the same programs proves 2. PLCverif with NuSMV, which shares neither our frontend nor ESBMC, agrees with ESBMC-PLC on all 207 of the 208 variants within the theorem's scope that it can run. On 413 LD programs from public GitHub repositories, none of the 104 that the per-program query can check differs from MATIEC. Every k-induction proof closes at k = 2. ESBMC's inductive step proves only properties that one scan preserves, so properties that depend on a longer history stay unproved.
尚无 AI 解读，展示原文摘要