Verification of programmable logic controller code using model checking and static analysis

This dissertation studies the formal methods model checking and static analysis to prove the correctness of Programmable Logic Controller (PLC) programs. For this, we developed the tool Arcade. PLC, which allow the automatic application of these methods to PLC programs written for different vendors. It extracts a model from the program by abstract simulation, which over-approximates the possible program behavior. The user is then able to verify whether the model obeys a specification, which can be written in the logic CTL or using automata. For applying model checking, we demonstrate how the model can be extracted automatically, such that the approach scales to industrial size programs. For this, we develop different abstraction techniques. Further, we introduce a simplified formalism to write specifications, which is influenced by an automata-based language established in industry. We implement an algorithm to check programs using this formalism and show that this technique is even able to detect errors in the specification. Finally, we detail how counterexamples generated by the model checker can be analyzed automatically to locate the actual erroneous line in the program. The static analysis we developed is able to detect program errors in a fully automatic way. We detect typical errors such as division by zero and illegal array accesses, but also PLC specific errors, e. g., during a restart. The analysis is based on a value-set analysis, which determines the values of all program variables in each program location. These sets are then verified against the predefined checks or user-provided annotations. We show how to implement this analysis such that it scales to industrial size programs. The approach is evaluated on an industrial case study.