Design & Verification of Restart-robust Industrial Control Software Dimitri Bohlender VTSA’18, Inria Nancy, 27 August 2018
Introduction On Restart-robustness Programmable Logic Controllers (PLCs) ◮ PLCs are devices tailored to the domain of industrial automation, e.g. for actuating valves of a tank ◮ Realise reactive systems, repeatedly executing the same task Single Cycle actuators sensors PLC Design & Verification of Restart-robust Industrial Control Software 1 / 9 D. Bohlender
Introduction On Restart-robustness Programmable Logic Controllers (PLCs) ◮ PLCs are devices tailored to the domain of industrial automation, e.g. for actuating valves of a tank ◮ Realise reactive systems, repeatedly executing the same task Single Cycle actuators sensors Input Variables PLC Design & Verification of Restart-robust Industrial Control Software 1 / 9 D. Bohlender
Introduction On Restart-robustness Programmable Logic Controllers (PLCs) ◮ PLCs are devices tailored to the domain of industrial automation, e.g. for actuating valves of a tank ◮ Realise reactive systems, repeatedly executing the same task Single Cycle Program actuators sensors Input Variables PLC Design & Verification of Restart-robust Industrial Control Software 1 / 9 D. Bohlender
Introduction On Restart-robustness Programmable Logic Controllers (PLCs) ◮ PLCs are devices tailored to the domain of industrial automation, e.g. for actuating valves of a tank ◮ Realise reactive systems, repeatedly executing the same task Single Cycle Program actuators sensors Input Output Variables Variables PLC Design & Verification of Restart-robust Industrial Control Software 1 / 9 D. Bohlender
Introduction On Restart-robustness Programmable Logic Controllers (PLCs) ◮ PLCs are devices tailored to the domain of industrial automation, e.g. for actuating valves of a tank ◮ Realise reactive systems, repeatedly executing the same task Single Cycle Program actuators sensors Input Local Output Variables Variables Variables PLC Design & Verification of Restart-robust Industrial Control Software 1 / 9 D. Bohlender
Introduction On Restart-robustness PLC Software ◮ Written in textual & graphical languages from IEC 61131-3 ◮ Features no recursion ⇒ Formalised as Control Flow Automaton (CFA) ✞ ☎ 1 1 PROGRAM RunningExample fs 2 VAR RETAIN 2 3 fs: BOOL := TRUE; 4 END_VAR fs:=FALSE !fs 5 VAR 3 6 a: INT := 0; b:=2 7 b: INT := 0; 4 IO 8 END_VAR 9 IF fs THEN 10 fs := FALSE; a:=1234/b 11 b := 2; 12 END_IF 13 a := 1234/b; 5 14 END_PROGRAM ✝ ✆ Design & Verification of Restart-robust Industrial Control Software 2 / 9 D. Bohlender
Introduction On Restart-robustness PLC Software ◮ Written in textual & graphical languages from IEC 61131-3 ◮ Features no recursion ⇒ Formalised as Control Flow Automaton (CFA) ✞ ☎ 1 1 PROGRAM RunningExample fs 2 VAR RETAIN 2 3 fs: BOOL := TRUE; 4 END_VAR fs:=FALSE !fs 5 VAR 3 6 a: INT := 0; b:=2 7 b: INT := 0; 4 IO 8 END_VAR 9 IF fs THEN 10 fs := FALSE; a:=1234/b 11 b := 2; 12 END_IF 13 a := 1234/b; 5 14 END_PROGRAM ✝ ✆ Design & Verification of Restart-robust Industrial Control Software 2 / 9 D. Bohlender
Introduction On Restart-robustness PLC Software ◮ Written in textual & graphical languages from IEC 61131-3 ◮ Features no recursion ⇒ Formalised as Control Flow Automaton (CFA) ✞ ☎ 1 1 PROGRAM RunningExample fs 2 VAR RETAIN 2 3 fs: BOOL := TRUE; 4 END_VAR fs:=FALSE !fs 5 VAR 3 6 a: INT := 0; b:=2 7 b: INT := 0; 4 IO 8 END_VAR 9 IF fs THEN 10 fs := FALSE; a:=1234/b 11 b := 2; 12 END_IF 13 a := 1234/b; 5 14 END_PROGRAM ✝ ✆ Design & Verification of Restart-robust Industrial Control Software 2 / 9 D. Bohlender
Introduction On Restart-robustness Specifications ◮ Intermediate states are not observable 1 fs ⇒ Automation engineers and specs always 2 refer to the observable state fs:=FALSE !fs ◮ Most specifications can be formalised via 3 b:=2 invariants or temporal logics 4 IO ◮ Off-the-shelf verifier backend checks formalised program w.r.t. the specification a:=1234/b ◮ Domain-specific specifications may require dedicated procedures: 5 • PLCopen-/Specification automata • Cycle-bounded temporal logics Design & Verification of Restart-robust Industrial Control Software 3 / 9 D. Bohlender
Introduction On Restart-robustness Specifications ◮ Intermediate states are not observable ⇒ Automation engineers and specs always refer to the observable state ◮ Most specifications can be formalised via invariants or temporal logics ◮ Off-the-shelf verifier backend checks formalised program w.r.t. the specification IO ◮ Domain-specific specifications may require dedicated procedures: 5 • PLCopen-/Specification automata • Cycle-bounded temporal logics Design & Verification of Restart-robust Industrial Control Software 3 / 9 D. Bohlender
Introduction On Restart-robustness Specifications ◮ Intermediate states are not observable ⇒ Automation engineers and specs always refer to the observable state ◮ Most specifications can be formalised via invariants or temporal logics ◮ Off-the-shelf verifier backend checks formalised program w.r.t. the specification IO ◮ Domain-specific specifications may require dedicated procedures: 5 • PLCopen-/Specification automata • Cycle-bounded temporal logics Design & Verification of Restart-robust Industrial Control Software 3 / 9 D. Bohlender
Introduction On Restart-robustness Specifications ◮ Intermediate states are not observable ⇒ Automation engineers and specs always refer to the observable state ◮ Most specifications can be formalised via invariants or temporal logics ◮ Off-the-shelf verifier backend checks formalised program w.r.t. the specification IO ◮ Domain-specific specifications may require dedicated procedures: 5 • PLCopen-/Specification automata • Cycle-bounded temporal logics Design & Verification of Restart-robust Industrial Control Software 3 / 9 D. Bohlender
Introduction On Restart-robustness Specifications ◮ Intermediate states are not observable ⇒ Automation engineers and specs always refer to the observable state ◮ Most specifications can be formalised via invariants or temporal logics ◮ Off-the-shelf verifier backend checks formalised program w.r.t. the specification IO ◮ Domain-specific specifications may require dedicated procedures: 5 • PLCopen-/Specification automata • Cycle-bounded temporal logics Design & Verification of Restart-robust Industrial Control Software 3 / 9 D. Bohlender
Introduction On Restart-robustness Retain Variables ◮ PLC applications are often safety critical ◮ Power outage or manual restart should not affect correctness ⇒ PLCs feature battery-backed memory for retain variables Example Retain drill’s position in automated processing of workpieces ◮ Assignments to such variables have unspecified semantics ◮ Prominent: delayed writing at the current PLC cycle’s end Design & Verification of Restart-robust Industrial Control Software 4 / 9 D. Bohlender
Introduction On Restart-robustness Retain Variables ◮ PLC applications are often safety critical ◮ Power outage or manual restart should not affect correctness ⇒ PLCs feature battery-backed memory for retain variables Example Retain drill’s position in automated processing of workpieces ◮ Assignments to such variables have unspecified semantics ◮ Prominent: delayed writing at the current PLC cycle’s end Design & Verification of Restart-robust Industrial Control Software 4 / 9 D. Bohlender
Introduction On Restart-robustness Retain Variables ◮ PLC applications are often safety critical ◮ Power outage or manual restart should not affect correctness ⇒ PLCs feature battery-backed memory for retain variables Example Retain drill’s position in automated processing of workpieces ◮ Assignments to such variables have unspecified semantics ◮ Prominent: delayed writing at the current PLC cycle’s end Design & Verification of Restart-robust Industrial Control Software 4 / 9 D. Bohlender
Introduction On Restart-robustness Retain Variables ◮ PLC applications are often safety critical ◮ Power outage or manual restart should not affect correctness ⇒ PLCs feature battery-backed memory for retain variables Example Retain drill’s position in automated processing of workpieces ◮ Assignments to such variables have unspecified semantics ◮ Prominent: delayed writing at the current PLC cycle’s end Design & Verification of Restart-robust Industrial Control Software 4 / 9 D. Bohlender
Introduction On Restart-robustness Retain Variables ◮ PLC applications are often safety critical ◮ Power outage or manual restart should not affect correctness ⇒ PLCs feature battery-backed memory for retain variables Example Retain drill’s position in automated processing of workpieces ◮ Assignments to such variables have unspecified semantics ◮ Prominent: delayed writing at the current PLC cycle’s end Design & Verification of Restart-robust Industrial Control Software 4 / 9 D. Bohlender
Recommend
More recommend
