ESBMC-PLC+: A Unified IEC~61131-3 Formal Verification Framework as a PLCverif Successor
This paper introduces ESBMC-PLC+, a unified open-source framework that extends the ESBMC backend to support all major IEC 61131-3 languages (including Ladder Diagram and Structured Text) and unbounded verification, thereby overcoming the input format limitations and bounded proof constraints of its predecessor PLCverif while significantly outperforming nuXmv in verifying timer-heavy programs.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine a Programmable Logic Controller (PLC) as the brain of a factory machine. It's a tough, industrial computer that tells robots, valves, and lights when to move, stop, or change color. These machines run on a strict, repeating loop called a "scan cycle," checking sensors and making decisions thousands of times a second. Because these machines control things like nuclear power plants and train signals, a single mistake in the code can be catastrophic.
Formal verification is like a super-smart, mathematical proofreader that checks every single possible scenario the machine could ever face to ensure it never crashes or acts dangerously.
For years, the best open-source tool for this job was called PLCverif. Think of PLCverif as a highly skilled mechanic who is great at fixing cars (text-based code) but refuses to look under the hood of motorcycles (ladder diagrams) or doesn't have the right tools to prove the engine will run forever without overheating (unbounded proofs).
This paper introduces ESBMC-PLC+, a new, upgraded "super-mechanic" designed to replace and improve upon PLCverif. Here is what it does, explained simply:
1. Speaking Every Language (The Unified Framework)
PLC programmers speak three main languages:
- Ladder Diagram (LD): Looks like an electrical circuit diagram with rungs and rails. It's the most popular language in factories (like the "English" of the industry).
- Structured Text (ST): Looks like standard computer code (similar to Pascal or C).
- Graphical LD: The visual version of Ladder Diagrams.
The Problem: The old tool (PLCverif) could only read the "Structured Text" language. If an engineer had a Ladder Diagram, they had to manually rewrite it into text, which is slow and prone to errors. Also, if the Ladder Diagram had complex "function blocks" (like timers or counters), the old tool couldn't handle them at all.
The Solution: ESBMC-PLC+ is a universal translator. It can read all three languages natively.
- For Structured Text, it uses a trusted open-source compiler (MATIEC) to translate the code into a format the verification engine understands.
- For Ladder Diagrams, it has a new "decoder" that can now understand complex timers and counters that were previously ignored.
2. The "Forever" Guarantee (Unbounded Proofs)
Imagine you are testing a bridge.
- Bounded Checking (The Old Way): You drive a truck over the bridge 100 times. If it holds, you say, "It's probably safe." But you don't know what happens on the 101st time, or if the bridge collapses after 1,000 years. This is what the old tool's primary engine (CBMC) did.
- Unbounded Proofs (The New Way): ESBMC-PLC+ uses a technique called k-induction. Instead of just checking 100 times, it uses math to prove that if the bridge holds for the first few seconds, it will hold for infinity. It guarantees the machine will never fail, no matter how long it runs.
3. The Speed Demon (SMT vs. BDD)
The paper compares ESBMC-PLC+ against the "unbounded" engine of the old tool (nuXmv), which uses a method called BDD (Binary Decision Diagrams).
- The Analogy: Imagine you have a giant library of books (all possible machine states).
- The Old Tool (BDD) tries to read every single book one by one. If the library is huge (because the machine has many timers or counters), it gets overwhelmed and stops working (times out).
- ESBMC-PLC+ (SMT) uses a magical index. Instead of reading every book, it asks a super-intelligent librarian (an SMT solver) to check the logic of the whole library at once.
- The Result: On programs with timers, ESBMC-PLC+ was 400 to 2,000 times faster than the old tool. In some cases, the old tool gave up after 2 minutes, while ESBMC-PLC+ finished the proof in less than a second.
4. What It Actually Fixed
The paper highlights two specific "gaps" it closed:
- The Missing Text: It added support for Structured Text (ST) programs, which the old tool handled poorly or not at all for standard IEC code.
- The "Ghost" Timers: In the visual Ladder Diagrams, there were "function blocks" (like timers that wait 5 seconds before turning on a light). The old tool ignored these blocks, effectively pretending they didn't exist. This led to "vacuous" results—where the tool said "Safe!" just because it wasn't looking at the dangerous parts. ESBMC-PLC+ now models these timers correctly, ensuring the safety check is real, not a fake-out.
Summary
ESBMC-PLC+ is a new, open-source tool that acts as a universal translator for industrial machine code. It speaks all the major languages engineers use, handles complex visual diagrams with timers and counters, and uses a faster, smarter mathematical engine to prove that machines will be safe forever, not just for a short test run. It is designed to be the direct, superior successor to the previous industry standard, PLCverif.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.