🤖 AI Summary
This work addresses the lack of semantic guarantees in existing ladder diagram verification tools, which often leads to false negatives or false positives in safety violation detection due to imprecise translation into model checker inputs. To remedy this, the authors present the first K Framework–based, standards-faithful, and reusable executable formal semantics for IEC 61131-3 ladder diagrams. This semantics uniformly yields both an interpreter and a deductive verifier, serving as an independent audit benchmark for differential testing of translation processes. It accurately models contacts, coils, timers, counters, and retentive scan cycles, with machine-checked correctness verified via kprove. Applying this approach uncovered two real-world flaws in ESBMC: unsound certification of unsafe programs and generation of spurious counterexamples. Furthermore, it formally guarantees input/output behavioral equivalence with the standard for both combinational and latching logic.
📝 Abstract
Automated verifiers for IEC 61131-3 ladder diagrams enhance safety by translating diagrams into model-checker inputs. Still, their unverified front-end translations risk silently returning incorrect results (missing violations or raising false alarms) when they diverge from the standard. We address this gap with K-ESBMC, an executable formal semantics of IEC 61131-3 ladder diagrams built in the K framework. K-ESBMC models contacts, coils, timers, counters, edge blocks, and the retentive scan cycle, generating both an interpreter and a deductive verifier from a single definition. Validated scan-for-scan against OpenPLC/Matiec, K-ESBMC serves as an independent reference oracle to test the ESBMC Programmable Logic Controller (PLC) ladder diagram to GOTO translation differentially. It agrees with ESBMC on most programs and reproduces injected violations with concrete witnesses. Every disagreement exposes a genuine ESBMC defect, confirmed by OpenPLC and two other verifiers, revealing two failure modes: an unsound skip that certifies unsafe programs, and an imprecise havoc that produces spurious counterexamples. For the combinational and latch fragment, we machine-check in kprove that Kes BMC's rules implement the standard's input/output relation, elevating the correctness argument from empirical to formal. K-ESBMC provides a reusable, standard-faithful oracle for auditing any ladder diagram verifier's translation, offering a general approach to verifying the soundness of translation-based verification tools.