🤖 AI Summary
This work addresses a critical limitation in existing formal verification tools for open-source hardware PLC programs: the neglect of microcontroller bit-width and sensor ADC resolution, which leads to numerous false positives and missed real defects. To overcome this, the authors propose a hardware-faithful verification approach that employs a declarative Hardware Abstraction Layer (HAL) to precisely model target platform characteristics—such as 16-bit word size, I/O constraints, and ADC resolution—and integrates finite-precision arithmetic with physically realizable input ranges into the formal verification of IEC 61131-3 programs. HAL parameters are automatically derived from official Arduino core definitions and incorporated into the ESBMC ladder logic frontend. Evaluation on 123 real-world programs demonstrates that the method eliminates all 54 false alarms, uncovers genuine bit-width-dependent bugs, and produces reproducible, hardware-realizable counterexamples.
📝 Abstract
OpenPLC, Arduino OPTA, CONTROLLINO, and Industrial Shields M-Duino bring IEC 61131-3 to low-cost microcontrollers used in real automation and industrial control system (ICS) security research. Existing open-source verifiers for IEC 61131-3, including ESBMC-PLC, prove safety over an abstract scan-cycle model with idealized unbounded integers. The board artifact runs on a resource-constrained microcontroller unit (MCU) with 16-bit words (8-bit AVR Arduinos), and sensors are read via a finite-resolution analog-to-digital converter (ADC). We show this deployment gap makes naive width-aware verification unsound: across 123 real programs, checking 16-bit overflow without a hardware input model yields 44% false alarms (54/123) and finds no genuine defects, because it explores sensor values no ADC can produce. Since the gap lies where computation meets the physical process - a bounded sensor reading scaled by finite-width arithmetic into an actuation command - an overflow can silently suppress a safety action, such as a high-level alarm. An unbounded input model fabricates alarms that no environment can trigger. We present hardware-faithful verification for IEC 61131-3 on open hardware: a declarative hardware abstraction layer (HAL) descriptor (width, ADC/PWM resolution, I/O binding) and a sound lowering that interprets arithmetic at target width and constrains inputs to hardware-realizable ranges. We instantiate it for Arduino as ArduinoTool, deriving HAL parameters from official cores and realizing the input-range model in the ESBMC Ladder Diagram (LD) frontend. On the 123-program corpus, the HAL annotator eliminates all 54 false alarms while preserving robustness proofs, and a controlled corpus demonstrates the rare width-dependent defects it detects with realizable witnesses.