🤖 AI Summary
Existing tools fail to correctly parse graphical PLCopen XML ladder diagrams (LDs), often producing empty intermediate representations that erroneously lead to safety verdicts. This work proposes Graph-ESBMC-PLC, the first approach to achieve complete semantic parsing and formal verification of graphical LDs. It traverses the connection graph from power rails via depth-first search to extract rung logic and translate it into Boolean expressions. Coupled with a three-layer I/O inference mechanism, it accurately generates GOTO intermediate representations for SMT-based bounded model checking, while strictly adhering to the IEC 61131-3 scan cycle semantics for SET/RESET coils. Experiments demonstrate that the method successfully produces complete IRs and verifies three graphical LD programs as SAFE (k=2, <70 ms), shows no regression on eleven textual LD benchmarks, and identifies two unsupported scenarios in Beremiz.
📝 Abstract
PLCopen XML defines two encoding formats for IEC 61131-3 Ladder Diagram programs: a textual encoding using <rung> elements, and a graphical encoding that represents rung logic as a directed graph of localId/refLocalId connections. ESBMC-PLC supported the textual format but parsed graphical exports from CONTROLLINO, Beremiz, and OpenPLC Editor into an empty GOTO intermediate representation, causing vacuous verification success. This paper presents Graph-ESBMC-PLC, which closes this gap with a DFS-based graphical LD resolver. The resolver traverses the connection graph from leftPowerRail to each coil, extracts rung paths as Boolean contact conjunctions, and applies a three-tier I/O inference scheme. Ordering coils by rightPowerRail connectionPointIn sequence ensures SET coils process before RESET coils, matching IEC scan-cycle semantics. The graphical-to-IR conversion leaves the ESBMC backend unchanged. Validation on 3 graphical LD programs from CONTROLLINO/OpenPLC Editor shows all produce full GOTO IR with nondeterministic inputs and rung logic, versus the empty IR previously. All 3 verify SAFE at k=2 under 70ms. The 11 textual LD benchmarks are fully preserved, with no regression. Two Beremiz examples with no LD content or unsupported timer semantics are reported as discovered limitations. Artifact at Zenodo (DantasCordeiro2026graphical, doi:10.5281/zenodo.20699856).