A presentation based on Feldmann, S., Hauer, F., Ulewicz, S. and Vogel-Heuser, B., 2016, June. Analysis framework for evaluating PLC software: An application of Semantic Web technologies. In 2016 IEEE 25th International Symposium on Industrial Electronics (ISIE) (pp. 1048-1054). IEEE

1. Analysing PLC software
A SEMANTIC WEB POWERED FRAMEWORK FOR EVALUATING
CONTROL SOFTWARE IN AUTOMATIC PRODUCTION SYSTEMS
Akashdeep Singh Lamba – September 2018
School of Computer Science and Statistics
Trinity College Dublin, Dublin, Ireland
lambaa@tcd.ie

2. What is PLC software?
- Programmable Logic Controller
- Control devices like motors, power lines, and hardware in
huge industrial setups
- Industrial grade microcontroller; highly capable, you can
increase the number of input output ports by adding more I/O
units
- Programmed using the IEC 61131-3 standard programming
languages
- The most popular language is Ladder logic, a diagrammatic
language
Example of Ladder logic
Image Source:
http://automationprimer.com/2013/04/14/ladder-logic-203-faults/

3. Why is analysis hard?
- Static analysis helps us assess code quality without executing it
- Regular software static analysis: linting, go vet, dependency tree, module graph, etc
◦ Lint for C, FindBugs for Java, as well as SonarQube supports several languages
- Nature of control software has changed
◦ Focus has shifted from system’s logic to adaptability, dynamic configuration, self-healing
◦ Control software using IEC 61131-3 is now more complex and harder to maintain
- Tools exist but are limited to specific controllers or languages or resort to model checking
◦ Arcade (https://arcade.embedded.rwth-aachen.de/doku.php?id=arcade)
◦ PLCChecker (http://www.itris-automation.com/plc-checker/)
◦ CoDeSys Static Analysis (https://store.codesys.com/codesys-static-analysis.html)
- Not flexible, and don’t allow thorough and generally applicable analysis

4. Proposed solution – Features &
requirements
Comprehensive overview
Compliance to conventions and style guides
Metrics such as cyclomatic complexity,
coupling and hierarchies
Patterns
Key features according to experts
Dependency model
Flexible specification and application of
coding rules
and conventions, metrics and patterns
Visualization
Requirements for the framework

5. Proposed solution - Framework

6. Application of the framework - I
The dependency model
- Identify components:
POUs and edges
- Program Organization
Units (POUs) or nodes:
◦ Projects or Libraries
◦ Variables
◦ DataTypes: ElementTypes
or DerivedTypes
- Egdes
◦ Interaction between source POU and target POU
◦ ReadsEdge, WritesEdge
◦ CallsEdge, ExecutesEdge
Example dependency model using UML diagram

7. Application of the framework - II
Knowledge-based system
- Knowledge about code derived from code itself,
instead of comments and annotations
- Two components:
◦ Knowledge base
◦ Inference mechanism
- Knowledge base formally describes facts about
the code
◦ RDF
- Inference mechanism is a set of conditional and
logical test statements for analysis of the
knowledge base
◦ SPARQL
Example dependency model

8. Application of the framework - III
Flexible visualization
- Lots of information
- Built on top of previous two
stages
- Multiple views of control
software
◦ Direct data exchange view: for
focusing on POUs and the call
interactions between various POUs
◦ Indirect data exchange view: for
focusing on the POUs and the read
and write interactions between
them and their dependencies
◦ And more
Example RDF(S) representation dependency model

9. Example: RDF and SPARQL in action
Using SPARQL on the
RDF graph to analyse
software patterns such
as code reuse

10. Shortcomings and future scope
- Work needs to be done to test scalability
- Hardware characteristics need to be incorporated
- Coding rules, conventions need to be formally defined
- Standards for metrics and patterns need to be introduced

11. References
❑Feldmann, S., Hauer, F., Ulewicz, S. and Vogel-Heuser, B., 2016, June. Analysis
framework for evaluating PLC software: An application of Semantic Web
technologies. In 2016 IEEE 25th International Symposium on Industrial
Electronics (ISIE) (pp. 1048-1054). IEEE.
❑http://www.plctalk.net/qanda/showthread.php?t=93886

12. Acknowledgements
This analysis was conducted and presented as part of the 2018/19 Knowledge
and Data Engineering module CS7IS1 at Trinity College Dublin, under the
guidance of Dr. Declan O'Sullivan, Trinity College Dublin, School of Computer
Science and Statistics. 2018