- The paper introduces K-ESBMC, an executable formal semantics in the K framework for IEC 61131-3 Ladder Diagrams, bridging the trust gap in translation-based verification.
- It employs a rule-based operational semantics to model the PLC scan cycle and validates translation fidelity against OpenPLC, uncovering critical timer and counter errors.
- The work integrates both an interpreter and a machine-checked deductive verifier, providing actionable methods for differential validation in safety-critical automation.
Introduction and Context
The paper introduces "K-ESBMC: An Executable Formal Semantics of IEC 61131-3 Ladder Diagram for Validating Verifier Translations" (2607.10499), presenting an executable formal semantics for IEC 61131-3 Ladder Diagram (LD) in the K framework. LD remains the dominant language for programming safety-critical PLC-based automation. The safety and soundness of symbolic and bounded model checking (BMC) on such systems are inherently constrained by the fidelity of the LD-to-intermediate-representation (IR) translation in verification tools; this translation is typically not verified. The work addresses the trust gap between LD source code and internal model representations consumed by verification engines by constructing a formal, executable, and faithful semantics for LD—including contacts, coils, timers, counters, edge detectors, and the scan cycle—in K, yielding both an interpreter (krun) and a deductive verifier (kprove).
Technical Approach
K-ESBMC leverages K framework's rule-based operational semantics specification to define the scan-cycle-driven execution model of LD. The semantics encompasses the entire standard construct set:
- Series and parallel contact networks (normally-open/closed).
- Coil energization, latch/unlatch, and retained state across scans.
- All standard function blocks (TON, TOF, TP, CTU, CTD, R_TRIG, F_TRIG).
- The retentive, synchronous PLC scan cycle with controlled per-scan time advancement.
The configuration consists of cells representing the Boolean image, timers, counters, elapsed cycle time, and scan loop state. The semantics for timers and counters precisely implement reference state machines validated empirically against matIEC C code, the de facto behavioral standard executed by real PLCs (via OpenPLC).
K’s dual generation mechanism is fully exploited: from the same semantics definition, the interpreter can run concrete traces, while kprove is used to machine-check correctness lemmas for core fragments (combinational and latch rungs). The semantics is validated scan-for-scan against OpenPLC runtime, ensuring high empirical fidelity.
Differential Translation Validation
K-ESBMC is deployed as an independent reference oracle to validate the ESBMC-PLC translation from LD to GOTO-style control flow graphs, which is the foundation for subsequent BMC and k-induction-based verification. Differential validation covers a real-world and synthetic program corpus:
- Each program is parsed/translated without reusing ESBMC code into K-ESBMC’s internal DSL, producing comparable models.
- Both ESBMC and K-ESBMC are run over exhaustive or bounded input traces.
- Disagreements are adjudicated by directly running OpenPLC/matIEC code as an external tie-breaker.
The differential study exposed two structurally distinct translation failures in ESBMC’s timer handling:
- Unsound Skip: Timer paths skipped in graphical programs, leading to erroneous certification of unsafe programs as safe.
- Imprecise Havoc: Timer outputs unconstrained in linear rung format, yielding spurious counterexamples and false alarms.
Every root cause was confirmed by reference runtime and two verification engines with independent decision procedures (CBMC and NuSMV)—excluding artifacts of K-ESBMC or ESBMC-specific model checking.
Strong Results and Claims
- Complete empirical agreement between K-ESBMC and OpenPLC/matIEC at the scan level for all standard timers and counters.
- Differential validation identified and classified all genuine translation defects in ESBMC-PLC across the synthetic and real-world benchmark suite. K-ESBMC always provided correct verdicts, confirmed independently.
- Machine-checked proof of semantic rules for the combinational/latch fragment using kprove, elevating trust from empirical to formal.
- Fault-injection studies revealed that LD translation bugs frequently evade detection by property-based symbolic model checking unless properties explicitly observe mutated state. An executable oracle exposes all observable behavioral divergences—not just those hitting asserted safety properties.
Implications
Practical Impact: The methodology provides a reusable, rigorous foundation for auditing LD-to-verifier translations in any toolchain, not only ESBMC-PLC. Using scan-level equivalence with reference OpenPLC runtime as the ground truth ensures that auditor verdicts have operational relevance and not just abstract formal faithfulness. The K-ESBMC artifact can be integrated into conformance suites and regression testing for any tool that manipulates LD. The architecture also supports extension to richer data types, additional vendor blocks, and composition with mixed-language (ST/LD) projects via K.
Theoretical Impact: This work establishes a layered assurance foundation for LD verification: empirical equivalence with de facto behavioral standards, formal machine-checked proof for standard Boolean fragments, and high-coverage differential validation for executable translation soundness. The limitations of property-based validation in isolation are critically exposed, motivating the necessity of oracles capable of full program trace observation for sound toolchain validation.
Future Work
Outstanding open problems include full mechanization of scan-loop-driven timer/counter correctness via induction in K, the establishment of full semantic equivalence between K-ESBMC and ESBMC-PLC GOTO IR, and the extension of differential validation methods to richer language subsets and additional backends. These steps are required to further raise assurance from empirical and fragmentary formal proof to comprehensive mechanized correctness for full LD+BMC verification toolchains.
Conclusion
K-ESBMC delivers a robust, reproducible, and executable formal semantics for IEC 61131-3 LD, bridging the trust gap in translation-based automated verification. The approach substantiates the correctness of translation-heavy verification pipelines, distinguishes soundness issues from tool artifacts, and provides both practical validation workflows and theoretical assurance elevation. K-ESBMC establishes an actionable template for auditable assurance across the PLC safety-critical verification domain and serves as a general paradigm for reference-semantics-based differential validation of verification translation layers (2607.10499).