A Classification of PLC Models and Applications

1
A Classification of PLC Modelsand Applications
Angelika Mader University of Nijmegen
The Netherlands
2
The Current Situation
storm surge barrier
PLC applications
plant control
teddy bears
milking machines
traffic control
automation
3
The Current Situation
PLC languages
IEC 1131-3
SFC
Instruction List
Relay Ladder
Hygraph
4
The Current Situation
multi tasking
PLC features
periodically
interrupts
cyclical
communication with PC
5
The Current Situation
synchronous models
timed automata
PLC automata
Formal models
Petri nets
condition/event systems
6
The Current Situation
CELESTE
SMV
KRONOS
Tools
UPPAAL
PEP
7
The Current Situation
storm surge barrier
PLC applications PLC languages PLC
features Formal models Tools
plant control
synchronous models
multi tasking
IEC 1131-3
teddy bears
CELESTE
SMV
?
SFC
timed automata
Instruction List
milking machines
KRONOS
interrupts
UPPAAL
Petri nets
PEP
PLC automata
Hygraph
traffic control
cyclical
condition/event systems
8
Goals

• understanding existing models
• finding new, useful models
• methodology for verification

given an application, what is the best model?

• most simple model (depends on properties )
• most efficient tool support

9
Overview

• PLCs short introduction
• classification criteria and examples
• conclusions and future work

• PLCs short introduction
• classification criteria and examples
• conclusions and future work

10
Programmable Logic ControllersArchitecture
11
Programmable Logic ControllersArchitecture
CPU
output points
input points
MEMORY
12
Programmable Logic ControllersArchitecture
CPU
output points
input points
input area
output area
MEMORY
13
Programmable Logic ControllersOperation Mode
?2
?1
i/o phase
scan cycle
program execution phase
14
Overview

• PLCs short introduction
• classification criteria and examples
• conclusions and future work

15
PLC ModelsClassification Criteria

• Modeling of the Scan Cycles
• Use of Timers
• Language Fragments

16
PLC ModelsClassification Criteria

• Modeling of the Scan Cycles
• Use of Timers
• Language Fragments

17
Modeling of the Scan Cycles

• no scan cycles
• explicit scan cycles
• implicit scan cycles
• abstracting from scan cycles

18
No Scan Cycle
Only the program body is modelled no cyclical
execution
Application static program analysis
19
Explicit Scan Cycles
models with explicit time lower and upper time
bound of the scan cycle
Example1 asynchronous communication two
PLCs, output of one is connected to input of the
other
Example2 precise analysis of delays timer
TON may need run time 4 extra scan cycles
gt argument when scan cycles can be neglected
gt reference point for less detailed models
20
Modeling of the Scan Cycles

• no scan cycles
• explicit scan cycles
• implicit scan cycles
• abstracting from scan cycles

21
Implicit Scan Cycles
cyclic execution, but no real time ticks or
fixed execution time
Examples

• old PLCs with fixed scan cycle time
• periodical execution mode of a PLC program
• analysis of worst case maximal scan time
• parallel execution of different programs on one
  PLC

(synchronous models)
22
Modeling of the Scan Cycles

• no scan cycles
• explicit scan cycles
• implicit scan cycles
• abstracting from scan cycles

23
Abstracting from Scan Cycles
ideal controller instantaneous reaction PLCs
only approximate ideal control slow environments
cannot distinguish between an ideal control
and a PLC (e.g. chemical processes)
gt for modelling substitute PLC by
an ideal control
24
Abstracting from Scan Cycles

• Problem with instantaneous program execution
  ZENOness
• Solutions program execution

• in fixed or variable intervals
• if environment changes input, or timeout
• if environment reaches the actual threshold

25
PLC Models Classification Criteria

• Modeling of the Scan Cycles
• Use of Timers
• Language Fragments

26
Use of Timers
27
Use of Timers

• keeps output stable
• substitutes knowledge about environment

Insight about the purpose of timers
blinking light
filling a tank waiting a certain time waiting
until threshold is reached

28
PLC Models Classification Criteria

• Modeling of the Scan Cycles
• Use of Timers
• Language Fragments

29
Language Fragments

• Booleans and Integers vs. Reals
• Language Fragments of the Standard
• Feature Fragments

30
Language Fragments

• Booleans and Integers vs. Reals
• Language Fragments of the Standard
• Feature Fragments

31
Booleans and Integers vs Reals

• Most of what PLCs do is control (no complicated
  computations)

• Trend shift expensive numerical computation to
  PCs

32
Language Fragments

• Booleans and Integers vs. Reals
• Language Fragments of the Standard
• Feature Fragments

33
Language Fragments of IEC 1131-3
Problems with the standard

• Semantics ambiguous
• Semantics un-implementable

gt modeling the full standard is impossible
gt choose carefully the language fragment to model
gt possibly different languages in one model
34
Feature Fragments

• Originally PLCs as simple controllers
• Nowadays all sorts of modern features

• interrupts
• watchdogs
• event-handling
• multi-tasking
• ...

gt difficult to model
suggestion restricted use, if necessary
35
Conclusions

• Criteria help to understand PLC models
• Criteria help to ask questions about applications
  gt categorization
• Helps in finding the most efficient models
• Possibly different models at different levels of
  abstraction

36
Future Work

• Categorization of existing work (matrix)
• More useful criteria by case studies
• Identify missing models (useful ones)
• Tools (integration new ones)

37
The need for formal methods