Cyber-physical systems and the Internet-of-Things are getting more and more traction in different application areas. Boosted by initiatives such as Industrie 4.0 in Germany or the Industrial Internet Consortium in the US, they are enablers for innovation in industrial automation. To provide the advanced flexibility in production envisioned for future automation systems, Programmable Logic Controllers (PLCs), as one of their main building blocks, also need to become more flexible. However, the conservative nature of this domain prohibits changes in the controller architecture impacting the installed base. Currently there exist various approaches that evolve control architectures to the next level, but none of them address flexible function deployment at the same time with legacy support. In this paper, we present a an architecture for a multi-purpose controller that is inspired by the virtualization trend in cloud systems which moves from heavyweight virtual machines to lightweight containers solutions such as LXC or Docker. Our solution includes the support for multiple PLC execution engines and adds support for the emulation of legacy engines as well. We evaluate this architecture by executing performance measurements that analyze the impact of container technologies to the real-time aspects of PLC engines.

This paper presents a method for automatic test case generation for PLC software following the IEC61131-3 standard. The core component is a model checker that iteratively creates program traces, each of them covering a part of the program in terms of a coverage metric. These test cases are translated into Structured Text, a programming languages defined in the IEC61131-3, to allow the execution on a soft-PLC or the actual hardware. Our approach is evaluated on a set of function blocks that are used in industry. We demonstrate that test cases can be automatically generated within few seconds in most cases.

Latent errors in control system software can be hard to detect through traditional testing techniques. Such errors, if left undetected, could manifest themselves as failures during run-time that could be potentially catastrophic and very expensive to fix. In this paper, we present a static code analysis approach to detect potential sources of such run-time errors during compile time itself, thus ensuring easy identification, safe execution and reducing the effort required during debugging. In order to detect run-time errors, the control system application is first parsed to generate a set of abstract syntax trees, which in turn are used to derive the control flow graph for the application. A hybrid algorithm, based on abstract interpretation and traditional data flow analysis techniques is used to check the control flow graph for type constraints, reachability and liveness properties. Additionally, the abstract syntax trees are used to check for datatype mismatches and compliance violations. A proof of concept prototype is implemented to demonstrate how the algorithm/approach can be used to analyze control applications developed using domain specific languages such as those complying with the IEC 61131-3 standard.

We present an approach to accurately simulate the temporal behavior of binary embedded software based on timing data generated using static analysis. As the timing of an instruction sequence is significantly influenced by the microarchitecture state prior to its execution, which highly depends on the preceding control flow, a sequence must be separately considered for different control flow paths instead of estimating the influence of basic blocks or single instructions in isolation. We handle the thereby arising issue of an excessive or even infinite number of different paths by considering different execution contexts instead of control flow paths. Related approaches using context-sensitive cycle counts during simulation are limited to simulating the control flow that could be considered during analysis. We eliminate this limitation by selecting contexts dynamically, picking a suitable one when no predetermined choice is available, thereby enabling a context-sensitive simulation of unmodified binary code of concurrent programs, including asynchronous events such as interrupts. In contrast to other approximate binary simulation techniques, estimates are conservative, yet tight, making our approach reliable when evaluating performance goals. For a multi-threaded application the simulation deviates only by 0.24% from hardware measurements while the average overhead is only 50% compared to a purely functional simulation.

Static code analysis techniques are a well-established tool to improve the efficiency of software developers and for checking the correctness of safety-critical software components. However, their use is often limited to general purpose or “mainstream” programming languages. For these languages, static code analysis has found its way into many integrated development environments and is available to a large number of software developers. In other domains, e. g., for the programming languages used to develop many industrial control applications, tools supporting sophisticated static code analysis techniques are rarely used. This paper reports on the experience of the authors while adapting static code analysis to a software development environment for engineering the control software of industrial process automation systems. The applicability of static code analysis for industrial controller code is demonstrated by a case study using a real-world control system.

This paper presents optimization techniques for implementing software-based redundancy in industrial control devices. Initially, a brief survey of software-based state replication techniques with a special focus on their applicability in industrial control devices is conducted. The scalability, predictability and low latency of the technique are of particular interest in this case. Based on this survey, an analytic evaluation of different implementation alternatives is performed. As part of this analysis, a novel state replication algorithm is introduced. The approach uses support from the compiler or runtime environment to detect changes in the application state with very low overhead. This information is used to replicate the state of an automation controller in a redundant setup. Lastly, experimental results using a prototype implementation of the presented technique demonstrate that the proposed novel approach is able to perform state replication with constant overhead.

This paper presents a hybrid cache analysis for the simulation-based evaluation of data caches in embedded systems. The proposed technique uses static analyses at the machine code level to obtain information about the control flow of a program and the memory accesses contained in it. Using the result of these analyses, a high-speed source-level simulation model is generated from the source code of the application, enabling a fast and accurate evaluation of its data cache behavior. As memory accesses are obtained from the binary-level control flow, which is simulated in parallel to the original functionality of the software, even complex compiler optimizations can be modeled accurately. Experimental results show that the presented source-level approach estimates the cache behavior of a program within the same level of accuracy as established techniques working at the machine code level.

This paper presents an approach for accurately estimating the execution time of parallel software components in complex embedded systems. Timing annotations obtained from highly optimized binary code are added to the source code of software components which is then integrated into a SystemC transaction-level simulation. This approach allows a fast evaluation of software execution times while being as accurate as conventional instruction set simulators. By simulating binary-level control flow in parallel to the original functionality of the software, even compiler optimizations heavily modifying the structure of the generated code can be modeled accurately. Experimental results show that the presented method produces timing estimates within the same level of accuracy as an established commercial tool for cycle-accurate instruction set simulation while being at least 20 times faster.

This work presents a SystemC-based simulation approach for fast performance analysis of parallel software components, using source code annotated with low-level timing properties. In contrast to other source-level approaches for performance analysis, timing attributes obtained from binary code can be annotated even if compiler optimizations are used without requiring changes in the compiler. To consider concurrent accesses to shared resources like caches accurately during a source-level simulation, an extension of the SystemC TLM-2.0 standard for reducing the necessary synchronization overhead is proposed as well. This enables the simulation of low-level timing effects without performing a full-fledged instruction set simulation and at speeds close to pure native execution.