This paper presents an approach to reverse engineering and dynamic analysis of the reactive behavior of PLC programs. Based on execution traces, it is shown how to derive a state model representation of the reactive program behavior and how this model supports dynamic program analysis. In particular, the state model is used for mining execution patterns which occur repeatedly in a program execution. We discuss the key ideas of the approach, the various analysis and visualization methods available, and results from a case study.

This paper describes a tool for offline debugging and trace visualization of PLC applications. Based on trace data obtained by a deterministic replay technology for multi-threaded Soft PLC applications, the tool allows visualizing an application run in its various aspects and on various levels of abstraction. Each view shows a different level of detail, allowing the user to dive into the program from high-level views showing abstract program behavior to low-level views showing each executed statement or variable value in detail. With a set of views the tool supports the user to get an overview of the program execution, to identify abnormal program behavior, to discover the causes for program failures, and finally to locate defects in the source code. The paper presents the conceptional background of the approach, shows how program runs can be visualized, and how they can be analysed in detail. Then it demonstrates how the the tool supports a debugging process by an illustrative example.