基于动态符号执行的IEC 61131-3 ST程序自动化测试生成

191 浏览量更新于2024-08-27 收藏 236KB PDF 举报

"这篇研究论文探讨了使用动态符号执行技术自动生成IEC 61131-3 ST程序测试的方法，旨在提高可编程逻辑控制器（PLC）软件的测试效率和覆盖率，降低潜在的安全风险。 IEC 61131-3标准是工业控制领域广泛采用的一种编程语言标准，其中Structured Text (ST) 是该标准定义的一种高级文本编程语言，常用于编写PLC软件。PLC在自动化控制中的核心地位使得其软件质量至关重要，因为任何软件错误都可能导致经济损失甚至人身安全问题。传统的PLC软件测试方法主要依赖于手动设置输入数据，这种方法不仅效率低下，而且难以实现对代码全面覆盖的测试，无法充分暴露潜在的错误和漏洞。为此，论文提出了一个创新的自动化测试用例生成策略，利用动态符号执行技术来解决这一问题。动态符号执行是一种强大的软件测试技术，它能够模拟程序的执行路径，并通过符号值而非具体数值来探索可能的输入。这种方法可以生成多种不同的执行路径，从而增加测试覆盖率，发现隐藏的错误。在PLC ST程序测试中，动态符号执行可以帮助生成针对不同条件和分支的测试用例，有效验证程序的正确性和鲁棒性。论文中详细阐述了该方法的实现过程，包括如何构建ST程序的模型，如何进行符号执行，以及如何生成有效的测试用例。此外，还可能涉及对测试结果的评估，如代码覆盖率的计算，以及与现有手动测试方法的比较，以证明自动测试生成方法的优势。通过这种方法，可以显著降低测试成本，提高测试效率，同时确保PLC软件的安全性和可靠性。这将对工业自动化控制领域的软件测试实践带来积极影响，有助于预防因软件故障引发的事故，保障工业生产的安全和效率。"

Automated Test Generation for IEC 61131-3 ST

Programs via Dynamic Symbolic Execution

Li Hao

†

, Jianqi Shi

†‡∗

, Ting Su

, Yanhong Huang

†§

†

National Trusted Embedded Software Engineering Technology Research Center

East China Normal University, Shanghai, China

‡

Hardware/software Co-Design Technology and Application Engineering Research Center, Shanghai, China

Nanyang Technological University, Singapore

Shanghai Key Laboratory of Trustworthy Computing, Shanghai, China

Abstract—A programmable logic controller (PLC) is essentially

a computer dedicated to industrial control which is widely used

in the ﬁeld of global automation control. However, PLC software

bugs can result in economic losses and even personal safety issues.

PLC software must be thoroughly tested regarding function,

structure, safety, and other aspects to avoid accidents. Existing

PLC tools are mainly based on the manual setting of input data,

which is not only unable to be well automated but also cannot

provide information about code coverage. This paper presents

an automated test case generation approach for a Structured

Text (ST) language to reduce the cost of testing, using dynamic

symbolic execution. We apply this method to implement the

coverage-based automated test case generation tool STAutoTester.

We have evaluated STAutoTester on 21 programs. The experi-

mental results show that STAutoTester can effectively handle

these programs. For 11 ST programs, STAutoTester reduces, on

average, 87.5% of generated test cases compared to S

PLC.

I. INTRODUCTION

Programmable logic controllers (PLCs) are the core equip-

ment of industrial automation control and have been widely

used in various control systems. PLC software, particularly

used on military hardware, is increasingly demanding in terms

of correctness and security. IEC 61508 is an international

safety standard and applies to many industries. It speciﬁes

techniques for each phase of the life-cycle to prevent errors.

Software testing is an effective means of ensuring the quality

of software products. Unit testing is required in software

testing and depends on the target SIL (Safety Integrity Level)

capabilities of the software being tested. Unit testing also

covers speciﬁc criteria such as all statements, branches, or

conditions of the program.

At present, the most popular PLC software testing methods

are testing in the whole digital simulation test environment

and the hardware environment. These methods are mainly

concerned with whether the various needs of the user are met,

such as function, performance, interface, and so on. However,

compared with structured testing, functional testing needs

analysis of requirements to generate test cases and the process

of writing a requirement speciﬁcation is time-consuming and

is not fully automatic. The method of structured testing is a

white box test including model checking [1], [2], symbolic

execution [3], and so on. Model checking is more suitable

*Corresponding Author: jqshi@sei.ecnu.edu.cn

for checking design errors, as it is a vital but complicated

process to convert to an intermediate formal model higher than

the actual code abstraction level. In addition, model checking

suffers from the state-space explosion problem. Therefore, we

use dynamic symbolic execution techniques to automate test

case generation.

Dynamic symbolic execution (DSE) is a technique that

combines symbolic execution with concrete execution and is

widely used in source code-based automated software testing.

Many automated testing tools based on DSE (e.g. CUTE [4],

KLEE [5], and SmartUnit [6]) have appeared in academia and

industry.

There has been little work on directly applying dynamic

symbolic execution technology to automatic test case gener-

ation of ST, which is one of the IEC 61131-3 PLC standard

languages. One reason is that the CPU of the PLC sequentially

scans the running user program. That is, the PLC program has

the characteristics of cyclic execution. Another reason is that

generating a small number of test cases with high coverage is

not an easy task.

In this paper, we present an automated test case genera-

tion framework for ST using dynamic symbolic execution.

The framework takes the ST program and a search strategy

selection as input and outputs a test case set and coverage

information for the program. First, the ST source program

is preprocessed and parsed to get the abstract syntax tree.

Second, we generate an intermediate model by traversing the

abstract syntax tree. The intermediate model contains infor-

mation such as variables, assignment constraints, execution

condition constraints, and order constraints. Then, the dynamic

symbolic execution engine generates a set of test cases for the

program based on the intermediate model. The Satisﬁability

modulo theories (SMT) solver is called multiple times to solve

the constraints. Finally, a test case analysis report is output.

We have designed a general intermediate model named

CFG (Control Flow Graph for ST). ST CFG is a combi-

nation of control ﬂow graphs and PLC language features. The

operation of the DSE engine and the statistics of the test cases

are inseparable from ST

CFG. ST CFG is the uniﬁed input

structure of the DSE engine, which keeps the DSE engine

independent of the source program.

Additionally, we propose a test case generation algorithm

200

2019 International Symposium on Theoretical Aspects of Software Engineering (TASE)

DOI 10.1109/TASE.2019.00034

下载后可阅读完整内容，剩余7页未读，立即下载

weixin_38743391

粉丝: 9
资源: 915

基于动态符号执行的IEC 61131-3 ST程序自动化测试生成

Combining_Symbolic_Execution_and_Model_Checking_for_Data_Flow_Testing.pdf

matlab自相关代码-Ecology-Discovery-via-Symbolic-Regression:通过符号回归揭示复杂生态动力学的代

Painleve Analysis and Multi-soliton Solutions for a Variable-coefficient Nonlinear Schrodinger Equation with Symbolic Computation

lldb-symbolic:lldb命令-symbolic

SYMBOLIC EXECUTION

Application of Exp-function method to Whitham-Broer-Kaup shallow water model using symbolic computation

A Tool for the Symbolic Execution of Linux Binaries - PySymemu (Slides)-计算机科学

Lax pair and Darboux transformation for a variable-coefficient fifth-order Korteweg-de Vries equation with symbolic computation

VAL2.rar_Symbolic execution_execution

Student-Strategy-Prediction-Using-a-Neuro-Symbolic-Approach

最新资源