-

zy
zyxwvutsr
Formal methods in PLC programming

zyxwvutsrqpon
Abstract A detailed generic model of the control design proc-
Georg Frey and Lothar Litz

ess is introduced and discussed. It is used for surveying different

formal approaches in the context of PLC-programming. The
survey focuses on formal methods for verification and validation
Although being a rather intuitive discipline for a long time.
industrial PLC programming will be more and more sup-
ported by formal methods. There are several reasons for the
application of formal methods with PLC programming:
(V&V). The varying works in this area are categorized using
three criteria: the general Approach to the task (model based, The growing complexity of the control problems, the
constrained based or without a model), the Formalism (Petri net, demand for reduced development time, and the possi-
automata,...) used to state the formal description, and the ble reuse of existing software modules result in the
Method (Model-Checking, Reachabilily Analysis, ...) used to need for a formal approach in PLC programming. The
analyze the properties. Based on these three criteria (A-F-M) a papers by Baresi et al. [7] and by Antoniadis and Leo-
three letter code for V&V approaches is introduced. Some works

zyxwvutsrqpon
poulus [8] primarily aim in this direction.
from the multitude of V&V research are presented and catego-
rized using this new system. The demand for high quality solutions and especially
the application of PLC in safety-critical processes need
Index terms-PLC, logic control, verification, validation, formal verification and validation procedures, i.e. formal
methods. methods to prove specific static and dynamic properties
of the programs, as for example liveness, unambiguity
or response times. The papers by Canet et al. [9] and by
I. INTRODUCTION Mertke and Menzel [IO] deal with this aspect of formal
method application to PLC programming.
Since the 1970s PLC has been the primary workhorse of
industrial automation. For a long time it has provided a In Figure 2 a generic model of the logic control design
distinct field of research, development and application, process is given [ 111. The presentation form is a Channel
mainly for Control Engineering. This area has produced its Agency Net, see e.g. Reisig [ 121. Without the use of formal

zyxwvuts
own design methods and programming languages. Due to methods the controller design process only consists of the
its importance for industrial application a lot of these meth- outer ring: The realization of the controller is derived from
ods have been standardized internationally. Figure 1 the informal specification by direct implementation and
(adapted from [l]) shows an overview of the standardiza- afterwards it is informally validated against the informal
tion. Currently the most influential standards are IEC 1131 specification.
[2], [31 and IEC 1499 [41, P I , E61.

zyxwvutsrqpon
NEMA Programmable Controllers Committee formed (USA)

ion Charts (Gemany)

zyxwvutsrqpo
-304. ProgrammableControllers (USA) T
Validation

zyxwvutsrqponm
W G 6 formed
19 239, Programmable Controller
)38,Programmable Controllers

SC65A(Sec)49, PC Languages
IEC SC65A(Sec)67

Figure 2. Design process for logic control systems /7].

zyxwvutsrqpon
Figure I : Standardization in PLC programming

Contact: Georg Frey, University of Kaiserslautem, Institute of Process

Automation, PO Box 3049, 67653 Kaiserslautem, Germany, tel.: +49 631
205 3652, fax: +49 631 205 4462, e-mail: [email protected].
In almost all cases, the designer of a logic control system
starts with a given informal specification of the control
problem. The term “informal” refers to everything that is
not based on a strictly composed, syntactically and semanti-
cally well-defined form. In addition to an ‘easy to under-

0-7803-6583-6/001$10.00 0 2000 IEEE 2431

 zyxwvuts
zyxwvutsrqp
stand’ verbal description this includes for instance timing
diagrams, sketches, P&ID (piping and instrumentation
diagram) according to ISA S5.1 [13], [14] or the combina-
tion of a set of equations describing the behavior of the
uncontrolled plant with a set of verbal requirements for the
controlled process. In general, the informal specification
consists of a description of the uncontrolled process and
In recent years, the PLC community realized the need for
formal methods in programming and validation. A lot of
interdisciplinary work has been done with the aim of ap-
plying formal methods. There are formal programming
methods from software engineering as well as formal veri-
fication methods developed for the design of VLSI and
communication protocols. Including formal methods the
requirements for the controlled system. Explicit require- middle path in Figure 2 is added1 to the generic model of the
ments for the control algorithm are also possible. However, design process: The formalization is the conversion of an
the different parts of the specification are not always clearly informal into a formal specification. This conversion can be
separated. The main problem with informal specifications is done with the aid of computers but not automatically. It is a
that they do not facilitate tests for completeness, unambi- human core capability, since it involves informal informa-
guity and consistency. tion.

The industrial standard approach to get the realization from Deriving the realization from the formal specification is
the informal specification is the direct implementation of called implementation. This process depends on the spe-
the controller using a PLC programming language. Of cial target-system. The ideal is automatic code generation
course, the realization includes hard- and software. With
standard hardware and well-defined PLC-functionality, the
realization consists of the programmed control algorithm.

The informal method of validation is the test of the imple-

mented controller against the informal specification. Today
this often used approach involves a team of control design-
ers and users. The problem with informal validation is that
it is never complete and it takes quite a lot of time and per-
zyxwv
by the design tool.

zyx
The different parts of the formal specification with its new

zyx
abilities in controller design are discussed in this paper: In
Section I1 a more detailed generic model of the logic con-
trol design process is introduced and the formal methods
associated with it are presented. Section 111 focuses on dif-
ferent approaches for verification and validation-the main
aim of formal methods in PLC programming today.
son-power.

Figure 3: Detailed Design Process with Formal Specification and the Methods.
2432
 11. THECONTROL DESIGN PROCESS

A. Formalization and Reinterpretation

zyx
zyxwvutsrqp
zyxwvutsrq 0
Kowalewski and PreuBig [21] reinterpret SFC by C E
(Condition/Event)-sy stems.
Volker and Kramer [22] represent ST, SFC and FBD
by, higher order logic, the latter two by representing
them in ST first.
A more detailed model of the logic control design process is
given in Figure 3. The formalization of the informal speci- 0 Jimtnez-Fraustro and Rutten [23] use the synchronous

zyxwvutsrq
fication consists of three different tasks: language SIGNAL to reinterpret ST.

Formalization of specific properties, resulting in a set

of properties to be fulfilled by the controller or the B. Synthesis
controlled process. These control objectives are for-
malized using temporal logic [ 151, algebraic conditions The automatic synthesis of the control algorithm uses the
[16] or automata [17]. formal description of the process and the formal properties.
Methods for an automatic controller synthesis based on
Formal modeling of the uncontrolled process re- Petri Nets are described e.g. by Holloway and Krogh [24].
sulting in a process model that is needed in model Hanisch et al. use ConditionEvent systems [25] whercas
based approaches. This model may be discrete or hy- Moor et al. use automata [ 151. Dierks [26] developed a
brid, depending on the properties to check. synthesis method based on Duration Calculus. For formal
approaches, see also the works of Ramadge [27] and Li 1281
Direct formal modeling of the control algorithm can both with Wonham.
be done if the control problem given by the informal
specification is clearly structured and not to volumi-
nous. It is some kind of manual synthesis. Semi-formal C. Implementation
synthesis approaches include the step-wise refinement
following strict rules that guarantee given properties in Using one of the standardized PLC languages the formal
the design process. description of the control algorithm is implemented directly
(using a compiler) or indirectly (using an interprcter im-
As Figure 3 shows, depending on the formal methods ap- plemented in the PLC). In the following papers direct im-
plied, not all of these tasks have to be done. Furthermore, plementation methods are described:
there are specification methods that combine several parts
of the formalization in one step, resulting in a combined Frey works out a direct implementation of Petri nets
model. For instance the Process IPN (PIPN) presented in using SFC [29] or IL [30].
[ 181 contains the model of the plant and the properties to be Dierks shows in [31] a method to directly implement
fulfilled. automata using ST.
The formal specification of the control algorithm can be Cutts and Rattigan [32], Stanton et al. [33], and Uzam
derived in different ways. Either it is the result of the syn- and Jones [34], present different approaches for the im-

zyxwvutsrqp
thesis (manual or automatic). Or it is build via a reinterpre- plementation of Petri nets in LD.
tation procedure from the already implemented PLC code.
There are two reasons for the reinterpretation (also called 111. v & v VERIFICATION AND VALIDATION
translation, e.g. in [ 191) of existing PLC code into a formal
description: Verification and Validation are the main areas for applying
formal methods in PLC programming. Nevertheless, the
0 Most PLC programmers have no formal background notions are often confused. They answer, in fact, different
and hence they stay with their programming tech- questions. This is pointed out by Boehm [35] as follows:
niques.
‘Validation: Are we building the right product’
0 There are millions of already existing PLC programs
that can not be formally treated in any other way. ‘Verification: Are we building the product right’

Approaches for the reinterpretation of PLC programs writ- Roussel and Lesage state more precisely [36]: ‘The verifi-
ten in IEC 1131 Languages (IL = Instruction List, SFC =

zyxwvutsr
cation is the proof that the internal semantics of a model is
Sequential Function Chart, LD = Ladder Diagram, FBD = correct, independently from the modeled system. The
Function Block Diagram, ST = Structured text) can be searched properties of the models are stability, deadlock
found in the following papers: existence, ... The validation determines if the model agrees
with the designer‘s purpose.’
0 Mertke and Menzel [IO] translate IL to Petri nets.
Canet et al. [9] use a transition system to reinterpret IL. Verification and Validation may use the same formal meth-
0 Hassapis et al. [20] translate SFC to hybrid automata. ods but the properties investigated in verification are stan-

2433
dard and hence can be assumed as already formalized. L (Higher order) Logic: For an introduction to Higher
Therefore in principle, verification can be fully automated. order Logic see [40].
In validation specific properties of the controller have to be
formalized. Therefore the investigation of the informal S Synchronous Languages: the synchronous approach

zyx
specification is necessary. Hence validation can not be fully is presented in [41]. A synchronous language used in
formal and not be fully automated. control applications is “SignaI”[42].

zyxwvutsrq
The generic model shows different approaches for verifica- T General Transition Systems: See Ostroff [43] and
tion and validation. These are discussed in detail in subsec- Canet et al. [9] for examples.
tion A. The varying approaches often use the same model- E (Algebraic) Equations: Gunnarson [ 161 presents an
ing or description mechanisms. Hence, the formalisms are approach using algebraic equations over finite fields.
presented separately in subsection B . Finally the methods (Max,+) algebra [44] approaches also fall in this cate-

zyxwvutsrqpon
used to check properties are presented in subsection C.
Examples of verification and validation are presented in gory.
subsection D. Each of the examples consists of a combina-
tion of approach, formalism, and method. Using the results
of sub-sections A to C a three-letter-code is assigned to
c. Method
them. S Simulation is a widely used method for verification
and validation. Especially if there is a huge number of
input and output signals, simulation is very time-
A. Approach consuming since every possible situation has to be
checked. Hence, in most cases simulation is restricted
Validation as well as Verification can be model based or to the direct application of input signals and compar-
non model based.
ing the resulting output signals to the specification.
M Model based: In model based approaches a model of Hereby, the behavior of the process, i.e. its reaction to
the process under control is included in the analysis. the input signals, is neglected and - more critical -
The properties checked are statements on the con- only parts of the controller are tested. Simulation is

zyxwvutsrqp
trolled system. not considered in this survey.

N Non Model based: non model based approaches R Reachability Analysis: Methods based on reachabil-
analyze the formal description of the control algo- ity analysis build the complete state-space of the
rithm without taking the process into account. Con- modeled system and check properties by investigating
nections of the controller to its environment are the structure and the components of this state-space.
treated either as if they were not present or as if any- The problem with reachability analysis is the state-
thing could happen. explosion in discrete systems: The number of states in
the system grows exponentially with the number of
C Constrained based: Constrained based approaches discrete variables.
are typically non-model-based with the inclusion of
some very restricted knowledge about the process, for M Model checking: In model-checking, specifications
instance that two binary input signals are always dis- of the system behavior are checked automatically on a
joint. finite model of the system. The specifications are
formulated in a temporal logic (see [45] and [46] for
an overview on temporal logic). The model is for-
B. Fornialistn malized using automata or Petri nets e.g.. Model-
checking does not avoid the problem of state-
The presented approaches and methods are based on formal explosion.
models. The following six formalisms are (among others) T Theorem Proving: In theorem proving methods the
used for the formal description of PLC programs: system and its expected properties are formalized us-
P Petri nets: For an introduction of different Petri net ing some mathematical logic. Then the property for-
models see David and Alla [37]. mulas have to be proofed from the axioms of the sys-
tem description using some interference rules. A
C

A
Conditioflvent (C/E) Systems: C/E-Systems are
introduced by Sreenivas and Krogh [38]

Automata: Especially hybrid automata are used in

V&V of logic controllers, see Henzinger [39] for an
introduction to this formalism.

2434
zy
Theorem Prover assists the user in formulating the
proof. Intelligent approaches using machine-reasoning
may avoid this drawback of needing a highly qualified
user. A great advantage of theorem proving is the
avoidance of the state-explosion problem.
 D. zyxwvutsrqpo
zyxwvutsrqpon
Examples

In the following some examples of verification and valida-

tion approaches are given. For further approaches including
that the results are of more practical value with the inclu-
sion of additional process knowledge (constraints).

N-L-T: The group of B.J. Kramer [22] use higher order

zyxwvutsrqp
V&V for Grafcet see [19]. The presented methods are as- logic to represent ST programs. The requirements are speci-
signed a three-letter-code A-F-M indicating the used Ap- fied in LTL. The model and the requirements are used in a
proach, the Formalism to build the formal specification and theorem prover.
the Method for analysis.

M-P-R: Frey and Litz [ 1I] use a special Petri net as process IV. CONCLUSION
model and another one as model of the controller. The veri-
fication is done using reachability analysis of the combined The paper gives an overview of the current state of the art
model. of formal methods in PLC design. It rather aims to present
examples then to be complete.
M-P-M: Weng and Litz [47] present a model based verifi-
cation approach using model checking with LTL (linear The presented generic model of the control design process
time temporal logic) as method and Petri nets as formal and the definition of related terms allows the categorization
description. of different approaches in the fast growing area of research
and application.
M-P-M: Mertke and Menzel [lo] present a model based
validation approach. Their process model is build as Petri A three-letter-code for verification and validation methods
net and the PLC code is translated into another Petri net. based on the describing triple Approach-Formalism-Method
The aggregation of both nets is used as the basis for model is introduced and explained by some examples.
checking with LTL or CTL (computational tree logic). They
also propose the specification of properties in semi-formal V. REFERENCES
natural language with an automatic generation of the formal

zyx
[ l ] J.H. Christensen (Figure: International Language Standardi-

zyxwvu
description. zation) in PLCopen Standard Presentation VI.0, 1998.
[2] International Electrotechnical Commission (IEC), bzterna-
M-A-M: Hassapis et al. [20] translate an SFC to an hybrid tional Standard 61131: Programniable Logic Controllers.
automaton. The process is also modeled with a hybrid

zyxwvutsr
Part 3: Languages, 1993.
automaton. With the aggregated model of the controlled 131 R.W. Lewis, Programming industrial control systents using
process, model checking is performed using CTL and the IEC 1131-3’, IEE Publishing, London, United Kingdom,
HyTech tool. 1998.
[4] IEC 65/240/CD, Function blocks for industrial-process
M-C-R: Kowalewski and PreuBig [21] translate SFC pro- measurement and control systenis - Part I : Architecture,
grams into C/E systems. Another C/E system is used to June 1999.
model the uncontrolled plant. The composition of these CW [5] IEC 61499-2 (2”dCommittee Draft, Ed. 1.O), Function blocks
systems results in a model of the controlled plant. Reach- for industrial-process measurenzertt and control systems -
ability analysis shows if the specifications (formalized in Part 2: Engineering Task Support, April 2000.
terms of forbidden states) are fulfilled. [6] J.H. Christensen, ‘Basic Concepts of IEC 61499’, Proceed-
ings of Fachtagung Vertcilte Automatisierung, Magdeburg,
N-P-R: Frey and Litz [48] use a special Petri net model of Germany, pp. 55-62.2000.
the controller. The verification is done using reachability [7] L. Baresi, M. Mauri, A. Monti and M. Pezzk, ‘PLCTOOLS:
Design, formal validation, and code generation for program-
analysis of the Petri net.
mable controllers’, Proc. of the IEEE SMC, 2000.
N-T-M: The Carnegie Mellon research group around G.J. [8] LA. Antoniadis and V.I.N. Leopoulus: ‘A concept for the
integrated process description, PLC programming and simu-
Powers developed a method for the verification of given LD lation using Petri nets: Application in a production process’
programs [49], 1501, [51]. The L D is reinterpreted using a Proc. of the IEEE SMC, 2000.
Transition system and the properties to check are formal- 191 G. Canet, S. Couffin, J.-J. Lesage, A. Petit and P. Schnoe-
ized using CTL. The model-checker Symbolic Model Veri- belen, ‘Towards the automatic verification of PLC programs
fier (SMV) takes the model and the properties and implic- written in instruction list’, Proc. of the IEEE SMC, 2000.
itly builds the state-automaton of the system and checks if [ 101 Th. Mertke and Th. Menzel, ‘Methods and tools to the verifi-

zyxwvutsrqpo
the properties hold. If this is not true a state-sequence lead- cation of safety-related control software’, Proc. of the IEEE
ing to the contradiction is produced. SMC, 2000.
[113 G . Frey and L. Litz ‘Verification and Validation of Control
N/C-T-M: Canet et al. [9] present an approach for the vali- Algorithms by Coupling of Interpreted Petri Nets’, Proc. of
dation of existing PLC programs written in Instruction List. the IEEE SMC‘98, San Diego, Vol. 1, pp. 7-12, 1998.
[12] W. Reisig, A Primer in Petri Net Design, Berlin, Heidelberg,
The PLC code is translated into a transition system. For this
New York, Springer, 1992.
system specific properties are investigated using model- [13] P.W. Mumll, Fundamentals of Process Control Theory, ISA
checking with LTL. The example presented in [9] shows press, 3‘‘ ed., 2000.

2435
 zyxwvutsrq
zyxwvutsrqp
zyxwvut
zyxwvutsrq
[ 141 Instrument Society of America (ISA), ANSI/ISA-Standard [331 M.J. Stanton, W.F. Arnold and A.A. Buck, ‘Modelling and

zyxwvutsrqpo
S5.1: Instrumentation Symbols and ldentijkation, 1984, Re- Control of Manufacturing Systems using Petri Nets’, Pro-
affirmed 1992. ceedings of the 13” IFAC World Congress, pp. 329-334,
[15] J.G. Thistle and W.M. Wonham, ‘Control Problems in a 1996.
Temporal Logic Framework’, International Joumal of Con- [34] M. Uzam and A. H. Jones, ‘Dmiscrete Event Control System
trol, Vol. 44 (4), pp. 943-976, 1986. Design using Automation Petri Nets and their Ladder Dia-
[I 61 J. Gunnarson, ‘Algebraic Methods for Discrete Event Sys- gram Implementation’, lnt. Journal of Advanced Manufac-
tems - A Tutorial’, Proc. of the IEE WODES’96, Edinburgh turing Systems, special issue on Petri Nets Applications in
(GB), pp. 18-30, 1996. Manufacturing Systems, Vol. 14, No. 10, pp. 716-728, 1998.
[ 171 T. Moor, J. Raisch, and S.D. O’Young ‘Supervisory Control [35] B. W. Boehm, ‘Software Engineering: R&D trends and de-
of Hybrid Systems via 1-Complete Approximations’. Proc. fense needs’, Research Direclions in Software Technology
IEE WODES‘98, Cagliari, Italy, pp. 426-431, 1998. (P. Wegner, Ed.), MIT Press, Cambridge, 1979.
[ 181 C. Jorns, ‘Transparent Representation of Information Flow in [36] J.-M. Roussel and 3.-5. Lesage:, ‘Validation and Verification
Automatic Control Systems for Verification Purposes’ Proc. of Grafcet using state machine’, Proceedings of IMACS-IEEE

zyxwvutsrq
of the 1EE WODES’96, Edinburgh (GB), pp. 368-373, 1996. CESA‘96,Lille (F), pp. 758-764.,July 1996.
[ 191 S. LampCrihe-Couffin, 0. Rossi, J.-M. Roussel and J.-J. [37] R. David and H. Alla, Petri Nets and Grafcet - Tools for
Lesage, ‘Formal validation of PLC programs: A survey’, Modeling Discrete Event System, Prentice Hall, 1992.
Proceedings of the ECC’99, 1999. [38] R.S. Sreenivas and B.H. Krogh, ‘On ConditionEvent Sys-

zyxwvutsrqp
[20] G. Hassapis, I. Kotini and Z. Doulgeri, ‘Validation of a SFC tems with Discrete State Realizations’, Discrete Event Dy-
software specification by using hybrid automata’, IN- namic Systems: Theory and Applications, Kluwer Academic

zyxwvutsrq
COM’98, Volume 11, pp. 65-70, 1998. Publishers, Boston, USA, Vol. 1, pp. 209-236, 1991.
[21] S. Kowalewski and J. PreuRig, ‘Verification of sequential [39] T.A. Henzinger, ‘The Theory of Hybrid Automata’, Pro-
controllers with timing functions for chemical processes’, ceedings, 1I’hAnnual IEEE Symposium on Logic in Com-
Proc. of the. 131hIFAC World Congress, San Francisco, Vol. puter Science, IEEE Computer Society Press, pp. 278-292,
J, pp. 419-424, 1996. July 1996.
[22] N. Volker and B.J. Kramer, ‘Modular Verification of Func- [40] M.J.C Gordon. and T.F. Melham, Introduction to HOL.
tion Block Based Industrial Control Systems’, Proc. 24th Cambridge University Press, 1993.
IFAC/lFIP Workshop on Real-Time Programming, May [41] A. Benveniste and G. Berry, ‘The Synchronous Approach to
1999. Reactive and Real-Time Syste:ms’,Proceedings of the IEEE,

zyxwvu
[23] F. JimCnez-Fraustro and E. Rutten, ‘A synchronous model of Vol. 79, NO.9, pp. 1270-1282.,1991.
the PLC programming language ST’Proceedings of the Work [42] A. Benveniste and P. Le Guernic, ‘Hybrid Dynamical Sys-
In Progress session, 1st Euromicro Conference on Real-Time tems Theory and the SIGNAL Language’, IEEE Transactions
Systems, ERTS’99, York (GB),June 9-11, pp. 21-24, 1999. on Automatic Control, Vol. 35, No. 5 , pp. 525-546, 1990.

zyxwvutsrqp
[24] L.E. Holloway and B.H. Krogh, ‘Synthesis of feedback con- [43] J.S. Ostroff, ‘Automated verification of timed transition
trol logic for a class of controlled Petri nets’, IEEE Trans. on models’, Int. Workshop on Automatic Verification Methods
Automatic Control, Vol. 35, No. 5, pp. 514-523, 1989. for Finite State Systems (Springer LNCS 407), pp. 247-256,
1251 H.-M. Hanisch, A. Liider and J. Thieme ‘A Modular Plant 1989.
Modeling Technique and Related Controller Synthesis Prob- [44] F. Bacelli, G. Cohen, G.J. Olsder and J.P. Quadrat, Synchro-
lems’ Proceedings of the IEEE SMC’98, San Diego, pp. 686- nization and Linearity (An algebbra for discrete event sys-
691, 1998. tems), John Wiley & Sons, 1932.
[ 2 6 ] H. Dierks, ‘Synthesizing Controllers from Real-Time Speci- [45] R. Alur and T.A. Henzinger, ‘Logics and models of real time:
fications’ IEEE Transactions on Computer-Aided Design of a survey’, Real Time: Theoiy in Practice, Springer LNCS
lnregrnred Circuits and Systems, 18(1), pp. 33-43, 1999. 600, pp. 74-106, 1992.
1271 P.J.G. Ramadge and W.M. Wonham, ‘The Control of Dis- [46] T.A. Henzinger, ‘It’s about time: real-time logics reviewed’,
crete Event Systems’, Proc. of the IEEE, Vol. 77, pp. 81-97, Proceedings of the Ninth International Conference on
1989. Concurrency Theory (CONCIJR 1998), Springer LNCS 1466,
[28] Y. Li and W.M. Wonham, ‘Control of Vector Discrete-Event pp. 439-454, 1998.
Systems 1 - The Base Model’, IEEE Transactions on Auto- [47] X. Weng and L. Litz, ‘Verification of logic control design
matic Control, Vol. 38, NO.8, Aug. 1993, pp. 1214-1227. using SIPN and model checking-methods and case study’
[29] G. Frey, ‘PLC Programming for Hybrid Systems via Signal Proceedings of the American Control Conference ACC2000,
lnterpreted Petri Nets’, Proceedings of the 4th International Chicago, 2000.
Cor$c>rence on Automation of Mixed Processes ADPM, [48] G. Frey and L. Litz, ‘Correctness Analysis of Petri Net Based
Dortritund, Germany, September 2000. Logic Controllers’, Proceedings of the American Control
[30] G. Frey, ‘Automatic Implementation of Petri net based Con- Conference ACC2000, Chicago, 2000.
trol Algorithms on PLC’, Proceedings of the American Con- [49] I. Moon, ‘Modelling Programmable Logic Controllers for
rrol Conference ACC2000, Chicago, June 2000. Logic Verification’, IEEE Cmtrol Systems Magazine, pp. 53-
[31] H. Dierks, ‘PLC-Automata: A New Class of Implementable 59, 1994.
Real-Time Automata’, Transformation-Based Reactive Sys- [50] S.T. Probst, ‘Chemical Process Safety and Operability
/enis Development (ARTS‘97),M. Bertrait and T. Rus, editors, Analysis Using Symbolic Model Checking’, Ph.D. Thesis,
Springer LNCS 1231, pp. 1 I 1-125, 1997. Department of Chemical Eq;ineering, Carnegie Mellon Uni-
[32] G. Cutts and S. Rattigan, ‘Using Petri Nets to Develop Pro- versity, 1996.
grams for PLC Systems.” Proc. of Application and Theory of [51] I. Moon, G. Powers, J.R. Burch, and E.M. Clarke, ‘Automatic
Petri Nets 1992, Springer LNCS 616, pp. 368-372, 1992. Verification of Sequential Control Systems Using Temporal
Logic’, AiCHE Journal, Vol. 38 (l), pp.67-75, 1992.