Dániel Darvas (CERN BE-ICS-PCS / TU Budapest) DSL tools for formal verification Spoofax meeting 19/01/2016, CERN Joint work with B. Fernández, E. Blanco, S. Bliudze, J.O. Blech, J-C. Tournier, T. Bartha, A. Vörös, I. Majzik

What are we doing? Formal verification of PLC programs … to complement testing … to find hidden, complex bugs … accessible to developers

Native support for only one language Model checking (PLCverif) Formal model Formal requirement Model checker SatisfiedNot satisfied Counter- example PLC code (SCL) Verification report Reductions Verification based on the implementation External tool checks the satisfaction of the req. Self-contained report with counterexample Requirement patterns User-friendly requirem’t specification

Model checking – Technologies used Reductions Textual representation Textual input/output Textual representation HTML Java +Java Formal model Formal requirement Model checker PLC code (SCL) Requirement patterns Verification report

Model checking – Technologies used Reductions This should remain EMF Metamodel generated by Xtext Java Verification model PLC code (SCL) SCL AST

The PLCverif tool Eclipse-based editor for PLC programs

The PLCverif tool Defining verification cases (requirement, fine-tuning, etc.) No model checker-related things or temporal logic expressions

The PLCverif tool Defining verification cases (requirement, fine-tuning, etc.) No model checker-related things or temporal logic expressions

The PLCverif tool Click-button verification, verification report with the analysed counterexample

Problems with the current method −Our ST (SCL) Xtext grammar is partial −Double maintenance of ST (SCL) grammars However, −Xtext’s performance is good enough 1 file with 120k statements parsed in 1–3 sec (headless) −Headless parsing is needed (  Jenkins) −Our tool is relatively stable and working fine Could we use the Spoofax-based implementation in our setting without major changes?

Technologies used (reminder) Reductions This should remain EMF Metamodel generated by Xtext Java Verification model PLC code (SCL) SCL AST

Potential future work #1 Code generation PLC code (SCL) Currently Some model Future plan SCL Abstract Syntax Tree Some model PLC code (SCL) Code generator

Potential future work #2 Support for other PLC languages (IL/STL) ST (SCL) code FUNCTION_BLOCK Test VAR_INPUT in1: Bool; END_VAR VAR_OUTPUT out1: Bool; END_VAR BEGIN out1:= NOT in1; END_FUNCTION_BLOCK FUNCTION_BLOCK Test VAR_INPUT in1: Bool; END_VAR VAR_OUTPUT out1: Bool; END_VAR BEGIN out1:= NOT in1; END_FUNCTION_BLOCK Siemens IL (STL) code FUNCTION_BLOCK Test VAR_INPUT in1: Bool; END_VAR VAR_OUTPUT out1: Bool; END_VAR BEGIN NETWORK A in1; NOT; = out1; END_FUNCTION_BLOCK FUNCTION_BLOCK Test VAR_INPUT in1: Bool; END_VAR VAR_OUTPUT out1: Bool; END_VAR BEGIN NETWORK A in1; NOT; = out1; END_FUNCTION_BLOCK

Potential future work #2 Support for other PLC languages (IL/STL) PLC code (SCL) Currently PLC code (IL/STL) Future plan Regex-based translation Formal model PLC code (SCL) PLC code (IL/STL) Formal model Limited translation

Potential future work #3 Improve the requirement specification Currently one requirement at a time Limited editing support (only simple content assist) Here we should accept any Boolean SCL expression Currently

Potential future work #4 (Simple) static code analysis Are all the variables assigned? Do all conditional statements have meaningful conditions? IF unsignedVar >= 0 THEN … Are the variable names consistently used? foobar = FOOBAR = fOoBaR Is the code correctly indented? A technical student project is planned to be started on this.

Wrap up −Replacing Xtext with Spoofax would be beneficial No double maintenance Better SCL implementation Could help our future plans −Constraints for the replacement Performance Headless operation “It kind of works now.” – The replacement effort should be reasonable.