Automated test generation for IEC 61131-3 ST programs via dynamic symbolic execution

Weigang He; Jianqi Shi; Ting Su; Zeyu Lu; Li Hao; Yanhong Huang

doi:10.1016/j.scico.2021.102608

Automated test generation for IEC 61131-3 ST programs via dynamic symbolic execution

Weigang He
, Jianqi Shi^*
, Ting Su
, Zeyu Lu
, Li Hao
, Yanhong Huang

^*Corresponding author for this work

Software Engineering Institute

East China Normal University

Research output: Contribution to journal › Article › peer-review

11 Scopus citations

Abstract

Programmable logic controllers (PLCs) are essentially domain-specific computers that are widely used in the industrial field. These industrial devices are usually required to be of high reliability, and program bugs can lead to catastrophes. However, there are few automated testing tools for PLC programs. This paper proposes a framework, named STAutoTester, for automatically generating test cases for IEC 61131-3 Structured Text (ST) programs. It adopts Dynamic Symbol Execution (DSE) combined with redundant path pruning to efficiently perform PLC multi-cycle test data generation under different coverage criteria. We have evaluated STAutoTester on 21 programs. The experimental results show that STAutoTester can effectively handle these programs. Compared to S_YMPLC, a previous symbolic execution based tool for automatically testing PLC software, we achieved comparable statement coverage with much fewer test cases. Besides, we have achieved greater branch coverage and stricter MC/DC coverage, which were not implemented by S_YMPLC.

Original language	English
Article number	102608
Journal	Science of Computer Programming
Volume	206
DOIs	https://doi.org/10.1016/j.scico.2021.102608
State	Published - 1 Jun 2021

Keywords

Dynamic symbol execution
IEC 61131-3 ST
Test generation

Access to Document

10.1016/j.scico.2021.102608

Cite this

@article{38387e35a5e3471da16a6546d6ca9c1f,

title = "Automated test generation for IEC 61131-3 ST programs via dynamic symbolic execution",

abstract = "Programmable logic controllers (PLCs) are essentially domain-specific computers that are widely used in the industrial field. These industrial devices are usually required to be of high reliability, and program bugs can lead to catastrophes. However, there are few automated testing tools for PLC programs. This paper proposes a framework, named STAutoTester, for automatically generating test cases for IEC 61131-3 Structured Text (ST) programs. It adopts Dynamic Symbol Execution (DSE) combined with redundant path pruning to efficiently perform PLC multi-cycle test data generation under different coverage criteria. We have evaluated STAutoTester on 21 programs. The experimental results show that STAutoTester can effectively handle these programs. Compared to SYMPLC, a previous symbolic execution based tool for automatically testing PLC software, we achieved comparable statement coverage with much fewer test cases. Besides, we have achieved greater branch coverage and stricter MC/DC coverage, which were not implemented by SYMPLC.",

keywords = "Dynamic symbol execution, IEC 61131-3 ST, Test generation",

author = "Weigang He and Jianqi Shi and Ting Su and Zeyu Lu and Li Hao and Yanhong Huang",

note = "Publisher Copyright: {\textcopyright} 2021",

year = "2021",

month = jun,

day = "1",

doi = "10.1016/j.scico.2021.102608",

language = "英语",

volume = "206",

journal = "Science of Computer Programming",

issn = "0167-6423",

publisher = "Elsevier B.V.",

}

TY - JOUR

T1 - Automated test generation for IEC 61131-3 ST programs via dynamic symbolic execution

AU - He, Weigang

AU - Shi, Jianqi

AU - Su, Ting

AU - Lu, Zeyu

AU - Hao, Li

AU - Huang, Yanhong

PY - 2021/6/1

Y1 - 2021/6/1

N2 - Programmable logic controllers (PLCs) are essentially domain-specific computers that are widely used in the industrial field. These industrial devices are usually required to be of high reliability, and program bugs can lead to catastrophes. However, there are few automated testing tools for PLC programs. This paper proposes a framework, named STAutoTester, for automatically generating test cases for IEC 61131-3 Structured Text (ST) programs. It adopts Dynamic Symbol Execution (DSE) combined with redundant path pruning to efficiently perform PLC multi-cycle test data generation under different coverage criteria. We have evaluated STAutoTester on 21 programs. The experimental results show that STAutoTester can effectively handle these programs. Compared to SYMPLC, a previous symbolic execution based tool for automatically testing PLC software, we achieved comparable statement coverage with much fewer test cases. Besides, we have achieved greater branch coverage and stricter MC/DC coverage, which were not implemented by SYMPLC.

AB - Programmable logic controllers (PLCs) are essentially domain-specific computers that are widely used in the industrial field. These industrial devices are usually required to be of high reliability, and program bugs can lead to catastrophes. However, there are few automated testing tools for PLC programs. This paper proposes a framework, named STAutoTester, for automatically generating test cases for IEC 61131-3 Structured Text (ST) programs. It adopts Dynamic Symbol Execution (DSE) combined with redundant path pruning to efficiently perform PLC multi-cycle test data generation under different coverage criteria. We have evaluated STAutoTester on 21 programs. The experimental results show that STAutoTester can effectively handle these programs. Compared to SYMPLC, a previous symbolic execution based tool for automatically testing PLC software, we achieved comparable statement coverage with much fewer test cases. Besides, we have achieved greater branch coverage and stricter MC/DC coverage, which were not implemented by SYMPLC.

KW - Dynamic symbol execution

KW - IEC 61131-3 ST

KW - Test generation

UR - https://www.scopus.com/pages/publications/85101538298

U2 - 10.1016/j.scico.2021.102608

DO - 10.1016/j.scico.2021.102608

M3 - 文章

AN - SCOPUS:85101538298

SN - 0167-6423

VL - 206

JO - Science of Computer Programming

JF - Science of Computer Programming

M1 - 102608

ER -

Automated test generation for IEC 61131-3 ST programs via dynamic symbolic execution

Abstract

Keywords

Access to Document

Other files and links

Fingerprint

Cite this