TY - JOUR
T1 - Automated test generation for IEC 61131-3 ST programs via dynamic symbolic execution
AU - He, Weigang
AU - Shi, Jianqi
AU - Su, Ting
AU - Lu, Zeyu
AU - Hao, Li
AU - Huang, Yanhong
N1 - Publisher Copyright:
© 2021
PY - 2021/6/1
Y1 - 2021/6/1
N2 - Programmable logic controllers (PLCs) are essentially domain-specific computers that are widely used in the industrial field. These industrial devices are usually required to be of high reliability, and program bugs can lead to catastrophes. However, there are few automated testing tools for PLC programs. This paper proposes a framework, named STAutoTester, for automatically generating test cases for IEC 61131-3 Structured Text (ST) programs. It adopts Dynamic Symbol Execution (DSE) combined with redundant path pruning to efficiently perform PLC multi-cycle test data generation under different coverage criteria. We have evaluated STAutoTester on 21 programs. The experimental results show that STAutoTester can effectively handle these programs. Compared to SYMPLC, a previous symbolic execution based tool for automatically testing PLC software, we achieved comparable statement coverage with much fewer test cases. Besides, we have achieved greater branch coverage and stricter MC/DC coverage, which were not implemented by SYMPLC.
AB - Programmable logic controllers (PLCs) are essentially domain-specific computers that are widely used in the industrial field. These industrial devices are usually required to be of high reliability, and program bugs can lead to catastrophes. However, there are few automated testing tools for PLC programs. This paper proposes a framework, named STAutoTester, for automatically generating test cases for IEC 61131-3 Structured Text (ST) programs. It adopts Dynamic Symbol Execution (DSE) combined with redundant path pruning to efficiently perform PLC multi-cycle test data generation under different coverage criteria. We have evaluated STAutoTester on 21 programs. The experimental results show that STAutoTester can effectively handle these programs. Compared to SYMPLC, a previous symbolic execution based tool for automatically testing PLC software, we achieved comparable statement coverage with much fewer test cases. Besides, we have achieved greater branch coverage and stricter MC/DC coverage, which were not implemented by SYMPLC.
KW - Dynamic symbol execution
KW - IEC 61131-3 ST
KW - Test generation
UR - https://www.scopus.com/pages/publications/85101538298
U2 - 10.1016/j.scico.2021.102608
DO - 10.1016/j.scico.2021.102608
M3 - 文章
AN - SCOPUS:85101538298
SN - 0167-6423
VL - 206
JO - Science of Computer Programming
JF - Science of Computer Programming
M1 - 102608
ER -