Exploring Integrated Circuit Verification Methodology for Verification and Validation of PLC Systems

Manish M. Patil Professor, Department of Electronics, MAE College of Engineering, Alandi

Pune, India manishp@ieee.org

Dr. Shaila Subbaraman Professor, Department of Electronics,

DKTE College of Engineering Sangli, India

shailasubbaraman@yahoo.co.in

Shirish Joshi Director, Design

Advanced Digital Microsystems Mumbai, India

shirish_sjoshi@yahoo.com

Abstract – With increased complexity in control and automation systems, efforts are going on for developing reliable and safe control systems. IEC61131-3 is most commonly used control specification standard. Development of IEC61499 is an effort to utilize proven software engineering practices that can provide benefits such as portability, interoperability, configurability and re-configurability to these systems. But, researchers have raised questions on its effectiveness for defining system level architecture, successful exploitation of current software engineering practices and many other ambiguities [1, 2, and 3]. Irrespective of which standard is used for control specification, verification of such systems and their safety assurance is one of the major challenges.

VHDL is one of well accepted modeling languages used for design of integrated circuits. VHDL Register Transfer Level (RTL) synthesis is IEC and IEEE dual logo standard (IEC62050, IEEE1076.6). Functional Block (FB) and Ladder Diagram (LD) can be effectively modeled and implemented on FPGA using VHDL. VHDL supports expected benefits of the standard at implementation level. It is possible to get accurate timing analysis and reliable verification of control and automation systems. Existing methods and chain of VLSI design, verification and validation tools can be utilized for this purpose. Once PLC is implemented on FPGA, it also provides response time details under safety critical conditions. This paper presents how integrated circuit (IC) verification method can be used effectively for assuring functional correctness and response time analysis of PLC program.

Index Terms – PLC Verification and Validation, Ladder Diagram, Functional Block, VHDL, PLC on FPGA, PLC Response Time Analysis

I. INTRODUCTION

Programmable Logic Controllers are most commonly used devices for automation and control. They are finding their place in various critical control systems like nuclear reactors, apart from other complex industrial control applications [4]. It is standard practice to deploy dedicated hardware logic that can take care of safety aspects. Trend is now moving towards integrating safety aspects inside the

control program [5]. Verification and validation (V&V) of complete system is very important under such conditions. Typical objectives of V&V activities are to assure safety, guarantee correctness of functionality and correct estimation of systems time response. Jay H King had addressed practical difficulties in PLC validation on the field [6]. Lot of effort is going on to derive reliable and accepted V&V method by researchers [7 to 9]. Most commonly used methods are model checking and theorem proving. Such methods typically require implementing PLC program directly in a formal language or translating existing PLC program into formal language for automatic verification. Modeling and theorem deriving is very difficult activity for plant engineers. Various researchers have suggested different specification languages / methods for effective verification [10 to 14]. Automatic computer programs for such methods are possible, but there are problems with creating integrated environments resulting bottleneck in analytic V&V. IEC61499 was developed for system level design of distributed automation but its definition related to FB execution is incomplete. This makes it further difficult to verify and validate the PLC programmed with help of this standard. Root cause of these all issues is, sequentially executing controller or processors that are going to be used at the core of these PLC’s.

In his paper, Albert Benveniste had expressed need of synchronous programming language and a tool that is flexible enough to support an easy specification, and powerful enough that can guarantee matching of actual implementation with the specification [15]. Control and automation systems being reactive and real time systems, it consists of concurrently functioning and communicating components. LD and FB supports representing such specification. Problem comes when we try to implement this concurrency through sequentially executing controllers. VHDL can capture both sequential and concurrent distributed control specification. VHDL supports modular and formal techniques to specify, verify and implement the control logic on FPGA. Its constructs and modeling features

2011 International Symposium on Electronic System Design

978-0-7695-4570-7/11 $26.00 © 2011 IEEE

DOI 10.1109/ISED.2011.47

88

has potential for developing integrated framework covering complete specification-implementation cycle. VHDL can also describe timing specification and can also be used for waveform generation (Very useful feature for simulation and verification activities). It is used since 1990 for modeling, synthesis and verification of complex IC design. Set of matured and reliable tool chains are already available. Authors and other researchers have already demonstrated automated tool for conversion of LD to HDL [16, 17, and 18]. So, it has potential to create a platform; where common modeling and verification language can be utilized by the synthesis tool for direct implementation of PLC hardware on FPGA. When such modular, concurrent specification is implemented on FPGA, it generates fairly deterministic system. Being hardwired implementation on FPGA, all responses of implemented design are predictable. Vendors are also providing these devices appropriate for automotive, networking and industrial control segments. With help of mentioned verification methods, it is possible to develop an integrated framework that not only helps in system level verification but also provides accurate time response analysis of implemented design. Thus, what we need to assure safety and guarantee functional correctness of the control specification can be achieved. This creates completely integrated environment covering specification-verification-implementation-validation.

VHDL can play a role similar to XML [19] for easy exchange of information between tools of different FPGA vendors. This enables implementation of PLC on FPGA platform from any vendor (configurability and portability). FPGA by nature supports partial reconfiguration which makes it able to adapt to control hardware during operation (reconfiguration). Considering the fact that controllers and FPGA may co-exist in distributed applications, linkage between XML and VHDL can take care of issues associated with joint operation of different embedded devices (interoperability). In this paper, effectiveness of IC verification method for verification and validation of control and automation system is discussed with case study. Section II discusses various verification methods used by IC design engineers. Section III discusses application of Verification method: LD and FB are modeled using VHDL along with its verification using IC verification tools. Section IV discusses validation of the verified design using FPGA platform. Finally section V concludes the paper and discusses scope for future work.

II. IC VERIFICATION METHOD : AN OVERVIEW

Typical IC design process starts with writing design specification using HDL (VHDL or Verilog). It is followed by verification. Figure 1 shows basic IC verification architecture. It can be categorized broadly into two methods: 1) Functional verification and 2) formal verification. Whether it is functional or formal verification, writing testbench is integral part of the verification process.

Figure 2 shows different steps in complete IC verification flow.

Figure 1: Basic Verification Architecture

���������������� �������

�������������� ���� ���������������

���� ������������������

������������ ��������� ������!���� !�������"������

#������������� ���� ������������

�����������������

�����������������

����$%�&�������� !�������

����'������(�� ����'�����������������

�)�

Figure 2: Steps in Verification

A testbench is a stimulus generating model written in

VHDL that generates set of input pattern for verifying the functionality of design under test (DUT). Simulation environment then help in observing the response in wave window or through log file (text report). Quality testbench is required for successful verification of the DUT. While verifying complex design, it is very crucial to know whether all important test cases being covered by the test bench or no. How trust worthy is the written testbench? Are there human errors in written test bench? If the test bench is unable to generate all expected pattern of inputs, quality of verification is poor. Manually written testbenches typically suffer with incomplete stimulus generation. In order to remove such human errors and improve quality of verification, it is possible to automate the process of generating test benches. It is also possible to provide required constraints for such automated or randomized test bench generation. For example, this can help in avoiding state exploration problem. It is possible to avoid unwanted combination or pattern of input sequence through such constraints. Such constraints are typically derived from functional specification of the design. Hardware verification

89

languages (HVLs) like ‘e’ or ‘Vera’ helps in generating such automated testbenches. Even though generated automatically, quality of such automated testbenches still needs to be verified. Expected quality of these test benches is assured with help of coverage driven analysis. Coverage analysis typically checks for complete DUT cover by testbench. This includes, Line Coverage, Branch Coverage, Expression Coverage, Toggle Coverage, FSM Coverage, Path Coverage etc. This process ensures that test bench is generating all possible patterns required to verify the design (DUT). It is an indication that verification results obtained are trustworthy [20].

Figure 3. Generic Architecture for Coverage Driven Verification

For complex designs, it is difficult to manually read log files generated by simulator or find the bug by observing the waveform window. Formal method of model checking can be used in such situation. Assertion or characteristics of the design can be proved or disproved with this method. Figure 3 shows generic architecture of this coverage driven verification method [21]. “Generator” generates required transactions (high level test situation) based on constraints. Constraints are derived on the basis of objective of verification and scope of the test case. It is possible to generate multiple test benches to cover different corner cases in the design. “Driver” converts the test case situation coming from the generator to a lower level signals and drive it into the DUT (discrete state test pattern). Once stimulus is injected into DUT, “Monitor” captures input stimuli and output response of the DUT for further checking. “Checker” verifies the received data for expected response. Finally, “Coverage Scoreboard” counts number of verified and non verified conditions for estimating quantitative measurement of quality. Besides this, there is a very important verification aspect of error injection and error detection. In error injection, the generator generates the erroneous set of inputs and expects that the DUT flags the error. In error detection, the monitors and checkers catches the unwanted output assertions. This paper discusses only the method experimented for verification of the control specification using LD and FB.

III. APPLICATION OF IC VERIFICATION METHOD FOR

VERIFICATION OF CONTROL SPECIFICTION

In this section, application of the methods mentioned in section-II is demonstrated. It looks little difficult for real plant engineer to adopt this method without formal training but work is going on to automate the whole process through user friendly GUI. It is a matter of invoking different executables through tool command language (TCL) scripting.

Figure 4: Sample LD

Figure 5: VHDL Module of the sample LD

Figure 6: Sample FB

Figure 4 shows one sample ladder diagram. Figure 5 shows its corresponding VHDL model. Figure 6 shows one of the IEC compliant functional blocks. Its corresponding VHDL model is shown in Figure 7. Figure 8 represents the structure of testbench to verify LD design. “Xilinx Web Pack ISE” is one of the free FPGA development environments with built in simulator for VHDL modules. It also supports “ModelSim” simulator from Mentor Graphics. The environment supports two types of simulation. 1) Functional: where response of the DUT is verified for

library IEEE; use IEEE.STD_LOGIC_1164.ALL; use IEEE.STD_LOGIC_ARITH.ALL; entity PLC1 is Port ( start, I1, I2, clk : in STD_LOGIC; p1,p2 : out STD_LOGIC); end PLC1; architecture Behavioral of PLC1 is begin Process(clk) begin if clk = '1' and clk'event then p1 <= not start and (not start or I2) and not I1; p2 <= not start and I1 and not I2; end if; end process; end Behavioral;

90

correct functionality. 2) Post Place and Route: where simulator takes in to consideration actual implementation of the logic on configurable hardware of FPGA and provides time delay information for all signal responses. Figure 9 shows this simulation results and it can be related clearly with figure 4, 5 and 8. Figure 10 shows zoomed in view of the wave window which clearly shows time delay associated with output p1. The development environment also provides detail timing report from all inputs to outputs. Figure 11 shows snapshot of the timing report. The capabilities of the simulator built into Xilinx is limited to 1) viewing the results in the wave window, 2) querying the results in the console panel and 3) examine results in the read only static timing report. Even though the results are shown only for LD, as FB also is modeled using VHDL, same method is applicable for FB verification.

Figure 7: VHDL Model of FB This verification was done using ModelSim PE student

edition available free on net. Generator, predictor and checker models were developed using VHDL to create self checking testbench and results were observed in the simulator. Tools like Isim from Xilinx are in the process of upgrading and even though it currently do not support assertion based verification, it may support it in future enabling easy usage of the tool.

Figure 8: Test Bench for VHDL Model of LD

library IEEE; use IEEE.STD_LOGIC_1164.ALL; use IEEE.STD_LOGIC_ARITH.ALL; use IEEE.STD_LOGIC_UNSIGNED.ALL; entity FB1 is Port ( A,B,Enable : in STD_LOGIC; X : out STD_LOGIC); end FB1; architecture Behavioral of FB1 is begin Process (Enable) Begin If Enable = '1' then x <= (not A and B) or (not B and A) end if; end process; end Behavioral;

LIBRARY ieee; USE ieee.std_logic_1164.ALL; USE ieee.std_logic_unsigned.all;

ENTITY testplc IS END testplc;

ARCHITECTURE behavior OF testplc IS -- Component Declaration for the DUT COMPONENT PLC1 PORT( start : IN std_logic; I1 : IN std_logic; I2 : IN std_logic; clk : IN std_logic; p1 : OUT std_logic; p2 : OUT std_logic ); END COMPONENT; --Inputs signal start : std_logic := '0'; signal I1 : std_logic := '0'; signal I2 : std_logic := '0'; signal clk : std_logic := '0'; --Outputs signal p1 : std_logic; signal p2 : std_logic; -- Clock period definitions constant clk_period : time := 1us; BEGIN -- Instantiate the Unit Under Test (UUT) uut: PLC1 PORT MAP ( start => start, I1 => I1, I2 => I2, clk => clk, p1 => p1, p2 => p2 ); -- Clock process definitions clk_process :process begin

clk <= '0'; wait for clk_period/2; clk <= '1'; wait for clk_period/2; end process; -- Stimulus process stim_proc: process begin start <= '1'; wait for 10us; start <= '0'; wait for 5us; I1 <= '1'; I2 <= '0'; wait for 5us; I1 <= '0'; I2 <= '1'; wait for 5us; I1 <= '1'; I2 <= '0'; wait for 5us; end process; END;

91

Figure 9: Functional Simulation Result

Figure 10: Zoomed in View of Simulation Result

Figure 11 . Snap Shot of Static Timing Report

Even though the demonstrated example is very small, in one of the project of automating machine control using FPGA, machine was operating in cycles such as ‘C’, ‘S’, ‘L’ (plant engineers interpretation of the control operation based on the plate movements). Stimulus based simulation method was used to verify the operation of ‘C’, ‘S’ and ‘L’ cycles independently. This was 32 input 40 output system and discussed verification method was applied to find the bugs, where the transaction generator was designed to generate the PLC cycles like ‘L’ cycle, ‘S’ cycle, ‘C’ cycle in randomized fashion (Done using high level verification language: system Verilog). Then driver converted the cycles coming from the generator to a lower level signals to drive the design under test. Monitor helped in grabbing and comparing the different input and output data for reporting the discrepancies such as motor 3 is not stopping when sensor no 27 and 28 are getting activated at the time machine enters in to c cycle after L cycle. In all other sequence combination, it was functioning correctly. The checker helped in observing the output states are correctly transitioning as per the requirement and verified that no unwanted states are occurring.

Figure 12: Test Pattern Generation module

PE1

2

4

3 7

1 5

6preset

p2

p1 int2

clk startplc

int1Reset

CH4CH5CH1

PLC1

2

4

3 7

1

6I1

clk

I2 p2

start

p1

CH3

CLK1

LogicAnalyser

CLK2

CH2

Figure 13: Validation Platform Architecture

library IEEE; use IEEE.STD_LOGIC_1164.ALL; use IEEE.STD_LOGIC_ARITH.ALL; use IEEE.STD_LOGIC_UNSIGNED.ALL; entity PE1 is Port ( clk, preset, p1, p2 : in STD_LOGIC; startplc, int1, int2 : out STD_LOGIC); end PE1; architecture Behavioral of PE1 is type state_type is (s0,s1,s2); signal y: state_type ; begin process(preset,clk) begin if(clk'event and clk='1')then if(preset ='0')then y<=s0; else case y is when s0=>

y<=s1; int1<='0';

int2<= '0'; startplc<='1';

when s1=> if(p1 ='1')

then y<=s2; else y <= s1; end if; int1<='0'; int2<='1'; startplc<='0'; when s2=> if(p2 ='1')then y<=s1; else y <= s2; end if; int1<='1'; int2<='0'; startplc <= '0'; end case; end if; end if; end process; end Behavioral;

2 paths analyzed, 2 endpoints analyzed, 0 failing endpoints 0 timing errors detected. --------------------------------------------------------------- Source: I1 (PAD) Destination: p2 (FF) Destination Clock: clk_BUFGP rising at 0.000ns Requirement: 6.000ns Data Path Delay: 3.996ns (Levels of Logic = 2) Clock Path Delay: 2.146ns (Levels of Logic = 2) Maximum Data Path: I1 to p2 ------------------------------------------------- --------

Total 3.996ns (2.239ns logic, 1.757ns route)

92

Figure 14: Validation Results on Logic Analyser

IV. METHOD FOR DESIGN VALIDATION WITH FPGA

PLATFORM

In above mentioned sections (II and III) software based verification is done using computer. To guarantee the correctness of the adopted method and correctness of the simulation software, one more synthesizable VHDL module was developed that generated the expected test pattern physically on the FPGA pins. Figure 12 shows the pattern generating “synthesizable VHDL module”. It is as if actual process is emulated with this module. So PLC control module along with this test pattern generator module was ported on single FPGA chip with their pins coming out on FPGA separately. While connecting the outputs of pattern generator to PLC module and output of PLC module back to pattern generator module, these signals were tapped with help of logic analyzer and system response was analyzed. Any conventional PLC operation also can be validated using the method. Figure 13 shows architecture of this test set-up. So whatsoever test signals were generated by testbench for simulation environment in section-II (Figure 8), same were physically generated by this module. Figure 14 shows result obtained from the logic analyzer window that are matching with the simulation results in figure 9.

V. CONCLUSION

The paper had shown possibility of utilizing existing VLSI verification and validation methods for effective verification of PLC program as well as system. Once, IEC61131-3 control specifications are converted in to VHDL through automated tool, PLC V&V is open to explore all proven verification and validation methodologies from VLSI domain. Different examples are discussed to understand usage of available tool chain for control and automation systems. Even though for more complex applications, report or log files of obtained results are huge, tool command language (tcl), helps in extracting only required information that is relevant for verification of safety or other critical conditions. Such tcl scripts not only help in focusing on expected verification goals, but this is a key feature for developing user friendly tool, relieving plant engineers from the burden of understanding VHDL, and associated verification flow. The method is very effective for ensuring functional correctness as well as verifying real time responses of the system during safety critical conditions.

VI. REFERENCES [1] Valeriy Vyatkin, “The IEC 61499 Standard and Its Semantics”, IEEE

Industrial Electronics Magazine, December 2009 DOI 10.1109/MIE2009.934796 pp 40-48.

[2] Kleanthis Thramboulidis, “IEC 61499 Function Block Model: Facts and Fallacies”, IEEE Industrial Electronics Magazine, December 2009, DOI 10.1109/MIE2009.934788 pp 7-22.

[3] Alois Zoitl, Valeriy Vyatkin, “IEC 61499 Architecture for Distributed Automation: The Glass Half Full View”, IEEE Industrial Electronics Magazine, December 2009, DOI 10.1109/MIE2009.934789 pp 7-22.

[4] Junbeom Yoo, Sungdeok Cha, Eunkyoung Jee, “A Verification Framework for FBD based Software in Nuclear Power Plants”, 1530-1362/08.

[5] Andreas Otto, Klas Hellmann, “IEC 61131: A General Overview and Emerging Trends”, IEEE Industrial Electronics Magazine, Volume 3 No. 4 DEC 2009, pp 27-31.

[6] Jay H King, “A Practical Approach to PLC Validation”, Nov. 10, 2005, special edition: Computer Validation-II.

[7] Devinder Thapa, Chang Mok Park, Suraj Dangol, and Gi-Nam Wang, “III-Phase Verification and Validation of IEC Standard Programmable Logic Controller”, 0-7695-2731-0/06, 2006.

[8] M.Bani Younis, G. Fret, “Formalisation of existing PLC program: A survey”,S2R-00-0239, July, 2003.

[9] Darlam Fabio Bender, Benoît Combemale, Xavier Crégut, Jean Marie Farines, Bernard Berthomieu, and François Vernadat, “Ladder Metamodeling and PLC Program Validation through Time Petri Nets”, ECMDA-FA 2008, LNCS 5095, pp. 121–136, Springer-Verlag Berlin Heidelberg 2008.

[10] Aneta Vulgarakis, Aida auševi, “Applying REMES behavioral modeling to PLC systems”, 978-1-4244-4221-8/09.

[11] Tord Alenljung and Bengt Lennartson, “Formal Verification of PLC Controlled Systems Using Sensor Graphs”, 978-1-4244-4579-0/09.

[12] Hai Wan, Ming Gu, Xiaoyu Song , “Parameterized Specification and Verification of PLC Systems in Coq”, 978-0-7695-4148-8/10, 2010.

[13] Fernando Jim Cnez- Fr Austro, “A synchronous model of IEC 61131 PLC languages in SIGNAL”, 0-7695-1221-610

[14] Min Z Hou, Fei He, Ming Gu, Xiaoyu Song, “Translation-based model checking for PLC programs”, 0730-3157/09.

[15] Albert Benveniste, Gerard Berry, “The Synchronous Approach to Reactive and Real Time Systems”, Proceedings of the IEEE, Vol. 79, No. 9, September 1991, 0018-9219/91$01.00 © 1991 IEEE.

[16] Shaila Subbaraman, Manish M Patil, Prashant Nilkund, “Novel Integrated development Environment for Implementing PLC on FPGA by Converting Ladder Diagram to Synthesizable VHDL Code”, ISBN: 978-1-4244-7815-6/10, pp1791-1795.

[17] Manish M Patil, Shaila Subbaraman, Prashant Nilkund, “Considerations for implementing PLC on FPGA and Scope for Research”, IEEE International Conference ICCAS 2010 Korea, Oct 27-31, 2010, 978-89-93215-02-1 98560/10, pp2170-2174.

[18] Daoshan Du, Yadong Liu, Xingui Guo, Kazuo Yamazaki, Makoto Fujishima, “Study on LD-VHDL conversion for FPGA Based PLC Implementation”, International Journal of Advanced Manufacturing Technology (2009) 40:1181-1190 DOI 10.1007 /s00170-008-1426-4.

[19] MargaMarcos, Elisabet Estevez, Federico Prez, Eelco VanDer Wal, “XML Exchange of Control Programs”, IEEE Industrial Electronics Magazine, December 2009 DOI 10.1109/MIE2009.934794 pp 32-35.

[20] Janick Burgeron, “Writing Testbenches: Function Verification of HDL Models”, Kluwer Academic Publishers, ISBN 0-7923-7766-4.

[21] Thomas Anderson, Janick Bergeron, Eduard Cerny, Alan Hunter and Andrew Nightingle, “System Verilog Reference Verification Methodology”, http://www.eetimes.com/design/programmable-logic/4004083/SystemVerilog-reference-verification-methodology-RTL?pageNumber=2, 05/01/2006 9:00AM EDT.

93