PLC Ladder Logic Translation for SMT-Based Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for translating ladder logic into formal models for model checkers are not accurate enough to detect anomalous programs in Programmable Logic Controllers (PLCs), which are vulnerable to attacks like 'Ladder Logic Bombs, posing risks to industrial automation systems.
Innovation Solution
A method for automatic translation of ladder logic into a SMT-based model checker, involving defining network topology, extracting PLC program elements, and translating inputs, outputs, variables, and ladder diagrams into a circuit-like SMT-based model checker, using predefined data types and functions to create a formal model that can detect malicious behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing translation methods are used to convert ladder logic to formal models, then the translation process is simpler, but the accuracy is insufficient to detect anomalous programs in PLCs
Solution Approach 1:
The translation process is divided into distinct segments: extracting PLC program elements (inputs, outputs, variables, ladder diagram), translating data types according to predefined models, translating ladder diagram elements (contacts, coils, comparators, arithmetic operators) into SMT-based formal model components. This segmentation allows each aspect to be handled with appropriate precision while maintaining overall manageability.
Solution Approach 2:
A predefined formal model serves as an intermediary layer between the ladder logic representation and the SMT-based model checker. This intermediary model provides a structured mapping framework that translates PLC-specific concepts into formal verification-compatible representations, thereby improving translation accuracy without directly complicating the core verification process.
2Reliability
If a SMT-based model checker is used to detect anomalous programs, then the detection capability is improved, but the translation complexity increases
Solution Approach 1:
Predefined formal models and translation rules are established in advance before the actual translation process. These pre-configured models include data type mappings, ladder diagram element translations, and SMT function definitions, which are prepared beforehand to streamline the translation of PLC programs into verifiable formal models, thereby reducing the complexity burden during actual anomaly detection operations.
3Object-affected harmful factors
If automated translation tools are implemented to detect malicious code, then the security monitoring capability is improved, but the system complexity increases
Solution Approach 1:
The translation system automatically extracts PLC program elements from network packets, identifies the program structure, and translates it into formal models without requiring manual intervention. The SMT-based model checker then autonomously verifies the translated model to detect anomalous programs, enabling the system to self-monitor and self-protect against malicious code injection.
Data Source
AI summary
The present invention relates to a method for automatic translation of ladder logic to a SMT-based model checker in a network comprising defining (10) the topology of the network as an enriched network topology based on packets exchanged in the network, extracting (20) a program from the packets relating to a PLC in the network and identifying inputs, outputs, variables and a ladder diagram of the PLC, translating (30) the inputs, outputs, variables and ladder diagram into a predefined formal model, wherein the predefined formal model is a circuit-like SMT-based model checker, and wherein the translating (30) comprises translating the set of data types of the program according to a predefined model set of data types of the circuit-like SMT-based model checker, translating the inputs of the PLC as model inputs of the circuit-like SMT-based model checker of the same type, translating the outputs of the PLC as model output latches of the circuit-like SMT-based model checker of the same type, translating the variables of the PLC as model variable latches of the circuit-like SMT-based model checker of the same type, translating comparators and arithmetic operators of the ladder diagram into a plurality of predefined model functions of the circuit-like SMT-based model checker, translating contacts and coils of the ladder diagram according to predefined model recursive procedures relating to the predefined model set of data types, the model inputs, the model output latches, the model variable latches and the plurality of predefined model functions, wherein the contacts are switches that can block or allow the flow of the current in a connection and each of the contacts is controlled by a Boolean input or variable, and wherein the coils are assignments to Boolean variables.