<?xml version="1.0" encoding="UTF-8"?> <articles> <article xmlns:xlink="http://www.w3.org/1999/xlink/"> <front> <journal-meta> <journal-title/> <abbrev-journal-title/> <issn/> </journal-meta> <article-meta> <title-group> <article-title>Applying model checking to critical PLC applications</article-title> </title-group> <contrib-group> <contrib contrib-type="author"> <name> <surname>Fern谩ndez Adiego</surname> <given-names>Borja</given-names> </name> <aff> <institution>CERN</institution> </aff> </contrib> <contrib contrib-type="author"> <name> <surname>Avinashkrishna</surname> <given-names>Bhimavarapu</given-names> </name> <aff> <institution>TCS, Madhapur</institution> </aff> </contrib> <contrib contrib-type="author"> <name> <surname>Blanco Vi帽uela</surname> <given-names>Enrique</given-names> </name> <aff> <institution>CERN</institution> </aff> </contrib> <contrib contrib-type="author"> <name> <surname>Darvas</surname> <given-names>Daniel</given-names> </name> <aff> <institution>CERN</institution> </aff> </contrib> <contrib contrib-type="author"> <name> <surname>Gaikwad</surname> <given-names>Yogesh</given-names> </name> <aff> <institution>TCS, Madhapur</institution> </aff> </contrib> <contrib contrib-type="author"> <name> <surname>Lee</surname> <given-names>Gisik</given-names> </name> <aff> <institution>Mobiis Co. Ltd., Seoul</institution> </aff> </contrib> <contrib contrib-type="author"> <name> <surname>Pedica</surname> <given-names>Riccardo</given-names> </name> <aff> <institution>Vitrociset, Rome</institution> </aff> </contrib> <contrib contrib-type="author"> <name> <surname>Prieto Diaz</surname> <given-names>Ignacio</given-names> </name> <aff> <institution>IBERINCO, Madrid</institution> </aff> </contrib> <contrib contrib-type="author"> <name> <surname>Sallai</surname> <given-names>Gyula</given-names> </name> <aff> <institution>Budapest, Tech. U.</institution> </aff> </contrib> <contrib contrib-type="author"> <name> <surname>Sreekuttan</surname> <given-names>Sailaraj</given-names> </name> <aff> <institution>TCS, Madhapur</institution> </aff> </contrib> </contrib-group> <pub-date pub-type="pub"> <year>2018</year> </pub-date> <volume/> <fpage/> <lpage/> <self-uri xlink:href="http://cds.cern.ch/record/2305319"/> <self-uri xlink:href="http://cds.cern.ch/record/2305319/files/thpha161.pdf"/> </article-meta> <abstract>The development of critical systems requires the application of verification techniques in order to guarantee that the requirements are met in the system. Standards like IEC 61508 provide guidelines and recommend the use of formal methods for that purpose. The ITER Interlock Control System has been designed to protect the tokamak and its auxiliary systems from failures of the components or incorrect machine operation. ITER has developed a method to assure that some critical operator commands have been correctly received and executed in the PLC (Programmable Logic Controller). The implementation of the method in a PLC program is a critical part of the interlock system. A methodology designed at CERN has been applied to verify this PLC program. The methodology is the result of 5 years of research in the applicability of model checking to PLC programs. A proof-of-concept tool called PLCverif implements this methodology. This paper presents the challenges and results of the ongoing collaboration between CERN and ITER on formal verification of critical PLC programs.</abstract> </front> <article-type>research-article</article-type> <ref/> </article> </articles>