Plant Model Generator from Digital Twin for Purpose of Formal Verification Johannes Håkansson Computer Science and Engineering, master's level 2021 Luleå University of Technology Department of Computer Science, Electrical and Space Engineering ii Abstract English This master thesis will cover a way to automatically generate a formal model for plant verification from plant traces. The solution will be developed from trace data, stemming from a model of a digital twin of a physical plant. The final goal is to automatically generate a formal model of the plant that can be used for model checking for verifying the safety and functional properties of the actual plant. The solution for this specific setup will be generalized and a general approach for other systems will be discussed. Furthermore, state machine generation will be introduced. This includes generating state machine data from traces, and in the future is planned be used as an intermediate step between the trace data and model generation. The digital twin solution used in this project is a joint setup in Visual Components and nxtSTUDIO. The symbolic model checker NuSMV is utilized in order to verify the functional properties of the plant. Svenska I detta examensarbete utforskas ett s¨attatt generera formella modeller av en process via inspelningar av dennes beteende. L¨osningen¨arutvecklad fr˚andata ¨over processens beteende, som tas upp av en digital tvilling. Det slutgiltliga m˚alet¨aratt med hj¨alp av den digitala tvillingen automatiskt generera en modell som kan anv¨andasf¨oratt verifiera s¨akerhet och funktioner f¨orden riktiga processen. L¨osningenblir sedan gen- eraliserad f¨oratt i framtiden kunna bli applicerad p˚aandra processer. Ett s¨attatt generera tillst˚andsmaskinerkommer l¨aggasfram. Detta s¨attkommer generera data f¨or tillst˚andsmaskinernagenom den digitala tvillingens beteende och i framtiden planeras att anv¨andassom ett mellansteg f¨oratt generera de slutliga modellerna. Den digitala tvillingen som anv¨andsi det h¨arprojektet ¨arimplementerat av Aalto universitet, och i flera program. Den visuella delen, som ¨aven spelar in tvillingens be- teende, ¨arimplementerad i Visual Components. En kontroll f¨orden digitala tvillingen ¨argjord i nxtSTUDIO. Verktyget f¨oratt verifiera modellens s¨akerhet och funktioner ¨ar gjord i NuSMV. iii iv Contents Chapter 1 { Thesis Introduction 1 1.1 Background . .1 1.2 Problem Definition . .1 1.3 Methodology . .2 1.4 Related Work . .3 Chapter 2 { Theory 5 2.1 Industrial Automation . .5 2.1.1 Introduction . .5 2.1.2 Model Driven Engineering . .6 2.2 Programmable Logic Controller . .6 2.3 Simulation Techniques . .7 2.4 Digital Twin . .8 2.4.1 Drawbacks and Advantages of Digital Twins . .8 2.4.2 Traces from Digital Models . 10 2.5 IEC Standards . 10 2.5.1 IEC 61131-3 and 61499 . 10 2.5.2 History of IEC 61499 . 11 2.5.3 Software implementation . 11 2.6 Design and Verification for Industrial Control Systems . 12 2.6.1 Verification of Logic . 13 2.6.2 Model Checking With the Help of a State Machine . 15 2.6.3 Partial-Order Reduction . 16 2.6.4 Kripke Structure . 16 2.6.5 Abstraction . 18 Chapter 3 { Setup and Material 19 3.1 Complete Plant Setup . 19 3.1.1 Physical Plant . 19 3.1.2 Digital Twin . 19 3.2 Other Components . 20 3.2.1 Python . 20 3.2.2 NuSMV . 21 Chapter 4 { Results 23 4.1 Implementation . 23 4.1.1 Digital Twin Component Isolation . 23 v 4.1.2 Visual Components Requirement Example . 27 4.1.3 Models of a System . 28 4.1.4 Trace Manipulation Method . 28 4.1.5 Generalized Model from a Generated Trace . 28 4.1.6 Implementation . 29 4.1.7 NuSMV Simulation . 32 4.1.8 Behavior . 33 4.1.9 Connections Between State Machine and NuSMV Model . 33 4.1.10 Solution . 35 4.1.11 Pseudo Code . 37 4.2 General Solution . 41 4.2.1 Structure of the Generalized Solution . 41 4.2.2 New Ideas to Complement Existing Ones . 43 Chapter 5 { Analysis 45 5.1 Test Cases . 45 5.1.1 CTL Test Cases . 45 5.1.2 Model Generated from a Different Trace . 47 Chapter 6 { Discussion 49 6.1 Conclusion and Future Work . 49 References 53 Chapter 7 { Appendix 57 vi Chapter 1 Thesis Introduction 1.1 Background Industrial automation has been around for many decades. The field is vastly explored and today's systems are very intricate and complex. With the increased complexity of systems, it's only natural that the frequency or magnitude of issues increases as well. These issues can cause problems, so it is important to identify them as early as possible. Model checking offers a solution to this, by evaluating a model of a plant in regards to the functional properties of the plant. An interesting field to explore is if we can generate these plant models automatically. There are a lot of existing plants in industrial settings, and to replace these will be far to costly. Replacing entire plants is therefore not a suitable approach. Therefore, the approach needs to be done in such a way that updates to existing plants needs to be developed. For these existing plants and systems, it is required that they can be updated in a reasonable manner. Since every system that has been created has been done so in different ways, an issue is to apply a general solution that is relevant to the majority. Models for any given plant should be generated and result in a suitable solution. This thesis work builds upon previous work from [1]. The key differences are related to state machine generation. Their work is about state machine generation for a controller using traces from a real controller, whereas this master thesis takes a look at state machines and formal model generation of plant model using traces from a digital twin model of a plant. 1.2 Problem Definition Mass customization is a field more and more sought after in industrial automation. Ef- fective resource management as well as quick reconfiguration are byproducts of this ad- vancement. Control systems that are reconfigured needs to be verified and tested in order to make sure they function properly. The main target of a possible solution is existing 1 Figure 1.1: Workflow during the project. systems. Can we use the functionality of an existing plant to extract a model based of the current behavior of the plant? An approach to automatically generate plant models of control systems will be ex- plored. These models will be used to evaluate the performance. By verifying the func- tional properties of the plant, correctness and accuracy of the generated model is decided. There needs to be a way so that desired plant behavior can be entered into the model to verify that it has been generated correctly. There needs to be a plan in order to answer if there exists a way to extract these models from older behavior and in theory, save time and effort for a reconfigured system. A digital twin will be used as a base in order to create the models used for the verification process. The digital twin field will be thoroughly explored and the knowledge will be used in the confines of this thesis. By creating a solution with the help of a digital twin, can a good general solution be derived from this? In order to make a general solution that works for most systems, knowledge about the inner workings of a digital twin is paramount. It is crucial in order to enable the possibility to draw conclusions about common traits of any system. Is general understanding of the digital twin field, coupled with the specifics of an actual digital twin, enough to derive a general solution? 1.3 Methodology This master thesis project workflow was divided into different stages. They are visualized in figure 1.1. In the introduction stage, we have literature review, report structuring and initial writing, as well as architecture, method, framework and tool decision. In the literature review stage, relevant research was acquired and studied thoroughly. Research articles were mostly searched out by me, the student, and further supplemented by my supervisor Sandeep Patil. With this research taken to heart, report writing commenced with relevant data and a solid core was formed. For the architecture, method, framework and tool decision stage, the proper architecture, methods, frameworks and tools were decided that would supply me with the possibility to reach my goals. The implementation and analysis stages are closely related and are alternated between in an iterative process. The implementation stage starts of with an idea. The idea is made 2 a reality before being put through the analysis stage. Here, issues with the approach are surfaced and the implementation stage is revisited with this new information in mind. Improvements are made every iteration until a satisfactory result is reached. For the conclusion stage, the solution produced from implementation and analysis stage will be discussed in regards to the questions presented in section 1.2. How well did the solution live up to the goals set beforehand? How well does the solution answer the questions presented in 1.2? 1.4 Related Work The authors of [1] proved that they could identify a state machine controller from noisy PLC (Programmable Logic Controller, a computer specifically created for industrial ap- plications) traces. They found that their controller had the same behavior from the traces as the actual PLC controller. What they could not guarantee was if the generated controller was identical in every sense to the original.