Automatic test case generation for PLC programs using coverage metrics

This paper presents a method for automatic test case generation for PLC software following the IEC61131-3 standard. The core component is a model checker that iteratively creates program traces, each of them covering a part of the program in terms of a coverage metric. These test cases are translated into Structured Text, a programming languages defined in the IEC61131-3, to allow the execution on a soft-PLC or the actual hardware. Our approach is evaluated on a set of function blocks that are used in industry. We demonstrate that test cases can be automatically generated within few seconds in most cases.