Formal verification of ladder logic programs using NuSMV

Programmable logic controllers (PLCs) are heavy-duty computers used to control industrial systems. For many years these systems were physically separated from any other network making attacks extremely difficult. However, these increasingly connected systems have not improved much in terms of security, leaving them vulnerable to attacks. This paper attempts to show that ladder logic programs for PLCs can be modeled in NuSMV and verified using computational tree logic (CTL) specifications. This paper also shows how simple changes to the ladder logic program can cause catastrophic damage to the PLC system. This intruded code can be difficult to detect by looking at the ladder logic program because the change is so small. However, the intruded code can be modeled in NuSMV and identified by properly written CTL specifications.