[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-82027-en":3,"doc-seo-82027-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},82027,7971461740886,"Theodore","https://ap-avatar.wpscdn.com/davatar_3d24733baf745e90a7e4bdd5f77d97b2",6,"Technology","Closing the Deployment Gap for Formal Verification of Open-Hardware PLCs","Open-hardware PLCs built on IEC 61131-3—such as OpenPLC, Arduino OPTA, CONTROLLINO, and M-Duino—enable low-cost automation and Industrial Control Systems security research, but existing IEC 61131-3 verifiers reason over abstract scan-cycle models with effectively unbounded integers and unconstrained inputs. This paper shows that deployment on 16-bit MCU word hardware with finite-resolution ADC sensing creates a deployment gap that makes naive width-aware verification unsound in practice. A hardware-faithful Hardware Abstraction Layer (HAL) method and an ESBMC-Arduino instantiation align arithmetic semantics and hardware-realizable input ranges, eliminating false alarms while preserving robustness proofs.","ESBMC-ARDUINO: CLOSING THE DEPLOYMENT GAP FOR FORMAL VERIFICATION OF OPEN-HARDWARE PLCS  \nPREPRINT  \nPierre Dantas*  \nDepartment of Computer Science The University of Manchester Manchester, UK  \n[pierre.dantas@manchester.ac.uk](pierre.dantas@manchester.ac.uk)  \nLucas Cordeiro  \nDepartment of Computer Science The University of Manchester Manchester, UK  \n[lucas.cordeiro@manchester.ac.uk](lucas.cordeiro@manchester.ac.uk)  \narXiv :2607 .08550v 1 [ cs .PL] 9 Jul 2026  \nWaldir Junior  \nElectrical Engineering  \nFederal University of Amazonas (UFAM)  \nManaus, AM, Brazil  \n[waldirjr@ufam.edu.br](waldirjr@ufam.edu.br)  \nJuly 10, 2026  \nABSTRACT  \nOpenPLC, Arduino OPTA, CONTROLLINO, and Industrial Shields M-Duino – bring IEC 61131-3 programming to low-cost, microcontroller-class devices increasingly used in real automation and in Industrial Control Systems (ICS) security research. Existing open-source verifiers for IEC 61131-3, including the ESBMC-PLC line, prove safety over an abstract scan-cycle model with idealized unbounded integers. The artifact that runs on the board, however, executes on a resource-constrained Microcontroller Unit (MCU) with a 16-bit machine word (8-bit AVR Arduinos), and sensors are read through a finite-resolution Analog-to-Digital Converter (ADC) . We show that this deployment gap makes naive width-aware verification unsound in practice: on 123 real third-party programs, checking 16-bit arithmetic overflow without a hardware input model raises a 44% false-alarm rate (54/123) and finds zero genuine defects, because it explores sensor values no ADC can produce.  \nBecause the gap sits exactly where computation meets the physical process – a bounded sensor reading scaled by finite-width integer arithmetic into an actuation command – an overflow can silently suppress a physical safety action such as a high-level alarm. At the same time, an unbounded input model fabricates alarms that no environment can trigger. We present a method for hardwarefaithful verification of IEC 61131-3 on open hardware: a declarative Hardware Abstraction Layer (HAL) descriptor (word width, ADC/Pulse-Width Modulation (PWM) resolution, I/O binding) anda sound lowering that interprets arithmetic at the target word width and constrains each input to its hardware-realizable range, transferring to the Programmable Logic Controller (PLC) domain the target-model discipline established for safety-critical embedded C (Frama-C, Astrée) . We instantiate it for Arduino as ESBMC-Arduino, deriving HAL parameters from the official Arduino cores and realizing the input-range model as a lightweight hook in the Efficient SMT-based Context-Bounded Model Checker (ESBMC) Ladder Diagram (LD) frontend. On the 123-program corpus, the HAL annotator eliminates all 54 false alarms (54→0) while preserving every robustness proof, and a controlled corpus demonstrates the genuine – but rare – width-dependent defects the method detects with physically realizable witnesses.  \nKeywords deployment gap · hardware-faithful verification · HAL descriptor · machine word width · ADC input model · PLC · IEC 61131-3 · open-hardware PLC · ESBMC · BMC · k-induction · formal verification · LD · PLCopen XML  \n∗ Corresponding author.  \n1 Introduction  \nProgrammable Logic Controllers (PLCs) govern safety-critical processes, but a new class of open-hardware PLCs – OpenPLC [1, 2], Arduino OPTA [3, 4], CONTROLLINO [5], and Industrial Shields M-Duino [6] – now brings International Electrotechnical Commission (IEC) 61131-3 programming to low-cost, microcontroller-class devices. These platforms are widely used in education, small-scale automation, and – importantly for assurance – as the runtime substrate for academic Industrial Control Systems (ICS) security testbeds; OpenPLC, in particular, was designed explicitly for cybersecurity research [1] .  \n1.1 The Deployment Gap  \nOpen-source verifiers for IEC 61131-3 – the ESBMC-PLC in particular [7, 8, 9], and PLCverif [10, 11] – prove safety prop","cbCaijKlnPpi7Iyx","https://ap.wps.com/l/cbCaijKlnPpi7Iyx","pdf",413476,1,21,"English","en",105,"# Introduction\n## The Deployment Gap\n## Contributions\n# Hardware-faithful verification of IEC 61131-3","[{\"question\":\"What problem does the paper call the “deployment gap”?\",\"answer\":\"The deployment gap is the discrepancy between abstract IEC 61131-3 verification models (unbounded integers and unconstrained inputs) and the deployed execution on resource-constrained MCUs with finite-width arithmetic and finite-resolution ADC inputs.\"},{\"question\":\"Why does naive width-aware verification lead to many false alarms?\",\"answer\":\"It constrains arithmetic to the machine word width but does not model hardware-realizable sensor ranges, so the checker explores ADC values no environment can produce, triggering overflows that cannot occur on the device.\"},{\"question\":\"How does the proposed method make verification hardware-faithful?\",\"answer\":\"It uses a declarative Hardware Abstraction Layer (HAL) descriptor to model target word width and ADC/PWM resolution, then applies a sound lowering so arithmetic executes at the target width and each input is constrained to the hardware-realizable range.\"}]",1784177682,53,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"closing-the-deployment-gap-for-formal-verification-of-open-hardware-plcs","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/technology/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/closing-the-deployment-gap-for-formal-verification-of-open-hardware-plcs/82027/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does the paper call the “deployment gap”?","Question",{"text":75,"@type":76},"The deployment gap is the discrepancy between abstract IEC 61131-3 verification models (unbounded integers and unconstrained inputs) and the deployed execution on resource-constrained MCUs with finite-width arithmetic and finite-resolution ADC inputs.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"Why does naive width-aware verification lead to many false alarms?",{"text":80,"@type":76},"It constrains arithmetic to the machine word width but does not model hardware-realizable sensor ranges, so the checker explores ADC values no environment can produce, triggering overflows that cannot occur on the device.",{"name":82,"@type":73,"acceptedAnswer":83},"How does the proposed method make verification hardware-faithful?",{"text":84,"@type":76},"It uses a declarative Hardware Abstraction Layer (HAL) descriptor to model target word width and ADC/PWM resolution, then applies a sound lowering so arithmetic executes at the target width and each input is constrained to the hardware-realizable range.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,113,118,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":111,"slug":112},50,"technology",{"id":114,"doc_module":4,"doc_module_name":45,"category_name":115,"show_sort_weight":116,"slug":117},7,"Healthcare",40,"healthcare",{"id":119,"doc_module":4,"doc_module_name":45,"category_name":120,"show_sort_weight":121,"slug":122},8,"Research & Report",30,"research-report",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":45,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":45,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]