[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-82026-en":3,"doc-seo-82026-105":31,"detail-sidebar-cat-0-en-105":92},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":28,"seo_description":14,"update_tm":29,"read_time":30},82026,7971461740886,"Theodore","https://ap-avatar.wpscdn.com/davatar_3d24733baf745e90a7e4bdd5f77d97b2",8,"Research & Report","Detecting Ladder Logic Bombs in IEC 61131-3 PLC Programs Using ESBMC-PLC+: A Formal Verification Approach with Trigger Synthesis","A Ladder Logic Bomb (LLB) is malicious control logic inserted into a Programmable Logic Controller (PLC) program that remains dormant until a trigger fires a payload manipulating actuators, forging sensor readings, or denying operator control. The work observes that real LLBs often hide inside function-block bodies, making them indistinguishable for existing Ladder Diagram verifiers. ESBMC-LLB repurposes ESBMCPLC+ by adding a modeling layer that exposes function-block-resident logic to the prover, enabling k-induction unbounded bomb-absence proofs and BMC counterexamples as automatic trigger synthesis. Evaluations show full detection on a public dataset and strong semantic model checking on SWaT, with complementary trade-offs versus CFG-triage detectors.","DETECTING LADDER LOGIC BOMBS IN IEC 61131-3 PLC PROGRAMS USING ESBMC-PLC+: A FORMAL VERIFICATION  \nAPPROACH WITH TRIGGER SYNTHESIS  \nPREPRINT  \nPierre Dantas*  \nDepartment of Computer Science The University of Manchester Manchester, UK  \n[pierre.dantas@manchester.ac.uk](pierre.dantas@manchester.ac.uk)[ ](pierre.dantas@manchester.ac.uk)[ORCID: 0000-0001-6390-9340](ORCID: 0000-0001-6390-9340)  \nLucas Cordeiro*  \nDepartment of Computer Science The University of Manchester Manchester, UK  \n[lucas.cordeiro@manchester.ac.uk](lucas.cordeiro@manchester.ac.uk)[ ](lucas.cordeiro@manchester.ac.uk)[ORCID: 0000-0002-6235-4272](ORCID: 0000-0002-6235-4272)  \narXiv :2607 .084 17v 1 [ cs .CL] 9 Jul 2026  \nWaldir Junior*  \nElectrical Engineering  \nFederal University of Amazonas (UFAM)  \nManaus, AM, Brazil  \n[waldirjr@ufam.edu.br](waldirjr@ufam.edu.br)  \nORCID: 0000-0003-3095-0042  \nJuly 2026  \nABSTRACT  \nA Ladder Logic Bombs (LLB) is malicious control logic inserted into a Programmable Logic Controller (PLC) program that lies dormant until a trigger fires a payload which manipulates actuators, forges sensor readings, or denies operator control. We make a structural observation about real LLB datasets: the malicious logic hides inside function-block bodies, which existing Ladder Diagram (LD) verifiers drop from their Intermediate Representation (IR), rendering the malicious and benign programs indistinguishable to the prover. We present ESBMC-LLB, a method that uses ESBMCPLC+ (an existing IEC 61131-3 verifier) as its verification engine, adding a modeling layer that exposes the function-block-resident logic to the prover and recasts LLB detection as formal verification: a scan-watchdog exposes denial-of-control (non-termination) payloads and output wiring exposes actuator-forgery payloads as checkable safety violations. k-induction yields an unbounded proof of bomb-absence across all scan cycles, and the bounded model checker returns a counterexample that is the detonation trigger – two guarantees that signature-, anomaly-, and Control Flow Graph (CFG)-triage detectors do not provide. On the public Iacobelli et al. [12] dataset, ESBMCLLB detects all 30 bombs and recovers every trigger; because it reasons over program semantics rather than syntactic patterns, it also detects adaptive triggers (computed, opaque-arithmetic, multiscan) that evade a CFG-triage heuristic. We further report the first evaluation of a semantic model checker on the state-of-the-art’s real analog benchmark (PLC-Defuser’s SWaT corpus): our analog modeling extension makes the full corpus parseable for the first time and, on the archived v1.0.0 release, detects 149/150 bombs (99%) with zero false positives, recovering each trigger; on a later corpus version that adds nonlinear non-termination bombs, detection drops to 49% as the Satisfiability Modulo Theories (SMT) backend times out. We conclude that semantic model checking and CFG-triage are complementary – the former adds unbounded bomb-absence proofs and adaptivetrigger robustness and handles Boolean/integer and linear analog logic, the latter leads on nonlinear analog non-termination – and we delineate exactly where each wins.  \n∗ The authors contributed equally to this research. Corresponding author: [pierre.dantas@manchester.ac.uk](pierre.dantas@manchester.ac.uk).  \nKeywords Ladder Logic Bombs · PLC · IEC 61131-3 · Industrial Control Systems security · ESBMC · BMC · k-induction · SMT · trigger synthesis · formal verification · LD · PLCopen XML  \n1 Introduction  \nProgrammable Logic Controllers (PLCs) run the control logic of safety-critical Industrial Control Systems (ICS): water treatment, power, chemical, and manufacturing plants. An attacker who gains write access to a PLC – through the engineering workstation, a compromised project file, or the supply chain – can insert a Ladder Logic Bombs (LLB): a fragment of control logic that remains dormant until a trigger fires, then executes a payload that sabotagesthe physica","cbCaio5pErMtYQIn","https://ap.wps.com/l/cbCaio5pErMtYQIn","pdf",297967,4,1,14,"English","en",105,"# Introduction\n## ESBMC-LLB: Formal verification view of LLB detection\n## Payload-to-property reduction and guarantees\n## Trigger synthesis via bounded counterexamples","[{\"question\":\"What problem does this paper address in IEC 61131-3 PLC programs?\",\"answer\":\"It targets Ladder Logic Bombs (LLBs), malicious control logic that stays dormant until a trigger fires and then sabotages the physical process by manipulating actuators, sensor readings, or operator control.\"},{\"question\":\"Why can existing Ladder Diagram verifiers miss real LLBs?\",\"answer\":\"Because LLBs can hide inside function-block bodies, and existing verifiers drop that content from their intermediate representation, making malicious and benign programs indistinguishable to the prover.\"},{\"question\":\"How does ESBMC-LLB detect bombs and recover the trigger?\",\"answer\":\"It models function-block-resident logic so verification can check safety/integrity properties. k-induction provides an unbounded bomb-absence proof, while bounded model checking returns a counterexample trace whose triggering input/cycle sequence is treated as the detonation trigger.\"}]","Detecting Ladder Logic Bombs in IEC 61131-3 PLC Programs Using ESBMC-PLC+: A Formal Verification Approach with Trigger Synthesis | PDF",1784177657,35,{"code":4,"msg":32,"data":33},"ok",{"site_id":25,"language":24,"slug":34,"title":13,"keywords":35,"description":14,"schema_data":36,"social_meta":87,"head_meta":89,"extra_data":91,"updated_unix":29},"detecting-ladder-logic-bombs-in-iec-61131-3-plc-programs-using-esbmc-plc-a-formal-verification-approach-with-trigger-synthesis","",{"@graph":37,"@context":86},[38,54,69],{"@type":39,"itemListElement":40},"BreadcrumbList",[41,45,49,52],{"item":42,"name":43,"@type":44,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":46,"name":47,"@type":44,"position":48},"https://docshare.wps.com/document/","Document",2,{"item":50,"name":12,"@type":44,"position":51},"https://docshare.wps.com/document/research-report/",3,{"item":53,"name":13,"@type":44,"position":20},"https://docshare.wps.com/document/detecting-ladder-logic-bombs-in-iec-61131-3-plc-programs-using-esbmc-plc-a-formal-verification-approach-with-trigger-synthesis/82026/",{"url":53,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":24,"description":14,"dateModified":62,"datePublished":63,"encodingFormat":61,"isAccessibleForFree":64,"interactionStatistic":65},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":42,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-07-29","2026-07-16",true,{"@type":66,"interactionType":67,"userInteractionCount":20},"InteractionCounter",{"@type":68},"ViewAction",{"@type":70,"mainEntity":71},"FAQPage",[72,78,82],{"name":73,"@type":74,"acceptedAnswer":75},"What problem does this paper address in IEC 61131-3 PLC programs?","Question",{"text":76,"@type":77},"It targets Ladder Logic Bombs (LLBs), malicious control logic that stays dormant until a trigger fires and then sabotages the physical process by manipulating actuators, sensor readings, or operator control.","Answer",{"name":79,"@type":74,"acceptedAnswer":80},"Why can existing Ladder Diagram verifiers miss real LLBs?",{"text":81,"@type":77},"Because LLBs can hide inside function-block bodies, and existing verifiers drop that content from their intermediate representation, making malicious and benign programs indistinguishable to the prover.",{"name":83,"@type":74,"acceptedAnswer":84},"How does ESBMC-LLB detect bombs and recover the trigger?",{"text":85,"@type":77},"It models function-block-resident logic so verification can check safety/integrity properties. k-induction provides an unbounded bomb-absence proof, while bounded model checking returns a counterexample trace whose triggering input/cycle sequence is treated as the detonation trigger.","https://schema.org",{"og:url":53,"og:type":88,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":90,"canonical":53},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":93},[94,98,102,106,111,116,121,124,129,132,136],{"id":21,"doc_module":4,"doc_module_name":47,"category_name":95,"show_sort_weight":96,"slug":97},"Story & Novel",90,"story-novel",{"id":48,"doc_module":4,"doc_module_name":47,"category_name":99,"show_sort_weight":100,"slug":101},"Literature",80,"literature",{"id":20,"doc_module":4,"doc_module_name":47,"category_name":103,"show_sort_weight":104,"slug":105},"Exam",70,"exam",{"id":107,"doc_module":4,"doc_module_name":47,"category_name":108,"show_sort_weight":109,"slug":110},5,"Comic",60,"comic",{"id":112,"doc_module":4,"doc_module_name":47,"category_name":113,"show_sort_weight":114,"slug":115},6,"Technology",50,"technology",{"id":117,"doc_module":4,"doc_module_name":47,"category_name":118,"show_sort_weight":119,"slug":120},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":47,"category_name":12,"show_sort_weight":122,"slug":123},30,"research-report",{"id":125,"doc_module":4,"doc_module_name":47,"category_name":126,"show_sort_weight":127,"slug":128},9,"Religion & Spirituality",20,"religion-spirituality",{"id":127,"doc_module":4,"doc_module_name":47,"category_name":130,"show_sort_weight":127,"slug":131},"World Cup","world-cup",{"id":133,"doc_module":4,"doc_module_name":47,"category_name":134,"show_sort_weight":133,"slug":135},10,"Lifestyle","lifestyle",{"id":137,"doc_module":4,"doc_module_name":47,"category_name":138,"show_sort_weight":107,"slug":139},19,"General","general"]