Fearing substantial machine downtime, the conservative PLC industry is very reluctant to address its legacy software. Based on Bas Beuting's master's thesis, Cordis and Axini have developed a combination of automatic code-to-model transformations and model-based testing that can overcome this reluctance. Capgemini Engineering is ready to put the integrated solution into practice.
"Many factories are struggling with obsolete machine parts," observes Matthijs van Doormaal, application engineer and PLC specialist at Capgemini Engineering. "They get parts from everywhere to keep their old systems running. We see them scouring the Internet to build up a stock in case an old I/O module or PLC fails. They do everything they can to avoid having to integrate new control components, because that would mean upgrading the existing control software, which, because of a lack of knowledge, would involve a lot of effort and thus a lot of downtime."
"We're talking about systems that are 20 years old, sometimes even older," Van Doormaal continued. "While the hardware is usually still in good condition, the control software is outdated and no longer supported, and therefore in desperate need of an upgrade. With all the changes over the years and the original programmers usually no longer available, replacing twenty-year-old PLC code is quite a challenge."
"The PLC market has traditionally been very conservative," explains Floris Verstegen, solutions manager at Capgemini Engineering. "There is a huge installed base with an equal amount of legacy, but there is usually no test infrastructure and the documentation is often missing as well. All the knowledge about the systems is in the code. That is the only truth they have, which is why they are so reluctant to change it."
There is more to a system upgrade than just installing new software, Verstegen adds. "After the upgrade, for example, the system has to receive a new CE mark. Because safety requirements have become much more stringent since the 1990s, that process is usually no less labor-intensive and requires a lot of additional development work."
Through its partnership with Cordis, Capgemini Engineering already has a partial solution to the problem. With the Cordis Suite low-code development environment, machine control applications can be captured in graphical models, from which error-free code can be automatically generated for a wide range of hardware platforms. According to Verstegen, this solution is ideal for creating control software from scratch in greenfield projects and also for extending an existing code base in brownfield situations. "You can take your legacy PLC code, put an interface layer around it and build new functionality on top of it," he said.
Addressing the legacy itself, however, requires something more. The conservative PLC industry wants to be absolutely certain that their systems exhibit exactly the same behavior before and after the "code rejuvenation. Together with Axini's model-based testing specialists, Cordis has developed a solution that can provide that assurance.
The idea for the solution was conceived by Bas Beuting, son of Cordis founder Benno, when he was looking for a topic for his master's thesis at Eindhoven University of Technology (TUE). He was inspired by a guest lecture by TNO-ESI on their Renaissance methodology and tooling to analyze and automatically refactor complex codebases. Familiar with his father's work, he saw an opportunity to translate the approach to Cordis and the PLC domain. His university professor, Mark van den Brand, was quickly enamored with the idea, as was Capgemini Engineering, TNO-ESI's implementation partner charged with industrializing Renaissance research results.
"That's how my research into PLC code rejuvenation was born," recalls Beuting junior. "The basic idea is to make software more future-proof and maintainable by converting it into hardware-independent Cordis models, which then become the only source of truth. From these models, new code can be generated that is proven to have the same behavior as the legacy code using Axini's model-based testing framework."
As a first step, the younger Beuting limited the playing field. "PLCs can be programmed in different languages. After some research, I decided to focus on the variant called Structured Text. Unlike graphical PLC formalisms, ST has a textual notation similar to traditional programming languages. Applications written in Structured Text also often have a state-based structure. These features make the code relatively easy to parse and convert into Cordis models. In addition, ST is one of the most widely used PLC languages."
Beuting then set up a library of common code patterns and their corresponding representations in Cordis. "From companies like ASML and VDL, I obtained a significant amount of real-world PLC code in Structured Text. In an in-depth analysis of this code, I identified a large number of recurring patterns, large and small. For each pattern, I analyzed the execution behavior on the PLC and mapped it as state machines. Because Cordis models are also based on state machines, the final transformation was relatively simple."
Last but not least, Beuting was able to demonstrate that the PLC code had indeed been correctly transferred to Cordis, i.e., that the original Structured Text and the resulting models exhibited the same behavior. "I turned to TUE's verification specialists for advice, who gave me a few options. After ticking off the alternatives that were difficult to automate or too time-consuming, only one option remained: model-based testing. After talking with Axini's Machiel van der Bijl, I decided to give it a try and found a way to verify the correctness of my transformations."
"First, I converted the Cordis models into Axini models. This is quite simple because the models resulting from the Structured Text transformation are not very complex," Beuting further explains his solution. "From the Axini models I had test cases generated automatically, which I ran against the PLC code generated from the Cordis models to double-check the validity of the tests for the generated code. Then I ran the same test cases against the original PLC code and they all passed, indicating that the old and new code have identical behavior."
Axini's approach to model-based testing (MBT) automates the entire testing process: it generates, executes and evaluates tests automatically. It is a form of model-based software engineering. Instead of generating code, it generates test cases.
For manual testing, you need a specification, based on which you create tests that predict the outcome. Then you run the tests and evaluate the outcome. Scripting approaches, such as behavior-driven development (BDD) and test-driven development (TDD), automate some of the test execution using programmed tests. MBT eliminates the need to program test cases. Instead, you create a model of the system to be tested and automate all testing steps: test creation, outcome prediction, test execution and evaluation.
The Axini Modeling Platform (AMP) uses an adapter that envelopes the system under test and allows independent sending and receiving of messages across all interfaces. The model defines the relationship between inputs and outputs according to the specification. AMP reads the model and experiments with the system under test to see if it meets the specification. The ability to simultaneously send and observe messages across all interfaces enables early testing during the development cycle without the need for simulators or the external system environment.
This first of its kind combination of static code-to-model transformations and runtime verification closes the loop, from design to coding to testing back to design. "You can statically scan your brownfield environment and have your legacy software transform into models. From these models, you can then generate code for a wide range of PLCs. By verifying this code dynamically, you can verify the accuracy of the models," Verstegen of Capgemini clarifies. "You can do this in parallel with your operations, on a separate PLC or soft PLC, without the risk of downtime. Because all steps can be performed automatically, you can shift your engineering focus to adding real value."
Bas Beuting thinks it is already possible to automatically transform 70-80 percent of PLC code written in Structured Text. "You still have to do some manual work, but the bulk is done for you. And because my pattern library is open source, new patterns can be incorporated to further reduce the remaining manual work." In the future, he himself is considering extending his solution to other PLC dialects. "Ladder diagrams are also relatively widespread. They don't really include state machine behavior, but further research, perhaps as part of a PhD project, could find a way around that."
In addition to facilitating code rejuvenation, the approach can also help improve the software in the process. "The model-based testing step reveals the differences in behavior between the original code and its generated counterpart," Verstegen further explains. "Most deltas will be acceptably small. Occasionally the new behavior is better or even the old behavior turns out to be outright wrong because of a previously undetected bug, such as in an exceptional situation that the software has not yet encountered. Model-based testing gets everywhere, including places where the system doesn't normally go."
"When such a bug comes to light, you can easily see where it goes wrong," adds Beuting. "You can track the test traces, from start to error, then go to the Cordis Suite Dashboard and get real-time and historical status information from all the relevant state machines in your Cordis models. This allows you to determine exactly where the system took a wrong turn and why. You can then make the appropriate changes to your Cordis and Axini models and run the tests again, repeating the cycle until all issues are resolved."
An additional benefit of moving to Cordis models is data availability. "To avoid having to touch the software, data analysts traditionally connect all kinds of external sensors to the PLCs. Unfortunately, this data acquisition is far from hard real-time," Verstegen notes. "When the control software is modeled in Cordis, you have hard real-time access to all system data. This opens up a wealth of opportunities for data analysts."
Axini's Machiel van der Bijl, Benno and Bas Beuting of Cordis and Niels Brouwers, Thijs Geurts and Matthijs van Doormaal of Capgemini Engineering next to Festo's demo production line at the Brainport Digital Factory.
Bas Beuting's solution was recently integrated into Cordis Suite and the Axini Modeling Platform, says his father Benno. "Bas has come much further than we thought possible, so much so that the integration was relatively easy." Outside of the Cordis and Axini environments, only one small component remains: the open-source library that converts PLC code patterns into Cordis models. Beuting senior expects the industrialized version of the solution to be available soon. He is already in talks with parties eager to use it.
Capgemini Engineering experts are equally surprised by the rapid progress. "I expected there to be much more variation in the PLC code, which would make pattern recognition much more work and reduce the level of automation. The variation turned out to be not so bad, which allowed Bas to bring the automation to a surprisingly high level," acknowledges model-based re-engineering specialist Niels Brouwers, who is closely involved in the industrialization of TNO-ESI's Renaissance effort. "While this is already a great achievement, the validation by verifying the transformation to Cordis is a huge bonus, possibly even the most valuable contribution. The ingredients are not new, but how Bas has combined them is a first."
"What I like most about the approach is that it allows you to regain control," Brouwers stresses. "There is a completely intangible legacy application, of which all knowledge has been lost. Bas' approach allows you to regain control of it. You can take your uncontrollable PLC code to a higher level of abstraction and make it resistant to change, extending the life of your software by decades."
Axini sees a world of possibilities outside the PLC domain. "In the Eulynx project, for example, Prorail and other infrastructure managers are working on reusable object controllers for the European railroad network. Currently these are modeled in SysML, but I'm sure Bas' approach could be extremely valuable there as well," illustrates Machiel van der Bijl.
"Legacy is a multi-headed monster for many companies," observes Capgemini's Verstegen. "This approach is a big step toward defeating the beast. There's still a lot of work to do on people and processes, but it's a big piece of the puzzle and an enabler for much more."
This article was written in close collaboration with Axini and Cordis.
By collaborating with educational institutions and industry combined with technology to accelerate digitalization, we are developing knowledge on "what, why, how" of the digital factory together with our members.
Dutch