Structural Analysis of GRAFCET Control Specifications

TL;DR

This work addresses the verification of GRAFCET control specifications by tackling concurrency-induced state-space growth. It introduces a two-part structural approach: (i) a step-reachability/concurrency algorithm to identify which steps can be active concurrently, and (ii) a Petri-net–inspired invariants-based analysis to bound internal and output variables, enabling specification-level reasoning without full state exploration. By using a linear-relaxation view with the incidence matrix $N$ and the state equation $sit = sit_0 + N q$, the method derives bounds via $S$- and $T$-invariants and provides conservative estimates of behavior. The evaluation on an industrial Grafcet demonstrates the approach’s ability to verify behavioral errors and detect race-condition-like interactions with fast performance, while acknowledging potential false alarms due to over-approximation. Overall, the paper presents a scalable verification pathway for IEC 60848 Grafcets that can support PLC design by exposing safety-relevant dynamics at the specification level.

Abstract

The graphical modeling language GRAFCET is used as a formal specification language in industrial control design. This paper proposes a structural analysis that approximates the variable values of GRAFCET to allow verification on specification level. GRAFCET has different elements resulting in concurrent behavior, which in general results in a large state space for analyses like model checking. The proposed analysis approach approximates that state space and takes into consideration the entire set of GRAFCET elements leading to concurrent behavior. The analysis consists of two parts: We present an algorithm analyzing concurrent steps to approximate the step variables and we adapt analysis means from the field of Petri nets to approximate internal and output variables. The proposed approach is evaluated using an industrial-sized example to demonstrate that the analysis is capable of verifying behavioral errors and is not limited by the specification size of practical plants.

Figures (7)

• Figure 1: Illustrative example of a Grafcet.
• Figure 2: Different structures in GRAFCET iec60848 resulting in concurrent behavior indicated by actions $a$ and $b$.
• Figure 3: Example partial Grafcet $c$ with the initial situation $\{s3, s4, s5\}$ and the possible concurrent steps $S_s^C$ marked in blue for every step $s \in S_c$, which is the final result of Alg. \ref{['alg:reachabilility']} and \ref{['alg:concurrency']}.
• Figure 4: Overview of approximation of internal and output variables.
• Figure 5: Example partial Grafcet with $S^I = \{s1, s2\}$ that is $n$-bounded with $n = 2$.