Points-to analysis of IEC 61131-3 programs: Implementation and application

A call graph of a program represents the information which executable program element calls which other executable program elements. Based on the call graph, points-to sets can be computed, which represent the memory locations a reference variable can possibly point to. Call graph and points-to sets provide important information for static program analysis. This is especially true for PLC programs which heavily use pointer variables. However, due to the complexity of the algorithms, call graph and points-to analysis methods are not widely available in static analysis. In this paper, we present an approach for call graph and points-to analysis of IEC 61131-3 programs. We present the algorithm for computing call graph and points-to sets and its implementation in a tool environment, show several different application scenarios, and present first results from industrial application.