WO2015010912A1

WO2015010912A1 - Prognosis of the operating behavior of a control unit

Info

Publication number: WO2015010912A1
Application number: PCT/EP2014/064782
Authority: WO
Inventors: Tim Lange; Martin Richard NEUHÄUSSER; Thomas Noll
Original assignee: Siemens Aktiengesellschaft
Priority date: 2013-07-23
Filing date: 2014-07-10
Publication date: 2015-01-29

Abstract

The invention relates to a verification device (10) for checking a control unit (14) in order to determine whether during the execution of a control program (P), the control unit (14) only assumes operating states that are valid according to a state preset (20, 22) defined by program variables of the control program (P). The problem addressed by the invention is that of efficiently testing the operating behavior of the control unit (14). The problem is solved in that the verification device comprises an input unit (26) for receiving a user input of the state preset (20, 22), and a solver unit (30) for checking a capability of the state preset (20, 22) to be achieved by the control program (P). A compression unit (50) is configured to compress the control program (P) in a semantically true manner prior to verification by the solver (30) such that a number of program points with value assignments is reduced.

Description

description

Forecasting the operating behavior of a control unit

The invention relates to a checking device and a method for checking a control unit, according to whether the control unit only assumes operating states when executed a control program, which are marked as valid according to a condition specification.

In automation technology; The consequences of logic errors in programmable logic controller (PLC) programs range from costly disruptions in the production or automation task to hazards to human lives and the environment when safety-related PLC programs are involved, such as: B. in distributed security. Therefore, such errors must be excluded for both economic and regulatory reasons. Safety regulations such. For example, IEC 61508-3 recommends the use of a formal review to reduce the risk of logical errors in production and automation systems.

In today's practice, however, only extensive tests are used to detect logical errors. These tests are designed manually and are very often done by hand, which is error prone and extremely time consuming, and causes high financial costs. Generally, for all but the simplest programs, testing is inherently incomplete, as it is unable to prove the absence of errors.

In principle, these disadvantages are completely eliminated by a formal code check. In contrast to testing, formal verification techniques such as For example, model checking is complete because it guarantees to find all the errors and can prove the absence of errors. They can also be completely automated be, because only require that the engineer describes the relevant characteristics of the code that needs to be checked as a conditional specification. Then, by means of a solution algorithm for the so-called satisfiability problem of the statement logic (SAT, English satisfiability), it can be checked whether the control program can always only lead to operating states which are valid according to the state specification, ie, safe and / or economically reasonable , are, or whether the control program can also lead to an invalid operating state.

However, this decision problem is very complex in the calculation and even in the pure statement (SAT) so-called NP-complete. This theoretical result has practical consequences, since the runtime of model checkers for detecting properties generally grows exponentially and becomes prohibitively large, even for relatively simple problem cases. In fact, this is the real reason why a formal review for industrial use has not been widely adopted.

The object of the invention is to efficiently check a performance of a control unit. The object is solved by the subject matters of the independent claims. Advantageous developments of the invention will become apparent from the features of the dependent claims. By means of the method according to the invention, a control unit is checked to see whether, when a control program is executed, it only assumes valid operating states in accordance with a status specification. The invention is based on the recognition that the operating states are defined by the program variables of the control program. A concrete operating state results in each case by the current, current values of each program variable. The values of each program variable can therefore be summarized as a state vector. the one indicating an operating point in the state space. The more program variables there are, the more dimensions the state space has.

The method according to the invention is based on the described state specification, by means of which all those operating states which are regarded as valid, ie all valid operating points, can be described. Alternatively, the invalid operating states can also be defined by the state specification. In order to check whether the control unit can assume an undesired or invalid operating state, in the method according to the invention all operating states that are possibly assumed are predicted. Then it can be checked whether an invalid operating state is included. In order to predict all operating states, according to the described knowledge, it must therefore be checked for all program variables which possible values they can have. For this purpose, in the method by a solver unit in the control program, this review is performed. All values possible by the value assignment are then set, e.g. a program variable x determined. For this purpose, the solver unit can be based, for example, on one of the following approaches in a manner known per se: SAT (Boolean Satisfiability), SMT (Satisfiability Modulo Theory) or BDD (Binary Decision Diagram).

As already stated, each program location, for example each program line, to which a program variable is assigned a value, defines another dimension in the state space. In the method according to the invention, it is now provided to reduce the dimension of the state space by reducing the number of program points with value assignment.

For this purpose, a compression unit checks in preprocessing, ie before the solver unit calculates all possible values of the program variables, whether a first program location converts a read handle to a program variable. holds, eg the program variable x. For example, the first program location may be program line 1:

1: y = x + 1;

The value assignment (x + 1) reads out the current value of x by a read access. Another expression for value assignment is expression or expression (exp). In the event that such a value assignment comprises a read access to the program variable, in the method according to the invention the compression unit determines at which preceding second program location a value is recursively assigned by a preceding value assignment of the program variables. By "preceding", it is meant that the second program location is executed prior to the execution of the control program before the first program location.The value assignment is a recursive value assignment, ie in the value assignment to the program variable x is again a read access to the program variable x itself For example, the second program location may include the following program line:

1 ': x = x + z;

If such a second program location is found, the procedure at the first program location replaces the read access with the preceding value assignment and deletes the second program location. In the example described, therefore, the program line 1 'is deleted and the program line 1 then looks like this:

1: y = x + z + 1;

The control program is now compressed because the program line 1 'or generally the second program point is missing. There is now a program station with a program less, which means one dimension less in the state space.

The described replacement means that the compression is semantically correct, that is to say the control program and the compressed control program lead to the same operating behavior in the control unit. In the case of the compressed control program, however, a large number of checking steps is no longer necessary since all operating states that could result from the different values of the program variable x at the second program point 1 ^Λ in the unchanged control program no longer exist. As a result, checking steps are omitted when operating the solar unit, which makes the operation of the solar unit efficient. An acceleration by the factor 100 and even 1000 may be possible.

An advantageous development of the method according to the invention provides that, in addition to the second program location, a third program location which also precedes the first program location is determined, to which a value is assigned by a value assignment as an alternative to the second program location of the program variables. For example, a second program location and a third program location of the type described can result in a branch in the program flow, that is, for example, in a conditional execution of program code. Depending on the program branch or branch being executed, there may be another program point at which the program variable is assigned a value via a value assignment. At the first program point, the read access is then only replaced and accordingly the second and the third program point are only deleted if the value assignments at the second and the third program point are the same. In this embodiment, there is the advantage that the compression is also possible if the first program point can be reached via two different program paths. A development which is particularly advantageous in this connection provides that in the control program each program point is identified with an individual designation information, that is to say an individual label. This allows the control program to determine the origin of each value assignment.

Just as there may be several program paths through which either the second program location or the third program location can access the first program location, it may happen that the value assignment located at the second program location is not used once, namely the first program point, but also at least one other program point. An embodiment of the method according to the invention therefore provides that the read access is replaced by the value assignment from the second program point both at the first program point and at every other program point with a read access to the program variable. Then it is possible to delete the second program location without changing the semantics of the program.

In order to reliably find all the relevant preceding program points for program points, such as the first program point, it has proven to be particularly advantageous to determine the second program point by means of a forward-looking data flow analysis for determining the available expressions. Such a data flow analysis is also called

Available Expression Analysis (Nielson, F.,

Nielson, H.R., Hankin, C: Principles of program analysis, Springer, 1999).

If, according to the data flow analysis, an availability of the value assignment at the second position at the first program point is missing, that is, eg the above program line 1 'can have no influence on the program line 1. Then, the second program point is preferably marked with a block blocking the deletion. This results the advantage that at the first program point only the read access is actually replaced by the value assignment of the second program point, if the data flow analysis actually displays the corresponding availability.

The compression can advantageously be accelerated if the second program point is determined only under a precondition. This precondition implies that a reaching definition analysis of the first program location indicates a non-empty solution set. Such a reaching-definition analysis is known per se from the prior art. It can be used to determine whether there is any value assignment in the control program at all. If these are missing, ie if the solution quantity of this reaching-definition analysis is empty, this means that there is a direct assignment of variables, for example by reading in a value from a control input of the control unit, e.g. from a temperature sensor, there. Alternatively, there may also be a system flag, which likewise need not have a definition.

Preferably, the control program is iteratively compressed several times by the compression unit. This allows you to delete more channels, that is, the compression of the control program is particularly large.

The iterative compression is terminated, in particular, if the control program remained unchanged in the last iteration performed. Then a so-called fixed point is reached, at which the compression has reached an optimum.

As already stated, the invention also includes a checking device for checking a control unit. The control unit may, for example, be one for an automation system. For example, the verification device may be configured as an engineering development station for configuring the control unit. The verification device has an input Entity for receiving a user input regarding the state default on, so for example, a computer workstation for entering the state default. In addition, it has a solver unit for checking a satisfiability of the control specification to be achieved by the control program. As a suitable solver unit can be used on one of the sol units described in the prior art. The checking device according to the invention is characterized by a compression unit which is designed to carry out an embodiment of the method according to the invention.

In the following an embodiment of the invention is described. This shows:

1 shows a schematic representation of an embodiment of the inventive verification device and

2 shows a control flow graph for illustrating a control program for a motor.

The exemplary embodiment explained below is a preferred embodiment of the invention. In the exemplary embodiment, however, the described components of the embodiment each represent individual features of the invention, which are to be considered independently of each other, which also develop the invention independently of one another and thus also individually or in a different combination than the one shown as part of the invention. Furthermore, the described embodiment can also be supplemented by further features of the invention already described.

In FIG. 1, an inspection device 10 is shown, which can be designed, for example, as a computer workstation. By means of the checking device 10, its control unit 14 can be checked, for example, by a production robot 12. In this case, for example, it should be ensured that a Robot arm 16 of the robot 14 when executing pivotal movements 18, which are made possible by driving a drive unit (not shown) of the robot 12, the robot arm 16 is within an authorized pivoting range 20. In particular, it may be provided that the robot arm 16 is limited in its freedom of movement to the effect that the robot arm 16 is not pivoted into a blocking region 22, in which, for example, a mechanic may be present. The monitoring of the assembly robot 12 is only to be understood as an example for illustrating the mode of operation of the monitoring device 10. The monitoring device 10 can also be used to monitor control units other than the control unit 14, for example control units of production plants, production plants or generally automated plants.

An operating behavior of the control unit 14 may be determined by a control program P. The monitoring device 10 may include a translator 24, an operating unit 26, a central controller 28 and a solver 30.

The translator 24 may be configured to receive the control program in a step S10 and to convert the control program P into a symbolic model MOD in a manner known per se in a step S12. The model MOD may be output to the central controller 28 where it may be stored as a model 40.

The operating unit 26 can have, for example, an operating terminal 30 with a monitor and an input unit 34, for example a keyboard. By means of the operating unit 30, a user (not shown) of the monitoring device 10 can define the approved area 20 and / or the blocking area 22 for the assembly robot 12 in a step S14. The approved area 20 and / or the blocking area 22 represents a condition specification. In a step S16, the operating unit 26 may, for example, based on the predicative programming or logic programming from the input received in step S14 in a known manner form a logical formula φ. The logical formula φ can be transferred to the central controller 28 and stored there as a logical formula 38. Optionally, it may be provided that the logical formula φ is negated, as a result of which it is possible to switch between a state specification for the permissible range 20 and a status specification for the stop band 22 in the example.

Optionally, a variable 3 for a limitation k of the analysis steps may be provided in the central controller 28. The central controller 28 may operate the solver 30 based on the logical formula 38 stored by it and the stored model 40 of the control program P, and optionally the variable 36.

The solver 30 may be, for example, an SAT solver or an SMT solver. As a result of the operation of the solver 30, it indicates a prediction 42, 44 as to whether the control unit 14 complies with the state instruction according to the logical formula φ based on the control program P (output 42) or violates the state instruction (output 44). If the state specification is violated, the program state 46, by which the state specification is violated, can be transmitted to a development unit 48, which can be designed such that the user adjusts the program code P and thereby generates a customized program code P 'which again checked by means of the translator 24 with respect to the state default and, if the state default is satisfied by the program code P ', can be stored in the control unit so that the robot 12 behaves correctly.

The verification device can thus provide automatic verification of PLC programs. When using the limit k, the PLC program requires a statement logic cpk which represents the semantics of the program when executing at most k instructions. Here every command of the PLC program corresponds to a sub-formula cpi, which occurs k times in cpk. Therefore, cpk grows to O (kn), where n is the number of instructions in the input program.

In the limited model check (but also in other symbolic model check methods, interpolation based check, and inductive check techniques), the formula cpk is introduced into the solver 30, which determines its satisfiability.

In the checking device 10, the operation of the

Solvers 30 particularly efficient. For this purpose, a compression unit 50 is provided, which compresses the translated program code P semantically, so that the model 40 can check through the solver 30 with fewer checking steps with respect to the violation or compliance with the condition specification. The key idea here is a new preprocessing step that allows the model of a PLC program to be minimized while preserving its semantics. It goes beyond the state of the art of static analysis, which today serve as pre-calculations, which are constant folding, loop processing and program separation.

It can e.g. the following input program are processed as examples: 0: x: = x + y;

1: if (x <y) goto 6;

2: x: = z + y;

3: y: = y + 1;

4: x: = x + y;

5: goto 1;

6: z: = x; Consider the simple input program and assume that the operating states of a control unit are critical according to the value of variable z on completion. Then, the program can not be further minimized using the known constant convolution, loop, or program separation techniques.

However, compression unit 50 may remove an additional command and obtain a smaller model 40. Namely, the program positions 0 and 5 can be removed intuitively, if at the same time their right sides are spread out into the program positions 1, 2 and 7. The result of the compression can then be: if (x + y <y) goto 4;

x: = z + y;

y: = y + 1;

goto 0;

z: = x + y;

The compression unit 50 method allows minimizing the number of program locations that are not overcome by conventional techniques, such as e.g. B. constant spread or program separation is achieved. It can use an adaptation of the analysis of available expressions. This analysis can be extended by including information about the program location from which the available expressions are derived. By combining this information with the result of a reaching definition analysis, sufficiently accurate information can be derived to minimize the control program P beyond the prior art.

This type of analysis is not a standard, as it has few applications in areas outside of model validation:

1. It is based on a special intermediate code that allows complex entities on the right sides of assignments as shown in the above example at the program point 0 of the compressed control program. This contrasts with the classic three-address code used in optimization compilers. Based on the three-address code, the method would not be applicable.

2. Moreover, the compression unit 50, using expression propagation, can minimize the number of program locations of the input program by increasing the complexity of the right sides of assignments. Normally in the compiler design, the simplicity of the assignments is valued higher than the length of the resulting program (eg, in the code with three-address programs, programs usually have a large number of program locations). Therefore, this type of forward propagation is new.

The use of the analyzes can be made by constructing an artificial program according to the scheme of the above,

uncompressed control program are detected. Instead of a while loop, you can also use nested if-then-else formations to create arbitrarily long programs that can be minimized using our technique. The control flow of such a program remains complex if forward propagation is not used. This is reflected in the runtime of a model examiner if it lacks an implementation of this analysis.

If the described forward propagation is used, the time for the model check is drastically reduced.

The optimizations are motivated by the fact that, in addition to some deviations introduced by the solver 30 used, the limited model check tends to become inefficient with increasing size of the checked program P in the form of the model 40. When considering the control program P can optimize in such a way that Consequently, getting a minimal program with the same semantics in terms of the property being checked will most likely accelerate it.

Since the intermediate code of the model 40 supports expressions of any length and the goal is to reduce the number of lines of code, the compression unit 50 adds multiple assignments to one combined by enlarging the expression, which is the opposite goal of standard compiler optimizations which is to reduce the number of computations and instead introduce new allocations to buffer expression results. However, because the solver 30 can efficiently compute such expressions as it struggles to compute successor configurations for variables, it is more efficient with fewer allocations and larger expressions.

To achieve such a transfer of an expression from its assignments to later read accesses of the variable, first a standard analysis of available expressions (AvExp for short) is applied, which is provided with program variables or, in short, variables to which the expression is assigned. The problem with this spread is that the results often look like this.

Here is an example of a motor control, as it may be stored as the control program P in the control unit 14. The following representation is a symbolic program description generated by the translator 24, ie an uncompressed model:

1 counter = counter + 1

2 CJump (counter> n) 16

3 CJump (state = 1) 13

4 CJump (state = 2) 8

5 {control speed}

6 overpow = overpow V (speed> max)

7 jump 11 8 {speed up}

9 overpow = overpow V (speed> max)

10 CJump (speed = target) 15

11 warning = overpow V emergency

12 Jump 16

13 {initialize engine}

14 overpow = overpow V (speed> max)

15 warning = overpow

16 stop

FIG. 2 shows the control flow graph for the control program P.

By the compression by means of the compression unit 50, the following compressed program description can be obtained as an optimized model 40:

1 CJump (counter + l> n) 10

2 CJump (state = 1) 6

3 CJump (state = 2)

4 {control speed}

5 Jump 11

6 {speed up}

7 CJump (speed = target) 11

8 warning = overpow V (speed> max) V emergency

9 jump 12

10 {initialize engine}

11 warning = overpow V (speed> max)

12 stop The compressed control program has four fewer program lines. The expressions of line 1 were transferred to the reading in line 2 and the expressions of lines 6, 9 and 14 were combined with the assignments in lines 11 and 15. For this purpose, the compression unit 50 applies the following principles:

Definition 1 (Recursive assignment): Considering a program point a of the form x = exp, we define a as recursive if x is contained in the set of variables that occur in the value assignment exp, ie a read access to x is contained in exp.

To achieve the desired result, we first need AvExp to look at recursive assignments. It should be noted that sometimes we also call the expression recursive when it comes from a recursive assignment. In the standard method, these expressions are excluded from the gen function (see the above document by Nielson et al.) Because the computed expressions in subsequent lines are not available. However, simply generating recursive expressions in AvExp prevents the propagation from ending because we rely on the fact that the propagated code becomes a dead code in the standard propagation. However, in forward propagation of recursive expressions, no lines of code will be dead, since propagating the assignment x = exp to an expression exp 'will replace the occurrence of x in exp' by exp, and thus retain x in exp '. In the next pass of required variables, x is considered important, as is the original assignment, which is therefore not separated. The next run of AvExp expands exp, and so on. Therefore, we need to find more sophisticated possibilities for AvExp and expression propagation.

The key to preserving semantics, that is, semantics-critical propagation of recursive assignments, is to recognize that exchanging a variable for the assigned recursive expression is only permissible if the source, ie the assignment, can be removed. In order to remove a recursive expression exp assigned to x, any reading of x that can be reached by the assignment must be replaced by exp to maintain the semantics. For this purpose, we need to include label or label information in AvExp so that we can determine the origin of the expression. To reflect the original behavior To maintain AvExp, we define the LUB (least upper bound) by applying the default LUB of AvExp to the projection on variable and expression.

Definition 2 (Extended analysis of available expressions) The extended analysis of available expressions can be formalized by the following data flow system: a limited set of labels L = L _p

a set of extremal labels E = init (p) c L a flux link F c L x L

a complete lattice

(D, C) = (2 ^{LxVarp X EXP} , _2 _V ar, _E xp)

fulfilling the ACC (Accending Chain Condition) with the LUB U and the least element 1 = D an extreme value 0 e D and

a collection of monotone transfer functions {cpi | 1 e L} of type cpi: D -> D. in which

cpi (T) = (T \ killi) U gen _! geni = {(l, x, exp)} if cmd = Assign (x, exp)

0 otherwise

killi = {(1 ', x', exp ') I e Var _exp } U {(l', x, exp

if cmd ¹ = Write (x,

0 otherwise

For A, B c L x Var _p x EXP in program P

A c B iff V (l, v, e) eB Ξ (l ', v, e) eA

=> A II B = U {(l, v, e), (l ', v, e), (l, v, e) e A, (1', v, e) e B}.

0 stands for the empty set.

For additional information about dependencies between read and write access to variables, a

Reaching definition analysis used. According to the Reaching definitions, we call a value assignment a "definition" or short def and read access the assigned variable one use or short use.

Definition 3 (Reaching Definitions):

AIvdef shall be the information obtained from the Reaching Definition Analysis for all designations, and Allrdef shall be the set of information for designation 1. We define: Al ^ ef = ^{(χ ', 1) I x = x'} *

Definition 4 (Filtered information of available expressions):

Considering an analysis information Alavexp for the program p and Allavexp for the designation 1 in the program p we define

: = {(1 ', ^χ ', exp ') | x = x '}. Modified forward expression propagation:

Now, when we start our propagation, check for each element in

{1 I Vx, exp, l ".cmdi = Assign (x exp) V cmdi = CondJump (exp) 1"} and every variable χ ^Λ in exp, whether it is reached by an existing definition def, that is

Al ^ 'rdef (Χ',?).

If this is not the case, x 'is not written on any program path or short path leading to 1, i. x 'is an input or a system flag. Otherwise, three cases can be distinguished:

(a) There is no analysis information of AvExp for the variable x ', ie, AI ^{1, x,} _avexp = 0 or AIl, x'avexp = 0. If a recursive assignment to x' exists at 1 'with use in 1 , ie AI ^{1, x,} _rdef = (χ ', 1') or Al ^ x ^ def = (χ ', 1') with emdl, a recursive assignment, marks the Compression unit 50, the program point 1 'with a blocking mark as blocked.

If the value assigned to x 'at 1' reaches 1, but the assigned expression does not conform to AvExp, it can not be propagated. Therefore, not all readings of x 'can be replaced by the corresponding expression and the original assignment to label 1' can not be removed. This can trigger a "domino" effect of blocking recursive defs through the corresponding defuse chains. b) There exists exactly one entry in AI ^{1, x,} _avexp , eg (1 ', χ', exp '). If Ai ^{1, x '} _rdef Π {(x',?)} = 0 and 1 'is not blocked, then we mark 1' as possibly safe, otherwise we block 1 '.

(c) There is more than one entry in AI ^{1, x '} _avexp . Then each entry must assign the same expression exp 'to x', but from different labels, which is referred to below as L '.

If the value assignment x '= exp' recursively, AI ^{1, x,} _rdef Π {(x ',?)} = 0 and there is no 1' e L 'that is blocked, then we can all 1' e L ' mark as possibly safe, otherwise we will block all 1 'e L'.

If the above algorithm is executed until a fix point is reached, the result is the smallest fixed point of the safe recursive assignments. These secure recursive assignments are not blocked by any other assignment and therefore can be expanded and removed without changing the semantics. It should be noted that if any variable in an expression at any designation 1 "is replaced by a secure recursive expression, we must block 1" so as not to propagate false expressions. Thus, there is provided a method for speeding up the formal correctness testing of a program code of a programmable logic controller having at least two instructions by model minimizations, characterized by preprocessing the program code and minimizing the number of program locations by removing instructions by expression propagation. In addition, there is a system that is designed to carry out the method.

Overall, the example shows how the invention can provide a method and system for acceleration to verify the formal correctness of a program for a programmable controller.

LIST OF REFERENCE NUMBERS

10 Inspection device 12 Assembly robot

14 control unit

16 robotic arm

18 pivoting movements

20 permissible range of motion 22 restricted area

24 translators

26 operating unit

28 central control

30 solvers

32 screen

34 input device

36 limitation

38 formula

40 Program description

42, 44 issue

46 Program state

48 development tool

50 compression unit

S10 to S18 process step

P control program

Claims

claims

1. A method for checking a control unit (14) to determine whether the control unit (14) when executing a control program (P) only in accordance with a state default (20, 22) valid, defined by program variables of the control program (P) operating states, wherein the Method by a solver unit (30) the satisfiability of the state specification (20, 22) by the control program (P) is checked by the fact that in the control program (P) all possible values of the program variables are determined in operation,

characterized in that

by a compression unit (50) in the event that a first program location comprises a read access to one of the program variables, at which preceding second program location a value is assigned by a preceding recursive value assignment of this program variable and at the first program location the read access with the previous value assignment is replaced and the second program location is deleted.

2. The method of claim 1, wherein in addition to the second program point still one of the first program point preceding third program location is determined to which alternative to the second program location of the program variable by an alternative value assignment is assigned a value, and at the first program point of the read access only replaced and the second and third program locations will only be deleted if the value assignments at the second and third program locations are the same.

3. The method according to any one of the preceding claims, wherein in the control program each value assignment is marked with an individual label.

4. The method according to any one of the preceding claims, wherein at the first program point and at each other program point with a read access to the program variable of each The read access is replaced by the value assignment from the second program point.

5. The method according to any one of the preceding claims, wherein the second program point is determined by means of a forward data flow analysis for determining the available expressions.

6. The method of claim 5, wherein the second program location is marked with an erase blocking blocking mark if, according to the data flow analysis, an availability at the first program location is missing.

7. The method according to any one of the preceding claims, wherein the second program point is only determined if a reaching-definition analysis of the first program point indicates a non-empty solution amount.

8. The method according to any one of the preceding claims, wherein the control program is iteratively compressed several times by the compression unit.

9. The method of claim 8, wherein the iterative compression is terminated if the control program has remained unchanged in the last performed iteration.

10. checking device (10) for checking a control unit (14) then whether the control unit (14) when executing a control program (P) only in accordance with a state Vorga- be (20, 22) valid, defined by program variables of the control program (P) operating states occupies, comprising:

- An input unit (26) for receiving a user input of the state default (20, 22) and

a solver unit (30) for checking a satisfiability of the condition specification (20, 22) to be achieved by the control program (P),

characterized in that a compression unit (50) is provided which is adapted to perform a method according to any one of the preceding claims.