Programmable logic controllers (PLCs) are essentially domain-specific computers that are widely used in the industrial field. These industrial devices are usually required to be of high reliability, and program bugs can lead to catastrophes. However, there are few automated testing tools for PLC programs. This paper proposes a framework, named STAutoTester, for automatically generating test cases for IEC 61131-3 Structured Text (ST) programs. It adopts Dynamic Symbol Execution (DSE) combined with redundant path pruning to efficiently perform PLC multi-cycle test data generation under different coverage criteria. We have evaluated STAutoTester on 21 programs. The experimental results show that STAutoTester can effectively handle these programs. Compared to S${}_{YM}$PLC, a previous symbolic execution based tool for automatically testing PLC software, we achieved comparable statement coverage with much fewer test cases. Besides, we have achieved greater branch coverage and stricter MC/DC coverage, which were not implemented by S${}_{YM}$PLC.

可编程逻辑控制器（PLC）本质上是领域特定的计算机，已在工业领域中广泛使用。通常要求这些工业设备具有高可靠性，并且程序错误可能导致灾难。但是，很少有用于PLC程序的自动测试工具。本文提出了一个名为STAutoTester的框架，用于自动生成IEC 61131-3结构化文本（ST）程序的测试用例。它采用动态符号执行（DSE）与冗余路径修剪相结合，可以在不同的覆盖率标准下有效地执行PLC多周期测试数据的生成。我们已经在21个程序上评估了STAutoTester。实验结果表明，STAutoTester可以有效地处理这些程序。与S相比${}_{ÿ\mathrm{中号}}$PLC是以前用于自动测试PLC软件的基于符号执行的工具，我们用更少的测试用例实现了可比的语句覆盖率。此外，我们实现了更大的分支覆盖范围和更严格的MC / DC覆盖范围，这是S并没有实现的${}_{ÿ\mathrm{中号}}$PLC。