Abstract: Programmable Logic Controller (PLC) is one of the most important components of industrial control system, which controls varieties of physical equipments and production processes. The faults of PLC control program caused by malicious tempering of attacker and programming errors of internal personnel will seriously threaten equipment safety and personal safety in industrial field. In order to solve this problem, a control flow analysis method of PLC program was proposed. Firstly, the lexical and syntactic structure of source code were analyzed by using flex and bison. Then, the intermediate representation without instruction side effects was generated and optimized by analyzing the Abstract Syntax Tree (AST). Finally, the basic blocks were divided on the basis of intermediate representation, and the control flow graph of the program was constructed by taking basic block as the basic unit. The experimental results show that, the proposed method can restore the control flow structure of PLC program in the form of statement table, and provide the basis for program understanding and security analysis.

Key words: Programmable Logic Controller (PLC), control flow, intermediate representation, program understanding, security

摘要： 可编程逻辑控制器（PLC）是工业控制系统的重要组成部分，控制着各类物理设备及工艺流程。无论是攻击者的恶意篡改还是内部人员的编程错误所造成的PLC控制程序错误都将严重威胁设备及人身安全。为解决该问题，提出了针对PLC程序的控制流分析方法。首先，利用flex和bison分析了源代码的词法及语法结构；其次，通过分析抽象语法树（AST）生成并优化了不含指令副作用的中间表示；最后，在中间表示的基础上划分基本块，并以此为基本单元构建了程序的控制流图。实验结果表明，所提方法能够恢复语句表形式PLC程序的控制流结构，为程序理解和安全性分析提供了基础。

关键词: 可编程逻辑控制器, 控制流, 中间表示, 程序理解, 安全性