Ambiguities in IEC 61131-3 ST and IL expression semantics

One of the aspects that affects the reliability of a software application is the programming language used for its development. In industrial automation applications, the most commonly used languages are those defined in the IEC 61131-3 standard. This work contains an analysis of the semantics of ST and IL expressions, and highlights ambiguities in the standard that might lead to seemingly correct code being executed and evaluated differently in distinct IEC 61131-3 execution environments. Examples of code that may be evaluated to different results are given, and an evaluation of several commercially available IEC 61131-3 compilers is made and compared. A static code analyzer was developed capable of identifying legal IEC 61131-3 code that may result in ambiguous behavior, and this analyzer was used to test source code currently in use in real-world control applications.