TRANSPARENCY ANALYSIS OF PETRI NET BASED LOGIC CONTROLLERS A MEASURE FOR SOFTWARE QUALITY IN AUTOMATION

Transcription

1 TANSPAENCY ANALYSIS OF PETI NET BASED LOGIC CONTOLLES A MEASUE FO SOFTWAE QUALITY IN AUTOMATION Georg Frey and Lothar Litz University of Kaiserslautern, Institute of Process Automation, PO Box 3049, D Kaiserslautern, Germany frey@eit.uni-kl.de, Phone.: , Fax: ABSTACT Control algorithms are a special type of application oriented software which clearly should meet the quality criteria defined by ISO/IEC9126 standard. It is shown how these criteria are related to two basic properties of control algorithms: correctness and transparency. This contribution concentrates on the analysis of transparency. An algorithm is said to be correct if it fulfils several formal criteria as for example determinism. It is said to be transparent if it is easy and clear to see what the controller does at the moment and what it will do in the next steps. A number of criteria for transparency are given. These criteria cover different aspects such as number of comments, directionality, and I/O-behavior. They are combined in a weighted sum to an automatically computable metric. The analysis is based on the Signal Interpreted Petri Net (SIPN). It is shown how the transparency properties of the SIPN can be determined using the SIPN itself and its reachability graph. Because of a close relation between SIPN and Sequential Function Chart (SFC) according to IEC standard the analysis is easily extended to SFC-nets. 1 INTODUCTION In general, the realization of a logic controller includes hard- and software of several layers. With the assumption of standard hardware with well-defined functionality, the application is realized by the program of the control algorithm i.e. software of the application layer. Hence the quality of the controller depends mainly on the quality of that software. Quality is defined in ISO 8402 standard [ISO 1994] as: The totality of characteristics of an entity that bear on its ability to satisfy stated or implied needs. According to ANSI/IEEE 610 standard [ANSI/IEEE 1991] software for process control is application software. For application software, The ISO/IEC 9126 standard [ISO 1991] defines software quality characteristics as: A set of attributes of a software product by which its quality is described and evaluated. A software quality characteristic may be refined into multiple levels of sub-characteristics. The paper aims to relate the concepts of software quality, as presented in Section 4, to the concepts of transparency described in Section 5. Beforehand, the next section presents the SIPN model in some detail. And Section 3 discusses analysis methods for SIPN. The contribution closes with a summary and an outlook on further work. 2 SIGNAL INTEPETED PETI NETS ω Petri nets are able to express the causality as well as the concurrency of a control algorithm. To model nonautonomous behavior Interpreted Petri Nets (IPN) have been introduced by Moalla and König independently in the early 80 s, see [MOALLA ET AL. 1987] and [KÖNIG AND QUÄCK 1988] IPN are ordinary Petri nets with binary markings and allow explicit description of input/output facilities in a welldefined way. Hence, IPN have been applied to logic control systems by many authors, e.g. [DAVID AND ALLA 1992]. The term Signal IPN (SIPN) for the presented model is used, since the influence of the environment on the system is based on signals rather than on events. 2.1 Formal Definition A Signal Interpreted Petri Net (SIPN) is described by a 9-tuple SIPN = ( P, T, F, m 0, I, O, φ, ω, Ω) with: (P, T, F, m 0 ) an ordinary PN with places P, transitions T, arcs F, and binary initial marking m 0, with P, T, F >0, I a set of logical input signals with I > 0 O a set of logical output signals with I O =, O > 0 φ a mapping associating every transition t i T with a firing condition φ(t i ) = Boolean function in I a mapping associating every place p i P with an output ω(p i ) (0, 1, -) O, where (-) means don t care. Ω the output function combines the output ω of all marked places Ω: m (-, 1, 0, c, r 0, r 1, c 0, c 1, c 01 ) O. The combined output can be undefined (-) one (1), zero (0), contradictory (c) redundant zero or one (r 0, r 1 ) or a combination of contradiction and redundancy (c 0, c 1, c 01 ). 2.2 Graphical epresentation As with PN, Places of SIPN are represented by circles, transitions by bars, the flow relation by arcs and the tokens by dots in the circle of the corresponding place. In addition to this basic representation the transitions of SIPN are labeled with their firing condition and the places are labeled with their output. Given larger numbers of output signals it is convenient to represent the output not in the vectorial form but by explicitly specifying the influence on variables instead, if for example O = (o 1,..., o 100 ) then ω(p i ): o 1 = 1; o 3 = 0 is better than ω(p i ) = (1, -, 0, -,...-). Places and Transition may be labeled with an additional comment. Fig. 1 shows an example of an SIPN where both representations are used. Proceedings of the American Control Conference ACC 2000, Chicago, June 28-30, p. 3182

2 Net1 P 5: Stirring ω(p 5 ): o 3 = 1 T 5 : Filled & Temp. OK ϕ(t 5 ) = i 2 i 3 p 1 : Stand By ω(p 1) = (0, 0, 0, 0) T 1 : Start Button pressed ϕ(t 1 ) = i 4 i 1 i 2 P 2: Filling ω(p 2 ) = (1, 0, -, 0) T 2 :Filled & Temp. low ϕ(t 2 ) = i 2 i 3 P 3 : Heating ω(p 3) = (0, 0, -, 1) T 3: Filled & Temp. OK ϕ(t 3 ) = i 3 P 4 : Emptying ω(p 4 ) = (0, 1, -, 0) Fig. 1. SIPN model for the heating tank controller. T 4 : Tank is empty ϕ(t 4 ) = i 1 i 2 i Dynamic behavior The dynamic behavior of an SIPN is given by the movement or flow of tokens through the net i.e. the change of its marking. This flow is realized by the firing of transitions. The firing of a transition t i removes a token from each of its pre-places (places p j with (p j, t i ) F) and puts a token on each of its post-places (places p j with (t i, p j ) F). For the firing process there are four rules: 1. A transition is enabled, if all its pre-places are marked and all its post-places are unmarked. 2. A transition fires immediately, if it is enabled and its firing condition is fulfilled. 3. All transitions that can fire and are not in conflict with other transitions fire simultaneously. 4. The firing process is iterated until a stable marking is reached (i.e. until no transition can fire anymore). Since firing of a transition is supposed to take no time, iterated firing is interpreted as simultaneous. After a new stable marking is reached, the output signals are recalculated by applying Ω to the marking. 2.4 elation to Sequential Function Chart There is a close relation of SIPN to Sequential Function Chart (SFC) according to IEC 1131 standard [IEC 1992]. [LEWIS 1998] There is one big difference in the dynamic behavior: In SFC there are, by definition, no transient states. The activity of a step is always held up for at least one PLC cycle. However, the cycle time of a PLC is very short resulting in quasi-transient states of the controller. The relation of SIPN and SFC is illustrated using the control algorithm for a heating tank [FEY AND LITZ 1999]. The informal specification to be fulfilled by the controller is as follows: After pressing the start button (i 4 = 1) the empty tank (i 1 = 0) tank is filled by opening Valve 1 (o 1 = 1). The filled tank (i 2 = 1) is heated (o 4 = 1) until the temperature sensor signals that the temperature limit is reached (i 3 = 1). The heated tank is emptied below the minimal level (i 1 = 0) by opening Valve 2 (o 2 = 1). During the whole process the contents are stirred (o 3 = 1). Fig. 1 shows a controller for the heating tank problem modeled by SIPN and Fig. 2 shows a solution employing SFC. From the figures it is easy to see that, using only a subset of SFC-language, an SFC can be built up in the same way as an SIPN. Note that both the solutions given for SIPN and for SFC meet the informal specification but they are not exactly equivalent in their dynamics. S5 S1 N o3 i2 i3 o1 o2 o3 o4 i1 i2 i4 i4 i1 i2 S2 N o1 i2 i3 S3 N o4 i3 S4 N o2 Fig. 2. SFC model for the heating tank controller. 3 SIPN ANALYSIS 3.1 eachability in SIPN A marking m is said to be reachable from a state m if there exists a sequence of input signal combinations such that a firing sequence starting from m has m as stable final marking. eachability set (S): The reachability set of an SIPN is the set of all markings reachable from m 0. eachability graph (G): The reachability graph is a graph G=(V, E) with the reachable markings as vertices (V = S). An edge e = (v i, v j ) indicates that there exists a combination of input signals such that the marking m j corresponding to e j is the next stable marking reached from m i (corresponding to e i ). The edges are labeled with the corresponding firing conditions and the vertices are labeled with the marking and the output of the net. 3.2 Dynamic Synchronization Dynamic Synchronization is an effect, that is so far only studied in the context of SIPN, but can be found in other non-autonomous models too: Two transitions t 1 and t 2 form a full dynamic synchronization if they always fire simultaneously. If the simultaneous firing results only for special input signals or net markings, the dynamic synchronization is said to be partial. With full DS, the algorithm can jump from a state to another state without passing through the intermediate states. With partial DS the algorithm jumps for some combinations of input signals and proceeds normally for others. 3.3 SIPN eachability Graph G SIPN As already indicated in most cases the reachability graph of an SIPN (G SIPN ) differs from the reachability graph of the Proceedings of the American Control Conference ACC 2000, Chicago, June 28-30, p. 3183

3 underlying PN (G PN ). In [FEY 2000] an algorithm to build G SIPN based on G PN is introduced. Based on this reachability graph, graph based analysis methods known from PN theory can be applied to SIPN. 4 SOFTWAE QUALITY ISO/IEC 9126 defines six characteristics of software that can be used as criteria for quality (cf. Table 1). In Table 2 these characteristics are set in the framework of controller design. The field of metrics to measure these software characteristics is maturing, see e.g. [JALOTE 1997] for an overview. However, to our best knowledge, metrics are only defined for textual programming languages. Some of the best known metrics date back to the late 70s [HALSTEAD 1977], [MCCABE 1976]. Experience with those metrics in the area of controller programming is not published. Table 1 Software Characteristics of ISO/IEC 9126 Characteristic Explanation Functionality Attributes that bear on the existence of a set of functions and their specified properties. The functions are those that satisfy a stated or implied need. eliability Set of attributes, that bear on the capability of software to maintain its level of performance under stated conditions for a stated period of time. Usability Attributes that bear on the effort needed for use, and on the individual evaluation of such use, by stated or implied set of users. Efficiency Attributes that bear on the relationship between the level of the performance of the software and the amount of resources used, under stated conditions Maintainability make specified modifications Attributes that bear on the effort needed to Portability Attributes that bear on the ability of software to be transformed from one environment to another. Table 2 Software Characteristics applied to Controllers Characteristic elevance / Criterion Functionality Very important / Correctness of the control algorithm eliability Very important / Correctness and robustness of the control algorithm Usability Important / Facility of Graphical User Interface and Transparency of the algorithm Efficiency Not important for unique applications (e.g. chemical plant). Very important for applications with multiple realizations (e.g. washing machine controller) Maintainability unique realizations / Transparency Very important for applications with Portability Very important to enable the software reuse on different hardware/ Transparency 5 TANSPAENCY As indicated in Table 2 functionality and reliability of the software rely on the correctness [FEY AND LITZ 2000] of the algorithm. Transparency is a means to achieve maintainability, usability and portability. It also helps to achieve functionality and reliability during the design process. 5.1 Definition of Transparency In contrast to known software quality metrics the concept of transparency originates from the area of controller design. Primary goals in applying formal methods to controller design are the correctness and the transparency of the resulting algorithm. Correctness and transparency are independent properties. An algorithm can be correct or not; and it can be more or less transparent. Transparency of an algorithm is defined as follows: 1. At any time it must be easy and clear to see what the controller does in the moment and what it will do in the next step. 2. At any time there must be the possibility to reinterpret the algorithm. This means the aim of the control algorithm must be recognizable. 5.2 Criteria for Transparency Frey and Litz [FEY AND LITZ 1999] introduced formal criteria for the transparency in SIPN and SFC. In Table 1 some criteria for transparency in SIPN algorithms are given. The list is not exhaustive and may be adapted to the special needs of the project under consideration. The criteria are normalized to one (one is high transparency, zero is no transparency at all). The overall transparency value is calculated as a weighted sum of the single criteria. 5.3 Transparency Analysis The transparency criteria t 1, t 6, and t 7 are directly evaluated using the SIPN. To derive t 1 the number of net elements and the number of associated comments have to be counted. For t 6 The direction of the arcs and for t 7 their intersections have to be determined. To determine the value of the transparency criteria t 2, t 3, and t 4 the reachability graph as well as the description of the SIPN is needed. This is because the total number of input signals (t 2 ), output signals (t 3 ), and output settings (t 4 ) has to be derived from the SIPN. If an input signal is trivial, it is not part of any of the (logically reduced) arc labels in G SIPN. To test the output signals for triviality, all output functions have to be compared. The number of correct output settings (0 or 1) can be counted in the output functions of G SIPN. The total number of output settings (t 4 ) given as the sum of output settings over all reachable markings is derived from the SIPN in combination with the G SIPN. The criteria t 5 and t 8 can be evaluated using solemnly the reachability graph. To determine t 5 the marking of all states has to be tested. For t 8 the labels of the arcs have to be checked. Arcs due to dynamic synchronization have a combined label t i t j. the other arcs have a label of the form t * i. Proceedings of the American Control Conference ACC 2000, Chicago, June 28-30, p. 3184

4 Table 3 Criteria for transparency # Criterion Explanation Measure t 1 Comments There should be a comment at every # Comments place/step and at every transition t1 = # Places + # Transitions t 2 No trivial input A defined input signal that does not influ- # trivial Input -Signals t2 = 1 max 1, # Input -Signals -1 ence the controller ( ) t 3 No trivial output An output signal that is set to the same value all the time. t 4 No redundant output If several activated places set an output signal to the same value then there is redundant information. t 5 Safety If the net is safe, the post-places of a transition need not to be checked to determine if the transition fires. t 6 Directionality The control flow should follow one preferred direction. t 7 Intersections There should be not be too much intersecting arcs t 8 No Dynamic Synchronization (DS) DS leads to transient states an hidden synchronization, introducing additional arcs in G SIPN that are not part of G PN. # trivial Output -Signals t3 = 1 # Output -Signals t # correct Output Settings in G SIPN 4 = max( 1, # Output Settings in SIPN markings) t 5 1 = 0 if net is safe if net is not safe t # arcs in preferred direction 6 = # arcs min( 5, # Intersections) t7 = 1 5 t = 1 8 # arcs due to DS in G max 1, ( # arcs in G ) SIPN SIPN 5.4 Example As an example, the transparency of two SIPN algorithms for the heating tank problem introduced in Section 2.4 is compared. The first one is the one already presented in Section 2.4 (Fig. 1) the second one is shown as in Fig. 3. Net2 p 7 ω(p 7) = (-,-,1,-,0,1) p 8 ω(p 8) = (0,-,-,-,0,1) t 3 φ(t 3) = i 3 p 2 ω(p 2 ) = (-,-,1,-,0,1) p 3: ω(p 3) = (-,-,-,-,0,1) t 2 φ(t 2) = i 2 t 1 φ(t 1) = i 4 p 6 ω(p 6 ) = (0,1,1,0,0,1) p 4 ω(p 4) = (1,0,1,1,0,1) p 5 ω(p 5) = (0,0,1,1,0,1) t 4: φ(t 4) = i 1 i 4 p 1 ω(p 1 ) = (0,0,0,0,0,1) t 5 φ(t 5) = i 4 i 5 i 6 Fig. 3. Another formally correct SIPN for the heating tank. Note that both SIPN are correct and fulfil the informal specification but their dynamic behavior and their I/Obehavior is not identical Criteria t 1, t 6, and t 7 can be derived directly from the graphical representation of the SIPN. In Net1 there are comments at every place and at every transition, whereas in Net2 there are no comments at all. This results in: t 1 (Net1) = 1; t 1 (Net2) = 0. In this example only two principal directions are distinguished: bottom-up and top-down, with top-down as preferred direction. In Net1 all twelve arcs point downwards, whereas in Net2 only 5 of 18 arcs point downwards, the others point upwards or directly sideways, giving: t 6 (Net1) = 1; t 6 (Net2) = 5/18. In Net1 there is no intersection between arcs, whereas in Net2 there are five intersection. This results in: t 7 (Net1) = 1; t 7 (Net2) = 0. For the other criteria the reachability graphs of the Nets are needed. Fig. 4 shows the two reachability graphs: To determine the value of the transparency criteria t 2, t 3, and t 4 the reachability graph as well as the description of the SIPN is used. Fig. 4 shows that in Net1 none of the four input signals is trivial whereas in the reachability graph of Net2 the input signals i 5 and i 6 are part of no firing condition. Hence, i 5 and i 6 are trivial in Net 2. With a total of six input signals (according to Fig. 3) in Net2 the results for t 2 are as follows: t 2 (Net1) = 1; t 2 (Net2) = 2/3. The output functions in Fig. 4 show that in Net1 none of the four output signals is trivial whereas in the reachability Proceedings of the American Control Conference ACC 2000, Chicago, June 28-30, p. 3185

5 graph of Net2 the output signal o 5 is always set to zero and o 6 is always one. Hence, o 5 and o 6 are trivial in Net 2. With a total of six output signals (according to Fig. 3) in Net2, the results for t 3 are as follows: t 3 (Net1) = 1; t 3 (Net2) = 2/3 Furthermore, the output functions in Fig. 4 show that in Net1 all outputs are set to zero or one whereas in Net2 there are redundant output settings. From Fig. 4 the number of correct output settings in Net2 is 10. Summing up the number of output settings in Net2 (Fig. 3) over all reachable marking (Fig. 4) results in a total of 59 output settings. Thus, the results for t 4 are as follows: t 4 (Net1) = 1; t 4 (Net2) = 10/59 m 0=(1,0,0,0,0) Ω = (0,0,0,0) m 1=(0,1,0,0,1) Ω = (1,0,1,0) t 5: i 4 i 5 i 6 m4 = (0,0,2,0,0,0,0,1) t 1: i 1 i 2 i 4 t 4: i 1 i 3 i 4 t 2: i 2 i 3 m 0 = (1,0,1,0,0,0,0,1) Ω = (r 0,0,0,0,r 0,r 1) (t 1 t 5) * : i 2 i 4 (t2 t3) * : i3 i2 (i1 i4) m 1 = (0,1,1,1,0,0,1,0) Ω = (1,0,r 1,0,r 0,r 1) m 2 = (0,1,1,0,1,0,1,1) Ω = (r 0,0,r 1,1,r 0,r 1) m 3 = (0,1,1,0,0,1,1,1) Ω = (r 0,1,r 1,0,r 0,r 1) t 5: i 2 i 3 t 2 * : i 2 i 3 t 3 * : i 3 (i 1 i 4) m 4=(0,0,0,1,1) Ω = (0,1,1,0) t 3: i 3 m 2=(0,0,1,0,1) Ω = (0,0,1,1) (t 2 t 3 t 4) * : i 1 i 2 i 3 i 4 t3 t4: i1 i3 i4 t 4: i 1 i 4 t1 t5 t2 t3: i2 i3 i4 (t 1 t 5 t 2) * : i 2 i 3 i 4 Fig. 4. eachability Graphs for the SIPN in Fig. 1(top) and Fig. 3 (bottom) The criteria t 5 and t 8 can be evaluated by solemnly using the reachability graph. Net1 is safe Net2 is not safe: t 5 (Net1) = 1; t 5 (Net2) = 0 In G SIPN of Net1 all arcs are labeled by single transitions. Hence, there is no DS in Net1. In G SIPN of Net2, six of nine arcs are based on DS, recognizable by their label. This gives the following results for t 8 : t 8 (Net1) = 1; t 8 (Net2) = 1/3. The overall transparency value for the SIPN is derived by building the weighted sum of t 1 to t 8. To keep it simple, in this example all elements of the weighting vector are set to one, resulting in: T(Net1) = 1; T(Net2) = 0.26 This result shows, that Net1 is fully transparent, whereas Net2 could be considerably improved. Hence the formal result is in good accordance with the subjective impression one gets by looking at the two SIPN in Fig. 1 and Fig CONCLUSION In this paper definitions and criteria for transparency are presented. They are based on Signal Interpreted Petri Nets (SIPN) and on methods for analyzing such nets. These methods are presented in some detail. It is shown that the concept of transparency is an important means to achieve software quality in the area of logic control design. The transparency criteria give a value between zero and one. One advantage of the presented approach is that all these criteria are objective can be automatically computed by algorithms. The implementation of the algorithms into a control design tool and the evaluation at examples of practical dimensions is a current research task. EFEENCES [ANSI/IEEE 1991] ANSI/IEEE, Standard , IEEE Glossary of Software Engineering Terminology [DAVID AND ALLA 1992]. David and H. Alla, Petri Nets and Grafcet - Tools for Modeling Discrete Event Systems, Prentice Hall, New York, London, [FEY 2000] G. Frey, Analysis of Petri-Net based Control Algorithms Basic Properties, Proceedings of the ACC [FEY AND LITZ 1999] G. Frey and L. Litz, A measure for transparency in net based control algorithms, To appear in: Proc. of the IEEE Conf. on Systems Man and Cybernetics, Tokyo, Oct [FEY AND LITZ 2000] G. Frey and L. Litz, Correctness Analysis of Petri Net Based Logic Controllers, Proceedings of the ACC2000. [HALSTEAD 1977] M. H. Halstead, Elements of Software Science. Elsevier: North Holland Publishing Co., 1977 [ISO 1991] ISO, International Standard 9126, Information Technology - Software Evaluation. Quality Characteristics and Guidelines for their Use. December [IEC 1992] IEC, International Standard A: Programmable Logic Controllers, Part 3: Languages [ISO 1994] ISO, International Standard 8402 Quality Management and Quality Assurance-Vocabulary [JALOTE 1997] P. Jalote, An Integrated Approach to Software Engineering, 2nd Ed., Springer Verlag, New York, [KÖNIG AND QUÄCK 1988]. König and L. Quäck, Petri-Netze in der Steuerungs- und Digitaltechnik, Oldenbourg Verlag, München, Wien., [LEWIS 1998] Lewis,. W.: Programming industrial control systems using IEC IEE Publishing, London, [MCCABE 1976] T. McCabe, A Complexity Measure, IEEE Transactions of Software Engineering, SE2 (1976), Nr.4, pp [MOALLA ET AL. 1987] M. Moalla, P. Pulou and J. Sifakis, Synchronized Petri Nets: A Model for the Description of nonautonomous Systems, LNCS 64, pp , Springer, Berlin, New York, Proceedings of the American Control Conference ACC 2000, Chicago, June 28-30, p. 3186