The Moby/plc Tutorial. Henning Dierks, Hans Fleischhack, Josef Tapken. CvO-Universitat Oldenburg. 16th February 2001.

Transcription

1 The Moby/plc Tutorial Henning Dierks, Hans Fleischhack, Josef Tapken CvO-Universitat Oldenburg 16th February 2001 Contents 1 Introduction PLC-Automata Moby/plc Examples Simple PLC-Automata Delays Connecting PLC-Automata Working with Hierarchy A Reference Card 17 A.1 Commands A.2 Syntax A.3 Nomenclature Introduction This paper introduces the language of PLC-Automata and the tool Moby/plc, a CASE-tool for PLC-Automata. The properties of the language are explained step by step using examples within Moby/plc. After reading this text the reader should be able to construct systems of PLC-Automata on her/his own. It is assumed that the reader is familiar with the behaviour of PLCs. 1.1 PLC-Automata Programmable Logic Controllers (PLCs) are often used in industrial practice to control real-time systems. The main reason is that the cyclic behaviour is suitable to handle real-time requirements. Moreover, they are cheap. 1

2 There are several programming languages for PLCs that provide constructs to ease the design of real-time programs. However, most of these languages are close to an assembler level. In order to construct PLC programs on a more abstract level the pascal-like language \ST" (structured text) has been proposed in the standard IEC Compilers are used to produce executable source code from ST. However, the debugging of real-time programs is still complicated and not supported by CASE-tools for those languages. In the UniForM project [KBPO + 96] the language of PLC-Automata [Die97, DT98] has been proposed to provide an abstract representation of PLC programs and to simplify debugging. A PLC-Automaton is an abstracted program for PLCs. Hence, the interface of such an automaton consists of inputs, locals, and outputs as usual for PLC programs. The automaton has states and transitions. Depending on the inputs the automaton may execute a legal transition which determines the successor state and may manipulate locals and outputs. It is reasonable to represent automata by graphs instead of a textual representation. Therefore, PLC-Automata are always given as graphs in this tutorial. States are given as rounded boxes while transitions are drawn as arrows. Both guards and assignments for transitions are given by annotations to the arrows. The syntax of those correspond to the syntax of ST. Besides the graphical representation further advantages of PLC-Automata are: 1. PLC-Automata are executable, i.e. the behaviour of the system can be visualised in the graphical representation directly. 2. PLC-Automata are equipped with formal semantics in real-time formalisms which allow for automatic verication of real-time properties. 3. PLC-Automata can be compiled into ST. 1.2 Moby/plc Figure 1 provides an overview over the components of Moby/plc. The central component is a graphical interactive editor for PLC-Automata from which all other components of the system can be controlled. These components are a simulator for networks of PLC-Automata, components to verify properties of such systems, an interface to the commercial test system \RT-Tester", and a compiler into ST. 2 Examples In this section we present some examples of PLC-Automata to explain the usage of Moby/plc. To this end we introduce all properties of the language step 2

3 verification methods graphical editor simulation ST code PLC code compiler RT-Tester Figure 1: components of Moby/plc by step. We explain how to use the pull-down menus and buttons. Alternatives like pop-up menus and hot-keys are often oered by the system,too. Those alternatives and the complete syntax of annotations are explained in Section A. 2.1 Simple PLC-Automata Designing a radiator control Example 1 The temperature of a given room should range between 18 o and 22 o. Two sensors deliver Boolean information whether the temperature is below 18 o and above 22 o respectively. A radiator is given which can be switched o and on by sending a corresponding signal of type fon,og. The radiator should be switched o if the temperature has reached 22 o which is indicated by the corresponding sensor. Analogously, the radiator should be switched on when the temperature falls down to 18 o. Initially, the radiator should be switched o. The following ST program would implement such a controller: FUNCTION BLOCK radiator VAR above 22 : BOOL := FALSE; below 18 : BOOL := FALSE; status : on,o := o; state : INT := 2; END VAR above 22 := %IX0.0; below 18 := %IX1.0; CASE state OF 3

4 1 : (* state = radiator on *) IF above 22 = TRUE THEN state := 2; status:=o; END IF; 2 : (* state = radiator o *) IF below 18 = TRUE THEN state := 1; status:=on; END IF; END CASE; %QX2.0 := status; END FUNCTION BLOCK Constructing the radiator control in Moby/plc First, we have to start Moby/plc. If you have installed it according to the installation instructions, then you can start it within a shell with the command PATH/bin/mobyPLC & where PATH stands for the path of the home-directory of your Moby/plc installation. A so-called project manager appears on your screen. We want to build a new project and therefore we select menu File and choose in menu New Project the item PLC-Project. 1 A request for the name of the new project appears and we enter radiator. The request disappears after hitting return or pressing the accept-button. Two new windows are opened automatically. The rst one with title MIXDes- Graph: radiator.mix is useful to manage complex systems since it represents the hierarchical structure of the whole project. At the moment this is not really necessary, because we will only design a small toy example. The second window carries the title PLCSysGraph: radiator.mix. and allows us to construct the system itself. On the left hand side of this window you can nd a column of icons. Select the blue box and click somewhere on the white construction area on the right. A blue box with the default annotation sys 1 1 appears at the position where you have clicked. 2 Select Edit > Edit Name and replace the default name by radiator in the Name-eld. Hit OK afterwards. Then select Hierarchy > Rene by > PLCAutomaton. A window entitled with PLCAutGraph: radiator.mix.radiator 1 for the rest of the tutorial we describe this as File > New Project > PLC-Project. 2 If something is not readable or colors mentioned in this tutorial dier from what you see on the screen, then be advised that Moby/plc has to compete with other applications on your terminal to get a number of colors. Moby/plc will loose this competition when you have started programs like web-browser beforehand. 4

5 appears. 3 First let us dene inputs and outputs. To this end we select on the left the icon with a yellow paper and click afterwards on the construction area. A default denition of a variable occurs. To edit this denition we choose Edit > Edit Properties and enter the name below 18, click on the Input button and on OK to nish our editing. Now the text of the variable denition may not t into the yellow box. To change this you might drag the little black boxes at the border of the yellow box. You can also change the position of the text within the yellow box by dragging. Analogously, construct now the input variable above 22 and the output variable status. In case of status overwrite the type by the enumeration f on,off g and the initial value by off. Each PLC-Automaton has an upper bound for the cycle time called epsilon. You can manipulate this integer value (default is 10) by Edit > Edit epsilon. Now construct the states of the automaton. Click on the green rounded box on the left and then on the construction area where you want to place the rst state. A default denition of the state will appear. To change this denition select Edit > Edit Properties, overwrite the default name by radiator off and hit OK. Again, you can manipulate the extends of the state by dragging the little black boxes around the state. To make this state the initial state press the mid key of your mouse and select Status > Start in the appearing pop-up menu. Construct the second state radiator on analogously. Note, that this state is not the initial state. Next we add transitions to the automaton. Hit the arrow symbol of the icon column on the left. Then click rst on the state radiator o and then on the state radiator on. An arrow from the rst to the second state occurs. To add annotations to this arrow we select Edit > Edit Properties. Add the condition below 18 = true and the action status := on and hit OK. The execution of this transition is only possible if the temperature is below 18 o and the execution will set the variable status to on. Construct analogously a transition from the second back to the rst state with the condition above 22 and action status := off. If you are not satised by the position of an arrow or its annotations you can change this by dragging the little black boxes if the transition is selected. You have nished your rst PLC-Automaton and the picture should look similar to Fig Simulation To check whether the radiator control meets our expectations we can simulate the system. Choose Simulate > Simulation. A warning appears that the initialisation of the simulator may take some time. Hit OK and the warning will disappear. 3 If the selection is disabled then you have probably deselected the blue box by clicking on the white construction area. In this case click on the blue box. Another reason might be that you have already done this step. 5

6 Figure 2: The PLC-Automaton for the radiator control After some seconds a simulation window should pop up. 4 Drag it into a position such that you can observe both the simulation window and the automaton. In the latter the initial state should have changed its color to red. This symbolises that the PLC-Automaton is currently in this state. First we reduce the speed to \4" by dragging the slider to the left accordingly. Hit the Run button and the simulation will start. By clicking the radio buttons of the input variables in the upper part of the simulation window you can manipulate the values of the inputs. First set the value of above 22 to true. As expected, the system does not react to this. Hence, we reset the value to False. Now set below 18 to True. According to our expectations the system changes its state and sets the value of status to on. Now set the value of above 22 to True again and observe the reactions of the system for a while. It does not stop switching its state. The reason is that we have not considered the possibility that the sensors signal contradictory values. To end the simulation hit Quit. Before quitting the work on the whole project we rst save our design. To this end choose in the window MIXDesGraph: radiator.mix the action File > Save. Afterwards select File > Quit to quit the project Another Example Example 2 We want to design a system that has two Boolean inputs I1,I2 and its Boolean output Out should contain the conjunction of the current input values. We want to have two states named is true and is false which also represent the 4 If this is not the case is it likely that you have mistyped something in the system. Check all items of the automaton. 6

7 current result of the computation. An automaton that implements the given specication is shown in Fig. 3 Figure 3: A PLC-Automaton for conjunction Note that in Fig. 3 we set is true to the initial state. This makes a dierence only for the rst cycle of the system because afterwards the output is determined by the input values. However, the output value during the rst cycle may contradict a given specication. Since we have not specied the initial value of Out in Example 2, we could choose the initial value arbitrarily Variables Example 2 shows that the current value of an output of a PLC-Automaton depends on the assignments that have been executed. It is legal to change more than one variable by a transition. We distinguish locals and outputs. Locals are intended for internal use only and are not visible for the environment. We can add to Example 2 a local variable counter of type f0..20g with initial value 0. This counter should count the number of state changes of the system. To this end add the counter to your system and add to the actions of both transitions the assignment counter := counter +1. Make sure that the assignments are separated by a semicolon. This editing can be done by selecting a transition and Edit > Edit Properties. Note that we added also the conjunct counter<20 to the conditions of the transition in order to prevent an error message of the system during simulation. This error occurs when the simulator tries to execute the assignment counter := counter + 1 and the current value of counter is 20. The assignment would violate the type denition. Save and quit this project now. 7

8 Figure 4: The PLC-Automaton for conjunction with counter 2.2 Delays Now we want to work on the radiation control again. In order to work on this project we have to open it by the project-manager if not already done. The project-manager marks open project with a + following the project's name. Recall the problem of contradicting sensor signals of the radiator control. We solve this problem as follows: we introduce a new state that stands for the detection of this problem. We change the controller such that contradicting sensor signals force a state change into the new error state. To make this problem a bit more complicated we want to consider short periods of contradicting sensor signal not as such an error immediately. The reason is that one of the sensors may produce a incorrect signal for a short duration. The behaviour of the PLC-Automata that we have constructed so far depend only on the current values of the variables and the state. To implement the additional functionality we have to inuence the behaviour time dependently. In the language of PLC-Automata time restrictions are annotated to states. We can add a delay to each state of the automaton representing the minimal amount D of time the state has to be held. The result is that all transitions leaving the state are not executed during the delay period even when the corresponding condition is fullled. However, sometimes we like to delay some transitions whereas other transitions should not be delayed. Hence, a simple delay time for the state is still not sucient to deal with typical real-time behaviour. Therefore, we add a delay time and a delay condition. Then, a transition that leaves the current state can only be executed when the delay time is over or the delay condition is not fullled. 8

9 Summarising, we can specify a time period a state should be stable and a condition for which input values this delay has to be considered or not. We can exploit this mechanism to solve the problem of the radiation control. To add the delay specication to the state radiator o we select this state and click Edit > Edit Properties. In the appearing window we change the time to wait to 30 and the events to ignore to below 18 and above 22. Hit OK. Change the second state analogously. Afterwards, add a state conict and transitions from both old states to the new state. These transitions should carry the condition below 18 and above 22 and the action status:=error. The last action implies that we also have to change the type specication of the variable status. Add the element error to the enumeration type of status. Finally, the automaton should be similar to the one in Fig. 5. Figure 5: The extended radiator control. The next example requires a dierent use of the delay construct. The system has to react immediately to error signals and has to react after the delay to the remaining inputs. Example 3 A system shall be designed that observes a Boolean input err. If it detects the input to be true, then it shall jump immediately into a state error st. As long as this has not happened the system shall switch between two states called A and B. Both states shall be stable for at least 60 time units unless the error signal occurs. 9

10 Figure 6: A PLC-Automaton for Example 3 Figure 6 presents an automaton that solve the problem of the last example. Note that the delay time and the delay condition are displayed in the lower part of the state's representation. The delay condition is restricted to input variables only. Hence, you are only allowed to use expressions ranging over inputs, not over locals or outputs. 2.3 Connecting PLC-Automata Now we extend the radiation control in a way that the output of the control is used as input for a control light. To this end we open the project radiator again and select the grey box in the window PLCDesGraph: radiator.mix. This window represents the hierarchical structure of the whole project. We choose Edit > Edit Graph and a window will appear. There we click on the blue box representing a system and afterwards somewhere in the contruction area on the right. We can change the default name to control light by selecting Edit > Edit Name. Maybe the blue system box has to be resized. Now, add an arrow from radiator to control light in the same way as transitions. This arrow indicates that an output of radiator is connected to an input of control light. Hence, Moby/plc asks which output of the radiator should be connected to an input of control light. In this case the possible choices are status or a new output. Select status. Now rene the system control light by the automaton that is given in Fig. 7. To do this, proceed as before. Now, the hierarchy graph of the whole control system should have a structure as given in Fig. 8 on the left hand side. On the right hand side the topmost view 10

11 Figure 7: The PLC-Automaton for the control light on the whole system is shown. We can simulate both automata simultaneously by selecting Simulation > Simulate in the system view (make sure that eithor no blue box is selected or both boxes are selected). To observe the reactions of the system working in parallel have both automata windows on the screen. 11

12 Figure 8: hierarchy graph and system view of the raditation control 12

13 2.4 Working with Hierarchy To structure a design it is useful to exploit the hierarchy concept of Moby/plc. Especially in cases where dierent modes of functionality are given. Then one should gather together states belonging to the same mode in a so-called superstate. On the higher level of superstates one would dene the transitions for a mode change and on the lower levels one would dene the functionality Radiation Control Revisited In the radiation control we can identify modes, eg. the sensors are working correctly or not. Hence, we select both states representing the mode that the sensors are working: radiator on and radiator o. To select both click on the states while the SHIFT-key being pressed. Figure 9: The radiation control after the folding Then we select Hierarchy > Fold to fold both states into a new superstate. A window appears in which we can assign the name sensors ok to the new superstate. After clicking on the OK-button both selected states will be replaced by a new state with the name given by us. Note that the new superstate is drawn with an additional line around the state. This symbolises that this state is rened by socalled substates. Make the superstate the initial state (the procedure is explained in Sect ). The window should now look similar to the one in Fig. 9. Then we select the superstate and choose Edit > Edit Renement. A window for editing an automaton appears containing the so-called subautomaton sensors ok. It consists of the selected states and a so-called outport. Make the state 13

14 Figure 10: The subautomaton sensors ok radiator o the start state. The result should look like the system in Fig. 10. The resulting hierarchy graph is shown in Fig. 11. Figure 11: Hierarchiegraph zur Heizungssteuerung Disco Light Controller Example 4 We want to design a PLC-Automaton that has two modes. One mode \green" should switch a green light on and o in an interval of 20 seconds. In the second mode \red" it should do the same with a red light. Switching between modes should be triggered by an input of type fgreen,redg. 14

15 We start to design the system by two states which represent the modes: green blinking and red blinking. We rene these states by a subautomaton in which we dene the behaviour that is expected in the current mode. In mode green blinking we switch between two states green on and green o with a minimal delay of 20 time units. Analogously, construct the subautomaton for red blinking. The whole system should look similar to Fig. 12. Make sure that you create the transitions between the superstates last. During creation of these transitions you will be asked by the system whether you want a \stubbed edge" or a \new port". Choose \stubbed edge". Figure 12: Hierarchical solution of the disco light controller In the upper automaton of Fig. 12 both superstates representing the modes of the system are shown. The additional frame around the states symbolises that these states are rened by subautomata. Both subautomata are shown below. Note that all levels of the automaton are equipped with a start state. This is important to determine the destination of the transitions in the upper automaton. The destination of a transition to a superstate is the start state of the corresponding subautomaton. For example, the destination of the transition to green blinking is the state green on. However, sometimes it is necessary to jump to a state that is not the start state of a subautomaton. In these case the user has to work with so-called \connectors". The usage of these connectors is displayed in Fig. 13. There we use the connectors (\outports" displayed as circled minus, \inports" as circled plus) to make a transition from red on to green on and from red o to green o. Note that in this case the transitions are divided into three parts. The rst part goes from the state to an outport, the second from the superstate into the other superstate, and nally from the inport to the destination state. Note that these 15

16 kind of transitions from substates or into substates are connected to the inner frame of the superstate. The previous transitions are connected to the outer frame. In cases where transitions are split in several parts as above, only the rst part can carry the condition and action of the transition. Figure 13: The usage of connectors The semantics of transitions from a superstate that is connected to the outer frame is the following: the transition is connected to all states of the subautomaton and has a higher priority than the ordinary transitions. References [DT98] H. Dierks and J. Tapken. Tool-Supported Hierarchical Design of Distributed Real-Time Systems. In Euromicro Workshop on Real Time Systems, pages 222{229. IEEE, [Die97] H. Dierks. PLC-Automata: A New Class of Implementable Real- Time Automata. In M. Bertran and T. Rus, editors, ARTS'97, volume 1231 of Lecture Notes in Computer Science, pages 111{125, Mallorca, Spain, May Springer-Verlag. [KBPO + 96] B. Krieg-Bruckner, J. Peleska, E.-R. Olderog, D. Balzer, and A. Baer. UniForM Universal Formal Methods Workbench. In U. Grote and G. Wolf, editors, Statusseminar des BMBF Softwaretechnologie, pages 357{378. BMBF, Berlin, March

17 A Reference Card A.1 Commands During the work with Moby/plc all three keys of the mouse have a meaning. 5 In each window you will get a menu that is related to the window if you press the right key. For example, here you can nd operations to close the window. Pressing the mid key let a menu (\context menu") appear that is related to the currently selected object of the window. This menu depends on the type of the corresponding object. The left key is used for selecting, deselecting, moving, resizing etc. of objects. A.1.1 Basic Operations of Graph Editors Most of the commands are oered in several ways to the user. Usually the user can issue a command by a pull-down menu, by a context menu, and by a hotkey. creating vertex a creating an edge changing source and destination open an object editor (i) pull-down menu Edit > Create, repeats creation until Edit > Create > Stop creation; (ii) if no object is selected, in the context menu Create; (iii) hotkey c creates the same object as the last created one; (iv) Click a corresponding symbol in the icon column on the left. (i) pull-down menu Edit > Create > Edge, then clicking on the source and on the destination afterwards; (ii) select the source, choose in the context menu Create edge, then select the destination; (iii) select the source, hotkey g, then select the destination; (iv) select the source, click the arrow symbol on the left, then select the destination; (i) select the edge, choose change source resp. change destination in the context menu, then click on the new source resp. destination. (i) select the object, pull-down menu Edit > Edit Name or Edit > Edit Properties; (ii) select the object, choose Edit Properties from the context menu; (iii) select the object, hotkey E; (iv) select the object, click lowest icon on the left; (v) SHIFT with double click on the object 5 If your mouse has only two keys, then the middle key is usually emulated by pressing both keys simultaneously. 17

18 selecting an object removing an object duplicating an object copying into the clipboard inserting from the clipboard Vertices and edges may be selected by clicking directly on the object using the left key of the mouse. Selected objects are symbolises by small black boxes around the object. To add objects to the set of selected objects click on the object while pressing SHIFT. To select objects in an area span the region with the left mouse key being pressed. (i) Select the object, then Edit > Remove; (ii) select the object, then Remove in the context menu; (iii) select the object, hotkey BackSpace. (i) Select the object, then Edit > Duplicate; (ii) select the object, then Duplicate in the context menu; (iii) select the object, hotkey D. (i) Select object(s), then choose pull-down menu Edit > Copy; (ii) Select object(s), then choose Copy in the context menu; (iii) select object(s), then hotkey C. (i) Select object(s), then choose pull-down menu Edit > Insert; (ii) Select object(s), then choose Insert in the context menu; (iii) select object(s), then hotkey I. A.1.2 Navigating Closing window Editing and Browsing through the hierarchy a Getting a hierarchy level higher or lower Each vertex of the design graph represents a window and each window belongs to a vertex of the design graph. To open a window (i) select the corresponding vertex and choose Edit > Edit Graph, (ii) select the corresponding vertex and use the hotkey e, (iii) doubleclick the corresponding vertex. Each window can be closed by (i) File > Close or (ii) Close in the window-menu (press the right button of the mouse). Closing the design graph closes the whole project. Saving a part of the system includes saving the whole project. From a window one gets one level up by choosing Hierarchy > Edit Supergraph. Stepping one level down is possible by (i) Hierarchy > Edit Renement whereas the vertex which is rened can be selected in advance or after the choice. (ii) Doubleclicking the rened vertex. (iii) Select the rened vertex, hit hotkey e. (iv) Select the rened vertex, choose Edit Renement in the context menu. Moreover one can get the window of the design graph on top of the screen by selecting Hierarchy > Edit Design. 18

19 Making a renement Removing a renement Ports In a system graph the user can assign a renement to a vertex by (i) Hierarchy > Rene by whereas the vertex can be selected in advance or afterwards. The user can make two kinds of re- nements. Either a renement by another system graph or by a PLC-Automaton. (ii) By selecting the vertex to be rened and choosing Rene By from the context menu. In an automaton window the user can rene a state by a subautomaton. This can be done by (i) Hierarchy > Add Renement whereas the vertex can be selected in advance or afterwards. (ii) By selecting the vertex to be rened and choosing Add Renement from the context menu. The renement relation between a vertex and a graph can be deleted by (i) choosing in the window of the vertex Hierarchy > Cut Renement whereas the vertex can be selected in advance or afterwards. (ii) By selecting the vertex and choosing Cut Renement from the context menu. Note that after this operation the renement graph still exists in the design graph. The graph can be removed by selecting the corresponding vertex in the design graph and choose Remove from the context menu. It is also possible to reuse this graph as a renement. To this end one has to add a renement for a vertex that carries the same name. Connections between neighbouring hierarchy levels are established by so-called ports. They symbolise the entrances and exits of a graph that is a renement of a vertex. If an edge from or to this vertex is created the user has to select a port that is connected to the edge. This relation between an edge from/to the rened vertex and a port on the level of the renement can be edited by the submenu Ports of the context-menu for the edge. In case of PLC-Automata it is possible that edges from/to rened vertices are not related to a port. We call those edges \stubbed edges". Stubbed edges from a rened state are implicitly connected with all states of the renement and this transitions has a higher priority than the transitions in the renement. Stubbed edges to a rened state are connected with the start state of the renement. The graphical representation displays stubbed edges to be connected with the outer frame whereas edges that are connected to ports are drawn to the inner frame of the vertex. 19

20 transparent display Rened vertices can be displayed transparently. In this case the graphical representation of a vertex contains the display of its renement graph. This can be selected by Display transparent in the context menu of the vertex. To switch o this option repeat this choice. To change the transparent display of the renement graph select Attach to navigator in the context menu of the rened vertex. A separate window appears in which a slider can be used to dene the scaling. The position can also be manipulated by scrolling. A.1.3 Simulation of one automaton Simulation of a system Specic Operations for PLC-Automata The simulation of one PLC-Automaton can be started by Simulation > Simulate in the window of the automaton. Note that it is note possible to start the simulation on a subautomaton. Starting the simulation is preceded by a syntactic analysis. If this analysis fails, a window with error messages will appear. To start the syntax analysis only, select Simulation > Parse. A simulation can be started in window of a system graph by Simulation > Simulate. Then a simulation of all selected vertices will be started. If no vertex is selected, all vertices will be taken into account for the simulation. During the simulation clicking on rened vertices will open a window for the renement. Clicking a variable will open a window that display the current value of that variable. Clicking a channel in a system graph will open a similar window. 20

21 Controlling the simulation The control window of the simulator oers several buttons to manipulate directly the behaviour of the simulation. Run starts a simulation or resumes it. Stop freezes the simulation. With Time the simulator can be started for a duration that can be chosen by the user. With Step the simulation is executed for one time unit whereas Next executes the simulation until the next action. An action is either polling of an input or a reaction of the automaton (which may cause a transition). In the upper part of the control window the user can manipulate the drivers for all input variables of the current system under simulation except for those inputs which are driven by another output of an automaton that is also under simulation. Values of outputs can be observed. Both the input variables and output variables are categorised. The category that is displayed by the simulation control can be changed with the help of the Categorymenu. In cases where more items belong to the category that can be displayed it is possible to ip through several pages by the \>" and \<" buttons. 21

22 Simulation options Exporting to PLC code By choosing Options > Edit Options in the control window of the simulator the user opens a window in which several additional features of the simulation can be used. The window contains three pages (General, Playback, Record). On page General it is possible to manipulate the ratio between the simulation time units and the editor time units. Moreover, breakpoints can be dened here. To add a breakpoint select Add and enter in the appearing window a condition for the breakpoint, a duration how long this condition must hold before the break should happen, and message that shall appear on the screen. Finally, choose in which way the simulator shall react to the break. If a breakpoint is detected then a window containing the message of the breakpoint appears on the screen and afterwards the simulation either holds, restarts, or resumes normally after acknowledging the break. The buttons Edit, Copy, and Delete cause the canonical operations on the selected breakpoint. On page Playback the user can specify that the simulation should not be controlled completely interactive. It is either possible to specify a trace le which is usually a pre-recorded simulation. Alternatively, it is possible to specify that inputs are triggered randomly. In the texteld Using le a particular lename can be entered by the user. Pushing Select presents a window in which the user can browse through the le system. The rest of the window allows to specify which components of the specied trace should be taken from the le and which inputs should be triggered randomly. On page Record a recording of the following simulation into a le can be selected (and deselected) by pushing the switch Write a protocol to a le. In the texteld Using le a particular lename can be entered by the user. Pushing Select presents a window in which the user can browse through the le system. The rest of the window allows to modify the contents of the recorded simulation. For each simulated automaton it is speciable whether the changes of variables are recorded or not and whether the time stamps of these changes are recorded. To translate a PLC-Automaton into PLC code (in \structured text") select File > Export > ST-Code. A window appears that allows for changing the lename of the compiled code and editing the relation of inputs and outputs to the input and output addresses of the PLC. 22

23 A.2 Syntax A.2.1 Type Declarations Moby/plc allows three kinds of types: Boolean variables can be declared by the keyword bool Enumerations are dened by enumerating the elements within curly brackets. For example, flight on,light og. It is allowed to use '.' once per identier. Hence, the type f a.b, c.d g is legal. Subranges of nonnegative integers are dened by giving the minimum and maximum separated by.. within curly brackets. For example, f3..6g contains 3,4,5, and 6. A particular variables is called states. If the user declares this variable, the type of it will generated automatically as the enumeration of the full names of all states in the automaton. Note that states cannot be dened as input. A.2.2 Conditions Conditions are boolean expressions over declared variables. The following operators and constants can be used. For some operators alternative syntax is given in rounded brackets, explanation are given in curly brackets. and (&,AND), or (j,or), not (!,NOT), true (TRUE), false (FALSE) if (IF)... then (THEN)... [else (ELSE)... ] endif (endif) = fequalityg, # (<>) finequalityg, >=, <=, >, < +,?,, = fdivisiong, % fmodulog (, ) For time conditions the use of local and output variables is not permitted. For conditions of simulation breakpoints variables have to be prexed by the name of the corresponding automaton separated by \.". For example, the breakpoint condition A1.var2=true is a syntactly correct if automaton A1 contains a boolean variable var2. A.2.3 Actions Actions are sequences of assignments which are separated by \;". An assignment has the shape u:=e where u is a local or an output variable and e is an expression that is type consistent with u. Examples are a:=a+1; b:=a*2; c:= radio o. Moreover, it is allowed to build statements by if-then-else. For example, if a>0 then a:=a-1;b:=b*2; else a:=10; endif is legal. Even nesting is ne. 23

24 A.2.4 Reserved Keywords All identiers for automata, variables and enumeration elements have to be unique. Identiers are strings consisting of letters (uppercase and lowercase), numbers, and \ " where the rst symbol is not a number. The following keywords are reserved and cannot be used as identiers: action, all, automaton, channel, condition, connect, delay, else, endif, epsilon, for, if, init, inport, in, interface, into, local, nextstate, outport, out, start, state, states, subautomaton, then,to, with all operators and constants given in Sect. A.2.2. For the conditions of simulation breakpoints the following additional keywords are also reserved (written in lowercase and uppercase): at, await, breakpoint, cycle, cyclic, def, else, message, option, parallel, poll, report, restart, since, stop, trace, use, vector, wait, InputPolling, TimeResolution. 24

25 25 Figure 14: Nomenclature in Moby/plc {design graph, hierarchy graph} design vertex of a system {inport, connector} subautomaton design vertex of an automaton design vertex of a subautomaton state {button column, icon column} transition condition time delay initial state channel selected vertex {system graph, system, block view} PLC-Automaton variable A.3 Nomenclature {refined state, superstate} outport selected edge, transition