PLC Programming for Hybrid Systems via Signal Interpreted Petri Nets

Transcription

1 PLC Programming for Hybrid Systems via Signal Interpreted Petri Nets Georg Frey University of Kaiserslautern, Institute of Process Automation Abstract To analyze control algorithms for hybrid processes a purely discrete event approach is in most cases not sufficient. First of all, hybrid processes often produce analog sensor signals. These signals have to be converted to events to be used in the discrete controller. Furthermore the controller has to set analog output signals to influence the process. An often used approach to include analog values in discrete controllers is to program pre- and post-processors for the external input and output signals. With this approach on the one hand the controller remains purely discrete but on the other hand the pre- and post-processors can not be included in the analysis of the controller. To overcome this problem, in this contribution Signal Interpreted Petri Nets (SIPN), which are a Petri net model with binary input and output signals suited for the specification of PLC programs are extended to include analog signals. Furthermore, SIPN are extended to timed SIPN. It is shown how the extended model can be analyzed, using a reachability graph that includes timing information in the form of time intervals, and how it can be implemented on PLC using Sequential Function Chart according to IEC standard. Keywords: Petri Nets, Logic Control, PLC, Sequential Function Chart 1 INTRODUCTION To design a controller for a hybrid process there are basically two approaches model-based and nonmodel-based. Model-based methods are synthesis and verification. A combination of both is possible. The synthesis approach is the one most closely related to Control Theory. Here a model of the uncontrolled process is build and based on formal specifications a controller is derived mathematically, see e.g. [1], [2]. The verification approach takes a model of the uncontrolled process and a model of the controller. The combination of these models results in a model of the controlled process. Using this model formal specifications can be verified mathematically, see e.g. [3], [4]. Non-model-based approaches stem from the area of Software Engineering. They measure or verify certain properties of a piece of software under minimal or no assumptions about its environment. This approach is well suited for logic controllers because the realization of a logic controller includes hard- and software. But under the assumption of standard hardware with well-defined functionality, the application is realized by the program of the control algorithm i.e. software. Hence the quality and functionality of the controller depends mainly on the quality and functionality of that software. Non-model-based analysis methods for purely discrete logic control algorithms based on Signal Interpreted Petri Nets (SIPN) are presented in [5] and [6]. They include correctness analysis and the measurement of transparency. Georg Frey, University of Kaiserslautern, Institute of Process Automation, PO Box 3049, Kaiserslautern, Germany, frey@eit.uni-kl.de. To analyze control algorithms for hybrid processes a purely discrete event approach is in most cases not sufficient. First of all, hybrid processes often produce analog sensor signals. These signals have to be converted to events (e.g. using thresholds) to be used in the discrete controller. Furthermore the controller has to set analog output signals to influence the process. An often used approach to include analog values in discrete controllers is to program a preprocessor for the input signals and a post-processor for the output signals. With this approach on the one hand the controller remains purely discrete but on the other hand the pre- and post-processors can not be included in the analysis of the controller. To overcome this problem, in this contribution Signal Interpreted Petri Nets (SIPN), which are a Petri net model with binary input and output signals suited for the specification of PLC programs are extended to include analog signals. Another important means in PLC programming is the use of timers to proceed in the process if no sensor signals are available or to implement supervisory functions. Therefore SIPN are extended to timed SIPN The rest of the paper is organized as follows. In Section 2 the SIPN is presented. Section 3 introduces the extension to timed SIPN and the corresponding analysis. Finally, Section 4 shows how the presented formal model is implemented on PLC using Sequential Function Chart according to IEC standard [12]. 2 SIGNAL INTERPRETED PETRI NETS (SIPN) Petri nets are able to express the causality as well as the concurrency of a control algorithm. To model non-autonomous behavior Interpreted Petri Nets (IPN) have been introduced by Moalla and König independently in the early 80 s, see [7] and [8]. IPN are ordi- Proceedings of the ADPM

2 190 Georg Frey nary Petri nets with binary markings. In addition to the standard Petri net functionality they allow the explicit description of input/output facilities in a well-defined way. IPN have been applied to logic control systems by many authors, e.g. [9]. In Signal IPN (SIPN) the influence of the environment on the system is based on signals instead of events used in other IPN approaches. In SIPN transitions are associated with a firing condition given as a Boolean function of the input signals. The places of an SIPN are associated with actions specifying output signals. In the following an extended definition for SIPN is given. In extension to previously published definitions (see e.g. [4]) it is not restricted to binary I/O-signals. The assignment of an interval of values to an output signal is an easy and effective way to specify constraints on the outputs. An example for such a constraint is the reduced permitted maximum speed of a robot while in teach mode. In a robot controller a place Teach may be marked indicating the teach mode. Setting a constrained output for all velocities in this place allows to check during analysis if the maximum permitted speed in teach mode is violated by the output function of another place during the marking of Teach. 2.1 Formal Definition A Signal Interpreted Petri Net (SIPN) is given by a 10-tuple SIPN = ( P, T, F, m 0, I, O, ν) with: (P, T, F, m 0 ) an ordinary PN with places P, transitions T, arcs F, and binary initial marking m 0, with P, T, F > 0 I a set of input signals with I > 0 O a set of output signals with I O = and O > 0 a mapping associating every transition t i T with a ILULQJFRQGLWLRQ t i ) = Boolean function in I a mapping associating every place p i P with an RXWSXW p i ). The output is assigned as an interval over the corresponding domain of the output sig- QDO p i ): O ([v 1,l, v 1,h ],..., [v O,l,v O,h ]) with v i,l v i,h and v i domain(o i ). This interval definition includes as special cases an unspecified output (don t care) and the specification of a single value. WKH RXWSXW IXQFWLRQ FRPELQHV WKH RXWSXW RI DOO marked places. The combined output for an output signal can be an interval, a single value, unspecified (the interval resembles the variable s domain), or a contradiction (e.g. one marked place sets the signal to 5 whereas at the same marking another marked place demands it to be greater than 10). ν the variable definition assigns a numeric data-type according to IEC61131 (e.g. BOOL, INT, REAL) to every signal s I O 2.2 Dynamic behavior The dynamic behavior of an SIPN is given by the flow of tokens through the net i.e. the change of its marking. This flow is realized by the firing of transitions. The firing of a transition t i removes a token from each of its pre-places (places p j with (p j, t i ) F) and puts a token on each of its post-places (places p j with (t i, p j ) F). For the firing process there are four rules: 1. A transition is enabled, if all its pre-places are marked and all its post-places are unmarked. 2. An enabled transition fires immediately, when its ILULQJFRQGLWLRQLVIXOILOOHG t i ) = True. 3. All transitions that can fire and are not in conflict with other transitions fire simultaneously. (Note: Since conflicts are treated as design errors in SIPN, there are no rules for conflict resolution.) 4. The firing process is iterated until a stable marking is reached (i.e. until under the current setting of input signals no transition can fire anymore). Since firing of a transition is supposed to take no time, iterated firing is interpreted as simultaneous. After the firing of transitions, the output signals are recalfxodwhge\dsso\lqj WRWKHPDUNLQJ 3 INCLUSION OF TIMERS 3.1 Definition and dynamic behavior of timed SIPN A timed SIPN (tsipn) is an SIPN extended by timing information. In tsipn delay times associated with the input arcs of transitions are considered. A tsipn is given by a tuple tsipn = (SIPN, with an SIPN as described in Section 2 and a mapping τ, associating every arc f i that is an input arc to a transition f i (P T) F with a time delay τ i R 0. With + f i = (p j, t k i is the time that a token has at least to stay in p j before it can be removed by the firing of t k. Since in timed nets the marking is no longer sufficient to describe the state of the system a clock vector δ is used that associates each place p i P with a clock δ i. The clocks position shows the time elapsed since a token was created on the place. If the place is empty, then the corresponding clock reads zero. 3.2 Analysis of timed SIPN The presented analysis of the tsipn is based on the reachability graph of the net. To build the reachability graph of the timed SIPN an approach similar to the one described for untimed SIPN in [9] is used: Building the reachability graph of the timed SIPN based on the reachability graph of the underlying timed PN. For a tsipn = ( P, T, F, m 0, I, O, ν, WKH Xnderlying timed PN (tpn) is given by tpn = (P, T, F, m 0, A transition in a tpn can fire if all its pre-places are marked, its post-places are unmarked and the clocks of the pre-places show times that are greater than or equal the time-delays specified at the connecting arcs. There is no forced firing in tpn. The presented tpn 190 Proceedings of the ADPM 2000

3 PLC Programming for Hybrid Systems via Signal Interpreted Petri Nets 191 model is equivalent in its dynamics to the Timestamp Petri Nets presented in [11] if the upper limit of the time intervals used in their model is set to infinity. 3.3 Reachability Graph of the underlying tpn The state of the tpn is given by the marking m and the positions of all clocks δ. With this state definition there are potentially infinite states in the system. (The number of markings is finite since the marking is binary. But the number of clock positions is infinite.) From System Theory it is known that all states that have the same influence of the future behavior of a system are equivalent. In tpn states that differ in the values of δ but still enable the same transitions are equivalent in this sense. These states can be grouped to meta-states M = (m, ) described by the common marking m and a vector of time intervals. Every marked place is associated with a time interval i = [t l, t h ] where t l is the minimum age of the token on the place and t h is the maximum age of the token on the place, when the marking is reached. Time intervals for a place with t l greater or equal the maximum delay time τ max associated with the descending transitions are equivalent for the behavior and set to [τ max, ]. Accordingly, time intervals for places without any timed post-arc are always set to [0, ]. With this definition a finite state space results. The influence of a marking on the dynamic behavior of the net can change at all time instances when a clock reaches an associated delay time and hence can enable a transition. To get the meta-states associated with a marking m for each marked place the time constants of the descending arcs have to be investigated. In the following a verbal description of the algorithm to derive the reachability graph RG tpn of a tpn is given. 1. For a given state derive all time intervals that lead to different enabling of transitions. Create auxiliary states that are reached by adding these time intervals to the age of the tokens (and reducing them according to the rule for equivalent time intervals given above). Connect the state to the auxiliary states by an arc inscribed with the corresponding time interval. For the auxiliary states determine all enabled transitions and fire them in single firings to derive the following states. 2. Proceed with 1 until no new states are generated. 3. Remove the auxiliary states by connecting their post-arcs with their pre-state and inscribing the time interval and the transition on the new arc. The reachability graph of the tpn is used as basis for the further calculation of the tsipn reachability graph. For the implementation of the tsipn it is of interest whether the net would be safe under the weak enabling rule (see Section 4) or not. Because a net that is safe in this sense is free of forward conflicts and contact situations. Therefore, if a transition can fire under the weak enabling rule (i.e. its pre-places are marked and the timing conditions are fulfilled) but not under the strong enabling rule (i.e. not all of its post-places are unmarked) a pseudo-state is included in the reachability graph showing which non-binary marking would be reached. The calculation of further states reachable from these pseudo-states is not necessary. The following example (Figure 1 and Figure 2) illustrates the presented algorithm In the graphical representation of the states, the time intervals associated with a place are written as subscript. Intervals i = [t l, t h ] with t l = t h are written as t l, time intervals i = [0, ] are omitted. The resulting reachability graph RG tpn shows which transitions are possible and when they are possible. Figure 1a shows a tsipn. Due to the inscribed time delays a token has to stay at least two time units on place p 2 before it can be removed by transition. For place p 3 the and transition delay is 3 time units. a) tsipn t 1 ) = i 1 i 2 >5 p 3 ): o 1 =1 τ = 2 τ = 3 ) = i 1 ) = i 1 t 4 ) = i 1 i 2 >3 p 2 ): o 2 > 5 p 4 ): o 1 =1 o 2 =1 b) RG tpn with auxiliary states M x1 = (0,1 [2, ),1 [2,3),0,0) M 2 = (0,0,1 [2,3),1,0) τ 3 [3-τ 1, ] τ 1 [2,3) M x3 = (0,0,1 [3, ],1,0) p 1 ): o 1 =1; o 2 =7 M 1 = (0,1 0,1 0,0,0) p 5 ): o 1 =0 M x2 = (0,1 [2, ],1 [3, ],0,0) M 3 = (0,0,1 [3, ],1,0) M 0 = (1,0,0,0,0) t 1 τ 2 [3, ] M 5 = (0,0,0,1,1) M 4 = (0,1 [2, ],0,0,1) Figure 1: Stepwise construction of RG tpn from tsipn via RG PN. From the initial marking M 0 transition t 1 can fire without any time delay. In the resulting new marking M 1 on places p 2 and p 3 tokens are generated (time 0). In this marking the enabling of the following transitions depends on the time because two arcs originating from t 4 Proceedings of the ADPM

4 192 Georg Frey marked places have delay times associated. The delay times are 2 for the arc (p 2, ) and 3 for the arc (p 3, ). This results in 3 distinct time intervals [0,2), [2,3), [3, ]. During the first interval no transition is enabled, during the second time interval only transition is enabled, and during the third interval transitions and are enabled. Hence there are two intervals with different enabled transitions (the first interval is of no interest for the generation of the reachability graph because nothing at all can happen) and therefore 2 auxiliary states M x1 and M x2 are generated. M x1 can be reached from M 0 after a delay time τ 1 [2,3), the tokens have an age greater or equal 2 and smaller 3. However, for place p 2 the maximum delay time is two. Hence, this token the interval from 2 to infinity is assigned. Similarly, the token age in M x2 is greater or equal 3. For these new states the enabled transitions are fired resulting in the new states M 2, M 3, and M 4. In the state M 2 the transition can fire if the token on p 3 is at leas time units old, given the age of the token as τ 1 this demands for a delay time of τ 3 [3- τ 1, ]. The iteration of this procedure leads to the reachability graph with auxiliary states depicted in Figure 1b. Now the auxiliary states are removed by merging their pre- and post-arcs. For M x1 in the example this results in an arc from M 1 to M 2 with the inscription of a time delay interval τ 1 [2, 3) from the original pre-arc (M 1, M x2 ) and the corresponding firing transition from the original post-arc (M x2, M 2 ). The removal of all auxiliary states results in the reachability graph for the timed PN shown in Figure 2 RG tpn τ 1 [2,3); M 2 = (0,0,1 [2,3),1,0) τ 3 [3-τ 1, ]; M 0 = (1,0,0,0,0) t 1 M 1 = (0,1 0,1 0,0,0) τ 4 [3, ]; M 3 = (0,0,1 [3, ],1,0) M 5 = (0,0,0,1,1) τ 2 [3, ]; M 4 = (0,1 [2, ],0,0,1) Figure 2: RGtPN without auxiliary states. 3.4 Reachability Graph of the timed SIPN In [9] an algorithm is described that derives the reachability graph RG SIPN of an SIPN from the reachability graph RG PN of the underlying PN and the firing conditions and output functions of the SIPN. Basically the algorithm checks under what input signal settings two single state transitions that are possible in RG PN can t 4 occur simultaneously in RG SIPN. The adaptation of this algorithm to tsipn also includes the timing information of the state transitions in this calculation: Two transitions fire simultaneously if their firing conditions are not disjoint and they are valid in a common timeinterval. As an example Figure 3 shows the RG tsipn derived from RG tpn in Figure 2 and the information on ϕ and ϖ given in the SIPN in Figure 1a. The example shows two cases of dynamic synchronization of transitions in the SIPN: If in the state M 1 the input signal i 1 changes from true to false later than three time units after M 1 was reached, the transitions and fire simultaneously resulting in M 5. Since the transitions are concurrent in the original PN and are synchronized due to the special dynamics of the SIPN this effect is called concurrent dynamic synchronization [9]. If in the state M 5 i 1 changes to true and i 2 has a value greater than five, then t 4 and t 1 fire sequentially resulting directly in M 1 (this effect is called sequential dynamic synchronization [9]) whereas if i 2 lies between three and five only t 4 fires resulting in M 0. G tsipn t 1 : i 1 i 2 > 5 M 1 = (0,1 0,1 0,0,0) Ã Ã ]) τ 1 [2,3); : i 1 M 0 = (1,0,0,0,0) Ã ÃÃ τ 2 [3, ]; (, ): i 1 τ 3 [3-τ 1, ]; M 2 = (0,0,1 [2,3),1,0) : i 1 Ã ÃÃ ]) (t 4, t 1 ) : i 1 i 2 >5 t 4 : i 1 3<i 2 5 M 5 = (0,0,0,1,1) Ã ÃFÃ Figure 3: Reachability Graph RG tsipn of the SIPN in Figure Aim of the analysis The most important aim of the analysis is to determine if the tsipn is unambiguous [6]. Every control algorithm has to be unambiguously defined. Unambiguity of a tsipn can be subdivided into four sub-criteria that can be checked using the reachability graph RG tsipn. Determinism: A control algorithm has to be deterministic. If it was not, its behavior in a given situation would depend on implementational aspects. This could not be the aim of a correct design. The algorithm is deterministic if the firing conditions at every branching in RG tsipn are disjoint or the corresponding time intervals do not overlap. (The example presented in Figure 3 is deterministic.) 192 Proceedings of the ADPM 2000

5 PLC Programming for Hybrid Systems via Signal Interpreted Petri Nets 193 Termination: In a cycle of a logic control algorithm, at least one marking must be stable for some time. A cycle without stable marking leads to an algorithm that does not terminate. This in turn could lead to a hang-up of the implemented controller or to nondeterministic behavior, in the case when the implementation breaks up the endless loop at some unknown point. The algorithm terminates if there is no self-loop without an associated time delay at any state in RG tsipn. (This criterion is fulfilled by the example in Figure 3) Defined output: There has to be a specification for the exact value of an output signal at every reachable marking. Undefined output signals can be directly seen in RG tsipn. (In the example of Figure 3 the output signal o 2 is not defined in the states M 1 and M 2.) Unambiguous output: If two places marked at the same time assign different values to an output signal, a contradictory output setting results. This is a clear design error. Contradictory output signals can be directly seen in RG tsipn. (This condition is violated by the output signal o 1 is the state M 5 in the example of Figure 3.) ) part of a tsipn with timed arc p 3 τ = 3 ) = i 1 p 4 b) corresponding part of an SFC S3 S4 i1 & S3.T >= 3 Figure 4: Implementation of delay times in SFC. For unsafe SIPN, the firing conditions of transitions leading to unsafe markings have to be extended in the SFC such that the unsafe state is not reached. This is done using the variable StepName.X defined in IEC for each step. StepName.X is true if the step is marked and false otherwise. Therefore, if the transition t i results in an unsafe marking in place p j the corresponding firing condition ϕ(t i ) has to be replaced by ϕ SFC (t i ) = ϕ(t i ) p j.x in the SFC (cf. Figure 5). 4 IMPLEMENTATION USING SFC a) unsafe SIPN t 1 ) = i 1 i 2 p 1 There is a close relation between SIPN and Sequential Function Chart (SFC) according to IEC standard [12], [13]. However, there are three differences that have to be considered: 1. In SFC there are, by definition, no transient states. The activity of a step is always held up for at least one PLC cycle. However, the cycle time of a PLC is very short resulting in quasi-transient states of the controller. 2. In SFC post-steps of a transition are not checked in the firing rule. A step that is already activated can be activated again. 3. There is a structural restriction in SFC allowing only one initial step. Therefore, for SIPN with several places marked initially an additional initstep has to be added in the SFC that activates the corresponding steps right after start-up. Prior to implementation the SIPN has to be analyzed in order to guarantee that it is unambiguous and to determine if it is safe and if it contains sequential dynamic synchronization. If the SIPN is not unambiguous the algorithm has to be corrected prior to implementation. If the tsipn is safe, and free of sequential dynamic synchronization it can be transformed one-toone into an SFC (the setting of intervals for the output signals are ignored). To implement the timed arcs the variable StepName.T defined in IEC for each step is used. StepName.T gives the time elapsed since the last activation of the corresponding step. For an arc f i = (p j, t k ) with τ(f i ) > 0 the firing condition ϕ(t k ) has to be extended to ϕ SFC (t k ) = ϕ(t k ) p j.t τ(f i ) in the SFC (cf. Figure 4) b) RG SIPN S2 p 2 ) = i 1 ) = i 1 i 2 t 1 : i 1 i 2 M 0 = (1,0,0) M 1 = (0,1,1) : i 1 M u = (0,0,2) : i 1 i 2 c) SFC S1 i1 & i2 NOT i1 & NOT S3.X i1& NOT i2 p 3 S3 Figure 5: SFC implementation of an unsafe SIPN. Proceedings of the ADPM

6 194 Georg Frey If the SIPN contains sequential dynamic synchronization, additional transitions have to be specified in the SFC to account for the sequential firing (cf. Figure 6). p 1 a) SIPN with sequential DS p 2 p 3 t 1 : i 1 i 2 t 1 ) = i 1 i 2 ) = i 1 ) = i 2 b) RG SIPN M 0 = (1,0,0) * : i 1 i 2 i1 & i2 NOT i1 & i2 NOT i2 M 1 = (0,1,0) M 2 = (0,0,1) : i 2 S1 S2 S3 c) SFC : i 1 i 2 NOT i1 & NOT i2 Figure 6: Implementation of SIPN with sequential dynamic synchronization. 5 CONCLUSION In this contribution Signal Interpreted Petri Nets are extended in two ways. First, analog signals are allowed as input and output. And second, time delays associated with arcs are introduced. With these extensions the transparent specification of logic controllers for hybrid systems is possible. It is shown that the extended model can be analyzed using a newly defined reachability graph that includes the necessary timing information. The timing information is included using time-intervals, resulting in a bounded reachability graph for the presented type of net. The analysis shows whether the specified algorithm is defined unambiguously and hence if it can be implemented on a PLC. The presented rules for the transformation of timed SIPN to SFC according to IEC61131 allow the implementation of the specified models on PLC. REFERENCES [1] T. Moor, J. Raisch, and S. D. O'Young Supervisory Control of Hybrid Systems via l-complete Approximations. Proc. IEE WODES 98, Cagliari, Italy, IEE. pp [2] H.-M. Hanisch, A. Lüder, and J. Thieme A Modular Plant Modeling Technique and Related Controller Synthesis Problems Proceedings of the IEEE International Conference on Systems, Man, and Cybernetics, San Diego, 1998, pp [3] S. Kowalewski and J. Preußig. Verification of sequential controllers with timing functions for chemical processes. Preprints of the IFAC 13 th World Congress, San Francisco, USA, 1996, Vol. J: pp [4] G. Frey and L. Litz, Verification and Validation of Control Algorithms by Coupling of Interpreted Petri Nets, Proc. of the IEEE International Conference on Systems, Man, and Cybernetics, SMC 98, San Diego, 1998 Vol. 1, pp [5] G. Frey and L. Litz, A Measure for Transparency in Net Based Control Algorithms. Proc. of the IEEE International Conference on Systems, Man, and Cybernetics, SMC 99, Tokyo (J), 1999 Vol. III, pp [6] G. Frey and L. Litz, Correctness Analysis of Petri Net Based Logic Controllers, Proceedings of the ACC2000. [7] M. Moalla, P. Pulou and J. Sifakis, Synchronized Petri Nets: A Model for the Description of non-autonomous Systems, LNCS 64, pp , Springer, Berlin, New York, [8] R. König and L. Quäck, Petri-Netze in der Steuerungs- und Digitaltechnik, Oldenbourg Verlag, München, Wien, [9] G. Frey, Analysis of Petri-Net based Control Algorithms Basic Properties, Proceedings of the ACC [10] R. David and H. Alla, Petri Nets and Grafcet - Tools for Modeling Discrete Event Systems, Prentice Hall, New York, London, [11] H.-M. Hanisch, K. Lautenbach, C. Simon, and J. Thieme, Timestamp Petri Nets in Technical Applications Proceedings of the IEE 4 th Workshop on Discrete Event Systems, pp , [12] IEC, International Standard A: Programmable Logic Controllers, Par: Languages [13] R.W. Lewis, Programming industrial control systems using IEC IEE Publishing, London, Proceedings of the ADPM 2000