Correctness analysis of Petri net based logic controllers

Abstract

Petri nets are able to express the causality as well as the concurrency of a control algorithm. To model logic controllers Signal Interpreted Petri Nets (SIPN) show good properties. In SIPN the firing of a transition depends on input signals from the environment and the SIPN influences the environment via output signals. Since the function of a logic controller is basically determined by software, the question of software quality arises in this area. ISODEC 9126 [IS0 19911 defines six characteristics of software that can be used as quality criteria. In [FREY AND Lrrz 20001 the six characteristics are set in the framework of controller design: The functionality and reliability of the software rely on the correctness of the algorithm. In this contribution criteria for formal correctness of SIPN control algorithms are given and it is shown how they can be evaluated using the SIPN reachability graph. Due to a close relation between Sequential Function Chart (SFC) according to IEC 1131-3 standard [IEC 19921 and SIPN the criteria are also valid for SFC. 1 SIGNAL INTERPRETED PETRI NETS 1.1 Formal Definition A Signal Interpreted Petri Net (SIPN) is described by a a 9-tuple SIPN = ( P , T, F, m, Z, 0, cp, o, Q) with: (P, T , F, m , , ) an ordinary PN with places P, transitions T , arcs F, and binary initial marking m, with IPI,ITI,IFI>O, a set of logical input signals with U1 > 0 a set of logical output signals with Z n 0 = 0, 1 0 1 > 0 a mapping associating every transition ti E T with a firing condition cp(ti) = Boolean function in Z a mapping associating every place pi E P with an output obi) E (0, 1, -)lo', where (-) means 'don't care'. the output function combines the output o of all marked places Q: m -+ (-, 1, 0, c, ro, rl, CO, c1,The combined output can be undefined (-) one (l), zero (0), contradictory (c) redundant zero or one (ro, rl) or a combination of contradiction and redundancy (co, c1, col). Dynamic behaviorThe dynamic behavior of an SIPN is given by the change of its marking. The firing of a transition ti removes a token from each of its pre-places and puts a token on each of its post-places. For the firing process there are four rules: 1. A transition is enabled, if all its pre-places are marked and all its post-places are unmarked. A transition fires immediately, if it is enabled and itsfiring condition is fulfilled. 3. All transitions that can fire and are not in conflict with other transitions fire simultaneously. 0-7803-551 9-9/00 $1 0.00 0 2000 AACC 31 654. The firing process is iterated until a stable marking is reached (i.e. until no transition can fire anymore). This also means that a change of input signal values can not occur during the firing process. After a new stable marking is reached, the output signals are recalculated by applying fl to the marking. Reachability in SI€"A marking m' is said to be reachable from a marking m if there exists a sequence of input signal settings such that a firing sequence starting from m has m' as stable final marking. Fig. 1 shows an SIPN and its reachabili...

A framework for building mobile single and multi-robot applications

“…Interpreted Petri Nets (IPNs), introduced by Moalla [13] and König [14], are ordinary PNs with binary markings extended for the explicit description of input/output facilities. Signal Interpreted Petri Nets (SIPNs) [15] are used to stress the fact that the influence of the environment on the system is based on signals instead of events. Therefore, the main difference is that several signals can change simultaneously, while events occur only one at a time.…”

Deadlock prevention for flexible manufacturing system

“…Thus, a controlled S3pR is obtained. In [6,7], an approach using signal interpreted petri net (SIPN) and model checking for the verification is presented. In this approach, the requirements asserted by users can be directly verified using TL formulas.…”