ESBMC
Efficient SMT-based Context-Bounded Model Checker
Loading...
Searching...
No Matches
ld_ast.h
Go to the documentation of this file.
1#pragma once
2
3#include <string>
4#include <vector>
5
6// Source location carried by every AST node so counterexample traces
7// reference original PLCopen XML positions.
9{
10 std::string file;
11 unsigned line = 0;
12 unsigned col = 0;
13};
14
15// -----------------------------------------------------------------------
16// Contact nodes
17// -----------------------------------------------------------------------
18
19enum class ContactKind
20{
21 NormallyOpen, // --[ ]--
22 NormallyClosed // --[/]--
23};
24
25// IEC 61131-3 ยง2.5.1.1 transition-sensing contacts. An edge contact conducts
26// for exactly one scan: the scan in which the operand takes the sensed
27// transition, measured against its value at the contact's previous evaluation.
28enum class ContactEdge
29{
31 Rising, // --[P]--
32 Falling // --[N]--
33};
34
42
43// -----------------------------------------------------------------------
44// Coil nodes
45// -----------------------------------------------------------------------
46
47enum class CoilKind
48{
49 Output, // --( )--
50 Set, // --( S )--
51 Reset // --( R )--
52};
53
60
61// -----------------------------------------------------------------------
62// Function-block nodes (timers, counters, arithmetic FBs)
63// -----------------------------------------------------------------------
64
78
80{
81 std::string port_name; // e.g. "IN", "PT", "CU"
82 std::string variable; // connected variable or literal
83};
84
86{
87 std::string port_name; // e.g. "Q", "ET", "CV"
88 std::string variable;
89};
90
92{
94 std::string instance_name;
95 std::string IN_var; // enable input variable
96 std::string PT_var; // preset time variable (tick count)
97 std::string Q_var; // output variable
98 std::string ET_var; // elapsed time variable
100};
101
103{
105 std::string instance_name;
106 std::string CU_var; // count-up input variable
107 std::string CD_var; // count-down input variable (CTD only)
108 std::string R_var; // reset variable (CTU only)
109 std::string LD_var; // load variable (CTD only)
110 std::string PV_var; // preset value variable
111 std::string Q_var; // output variable
112 std::string CV_var; // counter value variable
114};
115
117{
119 std::string instance_name;
120 std::string IN1_var;
121 std::string IN2_var;
122 std::string OUT_var;
124};
125
126// -----------------------------------------------------------------------
127// Rung and network nodes
128// -----------------------------------------------------------------------
129
130// A rung element is one of the Tier 1 constructs
139
150
151// A rung is a list of elements evaluated left-to-right within a scan cycle.
153{
154 std::string id; // rung number / label from XML
155 std::vector<RungElement> elements;
157};
158
159// A network groups rungs and the variable declarations for one POU.
161{
162 std::string name;
163 std::vector<RungNode> rungs;
165};
166
167// -----------------------------------------------------------------------
168// Variable declarations
169// -----------------------------------------------------------------------
170
171enum class VarKind
172{
176 TIME, // used for timer PT/ET fields
177 REAL, // IEC 60559 binary32 (analog process variables)
178 LREAL, // IEC 60559 binary64
179};
180
182{
183 std::string name;
185 bool is_input = false;
186 bool is_output = false;
187 // Writable from outside the program (program VAR_IN_OUT or VAR_EXTERNAL,
188 // %M memory): sampled each scan unless --ld-closed-world.
189 bool shared = false;
191 false; // invented by the graphical resolver (pins, power flow)
192 std::string derived_type; // type name when declared <derived>, else empty
193 // Initial value for numeric variables. Graphical LD wires FB presets from
194 // <inVariable> literals rather than declared variables, so the synthesised
195 // preset symbol carries the literal here.
196 long long init_value = 0;
198};
199
200// -----------------------------------------------------------------------
201// User-defined function blocks (e.g. EQ_0/GT_0/SUB_0 wrappers that may carry
202// Ladder Logic Bombs). Their Structured Text bodies are translated and
203// executed in the scan cycle so the embedded logic reaches the GOTO IR.
204// -----------------------------------------------------------------------
205
206// A function-block formal/local variable with its declared IEC 61131-3 type.
207// Carrying the type (rather than just the name) keeps REAL/analog FB variables
208// from being silently demoted to int when the body is translated.
210{
211 std::string name;
212 VarKind kind = VarKind::DINT; // numeric default for an untyped FB variable
213};
214
216{
217 std::string type_name; // e.g. "EQ_0"
218 std::vector<FBVarDecl> input_vars; // formal inputs (IN1, IN2, ...) + types
219 std::vector<FBVarDecl> local_vars; // FB-local variables (e.g. "i") + types
220 std::vector<FBVarDecl> output_vars; // every formal output + types
221 std::string st_body; // raw Structured Text body
222};
223
224// Wiring of an FB output pin to a program variable: "prog_var := <inst>__pin".
226{
227 std::string prog_var; // program variable driven by the pin (e.g. MV1)
228 std::string pin; // FB formal output name (e.g. OUT_MV1)
229};
230
231// Wiring of an FB input pin: "<inst>__pin := source" each scan. The source is
232// a program variable, a literal, or another block's "<inst>__<pin>"; empty when
233// the pin is unwired or fed by something not modelled (the pin stays nondet).
235{
236 std::string pin;
237 std::string source;
238 bool connected = false; // wired, whether or not the source is modelled
239};
240
242{
243 std::string type_name; // references a UserFBDef
244 std::string instance_name; // e.g. "EQ_00"
245 std::string block_id; // graphical localId of the block
246 std::vector<FBInWire> in_wires; // input pins and their sources
247 std::vector<FBOutWire> out_wires; // pins consumed by program outVariables
249};
250
251// -----------------------------------------------------------------------
252// Top-level AST
253// -----------------------------------------------------------------------
254
255struct LdAst
256{
257 std::string source_file; // path of the PLCopen XML file
258 std::vector<VarDecl> variables; // program variables and synthesised pins
259 std::vector<NetworkNode> networks; // one per POU (Tier 1: single POU)
260 std::vector<UserFBDef> user_fb_defs;
261 std::vector<UserFBInstance> user_fb_instances;
262 bool has_interrupt_tasks = false; // triggers Tier-2 rejection
263};
ContactEdge
Definition ld_ast.h:29
@ Falling
Definition ld_ast.h:32
@ Rising
Definition ld_ast.h:31
@ None
Definition ld_ast.h:30
RungElementKind
Definition ld_ast.h:132
@ TimerFB
Definition ld_ast.h:135
@ Coil
Definition ld_ast.h:134
@ Contact
Definition ld_ast.h:133
@ ArithFB
Definition ld_ast.h:137
@ CounterFB
Definition ld_ast.h:136
FBKind
Definition ld_ast.h:66
@ TP
Definition ld_ast.h:69
@ SUB
Definition ld_ast.h:73
@ DIV
Definition ld_ast.h:75
@ CTD
Definition ld_ast.h:71
@ MUL
Definition ld_ast.h:74
@ TOF
Definition ld_ast.h:68
@ TON
Definition ld_ast.h:67
@ ADD
Definition ld_ast.h:72
@ CTU
Definition ld_ast.h:70
@ MOVE
Definition ld_ast.h:76
ContactKind
Definition ld_ast.h:20
@ NormallyClosed
Definition ld_ast.h:22
@ NormallyOpen
Definition ld_ast.h:21
CoilKind
Definition ld_ast.h:48
@ Output
Definition ld_ast.h:49
@ Reset
Definition ld_ast.h:51
@ Set
Definition ld_ast.h:50
VarKind
Definition ld_ast.h:172
@ TIME
Definition ld_ast.h:176
@ INT
Definition ld_ast.h:174
@ REAL
Definition ld_ast.h:177
@ LREAL
Definition ld_ast.h:178
@ BOOL
Definition ld_ast.h:173
@ DINT
Definition ld_ast.h:175
Definition ld_ast.h:117
std::string instance_name
Definition ld_ast.h:119
std::string IN1_var
Definition ld_ast.h:120
std::string OUT_var
Definition ld_ast.h:122
LdLocation loc
Definition ld_ast.h:123
FBKind kind
Definition ld_ast.h:118
std::string IN2_var
Definition ld_ast.h:121
Definition ld_ast.h:55
LdLocation loc
Definition ld_ast.h:58
CoilKind kind
Definition ld_ast.h:56
std::string variable
Definition ld_ast.h:57
Definition ld_ast.h:36
LdLocation loc
Definition ld_ast.h:40
std::string variable
Definition ld_ast.h:39
ContactEdge edge
Definition ld_ast.h:38
ContactKind kind
Definition ld_ast.h:37
Definition ld_ast.h:103
std::string CU_var
Definition ld_ast.h:106
std::string instance_name
Definition ld_ast.h:105
LdLocation loc
Definition ld_ast.h:113
std::string R_var
Definition ld_ast.h:108
FBKind kind
Definition ld_ast.h:104
std::string CD_var
Definition ld_ast.h:107
std::string CV_var
Definition ld_ast.h:112
std::string Q_var
Definition ld_ast.h:111
std::string LD_var
Definition ld_ast.h:109
std::string PV_var
Definition ld_ast.h:110
Definition ld_ast.h:235
std::string pin
Definition ld_ast.h:236
std::string source
Definition ld_ast.h:237
bool connected
Definition ld_ast.h:238
Definition ld_ast.h:80
std::string variable
Definition ld_ast.h:82
std::string port_name
Definition ld_ast.h:81
Definition ld_ast.h:226
std::string pin
Definition ld_ast.h:228
std::string prog_var
Definition ld_ast.h:227
Definition ld_ast.h:86
std::string port_name
Definition ld_ast.h:87
std::string variable
Definition ld_ast.h:88
Definition ld_ast.h:210
std::string name
Definition ld_ast.h:211
VarKind kind
Definition ld_ast.h:212
Definition ld_ast.h:256
std::vector< UserFBInstance > user_fb_instances
Definition ld_ast.h:261
std::vector< VarDecl > variables
Definition ld_ast.h:258
std::vector< UserFBDef > user_fb_defs
Definition ld_ast.h:260
std::string source_file
Definition ld_ast.h:257
std::vector< NetworkNode > networks
Definition ld_ast.h:259
bool has_interrupt_tasks
Definition ld_ast.h:262
Definition ld_ast.h:9
unsigned line
Definition ld_ast.h:11
unsigned col
Definition ld_ast.h:12
std::string file
Definition ld_ast.h:10
Definition ld_ast.h:161
LdLocation loc
Definition ld_ast.h:164
std::vector< RungNode > rungs
Definition ld_ast.h:163
std::string name
Definition ld_ast.h:162
Definition ld_ast.h:141
ContactNode contact
Definition ld_ast.h:143
CounterFBNode counter_fb
Definition ld_ast.h:146
RungElementKind kind
Definition ld_ast.h:142
TimerFBNode timer_fb
Definition ld_ast.h:145
CoilNode coil
Definition ld_ast.h:144
ArithFBNode arith_fb
Definition ld_ast.h:147
LdLocation loc
Definition ld_ast.h:148
Definition ld_ast.h:153
std::vector< RungElement > elements
Definition ld_ast.h:155
std::string id
Definition ld_ast.h:154
LdLocation loc
Definition ld_ast.h:156
Definition ld_ast.h:92
LdLocation loc
Definition ld_ast.h:99
std::string instance_name
Definition ld_ast.h:94
std::string IN_var
Definition ld_ast.h:95
FBKind kind
Definition ld_ast.h:93
std::string PT_var
Definition ld_ast.h:96
std::string Q_var
Definition ld_ast.h:97
std::string ET_var
Definition ld_ast.h:98
Definition ld_ast.h:216
std::vector< FBVarDecl > input_vars
Definition ld_ast.h:218
std::string type_name
Definition ld_ast.h:217
std::vector< FBVarDecl > output_vars
Definition ld_ast.h:220
std::string st_body
Definition ld_ast.h:221
std::vector< FBVarDecl > local_vars
Definition ld_ast.h:219
Definition ld_ast.h:242
std::vector< FBInWire > in_wires
Definition ld_ast.h:246
std::string type_name
Definition ld_ast.h:243
std::string block_id
Definition ld_ast.h:245
std::string instance_name
Definition ld_ast.h:244
std::vector< FBOutWire > out_wires
Definition ld_ast.h:247
LdLocation loc
Definition ld_ast.h:248
Definition ld_ast.h:182
bool shared
Definition ld_ast.h:189
std::string name
Definition ld_ast.h:183
std::string derived_type
Definition ld_ast.h:192
long long init_value
Definition ld_ast.h:196
VarKind kind
Definition ld_ast.h:184
bool is_output
Definition ld_ast.h:186
bool is_input
Definition ld_ast.h:185
bool synthesized
Definition ld_ast.h:190
LdLocation loc
Definition ld_ast.h:197