<?xml version="1.0" encoding="utf-8"?>
<!-- Function Block Diagram (FBD) POU in PLCopen TC6 XML form. Demonstrates that
     the scanner analyses graphical logic, not just Structured Text: the same
     defects (cleartext Modbus master on 502, a hardcoded HMI password, a safety
     enable driven FALSE) are here wired as blocks and in/out variables. -->
<project xmlns="http://www.plcopen.org/xml/tc6_0201">
  <types>
    <pous>
      <pou name="PumpFbdCtrl" pouType="functionBlock">
        <interface>
          <inputVars>
            <variable name="HmiPassword"><type><string/></type></variable>
            <variable name="Safety_Enable"><type><BOOL/></type></variable>
            <variable name="ServerIp"><type><string/></type></variable>
          </inputVars>
        </interface>
        <body>
          <FBD>
            <!-- Modbus/TCP master: cleartext (AUTH := FALSE) on port 502 -->
            <inVariable localId="1"><expression>'10.20.0.5'</expression><connectionPointOut/></inVariable>
            <inVariable localId="2"><expression>502</expression><connectionPointOut/></inVariable>
            <inVariable localId="3"><expression>FALSE</expression><connectionPointOut/></inVariable>
            <block localId="10" typeName="Modbus_TCP_Master">
              <inputVariables>
                <variable formalParameter="IP">
                  <connectionPointIn><connection refLocalId="1"/></connectionPointIn>
                </variable>
                <variable formalParameter="PORT">
                  <connectionPointIn><connection refLocalId="2"/></connectionPointIn>
                </variable>
                <variable formalParameter="AUTH">
                  <connectionPointIn><connection refLocalId="3"/></connectionPointIn>
                </variable>
              </inputVariables>
              <outputVariables/>
            </block>

            <!-- Hardcoded HMI password wired into an output -->
            <inVariable localId="20"><expression>'admin123'</expression><connectionPointOut/></inVariable>
            <outVariable localId="21">
              <expression>HmiPassword</expression>
              <connectionPointIn><connection refLocalId="20"/></connectionPointIn>
            </outVariable>

            <!-- Safety enable driven FALSE in logic -->
            <inVariable localId="30"><expression>FALSE</expression><connectionPointOut/></inVariable>
            <outVariable localId="31">
              <expression>Safety_Enable</expression>
              <connectionPointIn><connection refLocalId="30"/></connectionPointIn>
            </outVariable>
          </FBD>
        </body>
      </pou>
    </pous>
  </types>
</project>
