
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Package containing the DEXPI data model in Python and a parser to load Proteus .xml data to the data model.
Smart, machine-readable Piping and Instrumentation Diagram (P&ID) data is key to unlocking innovation in the process industry, especially for emerging applications like Generative Artificial Intelligence (GenAI) - see examples of GenAI for the process industry. pyDEXPI helps enable this by making the DEXPI standard accessible and usable in Python.
pyDEXPI is an open-source tool in Python that implements the DEXPI data model. Importantly, pyDEXPI includes a Pydantic data class model of the DEXPI data model. This allows building Python applications with the DEXPI standard. pyDEXPI further provides functions to load a Proteus .xml export of DEXPI, the current DEXPI exchange format, into the data model.
pyDEXPI implements a parser to a graph representation of Piping and Instrumentation Diagrams (P&IDs) using NetworkX. This allows the user to work easily with the graph data.
Supports DEXPI version 1.3.
Please reference this software package as:
@InProceedings{pyDEXPI,
author = {Goldstein, Dominik P. and Schulze Balhorn, Lukas and Alimin, Achmad Anggawirya and Schweidtmann, Artur M.},
booktitle = {Proceedings of the 35th European Symposium on Computer Aided Process Engineering (ESCAPE35)},
title = {pyDEXPI:{A} {Python} framework for piping and instrumentation diagrams using the {DEXPI} information model},
year = {2025},
address = {Ghent, Belgium},
month = {July},
doi = {https://doi.org/10.69997/sct.139043},
}
Install the pyDEXPI package via
pip install pydexpi
or from GitHub via:
pip install git+https://github.com/process-intelligence-research/pyDEXPI
Alternatively, get the latest updates by cloning the repo and installing the editable version of the package with:
git clone https://github.com/process-intelligence-research/pyDEXPI
cd pyDEXPI
pip install .
The following section serves as a first guide to start using the package, illustrated with the DEXPI reference P&ID (data/C01V04-VER.EX01.xml
© DEXPI e.V.). We recommend to study the DEXPI data model before working with the tool.
For more details, see the extended documentation.
The pyDEXPI Python model is derived from the DEXPI data model and implemented using Pydantic. By using Pydantic the rules of the data model are automatically enforced, for instance, a pump cannot be added as a nozzle to a tank. Each DEXPI instance gets assigned an ID in the form of an uuid, if not specified differently by the user.
The following DEXPI data types are replaced with default Python classes:
The Proteus serializer loads a proteus .xml file to a DEXPI model. Drawing information are currently not parsed, among others.
from pydexpi.loaders import ProteusSerializer
directory_path = "data"
filename = "C01V04-VER.EX01.xml"
my_loader = ProteusSerializer()
dexpi_model = my_loader.load(directory_path, filename)
You can load and save DEXPI Python models via the serializer. Currently pickle .pkl
and json .json
are offered as file formats.
For json:
from pydexpi.loaders import JsonSerializer
my_serializer = JsonSerializer()
For pickle:
from pydexpi.loaders import PickleSerializer
my_serializer = PickleSerializer()
Then:
my_serializer.save(dummy_dexpi_model, "dummy_path", "dummy_filename")
dummy_dexpi_model = my_serializer.load("dummy_path", "dummy_filename")
The graph loader exports a DEXPI model to a NetworkX graph. This is implemented as an abstract class to accommodate customized graph formats. The package includes an implementation for direct application MLGraphLoader. Here, we represent DEXPI components such as tagged plant equipment, process instrumentation functions, and piping components as nodes. The connectivity between the nodes represent piping connections or signal connections as directed edges. Data attributes of the pyDEXPI classes are added as node/edge attributes of the respective, representing node.
from pydexpi.loaders.ml_graph_loader import MLGraphLoader
from pydexpi.loaders import ProteusSerializer
directory_path = "data"
filename = "C01V04-VER.EX01.xml"
# load proteus
my_loader = ProteusSerializer()
dexpi_model = my_loader.load(directory_path, filename)
# export to graph
my_graph_loader = MLGraphLoader(plant_model=dexpi_model)
my_graph_loader.parse_dexpi_to_graph()
my_graph_loader.draw_process_matplotlib()
The synthetic data generation generation contains code for the creation of synthetic P&IDs. This method is based on the aggregation of P&ID module templates (or patterns) as described in the publication Toward automatic generation of control structures for process flow diagrams with large language models. An abstraction of the generation logic allows to customize the procedure underlying the module aggregation. For this, the abstract GeneratorFunction can be implemented as required. An example implementation RandomGeneratorFunction is provided. This implementation selects P&ID modules at random. P&ID modules can be used in any data representation. For this, suitable abstractions of the Pattern Class and the Connector Class need to be implemented. A pattern wraps a P&ID data structure for the generation algorithm. A connector acts as a connection interface of a P&ID module. Sample implementations of patterns and connectors are provided for pyDEXPI instances and NetworkX graphs. A UML diagram of the implementation is given here.
The code below demonstrates the synthetic data generation algorithm with the RandomGeneratorFunction and the pyDEXPI/Graph patterns.
import os
from pydexpi.syndata import SyntheticPIDGenerator, PatternDistribution
from pydexpi.syndata.generator_function import RandomGeneratorFunction
# Load distributions
the_path = "./data/dexpi_sample_patterns"
# the_path = "./data/graph_sample_patterns" # Alternatively for graph patterns
pattern_distr_names = [name for name in os.listdir(the_path) if os.path.isdir(os.path.join(the_path, name))]
distributions = [PatternDistribution.load(the_path, name) for name in pattern_distr_names]
distribution_dict = {distribution.name: distribution for distribution in distributions}
generator_function = RandomGeneratorFunction(distribution_range=distribution_dict)
the_generator = SyntheticPIDGenerator(generator_function, max_steps=5)
syn_pattern = the_generator.generate_pattern("New pattern label")
Vision of GenAI for process engineering
Chat interface for P&IDs using Large Language Models (LLMs)
Error correction of P&IDs
Process development
Digitization of paper P&IDs to smartP&IDs
![]() | Dominik P. Goldstein | ![]() |
![]() | Lukas Schulze Balhorn | ![]() |
![]() | Achmad Anggawirya Alimin | ![]() |
![]() | Artur M. Schweidtmann | ![]() |
This software is released under the OSI-approved GNU Affero General Public License (AGPL-3.0) license (see license file file for details). We believe in open collaboration and knowledge sharing, and encourage use by students, researchers, open-source contributors, and industry. You are free to use, modify, and distribute the software under the given license terms. This is a copyleft license, which means that any software based on pyDEXPI, or any modified version thereof, must be published under the same open-source license.
Commercial or Proprietary Use?
If you would like to:
We’re happy to discuss a commercial or custom license on a case-by-case basis.
Please reach out to a.schweidtmann@tudelft.nl for more information.
Copyright (C) 2025 Artur Schweidtmann.
📧 Contact
FAQs
Package containing the DEXPI data model in Python and a parser to load Proteus .xml data to the data model.
We found that pyDEXPI demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.