Components and connections
The building blocks of a diagram: what each component is, what its settings do, and how to connect and arrange them.
Placing and arranging components#
- Add: drag a component from the Components drawer onto the canvas to place it exactly, tap or click it (or press Enter on it) to add it in the middle of what you are looking at, or type
add backend apiin the terminal. The drawer can collapse to a rail of icons (every icon can be dragged or tapped) to give the canvas more room. On a tablet the rail is always there and the full list opens over the canvas; the script panel does the same from View → Script panel. On a phone, tap Edit, then Add to pick a component from a searchable list. - Move: drag it. Components snap to the canvas grid; View → Snap all to grid tidies an older diagram in one step.
- Select several: Shift-drag a selection box, or Ctrl/Cmd-click to add to the selection.
- Copy and paste: Ctrl+C, Ctrl+X, Ctrl+V use the system clipboard, so you can paste into another diagram or another tab. Ctrl+D duplicates in place. Pasted copies get fresh ids, and connections between copied components come with them.
- Delete: select and press Delete or Backspace. Connections to a deleted component go with it.
- Find it again: double-click a component to centre and zoom the view on it.
- Undo: Ctrl+Z and Ctrl+Shift+Z (or Ctrl+Y) step through your changes. A whole terminal script is a single undo step.
Editing a component’s settings#
Every component card lists its settings. Click a value to edit it; numbers, true/false switches and fixed choices (like a database engine) each get the right kind of input. Hover a setting’s name for a one-line explanation. The same values live in the Script panel as JSON and in the terminal as set api requestsPerSec=500 — all three stay in sync.
Each component has an id (like backend-1) that is unique in the diagram. Ids are how connections and terminal commands refer to components. You can rename one in the terminal with rename backend-1 api; its connections follow.
Connections#
A connection says “these two components talk to each other”. Draw one by dragging from a component’s edge onto another component, or with connect web -> api -> db in the terminal. Drawing the same connection twice (same two components, same direction) is quietly skipped.
- Direction does not matter to Rule-based playback. Which way you dragged is an accident of where you started; the walk follows a connection from either end. A request goes out along it and the response comes back the same way.
- Right-click a connection to open its settings. Order is which of a component’s several connections Rule-based playback tries first (lower runs first). Direction (forward, backward, both) only affects Default playback, where markers animate along the line.
- Delete a connection by selecting it and pressing Delete, from its right-click menu, or with
disconnect web -> api. - Double-click a connection to zoom in on both of its ends.
Groups and replication groups#
Groups are a purely visual box around components that belong together (a “data tier”, a “region”). Select two or more components and press Ctrl+G or the Group button that appears. A group has a label, can be resized, and Ungroup removes the box without touching its members. A group is never a connection endpoint — you connect the components inside it.
Replication groups create several identical components at once, already grouped: select a component and press Create Replication Group… to make between 2 and 20 copies with the same type and settings. Dragging a connection onto a group’s empty area connects the dragged component to every member of the group in one go.
Starter templates#
File → Templates… opens a gallery of ready-made diagrams. Hover a card for Add, Preview and Start new diagram.
- Add puts the template into the diagram you have open, to the right of what is already there, with its components selected so you can drag them wherever you like. Nothing you made is touched. You can add as many templates as you want, in any order, to combine them — and one Undo takes away the last one.
- In a diagram you are sharing, adding a template is just another edit: everyone in it sees the new components appear, and nobody leaves or loses their place. A diagram saved to the cloud is limited to the number of components your plan allows; if a template would not fit, Diagravo tells you before changing anything.
- Start new diagram replaces the canvas with the template as a brand-new, unsaved diagram. If you have unsaved changes it asks first. The diagram you were in is not changed.
Custom icons#
Signed-in users can replace a component type’s icon with their own image from account menu → Custom icons. Published share links carry the custom icons so viewers see your diagram the way you drew it, and so do people you invite to it: they see the owner’s icons on the canvas, while their own palette keeps their own.
Component types#
Diagravo has 35 component types in 9 groups. The tables list what each one models, the names you can type for it in the terminal, and the settings it starts with (the same values a freshly dragged component gets).
Clients & Apps#
| Component | What it models | Settings (default) |
|---|---|---|
| Client | Where requests originate — web, mobile, or desktop. Terminal name: client | platform web, activeUsers 1000, payloadSizeKb 100, intent legitimate, sourceCount 1000 |
| HMI Panel | Human-Machine Interface — where an operator interacts with a CPS/industrial system. Terminal name: hmiPanel or hmi | activeOperators 1 |
Compute#
| Component | What it models | Settings (default) |
|---|---|---|
| Backend | Application server that processes requests. Terminal name: backend | vcpu 2, ramMb 512, requestsPerSec 100, sanitizesInput true |
| Serverless Function | Ephemeral, per-invocation compute — scales to zero, deployed independently of other services. Terminal name: serverlessFunction or function or lambda or serverless | memoryMb 512, concurrencyLimit 100, sanitizesInput true |
| Microcontroller | Small embedded processor (e.g. Pico, ESP32, Arduino) running firmware logic. Terminal name: microcontroller or mcu | clockMhz 133, ramKb 264, operationsPerSec 10000, sanitizesInput true |
| PLC | Programmable Logic Controller — industrial automation's workhorse, scan-cycle driven. Terminal name: plc | scanCycleMs 10, maxOperationsPerSec 1000, sanitizesInput true |
Data & Storage#
| Component | What it models | Settings (default) |
|---|---|---|
| Database | Persistent data store. Terminal name: database or db | engine postgres, storageGb 10, iops 3000, ramMb 1024 |
| Cache | Fast in-memory store for frequently accessed data. Terminal name: cache | ramMb 256, evictionPolicy lru, hitRatePercent 70 |
| Object Storage | Stores large files or media — capacity is throughput and size, not IOPS. Terminal name: objectStorage or s3 or bucket or storage | storageCapacityGb 500, bandwidthMbps 1000, ramMb 2048 |
| Search Index | Indexed store optimized for fast text/attribute search, not transactional reads. Terminal name: searchIndex or search | indexSizeGb 50, queriesPerSec 300 |
| Memory Chip | EEPROM/Flash/RAM — raw storage with a real read/write speed ceiling. Terminal name: memoryChip or memory | capacityKb 512, readWriteSpeedMbps 100 |
| Queue | Holds messages for asynchronous, decoupled processing. Terminal name: queue | throughputPerSec 200, maxDepth 1000 |
Networking#
| Component | What it models | Settings (default) |
|---|---|---|
| Load Balancer | Distributes incoming traffic across multiple targets. Terminal name: loadBalancer or lb | algorithm round-robin, maxConnections 1000 |
| Proxy | Sits in front of a service to route, filter, or rate-limit requests. Terminal name: proxy | rateLimitPerSec 500, detectsSessionHijack true, allowsCrawlers true, perSourceLimitPerSec 50 |
| API Gateway | Routes, authenticates, and rate-limits requests across multiple backend services. Terminal name: apiGateway or gateway | rateLimitPerSec 1000, perSourceLimitPerSec 100, allowsCrawlers true, verifiesCredential true |
| CDN | Edge-distributed cache for static content, closer to clients than an app Cache. Terminal name: cdn | bandwidthMbps 5000, hitRatePercent 90 |
| DNS Resolver | Resolves a hostname to an address before a connection can be made. Terminal name: dnsResolver or dns | recordType A, resolutionsPerSec 1000 |
| Edge Gateway | Bridges an embedded/IoT network to the cloud, routing and rate-limiting between them. Terminal name: edgeGateway or edge | rateLimitPerSec 1000, perSourceLimitPerSec 100 |
| Communication Bus | A wired protocol (I2C/SPI/UART/CAN) carrying data between embedded components. Terminal name: communicationBus or bus | busType I2C, baudRate 400000 |
Security & Identity#
| Component | What it models | Settings (default) |
|---|---|---|
| Auth/Identity Service | Issues and validates identity tokens for other services. Terminal name: authService or auth or identity | tokensPerSec 500, ramMb 512, sanitizesInput true |
| Secrets Manager | Stores credentials and keys other components read from at runtime. Terminal name: secretsManager or secrets | secretsCount 50, requestsPerSec 200 |
Observability#
| Component | What it models | Settings (default) |
|---|---|---|
| Monitoring/Logging | Ingests events/logs from other components for observability. Terminal name: monitoring or logging or logs | eventsPerSec 500, retentionDays 30 |
Integrations#
| Component | What it models | Settings (default) |
|---|---|---|
| Email Service | Sends transactional or bulk email on behalf of other services. Terminal name: emailService or email | emailsPerSec 50 |
| SMS/Push Notification | Sends SMS or push notifications on behalf of other services. Terminal name: smsNotification or sms or push | messagesPerSec 50 |
| Payment Gateway | Processes payments through a third-party processor. Terminal name: paymentGateway or payment or payments | transactionsPerSec 100 |
Physical Access#
| Component | What it models | Settings (default) |
|---|---|---|
| Turnstile | Physical gate that admits one person at a time after a valid credential. Terminal name: turnstile | maxThroughputPerMin 30, verifiesCredential true |
| Badge Reader | RFID/badge scanner that reads a credential before granting access. Terminal name: badgeReader or badge | scansPerSec 5, readRangeCm 5, verifiesCredential true |
| Door Lock | Electronic access-controlled lock, fail-safe or fail-secure on power loss. Terminal name: doorLock or lock or door | failSafeMode fail-secure, verifiesCredential true |
| Alarm Panel | Sounds an alert when a connected access-control component blocks an attempt. Terminal name: alarmPanel or alarm | triggersOnBlock true |
| CCTV Camera | Visual surveillance — observes, doesn't participate in request flow. Terminal name: cctvCamera or camera or cctv | fieldOfViewDeg 90 |
Electronics & Signal#
| Component | What it models | Settings (default) |
|---|---|---|
| ADC | Analog-to-Digital Converter — samples a continuous signal into digital values. Terminal name: adc | samplingRateHz 1000, resolutionBits 12 |
| DAC | Digital-to-Analog Converter — turns digital values back into a continuous signal. Terminal name: dac | outputRateHz 1000, resolutionBits 12 |
| Amplifier | Boosts an analog signal's strength (gain) — illustrative only, not electrically simulated. Terminal name: amplifier | gainDb 20 |
| Analog Filter | Shapes an analog signal's frequency content — illustrative only, not simulated. Terminal name: analogFilter | filterType low-pass |
| Real-Time Clock | Keeps time independent of the main system clock, even while powered off. Terminal name: realTimeClock or rtc | driftPpm 20 |
All settings#
Every setting name in the product, with what it means and which components have it. Settings marked “informational only” do not affect playback.
| Setting | What it means | Found on |
|---|---|---|
activeOperators | Active operators driving this panel — counted the same way a Client’s active users are. | HMI Panel |
activeUsers | Concurrent users generating traffic from this client. | Client |
algorithm | How this load balancer distributes traffic across its backends. | Load Balancer |
allowsCrawlers | Whether automated/bot traffic is allowed through, or blocked as policy — neither outcome is narrated as a security win or loss. | Proxy, API Gateway |
bandwidthMbps | Maximum data transfer rate — compared against load during Rule-based Play. | Object Storage, CDN |
baudRate | Communication speed of this bus, in bits per second — informational only. | Communication Bus |
busType | Which physical/electrical bus protocol this represents — informational only. | Communication Bus |
capacityKb | Total storage capacity — informational only. | Memory Chip |
clockMhz | Clock speed — informational only, doesn’t affect simulated capacity. | Microcontroller |
concurrencyLimit | Maximum in-flight invocations at once — a serverless function’s real capacity ceiling, not a requests-per-second rate. | Serverless Function |
detectsSessionHijack | Whether this checks a session token is still valid for its original context — blocks a replayed/stolen session during Rule-based Play. | Proxy |
driftPpm | Clock drift, in parts per million — informational only. | Real-Time Clock |
emailsPerSec | Emails sent per second. | Email Service |
engine | Which database engine this represents. | Database |
eventsPerSec | Events ingested per second. | Monitoring/Logging |
evictionPolicy | Which entries get evicted first once this cache is full. | Cache |
failSafeMode | Whether this unlocks (fail-safe) or stays locked (fail-secure) on power loss — informational only. | Door Lock |
fieldOfViewDeg | Camera’s field of view, in degrees — informational only. | CCTV Camera |
filterType | Which frequency range this filter passes or blocks — informational only. | Analog Filter |
gainDb | Signal amplification, in decibels — illustrative only. | Amplifier |
hitRatePercent | Percentage of requests served from cache instead of passing through — drives the hit/miss outcome during Rule-based Play. | Cache, CDN |
indexSizeGb | Total size of the indexed data — informational only. | Search Index |
intent | What kind of traffic this client sends during Rule-based Play — legitimate, or a named attack type to test your defenses against. | Client |
iops | Disk I/O operations per second. | Database |
maxConnections | Maximum simultaneous connections this load balancer accepts. | Load Balancer |
maxDepth | Maximum number of messages this queue can hold before it’s full. | Queue |
maxOperationsPerSec | This PLC’s real capacity ceiling — compared against load during Rule-based Play. | PLC |
maxThroughputPerMin | Maximum people/vehicles processed per minute — per MINUTE, not per second, like a real turnstile spec. | Turnstile |
memoryMb | Memory allocated to this function — checked for memory pressure during Rule-based Play. | Serverless Function |
messagesPerSec | SMS/push notifications sent per second. | SMS/Push Notification |
operationsPerSec | This microcontroller’s real capacity ceiling — compared against load during Rule-based Play. | Microcontroller |
outputRateHz | How many samples per second this converts back to an analog signal — informational only. | DAC |
payloadSizeKb | Size of each request’s payload — drives bandwidth/memory-pressure checks during Rule-based Play. | Client |
perSourceLimitPerSec | Max requests tolerated from any single source before it’s flagged as anomalous — independent of the overall rate limit, only checked for DDoS-intent traffic with a source count set. | Proxy, API Gateway, Edge Gateway |
platform | Which kind of client this represents. | Client |
queriesPerSec | Search queries handled per second. | Search Index |
ramKb | Memory available — checked against load during Rule-based Play. | Microcontroller |
ramMb | Memory available — checked against load during Rule-based Play. | Backend, Database, Object Storage, Cache, Auth/Identity Service |
rateLimitPerSec | Maximum requests allowed through per second before excess traffic is throttled. | Proxy, API Gateway, Edge Gateway |
readRangeCm | Maximum read distance for a badge/card, in centimeters — informational only. | Badge Reader |
readWriteSpeedMbps | Data transfer speed — compared against load during Rule-based Play. | Memory Chip |
recordType | Which DNS record type this resolver handles — informational only. | DNS Resolver |
requestsPerSec | Requests handled per second — compared against load during Rule-based Play to flag this as over capacity. | Backend, Secrets Manager |
resolutionBits | Precision of each sample, in bits — informational only. | ADC, DAC |
resolutionsPerSec | DNS lookups resolved per second. | DNS Resolver |
retentionDays | How long collected data/logs are kept before being discarded — informational only. | Monitoring/Logging |
samplingRateHz | How many samples per second this takes from the analog signal — informational only. | ADC |
sanitizesInput | Whether this validates/sanitizes input before acting on it — blocks a SQL-injection attempt during Rule-based Play. | Backend, Microcontroller, PLC, Auth/Identity Service, Serverless Function |
scanCycleMs | Time for one full scan cycle, in milliseconds — informational only. | PLC |
scansPerSec | Badge/card scans processed per second. | Badge Reader |
secretsCount | Number of secrets stored — informational only. | Secrets Manager |
sourceCount | How many distinct devices/IPs this client’s traffic represents — feeds a connected Proxy’s per-source anomaly check. | Client |
storageCapacityGb | Total storage capacity — informational only. | Object Storage |
storageGb | Total storage capacity — informational only. | Database |
throughputPerSec | Messages this queue can process per second. | Queue |
tokensPerSec | Auth tokens issued/validated per second. | Auth/Identity Service |
transactionsPerSec | Payment transactions processed per second. | Payment Gateway |
triggersOnBlock | Whether a connected access-control component blocking an attempt also sounds this alarm. | Alarm Panel |
vcpu | Virtual CPU cores allocated — informational only. | Backend |
verifiesCredential | Whether this checks a presented credential (badge, card, token) is genuine — blocks a cloned/replayed credential during Rule-based Play. | Turnstile, Badge Reader, Door Lock, API Gateway |
Last updated . Something unclear or out of date? Tell us.