I. Production Cell in Lustre

Our aim was to fully develop (i.e. specify, program and verify) a controller for the production cell simulator. We have specified and programmed the controller in Lustre, which is a declarative language for programming synchronous reactive systems. For verification we have used a symbolic model checker, called Lesar, which allows to automatically verify those Lustre programs which use only boolean data. Since the production cell controller could be written as such a program, we were able to automatically verify all the safety requirements given in the task description for this case study. Using a declarative language allowed to develop the controller in a relatively easy way, and in a relatively short time. 1.1 A quick introduction to Lustre Lustre [1][2][3][4][5] is a declarative language for programming synchronous reactive systems. In the computational model for synchronous reactive systems time is assumed to be discrete, i.e. divided into enumerable number of non-overlapping segments called instants of time. A synchronous reactive system is a cyclic, nonterminating process. Each cycle, a so-called reaction step, is performed in one instant of time. A reaction step consists in fetching inputs, computing, and emitting outputs. A synchronous reactive system may consist of several components. All components perform their reaction steps simultaneously, i.e. in the same instant. Local communication between components is considered to be instantaneous. 2 Leszek Holenderski In Lustre, a behaviour of a reactive component with input channels a, b, ... and output channels x, y, ... is specified by a set of equations of the form