Formal verification of programs specified with signal: application to a power transformer station controller

We present a formal speci!cation and veri!cation of the automatic circuit-breaking behavior of an electric power transformer station, using the synchronous approach to reactive real-time systems implemented by the data-4ow language SIGNAL. Synchronous languages have a mathematical model that supports the various phases of the development of a control system: speci!cation, veri!cation, simulation, code generation, and implementation. The complex hierarchical, state-based and preemptive behavior of the power station controller is speci!ed in SIGNALGT ̇, an extension of SIGNAL with notions of time intervals and preemptive tasks. To validate the speci!cation, a graphical simulator is generated using SIGNAL’s execution environment, and the required behavior is proven to be satis!ed, using its proof method. c © 2001 Elsevier Science B.V. All rights reserved.