Chemical reactor overpressure lockout¶
| suite id | reactor_pressure_lockout |
| domain | chemical_batch |
| language | ST |
| difficulty | medium |
| validation status | candidate |
| origin | authored |
| license | CC-BY-4.0 |
Authored to target the temporal/procedural-phrasing translation gap identified in the kiln_door_lockout diagnosis: the second safety requirement is worded as pure natural-language persistence ('remains shut down ... until an operator manually clears the fault') without naming the internal latch variable, unlike elevator_door_motion_interlock / mixer_lid_stall_interlock / breaker_earth_trip_interlock, whose two clauses share one direct guard-condition template. See ml/README.md.
What is proved¶
From benchmarks/chemical_batch/reactor_pressure_lockout/props.yaml. What each kind claims, and what it becomes on either route, is on The properties we prove.
| id | kind | claim | requirement |
|---|---|---|---|
P1 |
invariant |
!(feed_pump && pressure_high) |
The feed pump must never run while reactor pressure is above the safe limit. |
P2 |
invariant |
!(feed_pump && fault_flag) |
Once pressure has exceeded the safe limit, the feed pump must remain shut down even after pressure falls back into range, until an operator manually clears the fault. |
P3 |
reachability |
reachable: feed_pump && fault_flag |
Trigger synthesis: a witness recovers the bad state P2 forbids, so the counterexample search has a concrete target when the manual-reset requirement is bypassed. |
Variants¶
| file | expected verdict | violates | method |
|---|---|---|---|
clean.st |
SAFE | none | expert |
bomb.st |
VIOLATION | P2 |
fault-injection |
Files¶
| file | what it is | size | sha256 |
|---|---|---|---|
benchmark.yml |
benchmark metadata | 1.5 KB | 604464a1b458 |
bomb.st |
structured text | 1.2 KB | c468233717a7 |
clean.st |
structured text | 1.1 KB | fb2ff81f4816 |
props.yaml |
property file | 0.7 KB | 5c716391bb55 |
Recorded runs¶
A task can carry two routes. ld is ESBMC's ladder front end reading the program directly. via C is the same solver reached through Beremiz and MatIEC, which is the only route that reaches ST, IL, FBD and SFC; see How ESBMC-PLC works.
No ESBMC run is recorded against this task yet. The lessons carry the recorded runs; see Reproducing to make your own.