Steam Boiler Control Specification Problem: A TLA Solution

Our solution to the speciication problem in the speciication language TLA+ is based on a model of operation where several components proceed synchronously. Our rst speciication concerns a simpliied controller and abstracts from many details given in the informal problem description. We successively add modules to build a model of the state of the steam boiler, detect failures, and model message transmission. We give a more detailed controller speciication and prove that it reenes the abstract controller. We also address the relationship between the physical state of the steam boiler and the model maintained by the controller and discuss the reliability of failure detection. Finally, we discuss the implementability of our speciication.