Infusion-pump configuration
Can startup and control logic reach a declared over-delivery state under a reviewed configuration and environmental model?
Use cases
Bounded questions with explicit consequences.
These examples show evaluation targets, not certified product claims. Each requires a reviewed model, assumptions, property and horizon.
Explore three controller failures
Explore a failure sequence
Can motion continue after the guard opens?
A delayed interlock leaves the motor enabled for one step after the guard opens.
Illustrative four-step traces, not GCC runs. The corrected trace alone is not a proof.
Step 0: Guard closed. Motor enabled. Property holds at this step.
Click a step to inspect it
Questions to evaluate on your own model
Watchdog and reset sequencing
Can an illegal actuator command survive a bounded fault, watchdog and reset sequence?
Safety interlock logic
Can motion enable remain asserted while a modelled guard, limit or emergency-stop condition is active?
Repeated controller channels
Do structurally repeated channels preserve the declared property under exact composition and independent replay?