Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand,...

25
Specifying and verifying a transformer station in Signal and SignalGTi Herv´ e Marchand, ´ Eric Rutten, Mazen Samaan To cite this version: Herv´ e Marchand, ´ Eric Rutten, Mazen Samaan. Specifying and verifying a transformer station in Signal and SignalGTi. [Research Report] RR-2521, INRIA. 1995. <inria-00074157> HAL Id: inria-00074157 https://hal.inria.fr/inria-00074157 Submitted on 24 May 2006 HAL is a multi-disciplinary open access archive for the deposit and dissemination of sci- entific research documents, whether they are pub- lished or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L’archive ouverte pluridisciplinaire HAL, est destin´ ee au d´ epˆ ot et ` a la diffusion de documents scientifiques de niveau recherche, publi´ es ou non, ´ emanant des ´ etablissements d’enseignement et de recherche fran¸cais ou ´ etrangers, des laboratoires publics ou priv´ es.

Transcript of Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand,...

Page 1: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

Specifying and verifying a transformer station in Signal

and SignalGTi

Herve Marchand, Eric Rutten, Mazen Samaan

To cite this version:

Herve Marchand, Eric Rutten, Mazen Samaan. Specifying and verifying a transformer stationin Signal and SignalGTi. [Research Report] RR-2521, INRIA. 1995. <inria-00074157>

HAL Id: inria-00074157

https://hal.inria.fr/inria-00074157

Submitted on 24 May 2006

HAL is a multi-disciplinary open accessarchive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come fromteaching and research institutions in France orabroad, or from public or private research centers.

L’archive ouverte pluridisciplinaire HAL, estdestinee au depot et a la diffusion de documentsscientifiques de niveau recherche, publies ou non,emanant des etablissements d’enseignement et derecherche francais ou etrangers, des laboratoirespublics ou prives.

Page 2: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

ISS

N 0

249-

6399

appor t de r ech er ch e

INSTITUT NATIONAL DE RECHERCHE EN INFORMATIQUE ET EN AUTOMATIQUE

Specifying and verifying a transformer stationin Signal and SignalGTi

������������ �����������,������������ ���!�"�

,���#$�"�&%'� ()��� �

N˚ 2521March 1995

PROGRAMME 2

Page 3: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen
Page 4: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

����������� �������������������������������������� !#"��%$&�'�( )���'�%�"*�+�������*����,-����� �.�������,#/102�43

57698;:=<64>@?�8%A%BC?�DFEHGIG#J <K�8%LMA(N�OCP%PC6�DHGIGIGQJC>R?'S;6�DUT!?'V�?W?�DHGIGXGIG

Y!Z\[#]QZ_^�`�`baWc�dfeC^�gihkjlgnmMop`�qr[#gtsiu#jva#w�xlZ\[#]#Zk^�`�`�^�y\st[�z{aIyF]�|aIzvs}a'gt[#]QsihkstaIgY!ZM[~�aIy��F���_�F���

�W^�xlxr[#ZMyW��a�Z\ah\�laIZkhM�va�z���cQ�#cv�Cd���^�ZkhM�����#�#��df����xr^�]#aXm

�*���X�����¡ ��Q¢=£�a'xlZ\aImMaXz�y'y\�la{m\x¡a�hks¥¤¦hI^�y\st[#z7^�z¡��§#aIZ\s¨¤;hI^�y\s}[Qz�[�©�y\�la{^�jvyM[#`�^�y\sªhFhkstZ_hkjvs}y¬«­qvZMa^�®�stzl]qraI�¡^�§pst[#ZF[�©�^�z�aIgtahky\ZMsih�xr[#¯%aIZ'yMZk^�zlm¬©°[#Z\`baIZFmMyk^�yMst[Qz�jlmMstzl]�yM�la�mMopz¡h\�lZ\[#zl[Qjlm�^�xlxvZM[�^Qh\��yM[�ZMa^Qh\«y\s}§Qa{Z\a^�g¥«±yMst`baFmMopmMy\aI`bm�w)^�zr��x¡^�Z\yMsihkjlgi^�ZMgto�yM�la�²l³°´nµ;¶;·�gª^�zl]#jr^�]#aQ¸C¹C�la�mMopz¡h\�lZM[Qzl[#jvm�gi^�zl]#j¡^�]#aIm�¡^�§Qa{^�`�^�y\�laI`�^�yMsihI^�g¡`�[���aIg)m\jlxlxr[#ZMy\stzl]by\�la{§#^�ZMst[#jvmWxl�¡^�mMaIm'[�©�y\�la��paI§#aXg}[Qxl`baXz�yF[�©�^bh�[#zpyMZ\[#gm\o�m\yMaI`»º%mMxrahks¥¤¦hI^�yMst[#z)wr§QaIZMs¥¤¦hI^�yMst[#znwlmMst`�jlgi^�yMst[#z)wQhk[l�pa{]QaIzlaIZk^�y\s}[Qz)w¡^�z¡��st`bxvg}aX`baIzpy_^�yMst[�z)¸!¹C�laXs}Zm\aI`�^�z�y\sihkm�^�ZMa�^�y'yM�la�q¡^�mMa�[�©�y\�la{§#^�ZMst[#jvmWyM[p[Qg}m'�pa�psihI^�yMa�»y\[ba^Qh\�7xl�r^�mMa�^�zr��stzpyMaI]QZ_^�yMa� stz�y\[�l[Q`b[Q]#aIzlaX[#jlm��paIm\s}]Qz¼aIzp§�stZ\[#zl`�aIzpyMm¸½¹C�la�`baIy\�l[l�p[#gt[#]Qo7^�m\mM[lhksi^�y\a�¾¯CstyM�-y\�la7�l^�y_^.¿¡[�¯�gi^�z�«]Qj¡^�]Qa�²l³°´nµ;¶;·�stm{�paI`�[#zlm\yMZ_^�yMa�»[Qz7y\�laba�Àv^�`bxlgta�[�©�y\�la�©Ájlz¡hky\s}[Qz¡^�g%�paIm_h�ZMstxlyMst[Qz�[�©W^�`ba��s}jv`y\aIzlmMst[Qz�x¡[�¯%aIZCy\Z_^�zvm±©°[QZM`baXZCmMy_^�yMst[#z�^�z¡��yM�la'mMxrahks¥¤¦hX^�yMst[Qz�[�©�styMmW^�jlyM[Q`�^�y\sih%q¡aI�r^�§�st[QZCjlx¡[Qz�yM�la[lhIhkjvZMZMaXz¡hka'[�©¦^�z{aXg}a�hkyMZ\sªhX^�g¡�pa�©­^�jlgty�¸)¹C�la%mMxrahks¥¤¦hX^�yMst[Qz�[�©¡y\�laWhk[#`�xlgtakÀ��lstaIZ_^�Z_h\�lsihI^�g­w�mMy_^�yMak«±q¡^�mMa�^�z¡��xlZ\aIaI`bxvyMst§#a�qraI�¡^�§pst[#ZCstmF`�^#��aWstz�²l³°´nµ;¶;·)Â�Ã'ÄÅ wr^�z�akÀly\aIzlmMst[Qz7[�©�²l³Á´)µ;¶;·�¯CstyM��y\�la�zl[QyMst[#zlm[�©�yMst`ba'stzpyMaIZ\§#^�gtm�^�z¡��xlZ\aIaI`�xlyMst§#a�y_^�m\®pm¸�Æv[#ZWy\�la�§#^�gtsi�l^�y\s}[Qzb[�©�yM�la�mMxrahks¥¤¦hX^�yMst[Qz)w)^�]QZ_^�xl�lsihI^�gm\s}`�jvgª^�yM[QZ�stm�]QaIzlaIZk^�yMa���jlmMstzl]�yM�va�akÀlahkjly\st[#z�aIzp§ps}Z\[#zl`�aIzpy�©Á[#ZF²l³°´nµ;¶;·¡¸�Y!Z\[#xraIZMy\s}aXm�Z\auQjlstZMa��qpoy\�la�^�xlxlgtsihI^�yMst[#z-^�ZMa�xlZM[�§Qa�¾yM[»�l[#gi�»[Qz=y\�labm\x¡a�hks¥¤¦hI^�y\st[#zÇ[�©WyM�la�hk[Qz�y\ZM[Qg}gtaIZ�w�jlm\stzl]7y\�la�xlZM[p[�©`�aIyM�l[l��^�mMm\[lhksi^�yMa���¯CstyM�»²l³°´nµ;¶;·¡¸È�ÉpÊ;ËMÌ�Ír�#Î!��¢�Yn[�¯�aIZ%mMopm\yMaI`�mwlhk[Qz�y\ZM[Qg;mMopmMy\aI`bm�wQ©°[#Z\`�^�gp`�aIyM�l[l�pm�wpZMa^�g¥«­y\s}`�a#w�m\o�zrhM�vZM[#zv[#jlmCgi^�z�«]Qj¡^�]Qa#w¡�l^�y_^�¿¡[�¯�wpy_^�mM®�xlZMaIaX`bxly\s}[Qz)wQ©°[QZM`�^�gl`baXyM�l[l�pm�wp§#aIZ\s¨¤;hI^�y\s}[Qz�yM[p[#gtmwpm\[�©°y±¯C^�Z\a'm_^�©ÁaIy±o�¸

ÏiÐ�ÑÒ­Ó±ÔÕ ÑÒ�ÖØ×tÓ±Ù±ÚkÛ

Ü_ÝßÞ�à)á¡âkàÁãWäæå'çIè±àÁäæé#êMëXìiä¨âkå9ä¨í)íîÞ�ï�ï�âkà±ì°è\ð�ñ�ò7óôvõ èMêMìîàÁä¨ê±ä¨ì óè;ð�èØö�à±ëkå#ê\èI÷Ü\ÜMøiù)únøiû è¬ü}ýWë�ä õ�þ ýWëkà­ê þ ë�å�ÿ;äæàÁäæí°ë�÷ �¥àÜMÜ\Ü øiù)únøiû è¬ü}ýWë�ä õ à°Þ#ìÁì°è¬å�ÿßäæà°ä¨íÁë�÷ �¨àÜ\ÜMÜ\ÜMô�� ö�� �Øô ú í°è¬à­çXä¨êMè ô�� ð óè±ï#ëkà±ìÁè±ýWè±å�ì����������IÞ#ëkä� �ëIìîä¨è±à������������ þ ëIìÁâkÞ��rè\ð�è��%ö�à­ëkå#ê\è

Unite de recherche INRIA RennesIRISA, Campus universitaire de Beaulieu, 35042 RENNES Cedex (France)

Telephone : (33) 99 84 71 00 – Telecopie : (33) 99 84 71 71

Page 5: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

�b����'�����7�W�'�%�"*� �F�2����'�%���7�F�'�%�"��&������� ��"� n��� ����������� ØQ"{��$&�'�%�"�� ���,��� ���%�����H��� % � � � ���

���É��������É�¢�� [#jlm�xvZl|aIm\aIzpyM[#zvmCsªh�s¡gi^FmMxC|a�hks¥¤¦hI^�y\st[#zbaXy�gi^F§�|aIZMs¥¤¦hI^�yMst[#zb��jbhk[#zpyMZ �[#gtaIjlZC^�jvyM[#`�^�y\sªuQjla��� jlz��pstmt~k[#z¡h�yMaIjlZ'��� jlz�x¡[QmMy\a��pa'y\Z_^�zvm±©°[QZM`�^�yMst[#zÇ|aIgtahky\ZMsiuQjla#wraIz�jlyMstgtstm_^�z�yCg��æ^�xvxlZM[lh\�la'mMopz¡h\�lZ\[#zlaxr[#jlZ'gtaImFmMopmMy�aI`baIm'Zl|a^#hky\s¥©°mWy\aI`bxlmFZl|aIaXg}m'aIyFxlgtjlmWxr^�ZMy\sihkjlgts��aIZMaI`�aIzpyWgta�gi^�zv]�^�]Qa�²l³°´nµ;¶;·¡¸� ;aIm'gi^�z�«]p^�]#aXmØm\opz¡h\�lZM[QzlaIm!mM[Qz�ynq¡^�ml|aIm!mMjlZ!jlzva�`�[����aIgtaØ`�^�y\��|aI`�^�yMsiuQjla;mMaXZM§#^�zpy��pa�m\jlxlxr[#Z\y�^�jpÀ{�ps"!�|aXZMaIzpyMaXmxl�r^�mMaXm��pa��%|aI§QaIgt[#xlxraI`�aIzpyMmW�pj�mMopm\y�aI`�a�h�[#zpyMZ �[#g|a#ºpmMxC|ahks¥¤¦hI^�yMst[#z)wv§�|aIZMs¥¤¦hI^�yMst[#znwpmMst`�jlgi^�y\s}[Qz)w�]�|aIzC|ak«Zk^�yMst[Qz��pa�hk[l�pa#wpaXyCs}`�xlg|aI`�aIzpy_^�yMst[#zn¸# ßaIjlZ\mCml|aI`�^�zpyMsiuQjlaIm%mM[Qz�y$�^�gª^�q¡^�m\a��%� [QjlyMstgtm��pst§QaIZMmC�%|a�ps�|aIm&�^h\�¡^Qu#jvaWxl�¡^�mMaFaIy�stzpyl|aX]#Zl|aXm��l^�zlmC�paIm%aIzp§�stZ\[#zlzlaX`baIzpyMm%�pa�hk[Qz¡hkaIxvyMst[#z��l[#`�[#]'�aXzlaIm¸( )^'`Ç|aIyM�l[l�p[Qgt[�«]Qs}a�^�mMm\[lhks|aIa{^�j gª^�zl]�^�]#a ¿¡[#y\m��pa{��[#zlzC|aXaIm�²l³°´nµ;¶;· aImMy��%|ah�ZMstyMa�xr^�ZWjvz�a�À�aX`bxlgta��pa{�paXm_hkZ\s}xvyMst[#z©°[Qz¡hky\s}[QzlzlaIgtgta���� jlz�x¡[QmMyMaC�pa%yMZk^�zlm¬©°[#Z\`�^�y\st[#z�|aXg}a�hkyMZ\sªuQjla%aIy!gi^%mMxC|a�hks¥¤¦hI^�y\st[#z��pa�m\[#z{h�[#`bxr[#Z\yMaI`�aIzpy^�jlyM[Q`�^�y\siu#jva)�^*g�� ^�xlx¡^�ZMstyMst[#z���� jlz7�%|a�©­^�jly�|aIgtahky\ZMsiuQjla#¸* n^�mMxC|ahks¥¤¦hI^�yMst[#z��pj7hk[Q`bxr[#Z\yMaI`�aIzpyWhk[#`*«xlgtakÀla'^�§#ah �ls|aIZ_^�Z_h\�lsta��paFxlZl|aXaI`bxly\st[#z�aIm\y�©­^�styMaCaIz ²l³°´nµ;¶;·)Â�Ã'ÄÅ w#jvzlaWakÀly\aIzpyMst[#z��pa�²l³°´nµ;¶;·�^�§#a�hgtaIm�zl[#y\st[#zlm���� stz�y\aIZM§#^�gtg}aXm���abyMaX`bxlm�aXyb�paby �^#h\�laIm�xlZl|aXaI`bxly\st§#aIm�¸+ )^�§#^�g}si�l^�yMst[#z»�pabgi^�m\x�|ahks¥¤¦hI^ «y\s}[QzbaIm\yWZl|a^�gtstml|aIa,�^�g�� ^�si�pa���� jlz�mMst`�jlgi^�y\aIjlZ�]QZ_^�xl�lsiuQjla#wp]�|aXz�|aIZl|a�x¡^�Z%g�� aXz�§pstZM[QzlzlaI`�aIzpy��%� a�À�|a�hkjlyMst[Qz�pa�²l³°´nµ;¶;·¡¸- ;aIm'xlZ\[#xlZ\s|aXyl|aIm�Z\auQjlstmMaIm�x¡^�ZFg��æ^�xlxlgtsihI^�y\s}[Qzbm\[#zpy'xlZM[Qjl§�|aIaIm'aIz»yMaIz¡^�zpy�h�[#`bxvyMa{�pa�gi^m\x�|ahks¥¤¦hI^�yMst[#z»�pj�hk[#zpyMZ �[#gtaIjlZ�w.�^�g�� ^�si�pa���� jlzva�`Ç|aIyM�v[���a���a�xvZMaIjl§Qa{^�m\mM[lhks�|aIa/�^*²l³°´nµ;¶;·¡¸0 Ír� �XË_ 213�É*¢�m\o�m\y�aI`�a��paChk[#zpy\Z#�[#gta#wXyMaI`�xlm)Zl|aIaIg±w�gi^�zl]p^�]#a!m\o�zrhM�vZM[#zva#wX¿¡[#y\m���a��p[#zvz�|aIaIm�w�xlZl|aXaI`bxly\st[#z�pa�y#�^#h\�laXmwl[QjlyMstgtmC�pa�§�|aIZMs¥¤¦hX^�yMst[Qz)wp`Ç|aIy\�l[l�paF©°[#Z\`baIgtgtaIm�w#m4�jlZMaIyl|a{�pj�gt[#]Qsªh�s}aXg­¸

Page 6: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

��������� ��� ����������������� ��� ��������������� ������ ���!���"�#���$���%�&�'���(������)*�����+���,�-����)iÂ�Ã*� �

. / �{����"�� ���C�%�"*�

¹C�lstm�x¡^�xraIZ�xlZ\aImMaXz�y\m�^�z�akÀlx¡aIZ\st`baIzpy�s}z¾yM�la0�������1���������23�4���3�����#���51�yM[»yM�la�mMxrahks¥¤¦hX^�yMst[Qz)w!st`�«xlgtaI`�aIzpy_^�yMst[#z�^�z¡�*©°[QZM`�^�gl§#aXZMs¥¤¦hI^�yMst[#z�[�©6�����3����� ���7������)8��� � �9�5#���"���:�9; �#<Mw¡^�z¡��`b[QZMaWm\x¡a�hks¥¤¦hI^�gtgto[�©WyM�la��pahkgi^�Zk^�y\s}§Qabgi^�zv]#j¡^�]#a�²l³°´nµ;¶;·¡¸*=±y�stm{^�xlxlgtsta�»yM[�y\�la���aImMst]#z¾[�©�^�h�[#`bxvg}a�À7mMyk^�yMa�«­q¡^�mMa�ßw�pstmkhkZMaIy\a{aX§#aIzpyCqraI�¡^�§pst[#ZC[�©!yM�la�hk[#zpyMZ\[#gtgtaIZC[�©�^�x¡[�¯%aIZCy\Z_^�zvm±©°[QZM`baXZ�m\y_^�y\st[#z)¸>Fz-stzpyMaIZ\xlZMaXy_^�y\st[#z-[�©�y\�labm\o�zrhM�vZM[#zpo¾��opxr[#y\�laImMstm�stm{y\�¡^�y�^�gtg%yM�la�ZMaIgtaI§#^�z�y�§#^�gtjlaXm{stzp§#[Qg}§Qa�

stz�^{h�[#`bxvjly_^�yMst[#z'?Ás}zvxljlywp[QjlyMxvjlyW^�z¡��stzpyMaIZ\z¡^�g;§#^�gtjlaIm�@%^�Z\a'xlZMaIm\aIzpy'mMst`�jlgty_^�zlaI[#jvmMgto�¯CstyM�lstz�yM�lam\s}zv]#gta's}zvmMy_^�zpy�[�©Øgt[#]QsªhX^�gryMst`baC¯C�laXz�y\�la'mMopmMy\aI`2ZMa^QhkyMmFyM[�s}y\mCstzlxljly�¸p¹C�lstm�hk[Qz¡�pstyMst[Qzbstm�mk^�y\s}m¬¤¡a�©°[QZWm\o�m\yMaI`�mW¯C�lsih\��Z\a^#hky�©­^�m\yMaIZFyM�¡^�z�yM�la�x¡^Qhka{[�©�yM�vaIstZWaIzp§pstZM[#zv`baIzpy� mW�popz¡^�`bsihkm�wQ©°[#ZFs}zvmMy_^�z¡hkastz»mMopz¡h\�lZM[Qzl[#jvm��¡^�Zk�p¯C^�ZMaQ¸�=±y']Qj¡^�Zk^�zpyMaIaXm{�paIy\aIZM`�s}zvs}m\`([�©�y\�la�mMxrahks¥¤¡a��»q¡aI�r^�§�st[QZMmwn^�z¡�.©­^#h�s}gts¥«yk^�yMaXm�y\�laCmMaI`�^�zpyMsihI^�g#`�^�zlstxljlgi^�yMst[#zlm;[Qz{xvZM[#]QZ_^�`bmw�¯C�lsih\��^�ZMaCjvmMa��stz�yM�laW�pa�¤¡zlstyMst[#z�[�©rxlZM[Q]#Z_^�`y\Z_^�zvm±©°[QZM`�^�yMst[#zvm�xlZ\aImMaXZM§pstzl]�auQjlst§#^�gtaIz¡hka'[�©�qraI�¡^�§pst[#Z�¸�=±y\m�^#��§#^�zpy_^�]#aWstmFyM[�xlZ\[�§�si�pa'm\jlxlxr[#ZMy ©°[#Z^�¯C�l[Qg}a�mMaIy'[�©%yM[p[#gtm�^�mMm\s}m\yMstzl]�yM�va��paXmMst]#z�[�©�ZMa�^�g¥«­y\st`ba�^�xlxvg}sihI^�yMst[#zvmw¡^�gtgØ^�gt[Qzl]by\�laIstZ'g}s¥©°a�«¬hkolhkgta#¸¹C�la'mk^�`ba ©°[#Z\`�^�glq¡^�m\aImCmMjvxlx¡[QZMyFyM�la'[#xraIZk^�yMst[Qzlm�xraIZ¬©°[#Z\`ba�*q�o�yM�la'§#^�ZMst[#jlm%yM[p[Qg}m%stzby\�la��paImMst]QzaIzp§pstZM[Qzl`baIzpy\mºpyM�va�^�z¡^�gtopmMstm�^�yCyM�la��ps"!;aIZMaXz�yCgtaI§QaIgtmC[�©Ø^�qlmMy\Z_^#h�yMst[#z)w�©°ZM[Q`4ZMauQjlstZMaX`baIzpyMmW��[�¯CzbyM[hk[l�paC]QaIzlaIZk^�y\s}[Qz)w�yM�la%st`bxlgtaI`�aXz�yk^�y\s}[QzC[#z�m\x¡a�hks¥¤¦h%�¡^�Zk�p¯C^�ZMa%qpo�hk[�«M�paIm\s}]Qz)w�yM�la%xraIZ±©°[QZM`�^�z¡hka9aI§#^�«gtj¡^�yMst[#z�^�z¡��[#xvyMst`bs(A^�yMst[#z)w3B�B#BC>-©±^�`bstgtoW[�©¦gi^�zl]#j¡^�]#aIm!stm�q¡^�mMa��[Qz{y\�lstm��popx¡[QyM�laIm\stm6;æ�#<MwX©°a^�y\jlZMstzl]^�`b[#zv]#mMy%[#y\�laIZ'�!D�E8F�G8Fv·¡w8HCIJD�E8G8F)wß²l³°´nµ;¶;·b^�z¡��^�g}m\[b²�Ep¶�E8F�KML;¶8G�EJDQ¸l¹C�laIo�xlZ\[�§psª��a�hk[Q`bxlgtaIy\a�paXmMst]#z�aXz�§pstZM[Qzl`baXz�y\mwv¯Cs}y\��mMaIy\m�[�©�yM[p[#gtmCq¡^�mMa� jlxr[#z�y\�laIstZC©°[QZM`�^�grmMaI`�^�zpyMsihkm�w¡^�zr�b¯C�vsªh\��m\jlxp«xr[#Z\y�mMxrahks¥¤¦hI^�yMst[#znw�©°[QZM`�^�g#§QaIZMs¥¤¦hX^�yMst[Qz)w�[#xvyMst`bstm_^�yMst[#z'^�z¡��]QaIzlaIZk^�y\s}[Qz{[�©¦a�À�a�hkjly_^�qlgta�hk[l�paQ¸#¹C�laXs}Z^�s}` s}mCy\[�mMjlxvx¡[QZMyWy\�la{�paXmMst]#z�[�©Ømk^�©°aIy±o�hkZMsty\sªhX^�gØ^�xlxlgtsihI^�y\st[#zlm�wpaImMxrahksi^�gtgtoby\�l[#m\a�stzp§#[#gt§pstzl]�m\s}]Qz¡^�gxlZ\[lhkaImMm\stzl]�^�z¡��xlZ\[lhkaImMm'hk[#zpy\ZM[#g±¸p¹C�la'm\o�zrhM�vZM[#zv[#jlmCy\ah\�lzl[#gt[Q]#ob^�zr��styMmCgi^�zv]#j¡^�]#aIm�^�ZMa�^�§#^�stgi^�qvg}ahk[Q`b`�aIZ_hksi^�g}gtopwI^�z¡��^�xvxlgts}a���s}z�stz¡�pjlm\yMZ\sª^�g¡hk[Qz�y\akÀlyMm6;æ�-<¬¸�Y!^�Zk^�gtgtaIgtgto�wXZMaIm\a^�ZkhM��^�z¡��akÀlx¡aXZMst`baIzpy\m�^�ZMa]Q[#stzl]�[#z�[#z�zlaI¯ ©°a^�yMjlZ\aImwvmMj¡h\�7^�mCyM�la'[Qzla'ZMaIxr[#Z\yMa� [#z�stzby\�lstmCx¡^�xraIZ¸

²l³Á´)µ;¶;·�stm�^�ZMa^�g¨«±yMst`�a�m\o�zrhM�vZM[#zvsNAXa���l^�yk^�«Á¿¡[�¯¼gª^�zl]#jr^�]#aO;t�Q�P<¬¸3=±yMmC�pah�gª^�Z_^�yMst§#aFmMy±opgtaWstm�q¡^�mMa�[QzbauQj¡^�yMst[#zlm%�pak¤¡zlstzl]�yM�laF§#^�gtjlaIm�^�z¡��yM�vaWmMopz¡h\�lZ\[#zls(A^�yMst[#zvm�[�©)yM�la ¿¡[�¯Cm�[�©Ø�v^�y_^�hI^�gtgta��mMst]Qz¡^�gtm¸Y!Z\[lhkaImMm\aIm�^�Z\aWstz�©­^Qhky%mMopmMy\aI`bm%[�©)auQj¡^�yMst[#zvmwp^�z¡��hk[#`�xlstg}stzl]'^�²l³Á´)µ;¶;·�xlZ\[#]#Zk^�`�stzp§#[Qgt§#aIm!yMZk^�zlm¬«©°[QZM`�s}zv]�yM�la�m\x¡ah�s¨¤;hI^�y\s}[Qz�stz�y\[�^�z7akÀlah�jly_^�qlgtabhk[l�pa�mM[Qg}§pstzl]�yM�lstm'mMopmMy\aI`H[�©�a�u#jr^�yMst[Qzlm�^�y'a^#h\�Z\a^#hky\st[#z)¸Q¹C�laChk[#`�xlstgª^�yMst[#z�^�g}m\[WxraIZ±©Á[#ZM`�m�hM�vah\®�stzl]Qm�[#z�yM�vaWhI^�jlmk^�g¡^�z¡��yMaI`�x¡[QZ_^�glhk[QzlmMstm\yMaIz¡h�o{[�©y\�la�m\x¡a�hks¥¤¦hI^�y\st[#z)w#^�z¡�'[QxlyMst`bs(A^�yMst[#zvm¸\¹C�laW²l³Á´)µ;¶;·'xlZ\[#]QZ_^�`�`bs¥zl]�aIzp§pstZM[#zv`baIzpyr©°a^�yMjlZ\aIm�]QZ_^�xv�ls¥«hI^�g¡a��pstyM[#ZC^�zr��m\s}`�jvgª^�yMst[#z�yM[p[#gtmwQhk[#`�xlstg}aXZ�^�z¡��[#xvyMst`bs(A^�yMst[#z)w�hk[l�paW]QaIzlaIZk^�y\s}[Qz�stz�mMaI§QaIZ_^�g¡yk^�ZM]QaIygi^�zv]#j¡^�]#aIm�w¦^�z¡��^*xlZM[p[�©%yM[p[#gß©°[#ZFyM�la�^�z¡^�gto�m\stmC[�©��popz¡^�`bsihI^�g;mMopmMy\aI`bm�¸¡¹C�va{[QZMst]#stz¡^�g;auQj¡^�y\s}[Qz¡^�gz¡^�yMjlZ\a�[�©'²l³°´nµ;¶;·�`�^�®#aImFyM�¡^�y�sty'ZMaIgtstaIm'[#z�^*©°[#Z\`�^�gn`b[l�paIg!stz»yMaIZ\`bm'[�©Cx¡[Qgto�zv[#`bsi^�g)�popz¡^�`�sªhauQj¡^�yMst[#zvmØm\opmMyMaX`bmw�^�z¡�'yM�va�xlZ\[p[�©¡`�aIyM�l[l�'stmnq¡^�m\a��[Qz�yM�va�y\�laI[#Z\o�[�©;^�gt]#aIqvZ_^�sih!]QaI[#`�aIyMZ\oQ;t�cpw�R-<¬¸S'st§QaIz{y\�laWm\opz¡h\�lZM[Qzl[#jlmC�l^�y_^ ¿¡[�¯-m\y±opg}aC[�©Ø²l³Á´)µ;¶;·rw#sty\m�`b[l�paIgp[�©)yMst`ba�stm�qr^�mMa���[#z�stzlmMyk^�zpyMm�w#^�zr�styMm%^#hky\s}[Qzlm�^�Z\aCx¡aIZ¬©°[#Z\`ba��¯CstyM�lstz�yM�laCstzlm\y_^�z�y\m�Tp²l³Á´)µ;¶;·nÂ�Ã'ÄÅ stm�^FZMah�aIzpy�akÀly\aIzlmMst[Qz�yM�¡^�y�xlZM[�§psi�paImhk[QzlmMy\ZMj¡h�yMmF©°[#ZCy\�la'mMxrahks¥¤¦hI^�yMst[#z [�©Ø�vs}aXZ_^�Zkh\�lsihI^�gnxlZMaIaX`bxly\s}§Qa'y_^�m\®pmC[#z�stz�y\aIZM§#^�gtm�[�©ØyMst`�aQ;t��R�<M¸

£�a�hk[QzlmMsi�paIZ�s}z»yM�vs}m�x¡^�xraIZ�y\�lab^�xlxvg}sihI^�yMst[#z [�©'²l³°´nµ;¶;·7^�z¡�½²l³°´nµ;¶;·)Â�Ã'ÄÅ yM[�y\�la�mMxrahks¥¤¦hI^ «y\s}[Qz)w!mMst`�jlgi^�yMst[#z7^�z¡��§QaIZMs¥¤¦hX^�yMst[Qz-[�©'yM�la�^�jlyM[Q`�^�y\sih{hk[QzpyMZM[QgCmMopmMy\aI` [�©�^ xr[�¯�aIZ�yMZk^�zlm¬©°[#Z\`baIZm\y_^�y\st[#z)¸C=±y{hk[Qz¡hkaIZ\zlm�yM�la�Z\aImMxr[#zvmMa�yM[�aXg}a�hkyMZ\sªh��pak©­^�jlgtyMm�[Qz�yM�la�gts}zvaIm'yMZ_^�§QaIZMm\stzl]7sty�¸8=±y�stzp§#[#gt§QaImhk[Q`bxlgtakÀ�stzpyMaIZk^#hky\s}[Qzlm�qraIy±¯%aIaIzÇhk[#`�`�jlzlsihI^�yMstzl]�^�jlyM[Q`�^�y_^lwrstzpyMaIZ\ZMjlxvyMst[#z-^�z¡��xlZ\aIaI`�xlyMst[#z»qrak«�¡^�§pst[#Z\mw9yMst`baIZ\mb^�z¡� yMst`baI[QjlyMm�w!ZMa^QhkyMst§psty±o¼yM[-a�À�y\aIZMzr^�g'aI§#aXz�y\mw7B#B�B�¹C�va�©°jlz¡h�yMst[#z¡^�gts}y±o�[�©�yM�la

únú åVU�W�X�W �

Page 7: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

� � ����������4�����51 ���M��� ��V���$���!23�$�"������4������%� ��� �3���

hk[QzpyMZM[Qgtg}aXZ�stm�y\[{�¡^�z¡�pgtaCyM�va�stzpyMaXZMZMjvxlyMst[#z�[�©ØhkjlZ\ZMaIzpywvyM�laFZMa��s}Z\ahky\s}[Qz�[�©)mMjvxlxlgto{m\[#jlZkhkaIm�w¡^�zr��yM�laZ\ak«­aXmMy_^�qlgtstmM�l`�aIzpy{[�©�hkjlZ\ZMaIzpy�©°[Qgtg}[�¯Cstzl]�^�z�s}zpy\aIZMZ\jlxlyMst[Qz)¸!¹C�lab[Qq#~kahky\st§#a�stm��p[Qjlqlgta#ºnxlZM[QyMah�yMstzl]y\�la�h�[#`bxr[#zvaIzpyMmC[�©�y\�la{y\Z_^�zlm±©°[QZM`�aIZCstyMmMaXg¨©kw¡^�zr��`bstzlst`�s AXs}zv]�yM�la��pak©­^�jlgtyWstz�yM�la{��s}m\yMZ\s}qvjlyMst[#z�[�©xr[�¯�aXZ{stz»yMaIZ\`bm�[�© �pjvZ_^�y\st[#z-^�zr��m\sNAXab[�©Wy\�la�stzpyMaIZ\ZMjlxly\a��m\jlqp«±zlaIy±¯%[#Z\®¦¸n¹C�la�aIgtahkyMZ\sihb�pak©±^�jlgtyMmhI^�z�q¡aW��aIyMah�yMa��qpo�mMaXzlmM[QZMm�Tpy\�laWhk[Qz�y\ZM[Qg}gtaIZ9�¡^�m�y\[��pstmMyMstzl]QstmM��q¡aIy±¯%aIaIz�mMaI§QaIZ_^�g¡y±opxraIm�[�©ß�pa�©­^�jlgty\mw^�z¡��qraIy±¯�aXaIz�yMZk^�zlm\s}aXz�y�^�z¡��xraIZMm\s}m\yMaIzpy�[QzlaIm�¸¡¹C�vs}m'm\aIgtahkyMst[Qz�stz�§Q[#gt§#aXm�^�xvZM[#y\[lhk[#g±wl¯Csty\�7^bhkolhkgta[�©9^�yMy\aI`bxly\m�^�yCyMZ\a^�y\s}zv]�yM�la��pak©±^�jlgtyCstzbZ\a^#hky\st[#z�y\[{xraIZ_h�aIst§#a� aI§#aXz�y\m¸=±z yM�la�ZMaI`�^�stz¡�paXZW[�©%yM�lstm'x¡^�xraIZ�w;yM�la�mMopz¡h\�lZ\[#zl[Qjlm{^�xlxlZM[p^#h\��y\[�Z\a^�g!y\s}`�a�mMopm\yMaI`�m�^�zr��styMm

xlZ\[#]QZ_^�`�`bstzl]F`baIy\�l[l�p[#gt[#]Qo{^�Z\a'xlZMaIm\aIzpyMa� stz�yM�la'gtst]#�py%[�©)yM�va�^�xlxlgtsihI^�y\st[#z)¸3> ��aIy_^�s}gta��^#hIh�[#jlzpy[�©�yM�va�xr[�¯%aIZ�mMopmMy\aI` s}y\mMaIg¥© ;t�I�#<Wstm�[#jly\mMsi�pa�yM�la�mkhk[#xra�[�©Wy\�lstm�x¡^�xraIZ�¸��pah�yMst[#zÇc xlZMaIm\aIzpyMm�yM�la²l³°´nµ;¶;·�gª^�zl]#jr^�]#a'^�z¡��y\�la'yMst`baFs}zpy\aIZM§#^�g}mC^�zr�byk^�m\®�mC[�©�²l³°´nµ;¶;·nÂ�Ã'ÄÅ ¸ �pahky\st[#z���]Qst§#aImW^�]QaIzlaIZk^�g�paXm_hkZ\s}xvyMst[#z�[�©lyM�la�xr[�¯%aIZ)y\Z_^�zvm±©°[QZM`baXZ;mMy_^�yMst[#z�^�z¡�FyM�la�qraI�¡^�§pst[#Zn[�©p[#zla�[�©ls}y\m)hkaIgtgtmw�^�z¡����aIy_^�s}gtm;styMmm\x¡ah�s¨¤;hI^�y\s}[Qz�stz»²l³°´nµ;¶;·�^�zr��²l³Á´)µ;¶;·nÂ�Ã'ÄÅ ¸p¹C�la�§#aXZMs¥¤¦hI^�yMst[#z�`baXyM�l[l�pmC^�m\mM[lhksi^�y\a��¯CstyM�»²l³°´nµ;¶;·stmC�paIm_h�ZMstq¡a���stz��pah�yMst[#z��¡wp^�zr��styMmC^�xlxvg}sihI^�yMst[#z�y\[{y\�la'mMxrahks¥¤¦hI^�yMst[#z�stz���ahkyMst[Qz��l¸��Fstm_h�jlmMm\s}[Qzb[QzZ\aImMjlgty\m�^�zr�bZ\aIgi^�y\a��¯%[#ZM®�stmC]Qs}§QaIzbstz��pah�yMst[#z%Rl¸

� 0����� n���������9"���")�� � �'�����7"�� ,�����)������� %��2����� � ����� �I�� ���������� 9�"*�&% � �������������

!�"$# %'&)( T!L+*'DC?�, (.-�/)0.1�2+3�4�06587)0.1�0.9;:�3=<?>�(.0@5A9�1B2$C�(D5$0@4)E�/�06EF(

²l³°´nµ;¶;·%;t�#�P<;stm�^�mMopz¡h\�lZ\[#zl[QjlmCZMa�^�g¥«­y\st`ba%gª^�zl]#jr^�]#aQw#�l^�yk^'¿r[�¯Ç[#Z\s}aXz�y\a�'?��HG$�IGJ�¡�pah�gª^�Z_^�yMst§#a�@Xwpqljlstgty^�ZM[#jvz¡�{^F`�s}zvs}`�^�g�®#aIZ\zlaIgr[�©¡[Qx¡aXZ_^�y\[#Z\m¸Q¹C�lstmØgi^�zl]#j¡^�]#a�`�^�zlstxljvgª^�yMaIm;m\st]#z¡^�g}m�w�¯C�lsihM��^�Z\aCjlzpq¡[Qjlzp«�pa���mMaXZMstaIm�[�©Cy±opx¡a���§#^�gtjlaXmw;¯CstyM�-^�z-^�m\mM[lhksi^�y\a�-hkgt[lh\® ��aIyMaIZ\`bstzlstzl]�yM�va�mMaIy�[�©�stzlm\y_^�zpy\m�¯C�laIz§#^�g}jvaImW^�Z\aWxlZ\aImMaIzpy�¸¦Æv[#Z%stzlmMyk^�z¡h�a#w¡^�mMst]#zr^�g Kb�paIzl[QyMaImFyM�la'mMa�u#jvaIz¡hka�?MLN"@ANAO�P�[�©��v^�y_^�stz¡�pakÀla��qpoy\s}`�a�QCstz�^�yMst`�a��p[Q`�^�stz8R�¸S�pst]Qz¡^�gtm%[�©�^�m\x¡a�hksi^�g)®pstz¡��hI^�gtgta�UTWVST�X�Yb^�Z\a�hM�r^�Z_^QhkyMaXZMs(AIa� [#zlgto�qpoy\�laIstZWhkgt[lhM® �HG$�IGJ�¡y\�laIstZCxlZ\aImMaIzrhka#¸8S'st§#aIz�^�mMst]#zr^�g K¦wpsty\mWhkgt[�h\®�s}m%zl[QyMa��^�m�TWV T�X�YZK;w#`�a^�zlstzl]�yM�laaI§QaIzpy�xvZMaIm\aIzpy�m\s}`�jvg}yk^�zlaX[#jlm\g}o'¯CstyM�8K;¸�¹C�la'hk[#zlm\yMZ\j¡hkyMm%[�©)y\�laCgi^�zl]Qj¡^�]Qa�hX^�z�qraCjlmMa�*stz�^�z�auQj¡^�«y\s}[Qz¡^�g!m\y±o�gta�y\[�mMxrahks¥©°o�y\�la{Z\aIgi^�y\s}[Qzlm'q¡aXy±¯�aIaXz7m\s}]Qz¡^�gtm �HG$�IGJ�)qraIy±¯�aXaIz�yM�laXs}Z'§#^�g}jvaIm�^�z¡��qraIy±¯�aXaIzy\�laIstZ�hkgt[lh\®pm¸=�popmMy\aI`bmC[�©�a�u#jr^�yMst[QzlmW[Qz�m\st]#z¡^�g}mW^�ZMa�qvjlstg}yCjvmMstzl]b^�hk[Q`bxr[#mMsty\s}[Qz�hk[QzlmMy\ZMj¡h�y¸[�'^�yk^¿¡[�¯ ^�xlxlgtsihI^�yMst[#zlm�^�ZMa�^QhkyMst§pstyMstaIm�a�À�a�hkjlyMa���[�§#aIZ%^�m\aIy�[�©)stzlmMyk^�zpyMm%stz�yMst`ba#ºQ^�y�a^Qh\�bstzlmMyk^�zpywQstzlxljly�l^�y_^�stmC^#hIuQjlstZMa���©°ZM[Q`�yM�va�a�À�a�hkjlyMst[Qz�aIzp§ps}Z\[#zl`�aIzpy¸\FjlyMxljvyC§#^�gtjlaImW^�ZMa'xlZM[l�pjrhka��^QhIhk[#Zk�pstzl]�yM[y\�la�mMopm\yMaI`([�©ØauQj¡^�yMst[#zlmWh�[#zlm\sª��aIZMa� ^�mW^�zlaIy±¯%[#Z\®b[�©Ø[#xraIZk^�yMst[Qzlm¸

È�Ép�W]!É31nÍ�^%�;_!É 1Á��]@`'�!��`rÉ aU¹C�laC®#aXZMzlaIgr[�©;yM�va�²l³°´nµ;¶;·�gi^�zv]#j¡^�]#a%s}m9q¡^�m\a��[#z�©°[QjlZ![#xraIZ_^�yMst[#zvmw�pa�¤¡zlstzl]�xlZ\s}`�styMst§#aCxlZ\[lhkaImMm\aImwn^�z¡��^�hk[#`�x¡[QmMstyMst[#z�[Qx¡aXZ_^�y\st[#z�yM[�qljvs}gi�*`b[#Z\aWaIgi^�q¡[QZ_^�y\a'[#zlaIm�¸

bdc 2����5���$�����W^�ZMa'stzlmMyk^�zpy_^�zlaI[#jvmWyMZk^�zlm¬©°[#Z\`�^�yMst[#zlm9[#z�yM�la��l^�yk^l¸lÆv[#ZCakÀ¡^�`�xlgta#wpyM�va���ak¤¡zlstyMst[Qz[�©�^�mMst]#z¡^�g=e N q�o�yM�la�©°jlz¡hky\st[#z�fnº

g Q;hie N@j f ?lknm+o;h$kqprosh#B#B�Bsh$kuto�@

øiùnú)øiû

Page 8: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

��������� ��� ����������������� ��� ��������������� ������ ���!���"�#���$���%�&�'���(������)*�����+���,�-����)iÂ�Ã*� �

stmC¯CZMstyMy\aIz�stz�²l³°´nµ;¶;·rº���������� � ����������������� ��¸p¹C�la�m\s}]Qz¡^�gtm��;w�K��pwNB#B#BMw�K X�^�ZMa�Z\auQjlstZMa�yM[��¡^�§Qa'yM�la'm_^�`ba'hkgt[�h\®;¸

b � ��)N�������$���7[�©�^ mMst]#zr^�g�K=^QhIhk[QZ_�pstzl]»yM[-^ q¡[p[Qg}a�^�z=h�[#z¡�psty\s}[Qz��½s}m�º �"!�# K%$'&=T;X(�r¸!¹C�la[#xraIZ_^�z¡�pm�^�z¡�»y\�labZ\aImMjvg}y��p[�zv[#y�]QaIzlaIZk^�gtgto7�¡^�§Qa�si�paIzpyMsihI^�g�hkgt[lh\®;¸6�pst]Qz¡^�g)�»stm�xlZ\aImMaIzpy�s¥©^�z¡��[Qzlgto�s¨©@K�^�z¡����^�ZMa'xlZ\aImMaXz�y�^�y�y\�la�m_^�`baFyMst`baW^�z¡�*���¡^�mCyM�la'§#^�gtjla�Y,+�-=T�Tp¯C�laIz*��s}mxlZMaXmMaIzpywrstyMmC§#^�gtjlaWstmCyM�r^�yC[�©@K;¸

b/. �5� ����� � ���(�����$�7����� ���Xº�01!2# K43 T65 76-�8 Y9���pa�¤¡zlaIm'yM�va�jlzlst[#z�[�©�y±¯%[{m\s}]Qz¡^�gtmC[�©ØyM�va�m_^�`bay±opx¡a#¸p¹C�va�hkgt[lh\®�[�©:0�stm�yM�va�jvzlst[#z�[�©)y\�¡^�y%[�©[Kb^�z¡��yM�r^�y%[�©;�;¸#¹C�va�§#^�gtjlaC[�©:0�stm�y\�la'§#^�gtjla[�©@Kb¯C�laIz�styCstmCxlZMaXmMaIzpywr[QZCyM�¡^�yC[�©:��s¥©!s}yCstmCxlZ\aImMaXz�y'^�z¡�nK�s}m%zl[Qy¸

b/. ��)N���w¡^=<_��o�zr^�`bsih�>�xlZ\[�h�aImMm']#st§pstzl]{^QhIhkaIm\m�yM[�x¡^�mMyC§#^�g}jvaImC[�©�^�mMst]Qz¡^�g±¸lÆv[#ZCakÀ¡^�`�xlgta#wQyM�laauQj¡^�y\st[#z)º?�k N�j k N2@ mwv¯Cs}y\��stzlstyMsi^�gr§#^�gtjlaBA C��pak¤rzlaIm�^b�popz¡^�`bsihCxvZM[lhkaIm\m¸M=±yWstmCaIz¡h�[���a�qpo¦º,0 KD!�# K E�ǯCstyM��stzlstyMsi^�gts(A^�y\st[#zF0 K�G�X�G YIHKJr¸ ��s}]Qz¡^�gtm@K�^�z¡�L0 K��¡^�§#a%yM�laFm_^�`baChkgt[�h\®;¸�FaIZMst§#a��-[Qx¡aXZ_^�y\[#Z\mbstz¡hkgtj¡�pa��paXgª^�o�[Qz�M stzlmMyk^�zpyMm'?NE'O @Xw�^�z¡�¼^P$G;X 3 Q'$4R�[#xraIZk^�yMst[Qz=]Qs¥«§ps}zv].^QhIhkaIm\m{y\[7^�¯C�l[#gta�¯Cstz¡�p[�¯R[�©�xr^�mMy�§#^�gtjlaIm ?i©ÁZM[#` stzlmMyk^�zpyMm�Q�S�T�yM[nQ�@Iwn^�m�¯%aIgtg�^�mhk[#`�qvs}zr^�yMst[Qzlm�[�©!q¡[QyM��[#xraIZk^�yM[QZMm�¸

bVU ��� � �-���(� � ���C[�©¡xlZM[lhkaXmMmMaXm�stm!yM�laC^�m\mM[lhksi^�y\st§#a�^�z¡��hk[Q`b`�jlyk^�yMst§Qa)[#xraIZk^�yM[QZW<XY>'�paIzl[QyMstzl]FyM�lajlzlst[#z�[�©¡y\�la�jvz¡�paIZ\g}opstzl]FmMopmMy\aI`bmn[�©¡auQj¡^�yMst[#zvm¸#=±z�²l³°´nµ;¶;·¡w�s}ynstm)¯CZMsty\yMaIz)º[Z\X^] m X*] p X�_#w©°[#ZFxlZM[lhkaXmMmMaXm`] m ^�z¡�a] p ¸M=±y�hI^�z7qra{stzpyMaXZMxlZ\aIyMa��^�mWx¡^�Z_^�g}gtaIgtstmM`2¯CstyM��m\st]#z¡^�g}mFmMjlxvx¡[QZMyMstzl]stzlmMyk^�zpy_^�zlaI[#jvmWhk[#`�`�jlzlsihI^�y\st[#z�q¡aIy±¯%aIaIz xlZM[lhkaIm\mMaIm�¸

b�Ép�6cYdrÉlÎn^MÉp�l� �Ø��Él�%��]�Î�É,e;� ��f�1ÁÉ a �FaIZ\s}§Qa��xlZM[lhkaIm\mMaImC�r^�§#a%q¡aIaXzb�pak¤¡zla���©°ZM[Q` yM�laCxlZ\st`bstyMst§#a[Qx¡aIZk^�y\[#ZMm�wlxlZ\[�§psª��s}zv]{xlZ\[#]QZ_^�`�`bs¥zl]�hk[Q`�©°[QZMy�¸hgC¸ ]r¸}wQyM�va�stzlm\yMZ\j¡hkyMst[Qzji6k X�l�&K+ Qnm;K)o��p�w�¯C�vsªh\��mMxrak«hks¥¤¡aXm�yM�la�mMopz¡h\�lZM[Qzls(A^�y\st[#z�[�©Wm\st]#z¡^�g}m K ^�z¡�=�8T;$'&=T�Xq��]Qst§�stzl]�y\�la�hkgt[lh\®�[�©W[lhIhkjvZMZMaXz¡hkaIm�[�©r�^�y�yM�la�§#^�gtjlauY,+'-=T�T=K�lT�8h8/s7¯C�lsih\�»`baI`�[#ZMs(AIaXmW§#^�gtjlaXm�[�©�K7^�zr�»[#jly\xljlyMm�yM�laI` ^�g}m\[�¯C�laIz�sstm�yMZMjva�T!yM�la�akÀlxlZMaXmMmMst[Qz/�1!2#It4u»stm�^�h�[#jlzpyMaXZ�[�©C[�hXhkjlZMZ\aIz¡hkaXm�[�©WaI§#aXz�yBu»q¡aI�r^�§�stzl]»gtst®#a�yM�laakÀ¡^�`bxlgta']#st§#aXz�~�jlmMyFq¡aIgt[�¯�¸ >WZMZk^�opm�[�©�mMst]#z¡^�gtmW^�z¡��[�©%xlZM[lhkaIm\mMaIm��¡^�§#a�qraIaIz»stzpyMZM[l�pjrhka��^�mW¯%aIgtg­¸v s}aXZ_^�Zkh\��opwn`b[l�pjlgi^�Z\sty±o�^�zr��Z\ak«­jvmMab[�©�xvZM[lhkaIm\mMaIm�^�ZMa�m\jlxlxr[#Z\yMa�½q�o yM�la�xr[#m\mMstqlstgts}y±o [�©W�pak¤¡zlstzl]xlZ\[lhkaImMm'`�[���aIgtmwp^�z¡��stzp§#[#®pstzl]�stzlm\y_^�z¡hkaIm�¸>Fz-akÀ¡^�`bxlgta�[�©�^½²l³°´nµ;¶;·7xlZ\[lhkaImMm�stm{y\�la�©°[Qgtg}[�¯Cstzl]�hk[#jvz�y\aIZ�z¡^�`ba���,wyx Ohz ?°¯C�vsªh\�¾s}m�yM�la

akÀlx¡^�z¡�pa��©°[#Z\`�[�©!yM�la{��aIZMst§#a��b[Qx¡aXZ_^�y\st[#za�D!�#9t%u�@Iº{ + QnlT,ihi9�hwyx O,z #4m'|:u~},� pZ�X���!�#40,�h��X�0,��!2#I�hE�X*i6k X�l�& + Qnm�� o�upX�_

$'&=T6+ST90h�qG;X�GWY(JT;X 3

=±yF�¡^�mF[#zla�stzlxvjlyWm\s}]Qz¡^�g�u;w¡^�zr��^�z�[#jvyMxljly�u;¸l¹C�la�§#^�gtjla'[�©�y\�la{hk[QjlzpyMaIZ'stmr�rw¡^�z¡��styCstm��pa�¤¡zla�^�mCyM�la'xlZ\aI§ps}[QjlmC§#^�gtjla�0,��s}zrhkZMaI`�aIzpyMa��qpo�[#zva#¸p¹C�la'xlZMaX§�st[QjlmC§#^�gtjla�0h��stmC�pahkgi^�ZMa��gt[lhI^�g}gtopw#^�zr�

únú åVU�W�X�W �

Page 9: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

R � ����������4�����51 ���M��� ��V���$���!23�$�"������4������%� ��� �3���

Ænst]#jvZMa��#º�>Rhk[QjlzpyMaIZFstz7²l³Á´)µ;¶;·r¸

�pa�¤¡zla� jlmMstzl]�y\�la��paIgi^�ob[Qx¡aXZ_^�y\[#ZF[#z�mMst]#zr^�g;�MTpstyMmCstzlstyMsi^�g;§#^�gtjlaWstmCyM�va�x¡^�Zk^�`�aIyMaIZ H Jr¸�=±yWhk[QjlzpyMmy\�la{[lhIh�jlZMZ\aIz¡hkaIm�[�©%yM�la�stzlxvjlyWaI§QaIzpy�u¦ºry\�lstmWstmW[Qqly_^�s}zva��q�o�m\o�zrhM�vZM[#zvsNAXs}zv]byM�va{xlZ\aImMaXz¡hkab[�©�yM�lahk[QjlzpyMaIZ�w;^�z¡�*q�o�yM�lstmCy\�la�stz¡hkZ\aI`baIzpyk^�yMst[Qzb[#xraIZk^�yMst[QzbstyMm\g}a�©_wp¯CstyM��yM�la'[lhIhkjvZMZMaXz¡hkaIm�[�©)u¦¸

�'��Í `r��� � ��cl]@`�É ]�d�c°��Í ]���É])�Wa(¹C�la�²l³°´nµ;¶;·bhk[#`�xlstg}aXZ�x¡aXZ±©°[QZM`bm9yM�la�^�zr^�gtopmMstm�[�©)y\�la�hk[#zvmMstm±«y\aIz¡hko»[�©CyM�la�mMopm\yMaI`H[�©CauQj¡^�yMst[#zlm�w;^�z¡�»�paIy\aIZM`�s}zvaIm'¯C�laIyM�vaIZ{y\�la�mMopz¡h\�lZM[Qzls(A^�y\st[#z�hk[#zlm\yMZk^�stzpyMmqraIy±¯%aIaIz-y\�labhkgt[lh\®�m�[�©CmMst]#z¡^�gtm�^�ZMa�§QaIZMs¥¤¡a�»[QZ�zl[Qy¸8=±y'stm'q¡^�m\a��[Qz ^�z7stzpyMaIZ\z¡^�g9ZMaIxlZ\aImMaXz�yk^�y\s}[Qz©°a�^�yMjvZMstzl]�^�]#Zk^�xl�»[�©W�l^�y_^��paIxraIz¡�paXz¡hkstaIm�qraIy±¯�aXaIz-[Qx¡aIZk^�y\s}[Qzlmwn^�jl]Q`baIzpyMa���¯CstyM�»yMaI`�x¡[QZ_^�g9s}z�«©°[QZM`�^�yMst[Qz�hk[Q`bstzl]'©ÁZM[#`4y\�la�hkgt[�h\®�hI^�gihkjlgtjlm�¸�=Á©Øy\�la'xlZM[Q]#Z_^�`�stm�h�[#zlm\yMZ_^�stzla��mM[b^�m�y\[�hk[Q`bxljvyMa�^�paXyMaIZ\`bstzlstmMy\sªhFm\[#gtjlyMst[Qz)wpyM�laXz�akÀlahkjlyk^�qlgta{h�[���a�?°stz�� [#Z����8G�E8G;¶;µJ@WhI^�z�q¡a{^�jlyM[Q`�^�yMsihI^�gtgto�xlZ\[�«�pjrhka�;¸9¹C�la�hk[Q`bxlgtaIy\abxlZ\[#]QZ_^�`�`bs¥zl]baIzp§pstZM[Qzl`baIzpy{^�gtmM[7hk[Qzpy_^�stzlm�^ ]#Z_^�xl�lsihI^�g­wnqlgt[lh\®#«M�psi^�]QZ_^�`[QZMstaIzpyMa�¾jlm\aIZ�stzpyMaIZ¬©­^#hka�¯C�laXZMa�xlZM[lhkaXmMmMaXm.^�ZMa�q¡[�ÀlaIm�gts}zv®#a�½q�o�¯CstZ\aIm{Z\aIxlZ\aImMaIzpy\s}zv]-mMst]Qz¡^�gtmw!^�mstgtgtjlmMy\Z_^�y\a��stz�Ænst]#jlZ\a��Q¸

¹C�vab²l³°´nµ;¶;·�aXz�§pstZM[Qzl`baXz�y'^�gtmM[�stz¡hkgtj¡�paIm�^ �M���#��:��#���"���{w;y\[�§#aIZ\s¨©Áo7�popz¡^�`�sihWxvZM[#xraIZ\yMstaIm�[�©xlZ\[#]QZ_^�`�mw;stzp§#[Qgt§�stzl]�mMyk^�yMa�stzp©°[QZM`�^�yMst[Qz4?Ástz�yM�la��paIgi^�o#a�½mMst]#zr^�gtm�@�^�z¡�»yMZk^�zlm\styMst[#zlm�s}z¾ZMa^QhkyMst[Qzy\[�[lhIh�jlZMZ\aIz¡hkaIm�[�©�[QyM�laXZ�mMst]#zr^�gtm¸�vCaXz¡hka#wnsty�stm'xr[#mMm\stqlgta{y\[b©Á[#ZM`�^�gtgto�mMxrahks¥©°o�^�z¡� §#aXZMs¥©°o�yM�la�mk^�«y\s}m¬©­^#h�yMst[#z�[�©��popz¡^�`bsihI^�g;xvZM[#xraIZ\yMstaIm�[�©�y\�la�q¡aI�r^�§�st[QZMm¸r¹C�lstm�^�m\x¡a�hky'¯Cs}gtgnq¡a��paIyk^�stgta��stz��pah�yMst[#z�r¸

!�" ! %80�� ��>�([(.C���1�2+3F4 2$4 T!L+*'DC? ,�������²l³°´nµ;¶;·nÂ�Ã'ÄÅ s}m%^�Z\ahkaIzpyCakÀlyMaXzlmMst[#z�yM[�²l³°´nµ;¶;·¡wQ�¡^�zr�pgts}zv]�y_^�mM®pm�a�À�a�hkjlyMstzl]�[#z�yMst`ba%stzpyMaIZ\§#^�gtm�^�zr�y\�laIstZCmMauQjlaXz¡hkstzl]4;t�#R�<¬¸Q¹C�la'stzpyMaIZ\aImMyC[�©ØyM�vs}mCstm%yM�¡^�y��v^�y_^�¿¡[�¯ ^�z¡��m\auQjlaIz¡h�s}zv]�^�m\x¡a�hkyMm'^�ZMa'qr[#y\�aIzrhk[#`�x¡^�m\mMa�¾stz-y\�la�m_^�`�abgi^�zv]#j¡^�]#a�©°Zk^�`baX¯�[QZM®;w)y\�pjlm�ZMaIgtopstzl]»[#z-y\�la�m_^�`ba�`b[l�paXg�©°[QZ{y\�laIstZakÀlah�jlyMst[#z»^�z¡��^�zr^�gtopmMstm7?i©°[QZ�y\�la{hk[Q`bxlstgi^�y\st[#z�^�z¡��§#aXZMs¥¤¦hI^�yMst[#z�[�©�hk[QZMZ\ahkyMzvaImMm�[�©ØxlZ\[#]QZ_^�`�m�@X¸�=±zy\�lstm�^�xvxlZM[p^#h\�)w;^b�l^�y_^�¿¡[�¯R^�xlxlgtsihI^�y\st[#z�stm�hk[QzlmMsi�paIZ\a� yM[bqra�akÀlahkjly\a��©ÁZM[#`U^�z�stzlstyMsi^�g;m\y_^�yMa�[�©styMmF`baI`�[#Z\o{^�y'^�z�stzlstyMsi^�grstzlmMyk^�zpy��%wl¯C�lsih\��s}mCqrak©°[QZMa�y\�la'¤¡Z\mMyFaI§#aIzpyF[�©�yM�la�ZMa^QhkyMst§#a�akÀlahkjly\s}[Qz)¸>R�l^�y_^�¿¡[�¯ÇxlZ\[lhkaImMmF�¡^�mCzv[{y\aIZM`�s}zr^�yMst[Qz�mMxrahks¥¤¡a��stz�s}y\mMaIg¥©_ºQyM�vaIZMak©Á[#ZMa�s}y\m�aXz¡��^�yCstzlmMyk^�zpy�� hI^�z[Qzlgto�q¡aC�pah�sª��a��stz{Z\a^#hky\st[#z�yM['akÀlyMaIZ\z¡^�gvaI§#aIzpy\m�[#Z!yM�vaCZMa^QhM�vs}zv]�[�©¡]#st§QaIz{§#^�gtjlaIm¸6v aIz¡hka��7stmØxr^�ZMy

øiùnú)øiû

Page 10: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

��������� ��� ����������������� ��� ��������������� ������ ���!���"�#���$���%�&�'���(������)*�����+���,�-����)iÂ�Ã*� �

� � �K ����� ��������� ����

l�8,Qni T��Q { T�X�� � � �

��

� �

K�G�X�K(Qy-�Y�

��

��

���

� �

Ænst]#jlZ\a�cvºp¹Cst`baCstzpyMaIZ\§#^�gtmCmMjlq�«¬�pst§psi�pstzl]�y\s}`�a#¸

[�©�y\�la{a�À�a�hkjlyMst[Qz)wØ^�z¡��y\�la�yMst`ba�s}zpy\aIZM§#^�gØ[Qz7¯C�vsªh\��y\�lab^�xvxlgtsªhX^�yMst[Qz�akÀlahkjly\aIm�s}m'y\�la{gtak©Áy±«±[#xraIz)wZ\s}]Q�py±«Mhkgt[#mMa��bstzpyMaXZM§#^�g�� ��o � �¦¸

��c ��É4cM])��Ép�6d�� 1­� a(¹C�laIo-^�Z\a�s}zpy\ZM[l�pj¡hka��-stz¾[#Z_��aIZ�yM[»aIz¡^�qlgta�y\�la�mMy\ZMj¡hky\jlZMa��Ç�pahk[Q`bxr[#m\s}y\st[#z[�©�y\�labstzpyMaIZ\§#^�g � ��o � ��stz�y\[�mMjlqp«±stzpyMaIZ\§#^�gtm�^�m�stgtgtjlmMy\Z_^�y\a� s}z ¤¡]r¸)clw)^�z¡�»yM�vaIstZ{^�m\mM[lhksi^�y\s}[Qz7¯Csty\�xlZ\[lhkaImMm\aIm ;t��R�<M¸6��j¡h\�=^�m\jlqp«±s}zpy\aIZM§#^�g���stm{�paXg}st`�s}y\a� q�o�[lhIh�jlZMZ\aIz¡hkaIm�[�©Wq¡[Qjlz¡�pstzl]�aX§#aIzpyMmLs�^�yy\�labqraI]#stzlzvs}zv]7^�z¡�=u�^�y�yM�vabaIz¡�߸J=±y��r^�m�yM�la�§#^�gtjla*G�X�ihG63 TbqraIy±¯%aIaIz¼yM�la�zvakÀly{[lhIhkjvZMZMaXz¡hka�[�©s�^�zr��yM�la�zlakÀly'[lhIhkjlZ\ZMaIzrhka�[�© u;wr^�z¡�aQy-�Yi,G�3 T�[#yM�vaIZM¯CstmMaQ¸�=±y'�¡^�m�^�z�stzlstyMsi^�g;§#^�g}jva���J0?�G�X�i,G63ST[QZ Qy-�Y�i,G63 T�@I¸n¹C�lstmbstm�¯CZMstyMy\aIz)º�� !�#��hs)o*u���G�X�GWY��Jr¸ ;st®Qa�� ��o � �¦w!m\jlqp«±stz�y\aIZM§#^�gtmb^�ZMa g}a�©°y±«[Qx¡aIz ^�z¡�¾ZMst]Q��y¬«¬h�g}[QmMa�߸�¹C�lstmbh\�l[#sihka�stmbhk[Q�laIZMaXz�y�¯CstyM�¼y\�la�qraI�¡^�§pst[#Z�akÀlx¡ah�yMa� ©°Z\[#` Z\a^#h�yMst§#a^�jlyM[Q`�^�yk^lº�^FyMZk^�zlm\s}y\st[#z�stm�`�^Q�pa�^QhIhk[#Zk�pstzl]�y\[{^FZMahkaXs}§Qa��aI§#aXz�y9[�hXhkjlZMZ\aIz¡hka�^�z¡��^'hkjlZ\ZMaIzpyCm\y_^�y\a#w¯C�lsih\��ZMaIm\jlgtyMmCstz�^�zvaI¯ m\y_^�yMa#¸ v aIz¡hka#wry\�la's}zvmMy_^�zpy�¯C�laXZMa�y\�la'aI§#aIzpyC[lhIhkjvZMmWqraIgt[#zv]#mCyM[�yM�va�y\st`bastzpyMaIZ\§#^�gr[�©)y\�la�hkjlZMZ\aIzpyCmMyk^�yMaQwpzl[#y%yM[�yM�¡^�y�[�©!yM�laFzlaI¯Çm\y_^�yMa#¸p¹C�laF[#xraIZ_^�yM[QZ�lyQ�� { 8����pak¤¡zlaXmCyM�lahk[Q`bxlgtaI`�aIzpy)[�©ß^�z{stzpyMaIZ\§#^�g��lw�¯C�vsªh\��stm G�X\i,G63 TC¯C�laIz��'s}m)Qy-�YihG63 TW^�z¡��Z\ahkstxlZ\[�hX^�gtgto�¸W\Fx¡aXZ_^�y\[#Z\mQ { T�X���^�z¡�*l�8,Qni T���ZMaIm\x¡ah�yMst§#aIgto�]#st§QaWyM�va�[Qx¡aXzlstzl]�^�z¡�bh�g}[QmMstzl]�[lhIhkjlZ\ZMaIz¡h�aIm�[�©)y\�la'q¡[Qjlz¡�pstzl]aI§QaIzpyMm�¸ \'hIhkjvZMZMaXz¡hkaImC[�©¦^Cm\s}]Qz¡^�gK'stzlmMsi�pa%stzpyMaIZ\§#^�g��WhI^�z�q¡a%mMaXg}a�hkyMa�*qpo K G�X��lw�^�z¡��ZMah�s}xvZM[lhI^�gtgto[QjlyMm\sª��a�qpoqKqQy-�Y�l¸�=±z�yM�lstm%©°Zk^�`baX¯�[QZM®;whQ { T�X���stm sqQy-�Y�lwl^�zr�al�8,QniT���stm uFG�X��l¸

�9�¡���)�Wa ¹C�laXo=hk[QzlmMstmMy�stz¼^�mMm\[lhksi^�yMstzl]�^ ?°m\jlq�@¬xlZM[phkaImMm�[�©WyM�la�^�xvxlgtsªhX^�yMst[Qz-¯CstyM�¼^ ?ÁmMjlq�@\stzly\aIZ±«§#^�gW[�©�� ��o � �¼[#zǯC�lsih\�Çstybstm�akÀlahkjly\a�;¸F¹ØZk^#�psty\s}[Qz¡^�gCxvZM[lhkaIm\mMaIm»stz ²l³Á´)µ;¶;·Ç^�ZMa»y_^�m\®pm.^QhkyMst§Qa[Qz�� ��o � �;º)y\�laIo�^�ZMa � �������(���"�����%yM�lZ\[#jl]Q�l[#jvy�yM�la�¯C�l[#gtab^�xlxlgtsihI^�y\s}[Qz)¸M=±zlmMsi�pa�yM�la�y_^�mM®»s}zpy\aIZM§#^�g­wy\�la�y_^�mM®¼xlZ\[�h�aImMm�stmb^#hky\st§#a�s±¸ aQ¸}w!xvZMaIm\aIzpy.^�z¡�¾akÀlahkjly\stzl]-zl[QZM`�^�gtgto�¸=\FjlyMm\si�pa7y\�la�stz�y\aIZM§#^�g±w!yM�laxlZ\[lhkaImMm'stmW^�qvmMaIzpyW^�zr�by\�la�§#^�g}jvaIm�styC®QaIaIxlmFs}z�styMmCstzpyMaIZ\z¡^�gnmMy_^�yMa{^�ZMa'jlz¡^�§#^�stgª^�qlgta#¸�=±z�mM[Q`baFmMaIzlm\asty�s}m�[#jvy�[�©'yMst`ba#wßs}y\m{hkgt[lh\®�q¡aIstzl]�hkjly�¸!¹�^�mM®pm�^�Z\a��pak¤rzla�¾qpo�yM�la�xlZM[lhkaIm\m �»yM[»q¡a�akÀlahkjly\a�;wy\�la�akÀlahkjly\st[#z»s}zpy\aIZM§#^�g!�lw;^�zr��y\�la{m\y_^�ZMyMstzl]�m\y_^�y\a ?±hkjlZ\ZMaIzpywn[#Z'stzlstyMsi^�g,@%¯C�vaIz ?ÁZMak«"@\aIzpyMaIZ\stzl]�yM�lastzpyMaIZ\§#^�g±¸�.[#ZMa%xlZ\ahkstmMaIgtopw�yM�la%gi^�yMy\aIZ)`�a^�zvm)yM�r^�ywX¯C�laIz�ZMak«±aIzpyMaXZMstzl]'yM�la%y_^�mM®'stzpyMaIZ\§#^�g±wIy\�la�xvZM[lhkaIm\mhI^�z7qra�ZMa�«­m\y_^�Z\yMa� ©°ZM[Q`(styMm�hkjlZ\ZMaIzpy�m\y_^�y\ab^�yFyM�la�stzlm\y_^�zpyF¯C�laIZMa�yM�la�y_^�mM®�¯C^�m ��23��� ��������� ?��HG$�IGJ�stz-^�yMaI`�x¡[QZ_^�ZMo�©­^�mM�lst[Qz�@Iº;y\�lstm�stm'¯CZMstyMy\aIz"�(Q X#��¸C>WgtyMaXZMz¡^�yMaIgtopw;sty�hX^�z�qra�ZMak«±mMyk^�ZMy\a�½©°ZM[Q`UstyMmstzlstyMsi^�g#mMyk^�y\aW^�m��pak¤¡zva��qpo�yM�laC�pah�gª^�Z_^�yMst[#zlm![�©¦^�gtgpstyMm!mMyk^�yMa%§#^�Z\si^�qlgtaIm�ws¥©¡y\�laCy_^�mM®�¯C^�m � ���"������2#���"���

únú åVU�W�X�W �

Page 11: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

� � ����������4�����51 ���M��� ��V���$���!23�$�"������4������%� ��� �3���

� � � � � � � � � � � � � � � � � � � � � �� � � � � � � � �� ��� ��� ��� ��� ��� �� �� ��� ��� �� ���� � � � � � � � � � � � � � � � � � � � � ���� � � � � � � � �� ��� ��� ��� ������ � � � � � � � � � � � �

¹�^�qvg}a'�#º�¹ØZk^#hkaXm!©°[#Z!y\�laCy_^�mM®�[�©)hk[#jlzpy\s}zv] g w�[#z�^�z¡��a^QhM��stzpyMaXZM§#^�g = ?°sr`ba�^�zlmns}zvmMsi�pa�T�[rº�[#jvyMmMsi�pa#@I¸

?Á`ba^�zlstzl]¡º�^�qr[#ZMy\a��s}z�^���ak¤¡zlstyMst§Qa!©­^�m\�lst[#z�@Xº ��T�7 l�&��l¸�¹C�la%xlZM[lhkaXmMmMaXmW^�mMm\[lhksi^�yMa���¯CstyM��s}zpy\aIZM§#^�g}mhI^�z�yM�laX`bmMaXg}§QaIm�qrab�pahk[Q`bxr[#m\a�»stz�y\[�mMjlqp«±y_^�mM®pmºnyM�vs}m�¯�^�opwryM�la�m\x¡ah�s¨¤;hI^�y\s}[Qz-[�©91��$����������1��$���C[�©hk[Q`bxlgtakÀbqraI�¡^�§pst[#Z\mCstmCx¡[QmMmMstqlgta#¸

�9�¡�����XÉ�� �!É]� 6cM]@`���]�Î^fØ��ÉpÉ ��f!��cM][`.a =±y;stm)^#h\�lstaI§#a���^�m)^%Z\aImMjlgty![�©lhk[#zvmMyMZk^�stzlstzl]CstzpyMaIZ\§#^�gtm)^�zr�y\�laIstZ�qr[#jvz¡�pstzl]�aI§#aIzpy\mwl^�zr��^�mMm\[lhksi^�yMstzl]�^#hky\s}§pstyMstaIm%yM[�yM�laI` q�obh�[#zlm\yMZMjrhkyMstzl]��lstaIZ_^�Z_h\�lsihI^�g;y_^�m\®pm¸� ������) )N��) �(��� qraIy±¯�aXaIz�mMaX§#aIZk^�g)yk^�m\®�mCstmC[Qqly_^�s}zva��z¡^�yMjlZk^�gtgto�¯C�laIz�y_^�mM®pmCmM�r^�ZMa�yM�la'm_^�`baFs}zpy\aIZM§#^�g­w[QZC[�§#aIZ\gª^�xlxlstzl]�stzpyMaXZM§#^�gtm�¸M� ����2��������&����� �-������y\�laIz�^�`�[#jlzpyMm%yM[�hk[QzlmMy\Z_^�stzlstzl]�yM�va�stzpyMaXZM§#^�gtm%[�©!yM�layk^�mM®pm�wlqpo�hk[QzlmMy\Z_^�s}zvs}zv]�yM�laIstZCqr[#jlzr�pstzl]�aI§#aXz�y\m¸��CmMstzl]�Q X�^�z¡�UTy7nl�&)wl^�mW�pa�¤¡zla��^�q¡[�§Qa#wpaIz¡^�qlgtaImhk[QzpyMZM[Qg![�©�^#hky\st§�sty\s}aXm�^�zr��`b[QZMa'aIgi^�qr[#Zk^�yMa�q¡aI�r^�§�st[QZMm�hX^�z�qra�mMxrahks¥¤¡a��;¸;¹C�lstmW¯C^�opwps}yFstmWxr[#mMm\stqlgtay\[�mMxrahks¥©°o��lstaIZ_^�Z_h\�lsihI^�g;x¡^�Zk^�gtgtaIg;xlgi^#hka! �yMZk^�zlm\styMst[#z�mMopm\yMaI`�m¸

Æv[#Z!akÀ¡^�`bxlgta#w�^'hk[#jvz�y\aIZ%q¡aI�r^�§�stzl]�^�m��pak¤¡zva��xlZ\aI§pst[#jlm\g}o�hI^�z�qraW^�m\mM[lhksi^�y\a��¯CstyM��^�z�stzpyMaXZM§#^�g�lwrstz�y\[�^�y_^�mM®�qraI�¡^�§pstzl]�^�m'stg}gtjlm\yMZk^�yMa���qpo�yM�la�yMZk^#hkaXm�stz7¹�^�qvg}a��#wr¯C�laIZ\a���� !2#I�hwyx O,zm�up Q X�b^�zr� �#"�!�#4�,w6x O,zm�upDT�7nl�&��l¸l£�a�hI^�z7^�gtmM[b��ak¤¡zla{^*y_^�mM®by\�¡^�y'hI^�z q¡a�m\y_^�ZMyMa��;wrmMjlm\x¡aIzr�pa�;wZ\aImMjl`�a�;w#^�z¡�'aIzr�pa� ?°s±¸ a#¸�stzpyMaIZ\ZMjlxly\a��@ ?ÁZMaIm\x¡a�hkyMst§#aXg}aXo�q�o'aI§QaIzpyMm%$)w'ilw�+�^�z¡�8T�@I¸�¹C�lstm!stm�^#h\�lstaI§#a��§QaIZMo�mMst`�xlgto�jlmMstzl]b^�h�[#`�qlstz¡^�yMst[#z�[�©)QWX�^�z¡� T�7 l�&)º

{ + Qnl T,i,i �,w6x O,z,u#&(#m'|�TWV T�X�Y9xX\GWY)o*s)o*u)o(':o)& },�npZ�X Z�X��D!�#4�,wyx O,z�m xX\GWYp Q Xq� �

X�� � !�#%l�Q�� { �X�� !�#��*' o+&��X _dTy7nl�&-,

X., !�#��,s)o*u�� X _$'&=T6+ T4G�XBY T6+V 7h89� �;o��IG;X�GWY(Qy-�YihG63 T;o

,%G�X\GWY(Qy-�Yi,G�3 TT�X 3

¹C�lstm�stm{^�z�akÀ¡^�`�xlgta{[�© ^��vs}aXZ_^�Zkh\��o»[�©Cy_^�mM®pm¸C>�y\Z_^#h�ab[�©�^�hk[QjlzpyMaIZ�hk[Qz�y\ZM[Qg}gta�»stz�y\�lstm�¯�^�o s}m]Qs}§QaIz�stzby_^�qlgta�cl¸=±yCm\�l[�¯CmC�l[�¯ ^�zvaI¯ h�[#jlzpyMaXZWmMyk^�Z\yMmW[Qzba^Qh\��stz�y\aIZM§#^�g���$ oIT �;w#¯C�vs}gtaFq¡aIstzl]�stz¡^QhkyMst§QaWqraIy±¯�aXaIz

m\jlmMxraIzlm\s}[Qz�i�^�z¡��ZMaIm\jl`bstzl]B+;¸¹C�vaCaIz¡hk[l�pstzl]�[�©)yMst`ba9s}zpy\aIZM§#^�g}m%^�z¡��yk^�mM®pm�stzpyM['y\�la�²l³°´nµ;¶;·�®#aIZ\zlaIg*;t��R�<;s}m!st`bxvg}aX`baIzpyMa���^�m�^

xlZ\ak«±xlZM[lhkaIm\mM[QZ{y\[�yM�la�²l³Á´)µ;¶;·�hk[Q`bxlstgtaIZ�wlhI^�gtgta� ²l³°´nµ;¶;·)Â�Ã'ÄÅ ;t� ��<M¸�>WxvxlgtsªhX^�yMst[QzlmC[#y\�laIZ'yM�¡^�z�yM�la[Qzla{�pstm_h�jlmMm\a��stz�yM�lstmCx¡^�x¡aIZ'hk[#zrhkaIZMz�^�z�stz�y\aIZ_^QhkyMst§Qa�ZMak¿rakÀ�]�^�`�a�^�z¡��y\�la�mMa�u#jvaIz¡hkstzl]�[�©�§ps}m\j¡^�gm\aIZM§Q[#stzl]�y_^�mM®pmWstz�^�ZM[#qr[#yC§pstmMst[QzbmMopm\yMaI` ;t���<M¸

øiùnú)øiû

Page 12: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

��������� ��� ����������������� ��� ��������������� ������ ���!���"�#���$���%�&�'���(������)*�����+���,�-����)iÂ�Ã*� �

����� � � � � � � � � � � � � � � � � � � � � � � �� � �� � �� � � �� � �� � � � � � � � � � � � � � � � � � � � � � � � � �

� � ��� � � � � � � � � � � � � � � � � � � � � �� � � � � � � � � � �

¹�^�qlgta�cvºp¹!Z_^#h�aW©Á[#ZCyM�va�yk^�m\®b[�©�hk[#jvz�y\stzl]¡wlhk[QzpyMZM[Qgtg}a��bqpo�aI§#aIzpy\m $)wilw,+�^�zr� Tl¸

� �����������7�W�����"*��"{ �i��� ��"�� �'�(�������� !Q"{�%$&�'�( n���'�%�"��

��"$# �Z([4�([>�0@587)( ���=> 2 ��1�2$3�4�3�� 0 � 3 < ([> 1�>�0@4���� 3�>�C�(.>�� 1B0.1�2+3F4

circuit breaker

Higher Power

Transformer

link circuit breaker

departurecell

linkcell

arrivalcell

departure

arrival circuit breaker

Distribution of the power to the users

Ænst]#jlZ\a��lºp¹C�la'yM[Qx¡[Qgt[#]#o�[�©�^�z�aXg}a�hkyMZ\sªh�x¡[�¯%aIZCyMZk^�zlm¬©°[#Z\`�^�yMst[#z�xr[#m\y¸

��_!É�������]�� ^MÍ¡� ��Ép�{�X��v��cÁÍS]¾ÍS]¼��_!É�É 1ÁÉl ����6c­ 8]!Ép�IÌ�Ír� �@aU¹C�la'xljlZ\x¡[QmMa�[�©�^�zbaXg}a�hkyMZ\sªh�xr[�¯�aIZy\Z_^�zvm±©°[QZM`baXZWmMyk^�y\s}[Qz�stm'yM[bgt[�¯%aIZWy\�la�§#[#gtyk^�]#a'[�©�x¡[�¯%aIZ'mM[�yM�¡^�yWsty�hX^�z»q¡a��pstmMy\ZMstqljly\a��stz�jvZMq¡^�zhkaXz�y\aIZMm�¸r¹C�laW®pstz¡��[�©)y\Z_^�zlm±©°[QZM`�aIZ�¯%a�^�Z\a's}zpy\aIZMaIm\yMa��stz�ZMa�hkaIst§#aImF�lst]#��§Q[#gty_^�]#aCgtstzlaImwp^�zr��mMaI§QaIZ_^�g`�a�pstjl`(§#[Qgty_^�]Qa{gtstzlaIm�hk[Q`ba�[#jly�[�©�sty{^�z¡�7��s}m\yMZ\s}qvjlyMa�xr[�¯�aXZ�yM[�aIz¡��«­jlm\aIZMm%;t�X�#<¬w;^�m�stg}gtjlm\yMZk^�yMa��stz�Æ)st]QjlZMab�v¸¦Æv[#Z'a^Qh\���lst]#�»§#[#gtyk^�]#a�gtstzla#w;^�yMZ_^�zlm±©Á[#ZM`�aIZ'gt[�¯�aIZ\m'yM�la�§Q[#gty_^�]#a#¸M=±z�yM�vabhk[#jlZ\mMa�[�©akÀlxlgt[Qs}yk^�y\s}[Qz-[�©�y\�lstm�mMopmMy\aI`7w!m\aI§#aXZ_^�g'®pstz¡�pm�[�©�aXg}a�hkyMZ\sªhX^�g���ak©­^�jvg}y\mbhI^�z [�hXhkjlZ%?ÁyM�lZ\aIa�y±opxraImb[�©aIgtah�yMZMsihI^�g���ak©­^�jvg}y\m{^�Z\a�h�[#zlm\sª��aIZMa�ߺ!xl�¡^�m\a ���¦wr�l[Q`b[Qx¡[Qgª^�Z��;w;[#Z'¯C^�yMy\`baIy\ZMsih�� @Xw;�pjla�yM[�hI^�jlmMaXmstzpyMaIZ\z¡^�gF[#Z�akÀlyMaIZ\z¡^�gFyM[-y\�la�m\y_^�y\st[#z)¸*=±z¼[#Zk�paIZ�yM[�xvZM[#y\ahky�yM�la7��aI§psªh�a7^�z¡�¾y\�la�aIzp§pstZM[#zv`baIzpywm\aI§#aIZk^�g�hkstZ_h�jlstyWqlZ\a^�®QaIZMm�^�Z\a�xlgi^#h�a��stz�^�zlaIy±¯%[#ZM®�[�© ����) ) �%stz.��s !;aIZ\aIzpy�xr^�ZMy\mW[�©�y\�la�m\y_^�y\st[#z ?°[Qz

únú åVU�W�X�W �

Page 13: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

��� � ����������4�����51 ���M��� ��V���$���!23�$�"������4������%� ��� �3���

y\�laW^�Z\ZMst§#^�gQg}stzlaXmw�gtstzl®'gts}zvaImw�^�zr�{�paXx¡^�Z\yMjlZ\aCg}stzlaXm�@I¸�¹C�laXmMaWhkstZ_h�jlsty�qlZMa�^�®#aXZMm�^�ZMaC^�gtaIZMy\a��qpo'mMaIzlm\[#Z\m^�yW�ps"!¦aIZ\aIzpyWgt[lhI^�y\st[#zlm%[#z�yM�va�gtstzlaIm�¸

g9^#h\� h�s}Zkhkjlsty'qlZMa�^�®#aXZ�h�[#zpyMZ\[#gtgtaIZ��pak¤¡zlaXm{^�qraI�¡^�§pst[#Z'qraI]#stzlzlstzl]�¯CstyM��y\�la�h�[#zp¤¡Z\`�^�yMst[#z�^�zr�si�paIzpy\s¨¤;hI^�y\s}[Qz�[�©%yM�la�y±opx¡a�[�©�yM�va��pa�©­^�jlgty�¸�=Á©%yM�la��pak©­^�jlgtyWstm�h�[#zp¤¡Z\`ba�ßw¡y\�la�yMZMa�^�yM`�aIzpy�hk[QzlmMstm\yMmstz�[#xraIzlstzl]�yM�la�hkstZ_hkjlsty¬«­qlZ\a^�®QaIZW�pjlZ\stzl]b^�]Qst§#aIz��paIgi^�opw#y\�laIz�hkgt[#m\stzl]{styW^�]�^�stz)wp^�zr�b^�©ÁyMaIZW^�zl[#y\�laIZ�paXgª^�opwps¥©Øy\�la{�pak©±^�jlgty%s}mCm\yMstgtg;xlZMaXmMaIzpywry\�laIz�Z\aIx¡a�^�yMstzl]�yM�laXmMa�[Qx¡aIZk^�y\s}[Qzlm%©°[QZW^�hkaIZMyk^�stz�zpjl`�q¡aXZ�[�©hkolhkgtaIm�¸;¹C�la�xvjlZMxr[#m\a{[�©�yM�lstmFs}mFyM[�y\ZMa^�y�y\Z_^�zlmMstaIzpy���ak©­^�jvg}y\m�Trstz�hI^�m\a{y\�la���ak©­^�jvg}yCstmFmMyMstgtg)xvZMaIm\aIzpy^�yWyM�va{aIzr��[�©�y\�la�hkolhkgta#wryM�la�hkstZ_hkjvs}y¬«­qvZMa^�®#aIZ'stmW[Qx¡aIzva���pak¤¡zvs}y\aIgto�wr^�z¡�.yM�la�hk[#zpy\ZM[#gnstmW]#st§QaIz�yM[y\�la�ZMaX`b[#y\aW[Qx¡aIZk^�y\[#Z¸

\Fzla�[�©Wy\�la�xlZM[QqlgtaI`bm�stm�y\[7®pzl[�¯4¯C�lsih\�-[�©WyM�la�hkstZkhkjlsty{qvZMa^�®#aIZ\m�`�jlmMy�qra�[#xraIzla�߸*=Á©WyM�la�pa�©­^�jlgtyC^�xlxra^�ZMmC[#z�yM�la'�paIx¡^�ZMy\jlZMa�gtstzla#wQsty�stm�xr[#m\mMstqlgtaWy\[{[Qx¡aXz�y\�la�h�s}ZkhkjlstyCqlZ\a^�®QaIZW^�y���aIx¡^�Z\yMjlZ\agtaI§QaIg±w)[QZ�^�y�gts}zv®�gtaI§#aIg±wn[#Z�^�y{^�ZMZ\s}§#^�g�gtaI§#aXg­¸@\Fqp§�st[QjlmMgtopw;sty�stm�stz�yM�la�s}zpy\aIZMaIm\y�[�©Wjlm\aIZMm�y\�¡^�y�yM�lahkstZkhkjlsty'q¡a�qvZM[#®QaIz7^�y��paIxr^�ZMy\jlZMa�gtaI§#aXg­wr^�z¡�.zl[#yW^�y�^��lst]#�vaIZWgtaI§QaIg±wlmM[�yM�¡^�yWy\�la�©ÁaI¯�aXmMyWjvmMaIZ\m�^�ZMa�paXxlZMst§#a���[�©!x¡[�¯%aIZ¸v¹C�lstmCZMauQjlstZ\aIm�hk[p[QZ_�pstz¡^�yMst[#z�q¡aIy±¯%aIaIz yM�la{��s !;aIZ\aIzpyWhkstZ_hkjlstyFqlZMa^�®#aIZ'hkaIgtgtm¸

�%�6]� ���cÁÍS]!� 1�ÎnÉl� ��6cYf!��c°Í ]»Í�^W��ÎnÉhf!�l��� �!��Éb �É 1 1+aU£�a'¯Cstgtgl©Á[�h�jlmC[#z�[#zla'[�©!yM�la�y±o�xraImC[�©�hkaIgtg±ºy\�laW�paIx¡^�ZMy\jlZMa'hkaIgtg±wqrahI^�jlmMaFsty)©Áa^�y\jlZMaIm%^�gtgpyM�la%stz�y\aIZMaXmMyMstzl]�^�mMxrahky\m�[�©¡yM�vaW^�jly\[#`�^�yMstmM` qraI�¡^�§pst[#ZwaI§QaIz�stz�yM�vs}m'm\s}`�xlgts¥¤¡a��xlZMaXmMaIzpy_^�yMst[#zn¸[\FyM�laIZ�hkaIgtgtm��r^�§#a�^�qraI�¡^�§pst[#Z'¯C�lsih\��stm�[Qzlgto�x¡^�Z\y�[�©�yM�vs}m[Qzla#¸�=±yCstm���ahk[#`�x¡[QmMa�*stz�^�hk[#zp¤rZM`�^�yMst[#z�xvZM[lhkaIm\mwr¯C�lsih\��^�gtm\[{hI^�Z\aImC©Á[#Z%sª��aIzpyMs¥©°opstzl]�yM�va�y±opxraW[�©y\�la{�pak©±^�jlgtywQ©Á[#gtgt[�¯�a��qpo�^�y\ZMa^�yM`baXz�yCxv�¡^�m\a�stz�^�z�^�yMyMaX`bxlyC^�yC`�^�®pstzl]'yM�la{��ak©­^�jvg}yC�pstm_^�xlxra^�Z�¸

¹C�va�������� ��� �-� �$��� � 1 �-���Fhk[QzlmMstmMy\m's}z�yk^�®pstzl]�yM�la�yMst`baFyM[bgtaIyCy\Z_^�zlmMstaIzpy���ak©­^�jvg}y\m�hka�^�mMa�z¡^�yMjp«Zk^�gtgto�¸rÆl[QZWa^QhM�»[�©%yM�lab�pa�©­^�jlgtyFy±o�xraIm ? ���;w��;w¡[QZ � @F^��paIgi^�o�hI^�z�^�m\mMaIm\m�styMmWxraIZ\mMstmMy\aIzpy{xlZ\aImMaXz¡hka#¸¹C�laXo=^�Z\a�yMaIm\yMa�¼stz¾mMauQjlaIzrhka#w%jlzpyMstgW^»�pak©­^�jlgty{stm�hk[#zp¤rZM`ba�� ?°s±¸ a#¸twnxlZMaIm\aIzpy�^�y{y\�la�aIz¡�½[�©'yM�lahk[QZMZ\aImMxr[#z¡��s}zv]-�paIgi^�o�@I¸)vC[�¯%aI§QaIZw!y\�la�mMauQjlaIzrhka�stm{stzpyMaXZMZMjvxlyMa�¼^�m{m\[�[QzÇ^�m�yM�la��pak©±^�jlgty{�pstmk^�xp«xra^�Z\mwv[#ZC^�xlZ\aI§pst[#jlm\g}o�a�Àv^�`bstzla����ak©­^�jvg}yC^�xvx¡a^�ZMm�¸l¹C�lstm%gª^�yMy\aIZ�xr[#stzpy%s}zpy\ZM[l�pj¡hkaXmW^��lstaIZk^�ZkhM�po�[�©xlZ\aIaI`�xlyMst[#z�^�mCakÀlxlgi^�stzla�*s}z��pa�hkyMst[#z��v¸ cv¸t�#¸

¹C�va6�������#����������� 1 �-���nqraI]Qs}zvmدC�vaIz{y\�laC�pak©­^�jlgtyØstm!hk[#zp¤rZM`ba��;¸#=±y�^�gtyMaIZ\z¡^�y\aIm!q¡aIy±¯%aIaIz�qvZMa^�®�stzl]y\�la7hkstZ_h�jlsty��pjlZ\stzl]�§#^�Z\o�stzl]��paIgi^�opmw�^�z¡�Çhkgt[QmMstzl]»s}yb^�]�^�s}z¾yM[-h\�lah\®¼¯C�laIy\�laIZ�yM�va7�pak©­^�jlgty��¡^�m�pstmk^�xlxra^�Z\a�;¸ g�^#h\��hkstZ_hkjvs}y'qlZ\a^�®pstzl]�q¡aI]Qstzlm�¯CstyM��aX`bstyMy\s}zv]�yM�la�hk[#`�`�^�z¡��y\[�[Qx¡aXz7y\�labhkstZ_hkjvs}yqlZ\a^�®QaIZw ©°[#gtgt[�¯�a��Wqpo'yM�va�Z\ahkaIxly\st[#z�[�©¡y\�la w { T;X�aI§QaIzpyw�jlxr[#z�¯C�vsªh\��yM�la%hkjlZMZ\aIzpy��paIgi^�o'stm)m\y_^�Z\yMa��¸� x¡[Qzbhk[#`�xlgtaIyMst[#z'[�©¡yM�laW��aIgi^�o�w�yM�va�hkgt[QmMstzl]'[�©¡y\�laWhkstZ_h�jlstyØqvZMa^�®#aIZ�stm!ZMa�u#jvs}Z\a�;wp^�z¡��hk[#zp¤rZM`ba���qpoy\�la�Z\ahkaIxvyMst[#z�[�©��,8,Q iT63;¸ \Fz¡hka%yM�la�h�s}Zkhkjlsty!stm;ZMak«±aImMyk^�qlgtstmM�va�;w�aIsty\�laIZ!yM�la%�pak©­^�jlgty;�¡^�m!�pstm_^�xvx¡a^�ZMa�ßw^�z¡��yM�la{h�aIgtg)]#[paImFstz�y\[�styMmCzl[QZM`�^�g¡m\y_^�yMa#wr[#ZCstyCstmCmMy\stg}g;xvZMaIm\aIzpyºryM�laXz)wryM�la�y\ZMa^�yM`�aIzpyCxl�¡^�m\a']#[paImstzpyM['yM�vaWzlakÀly�h�o�h�g}aW^ ©°yMaXZ�^�¸æ��m��paIgi^�opw�[#Z�s¥©;s}y!¯C^�m�y\�laCgi^�m\y�h�o�h�g}aQw#y\�la�hkstZkhkjlsty�qlZ\a^�®QaIZ�stm��pak¤rzlstyMaIgtoqlZ\[#®QaIz)w¡^�z¡��styMmW`�^�z¡^�]#aI`�aIzpy!s}mCgtak©ÁyCyM[b^�ZMaX`b[#y\a�hk[#zpyMZ\[#gn[#xraIZ_^�yM[#Z�¸r¹C�la'mMaIZ\s}aXm�[�©��paXgª^�o�§#^�gtjlaIm?Ás}z yM�la�¤¡ZMm\y�hkolhkgta#º!¸ ��mwvs}z yM�la�m\ahk[Qz¡�;º�����mwvstz�yM�la�yM�vs}Zk�;º¡����m�@I¸rstmWyMZ\a^�y\a�»^�m�^*mMst]#zr^�g±wl^�z¡�.yM�lahkolhkgta�stmCZ\aIx¡a�^�yMa���^�mW^�m\aIZMstaImF[�©�^QhkyMst§#^�yMst[#z�s}zpy\aIZM§#^�g}mC^�mCa�À�xvgª^�stzla��stz��pah�yMst[#z7�v¸æcl¸æcl¸=±z�y\�laC©Á[#gtgt[�¯Cs}zv]¡wI¯%aC]#st§QaW^'mMst`bxvg}s¥¤¡a���^�z¡��m\�l[#Z\yMaIzva���paIm_h�ZMstxlyMst[Qzb[�©;yM�vaWxr[�¯�aIZ%mMopm\yMaI`�y\�¡^�y

¯%a�^�ZMa�hk[#zvmMsi�paIZ\s}zv]¡wn®#aIaIxvs}zv]7[Qzlgto7y\�la�`b[#m\y�st`bxr[#Z\y_^�zpy�^�m\x¡a�hkyMm�[�©�yM�vab[#Z\st]#stz¡^�g9mMxrahks¥¤¦hI^�yMst[#z;t�I�#<M¸)Æv[#Z'akÀ¡^�`bxlgta#wr¯%a�hk[QzlmMsi�paXZ{[Qzlgto�[Qzla�mM[QjlZ_h�ab[�©CakÀlyMaXZMz¡^�g�stzpyMaIZ\ZMjlxvyMst[#z»stzlmMy\a^#�»[�©�m\aI§#aIZk^�g±wqrahI^�jlmMa�yM�la'`�ah\�¡^�zlstm\`bm�stzp§#[Qg}§Qa�b^�ZMa'yM�va�m_^�`ba#¸

øiùnú)øiû

Page 14: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

��������� ��� ����������������� ��� ��������������� ������ ���!���"�#���$���%�&�'���(������)*�����+���,�-����)iÂ�Ã*� �#�

���������

� � ��� � � � �������

� ��� �������

� �����������

� ���

������� � � ����������

� ��������� ���

� ����� �� � ��� � �

� �

� ��� �������

� �� ��� ������� �

� �����!

� ��������� �"

� ����� � � ������

#$ � � ����������

Æns}]QjlZMa'�rºp¹C�la�hk[#zp¤rZM`�^�yMst[#z�xv�¡^�m\a#º¡^�z�stzpyMaXZMZMjvxlyMst[#z��lstaIZk^�ZkhM�pop¸

��" ! % � ( �=2'& �=0.1�2+3�4 2+4 T!L+*'DC?�, 0@4)7 T!L+*'D ? ,�� � ��( a*) a,+ ��_!É7 �Í ].-�� ���v��cÁÍS]�f@_!�¡�XÉr¢)��]9cl]n�Ép��� � f!� cÁÍ�] _ c°Ép���l�# �_nÊÆnst]#jlZ\a���stgtg}jvmMyMZk^�y\aIm�yM�la=�hQ X 5G6+ ��7 YG�QWX�xlZ\[�h�aImMm�mMxrahks¥¤¡a��ÇstzDzl³Á´)µ;¶;·nÂ�Ã'ÄÅ s}zÇÆnst]#jlZ\a��l¸!¹C�lay\�lZMaIa�hk[#zlm\y_^�z�yCxr^�Z_^�`baIy\aIZMm0/=T�8h7'k ���;w�/=T�8,7�k �;wl^�z¡�!/ T�8,7'k �bhk[#Z\ZMaIm\x¡[Qz¡��yM[�a^#h\��[�©!yM�la'yM�vZMaIa®pstz¡�pm�[�©WaIgtah�yMZMsihI^�gW�pak©­^�jlgtyMm�¸!¹C�labstzlxljvy�aI§#aXz�yLzG �=Tbstm{y\�labqr^�mMa�hkgt[lh\®7s±¸ a#¸twns}y�s}m�yM�la�hkgt[lh\®7[�©y\�la�gt[#]QsªhX^�grs}zvxljlyMm ���;w��;wl^�z¡� �0?°xlZ\aImMaIzrhka{[�©�yM�la��pak©±^�jlgtyMm�@C^�z¡��hk[Qzpy_^�stzlmCy\�la�hkgt[lhM®pmF[�©Øy\�la'y±¯�[[QyM�laIZ�stzlxljly�aI§#aIzpy\m uLY / T65 7y-�8 Y�^�z¡�21G�+iWY /=T�5 7y-�8 Y¦¸v¹C�labxvZM[lhkaIm\m�aI`bstyMm'y\�la�[#jly\xljly�aX§#aIzpy/=T65 �hQ X 5b¯C�vaIz�yM�va��pa�©­^�jlgtyCstm�h�[#zp¤¡Z\`ba��^�z¡��yM�va�[#jly\xljlyFg}[Q]#sihI^�g;mMst]#z¡^�g3/=T�5 7y-�8 Y�¯C�lsihM� ]#st§#aImy\�la�mMyk^�yMa�[�©�yM�va�hkaXg}g±¸;¹C�vs}mFgi^�yMy\aIZ'stm)Q�4�536�¯C�laIz�^�z»akÀlyMaXZMz¡^�g��pak©­^�jlgty's}m'�paIy\ahkyMa�� ?°Z\ahkaIxvyMst[#z�[�©uLY / T65 7y-�8 Y�@F[#Z�¯C�laIz-y\�lab�pak©±^�jlgty�stm{hk[Qzp¤¡Z\`ba� ?,/=T65 �,Q XK5�@Xw¡[QyM�laXZM¯CstmMa�s}y�s}m�5K7,8niTb¯C�laIz-^�pa�©­^�jlgtyCstmCzl[Qy�xlZ\aImMaXz�y�¸r¹C�la�stzpyMaIZ\ZMjlxly\st[#z��lstaIZ_^�Z_h\�pobstmW^�m%©Á[#gtgt[�¯Cmº

b ¯C�laIz�^��pak©­^�jlgtyWstmW�paIy\ahky\a� ?71G6+i Y /=T65 76-�8 Y�@Iwpy\�la{stzpyMaXZM§#^�g � ����stmWaXz�y\aIZMa��;¸8=±yWstmWhkgt[QmMa�qpo7y\�la�[lhIhkjlZ\ZMaIz¡h�a�[�©8/=T�5 7y-�8 Y4?±hI^�jvmMstzl]�y\�la�stz�y\aIZMZ\jlxly\s}[Qz�[�©CaI§#aXZMo�mMjvqp«¬^QhkyMst§psty±o�@I¸;g�^Qh\�yMst`baCy\�lstm�stzpyMaXZM§#^�gvs}m%aIzpyMaXZMa�;wr^�m\jlqp«±xlZM[lhkaXmMmWxraIZ¬©°[#Z\`bm�y\�la�hk[Qzp¤¡Z\`�^�y\st[#z�[�©)y\�la���ak©­^�jvg}yC^�m©°[#gtgt[�¯Cmºl^�hk[#jvz�y\aIZ�[�© zG �=T�s}m'^#hky\st§#^�yMa����pjlZ\s}zv]byM�va��paXgª^�o9/=Ty8,7'k ���¦¸ >Cy'yM�la�aXz¡��[�©�yM�vs}m�paIgi^�o;º

: s¥©;yM�laCgt[#]QsihI^�g�����stm�Y,+'- Tlw�[#Z9s¨©�����qrahk[#`�aIm � ��2 �9�pjlZ\s}zv]�y\�laCmMjvqp«­stzpyMaXZM§#^�g � ��[#Z9s¨©ryM�la�pa�©­^�jlgty'stm�hk[Qzp¤¡Z\`ba��^�y�^�gt[�¯�aXZWgtaI§#aXg­wry\�laIz»yM�la��pak©­^�jlgtyWstm�hk[#z�¤¡ZM`�a��^�yFyM�lstm'gtaI§#aXg­w

únú åVU�W�X�W �

Page 15: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

��c � ����������4�����51 ���M��� ��V���$���!23�$�"������4������%� ��� �3���

¯CstyM��y\�laCaI`�s}m\mMst[#z�[�©Ø^�z�aI§QaIzpy /=T�5 �,Q X 5¦¸�¹C�lstmدCstgtg¡hI^�jlmMaCy\�laWstzpyMaXZM§#^�g � ����y\[{hkgt[#m\a#wy\�laIZMaXq�o»^�gtmM[�yMaIZ\`bstz¡^�yMstzl]�y\�la�hk[#zp¤rZM`�^�yMst[#z�y_^�mM®;¸

: =±z�yM�va�[QyM�laXZ�hI^�mMa ? ���bstm�5 7h8niT�@IwQyM�la'stzpyMaIZ\§#^�g � �'?Á¯C�lsih\��stmC^�mMjlq�«­stzpyMaIZ\§#^�g;[�©!� ��� @stm�aIzpyMaIZ\a�;w�^�z¡��^ mMjlqp«±xlZ\[�h�aImMm�x¡aIZ¬©°[#Z\`bm�y\�labZ\aImMy�[�©WyM�la�hk[Qzp¤¡Z\`�^�y\st[#z)wrstz-^7uQjlsty\am\s}`�stgª^�Z�¯C^�o¦ºl^�hk[QjlzpyMaIZF[�©:zG �=T�stmW^#hky\s}§#^�yMa�*©°[QZ�y\�la{�paXgª^�o"/=T�8,7'k �;wl^�z¡�;º

3 s¥©��bstm�Y,+�-=TlwQ[#ZCqrahk[#`�aImCmM[b��jlZMstzl]�stzpyMaIZ\§#^�g � �;wp[#ZCs¥©Øy\�la{�pa�©­^�jlgty%stmWhk[#zp¤rZM`ba��^�y�^bgt[�¯%aIZ'gtaI§#aIg±wryM�vab�pak©­^�jlgty�stm�hk[Qzp¤¡ZM`�a�»^�y'yM�lstm'gtaI§#aXg­w߯Cs}y\�7y\�la�aI`�s}m\mMst[#z�[�©/=T65 �,QWX 5 ��hX^�jlm\s}zv]�yM�la'stzpyMaIZ\§#^�g;yM[bh�g}[QmMa#¸

3 =±z�yM�vaC[#yM�vaIZ�hI^�mMaO? ��stm 5K7,8niT�@Iw�yM�laCstzpyMaXZM§#^�g � �+?°¯C�lsih\��stm�^Fm\jlqp«±s}zpy\aIZM§#^�gl[�© � � @stmFaIzpyMaIZ\a�;w)^�z¡��^�gi^�m\yWmMjvqp«­xvZM[lhkaIm\m�yMZ\s}aXmWyM[�hk[#z�¤¡ZM`(y\�la���ak©­^�jvg}y���qpo�h�[#jlzpyMstzl]/=T�8,7'k �b^�z¡��yMaIm\yMstzl]�©°[QZ��;¸

¹C�laChk[l�pa%mMxrahks¥©°opstzl]Wy\�lstm)qraI�¡^�§pst[#Zns}z�²l³°´nµ;¶;·nÂ�Ã'ÄÅ stmn]#st§#aIz�s}z�¹�^�qlgta��lwI¯C�vs}gta�Ænst]#jvZMa��Fs}gtgtjlm\yMZ_^�yMaImsty¸

� � ���� �� ������� ����� ��� � ������ � ��� ���� � � � ��� � ����� � � ����� � �� � � ��� � �������� ���� � �� �"���8��8��� ��������� #$ � � � ������� ����� � ����� � � � ������������� ��� �� ��� ����� � ����� � ������ � �� � ���� � ���������� �

�"! � ����������$#%� #�$ � � � ��������� �'&����������� � ����� � �����&�����������(� ��� �(� � ����������� � ���)���! � ���*#%�$� � � � � � �)�!,+�� �-#%�/. ������� � � � ����������� � ����� � ������������.! 0������� ����� � � ��"�/&�����������10�"! # � &2� � � ���������(#%��� �����$���435� ��� �2�,� � � ��� �2� �"�! � ���"� ������$#%�$� � ��������� ����� # �2& � � � � � � � � "�

&�������� ��6� � �����!�� � �6+�� "�'&����������� � ����� �������� !7+�� -#%�/.$� �������$� ��� �"�"� � ����� # � & � � ����� � � � "�8� � ����� �������� '.! 0������ ����� � � ��� �& ������������0

�"! # �2& � � � � � � ��$#%�"� ������5�43�� ��� �2�9� � � � � � � "�! � ����� ��������� (#%�$� � �����!�������� # � & � � � ��� � �� �

&�����������6� � ������ � �6+����8�:&����������� � ����� � ��������!9+����;#%�/.�� � �����$� ������"� ������� # � & � � � ��� � �� �8� � ����� ���������� .! 0<����� ����� � ���� ��& ������������0

�=! # � & � � � ��� �����$#%��� ��������43�� ��� �2�9� � � ��� � ���)�! � ����� � ������'�#%���������"� � ����� # � & � � � ��� �2���!4� �������+����

!4� ��5���>+5� !4� ������>+���� !4�

� ��� � �� ����� � ��� � +5� � � � � ������� ��� &����?+5� � � � ������� � � &����@+���� � � � ������� ��� &����������� � � ����� ��������� �� � ���"� ������"� �A� � �� � ���� � ���

��� &B0������ ����� � � � ��� 0

¹�^�qvg}a��vºp¹C�la��hQ X 5G6+ ��7 YG�QWX�xlZM[lhkaIm\m¸

øiùnú)øiû

Page 16: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

��������� ��� ����������������� ��� ��������������� ������ ���!���"�#���$���%�&�'���(������)*�����+���,�-����)iÂ�Ã*� ��

( a*) a*) ��_!É����Ép�l� ��É])��f@_!�¡�IÉr¢)���XÉ��6cÁÉl�'Í ^rcM])��É��6dp� 1±�

\Fz¡hka�yM�la{��ak©­^�jvg}y%stmWhk[#z�¤¡ZM`�a�;wpyM�va�qraI�¡^�§pst[#ZCaXz�y\aIZMm'^�yMZ\a^�y\`baIzpy%xl�¡^�m\a{hk[QzlmMy\s}y\jlyMa��b[�©�^{hkolhkgta[�©�^�y\yMaI`�xlyMmC^�yC`�^�®pstzl]'yM�la��pa�©­^�jlgtyC�pstm_^�xlx¡a�^�ZCqpo�hkjvyMyMstzl]�yM�va�h�s}ZkhkjlstyCqlZ\a^�®QaIZ¸g�^#h\��yMst`baQw#sty%s}my\�la�xlZ\[�h�aImMm��'kly8 T ?°m\aIa{¹�^�qlgtaW� @%¯C�vsªh\��s}mW^QhkyMst§#^�yMa�;¸

¹C�vabxlZ\[�h�aImMm*��kl�8 Tbstm{xr^�Z_^�`baIy\aIZMs(AIa���¯CstyM�¼^��paIgi^�o2/=T�8h7'k � ?°yM�va.��jlZ_^�yMst[#z�qraIy±¯%aIaIz¼y±¯�[hkstZkhkjlstyWhkjly¬«­[2!¦mCstzby\�la�hkolhkgta�@Iwr^�z�s}zpy\aI]#aIZ O'?ÁyM�la'`�^�Àlst`{jl` zpjl`�qraIZ%[�©�^�yMy\aI`bxvyMm�@%^�zr�b^�z�^�Z\Z_^�o/=T�8,7�kiW[�©;O{§#^�gtjlaIm!©°[QZ�yM�va��pjlZk^�y\s}[Qz�[�©;qlZMa�^�®#aXZ�[Qx¡aIzvs}zv]�stz�a^#h\��^�yMy\aI`bxly�¸�=±yMm%stzlxljly9mMst]#z¡^�gtm�^�ZMay\�labaI§QaIzpyMmLw { T�X=T637^�zr���h8,QniT63�mMst]#zr^�gtgts}zv]byM�vab^#hky\j¡^�g%[#xraIzlstzl] ?ÁZMaIm\x¡a�hkyMst§#aXg}o;º�hkgt[QmMstzl] @�[�©CyM�lahkstZkhkjlsty�qlZ\a^�®QaIZw;y\�la�aI§#aIzpy�zG �=T ?Á¯C�lsihM�»stm'jlmMa� yM[�hk[Qjlzpy'yM�lab�ps"!;aIZMaXz�y��paXgª^�opm�@Iw)^�z¡��^�gt[#]#sihI^�gm\s}]Qz¡^�g8/=T65 ?°yM�va.��s}mt~kjlz¡h�yMst[#z¾[�©�y\�la�yM�lZ\aIa��pak©­^�jlgty{y±opxraImº9sty{stm8Yh+'-=T�s¨©�^�zpo�[�©Wy\�laI` stm�@I¸n¹C�laaI§QaIzpy�z�G �=T�stmWy\�la�q¡^�mMa{hkgt[lh\®�s­¸ a#¸twpstyCstmWy\�la{hkgt[lh\®�[�©�yM�la�gt[Q]#sihI^�g;stzlxvjlyW^�z¡� hk[#zpy_^�stzlmCyM�la�hkgt[�h\®pm[�© w { T�X T63�^�z¡�=�,8hQniT63;¸l¹C�la�[QjlyMxljvy�m\st]#z¡^�g}m'^�Z\a�yM�la�aI§#aXz�y\m & T�� w { T�X ��kl�8 Tb^�z¡�.& T�� �,8,Qni TZ\auQjlaImMy\stzl]�ZMaIm\x¡ah�yMst§#aIgto�yM�va�[#xraIzlstzl]b^�z¡��hkgt[#mMstzl]�[�©�yM�la{h�s}ZkhkjlstyCqlZ\a^�®QaIZwryM�va�aI§#aXz�y /=T�5 s,+ T�7��m\s}]Qz¡^�gtgtstzl]%yM�¡^�yØy\�laChkstZ_hkjlstynqlZMa^�®#aIZ!m\�l[#jlgi�'qra%[#xraIzla���pak¤¡zvs}y\st§#aIgto ?°qrahI^�jlmMaCy\�la�y\ZMa^�yM`�aIzpyØhk[Qjlgi�zl[Qy��r^�z¡�pgtaCy\�la��pa�©­^�jlgty�º#^�zl[QyM�laXZwQzl[#zp«M^�jvyM[#`�^�y\sªh9xlZ\[�h�a�pjlZ\a�m\�l[#jvgª��qra�^�xlxlgtsta��@Xw#^�z¡��y\�laWaX§#aIzpyu X 3 / T65 7y-�8 Y�m\st]#z¡^�g}gtstzl]�y\�¡^�yCy\�la��pak©­^�jlgtyC�¡^�mW��s}mk^�xlxra^�ZMa�;¸

� � ���� �� �� ����� �-� � ������ � � � � � � � � ��� � ������ � ��� ��� � . � ������ � � � � � � � � ���� ���������� ��������&�� �� � � ��&�� � ��� ���8���� � �� � � ���� ������������ � �� ����������2��� ������ � � ����� � ��� � ����� � � ������� # � & � � ������� ���2�

�=!9+�� � � �����#%�/.� � � �� ������� � � � ���� �� � � ��&�.! �"! � ���� � ��� #%�$�43 � � ����� +���� � ����8�������

0�� � ���� &���� � � � � � �� � ��������� � ��� � ���6� � � � � � � $ ����& ��&'0! � ����� � � �����$#%��� �����$� � ���� � ����� � �! � � �� �����2� � #%� � � ����� � � � �����2� ���.! � ����� �$#%����� �� ��� � � � ����� � ��� �!4�

! �"!9+��� �����# �/.� ��������&�� �� � � ��&�.! 0 � ��� ��� � �B� ��� � � � � ����� � ����� � � � � � ���� ��� .������ � � ��&�������� � � ����� � � 50

�"!� � � � �� � � �<#%��� ����� ��� 3�� ��� ���7� � � �����"�!4� �������6+��� �����

!4��������+�� � � ����

! # � & � � ����������� # ��� �����"��� �$� � ���9������+�� � � ����)�! 0 � � ����� � ��� ����� � �2 � ����� � � � � � � ��� ��� � � � � ��� � � � &�� ���6+�� � � ���� 0

�"!����� �� ���������� �����<#%��� ����� � �43�� ��� �2�7� � � � � � � �/�!4� ������6�� � ��+�� � � ����

!4�� ��� � �� ����� � ��� � +���� � ���� � � � � � � � � &����?+��� ����� � � � ������� � � &����� ������ � � � � � � � � � � � � � ��� � � ����.�� � � �� �����2� ��� � � � � ����� � � ����.�� � � ��2� ��� � � � ���

��� &B0 �� �����'0

¹�^�qlgtaF�¡ºp¹C�la��'kly8 T�xlZ\[lhkaImMm�¸

únú åVU�W�X�W �

Page 17: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

�X������������4

�����51���M��� ��V���$���!23�$�"������4������%

���� �3���

�� � �� �� �

�� � � � � � ��� �� � � �� � � � ��� � � � �

�� � � � � �� �

�� � �� � � � � � � � � �� �

� � � � � � �� �

� �� �� �

� � � �� �

� �� ��

� �� � � � � !� �� � � � � !

� � � "# � �

�� � � � �

$ � � � ! % � � ! &' � (

� ! � � � !

� �� � � � � !

) � � * � � � ��� � "# � �

� � � � � �

+

�� � "# � �

�� � � � �

+, + -

"# � �� �

Ænst]#jlZ\a��vºl¹C�la'y\ZMa^�yM`baXz�yCxv�¡^�m\a#º¡^�mMaIZ\staIm'[�©ØstzpyMaXZM§#^�gtm�¸

øiùnú)øiû

Page 18: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

��������� ��� ����������������� ��� ��������������� ������ ���!���"�#���$���%�&�'���(������)*�����+���,�-����)iÂ�Ã*� ��

\Fz�a�^#h\�{aXz�y\ZMo�stz'styMm!^#hky\s}§psty±o'stz�y\aIZM§#^�g±wIyM�va�q¡aX�¡^�§ps}[QZØ^�g}y\aIZMzr^�yMaXmØqraIy±¯%aIaIz�qlZ\a^�®pstzl]FyM�laChkstZ_hkjvs}ystz�yM�la%stz�y\aIZM§#^�g�� s,+ST�7��Q?ÁstzlstyMsi^�gtgto�G�X�i,G�3 T�@)^�z¡��hkgt[QmMstzl]'styØ^�]p^�stz�¯C�lstgta�y\aImMy\s}zv]W©Á[#Z��pstm_^�xlx¡a�^�Z_^�z¡hka[�©�yM�va.��ak©­^�jvg}y�¸!¹C�la�hkolhkgtaImb^�Z\a�hk[#jlzpy\a�¾q�o�O ��kl�8 Tlw)stzlstyMsi^�g}gto�auQj¡^�gCyM[4�pwØ^�z¡�¾stz¡hkZMaX`baIzpyMa��^�y Q { T�X�� s,+ST�7��)¸�£Ç�vaIz y\�lstm�hk[#jlzpy\aIZ�akÀ¡hkaIa�pm»yM�va7`�^�Àlst`�jl`Hz�jv`�q¡aIZ^O;w�y\�laIz /=T�5 s,+ T�7��[lhIhkjvZMm¸F¹C�la�hkjlZ\ZMaIzpy»§#^�gtjla�[�©{yM�la �FaIgi^�o¼yM[¼q¡a»mMxraIzpy�[Qx¡aIz stzÇyM�va hkolhkgta�stma�y-K+,+ T�X�Y /"!�#/=T�8,7�ki��NO �'kl�8�T �;¸*=±y�stm{`�aI`b[QZMs(AIa�»qpo¾yM�la=lT�8h8�^�z¡�¾xlZM[l�pjrhka�Ç^�y�yM�la7h�g}[lh\® zG �=Tlº)y\�lstm�s}mzla�hkaImMmk^�Z\o�q¡a�hI^�jlm\a{y\�la'§#^�gtjla'[�©!yMst`baXZMm%¯Cs}gtgrq¡a�hk[#`�x¡^�Z\a��¯CstyM� /=T�8,7�kb^�y�y\�¡^�yWh�g}[lh\®;¸

b =±zlmMsi�pa � s,+ T�7��)w�^FmMjlq�«­stzpyMaIZ\§#^�g�� w { T�X{stm���ak¤¡zla��m\y_^�ZMyMstzl]�¯Cs}y\�{y\�laW^#h�yMj¡^�g�[Qx¡aXzlstzl]�[�©ryM�laqlZMa�^�®#aXZº�w { T�X=T�3+?°ZMa�hkaIst§#a��stzbZ\aImMxr[#zvmMa�y\[�yM�la'[Qx¡aIzvs}zv]{Z\auQjlaImMy & T�� w { T�X �'kly8 T�@I¸�=±zlmMsi�pa� w { T;X)w;^��paIgi^�o ?°[�© ^�mMaXZMstaIm�[�©�§#^�g}jvaIm�hI^�Z\ZMsta�»qpo�yM�va�mMst]#z¡^�g /=T�8h7'k�@Cstm�hk[QjlzlyMa��»[#z»yM�laq¡^�m\a�[�© zG �=Tl¸3>Rhkgt[#mMstzl]�Z\auQjlaIm\y & T�� �,8,QniT�s}mCaX`bstyMy\a��¯C�laXz�y\�lstmW�paIgi^�obstm%aIgi^�xlm\a�;¸

b \FjlyMm\sª��a�[�©�� s,+ T�7��ßwnyM�va�qlZMa�^�®#aXZ�s}mbh�g}[QmMa� T�yM�va�aX§#aIzpy�u X 3 /=T�5 7y-�8 Y7stm�aI`bstyMy\a��s¥©'yM�la�pak©­^�jlgtyW�pstm_^�xlx¡a�^�ZMm7?Ás±¸ aQ¸}w /=T65�s}m%©±^�gtmMa�@%stz�yM�la'`ba�^�zpyMst`baQ¸�¹C�la��pjlZk^�yMst[Qz�/=T�8h7'k ��qraIy±¯�aXaIzy±¯�[bh�s}ZkhkjlstyWhkjly¬«­[2!¦mFstzbyM�va�h�o�h�g}a�s}mWh�[#jlzpyMa��b[Qz*z�G �=T�[#jvyMmMsi�pa'[�© � s,+ T�7��)¸

( a*) a ( ��_!É7 �Í ��f�1°Ép��Éb��É_!�,d�c°Ír�Ænstz¡^�gtgtopwIyM�va�y±¯%['xlZM[lhkaIm\mMaIm%xlZ\aImMaIzpy\a�b^�q¡[�§Qa�^�ZMaC^�mMm\aI`�qlgta�'stzpyM[�^Fhk[#`�xlgtaIyMa�y\ZMa^�yM`�aIzpyØqraI�¡^�§pst[#Z^�m�mMxrahks¥¤¡a�¼stz¾¹�^�qlgtab�l¸*=±y�stm{x¡^�Z_^�`baIy\aIZMs(AIa�¾¯CstyM�¾yM�la�jlzvs}[Qz-[�©WyM�la�x¡^�Z_^�`�aIyMaXZMm�[�©Wy\�la�y±¯�[xlZ\ahka��s}zv]�xvZM[lhkaIm\mMaIm�¸*=±yMmWstzpyMaXZ±©­^Qhka�[�©%s}zvxljly�^�z¡��[#jly\xljly'mMst]Qz¡^�gtmCstm�^�g}m\[b�pak¤¡zva��[Qz�x¡^�ZMyW[�©�yM�lastzpyMaIZ¬©­^#h�aImW[�©�y\�la'[#y\�laIZCxlZ\[�h�aImMm\aIm¸

¹C�va{gt[#]QsihI^�gns}zvxljlyMm�hk[QZMZ\aImMxr[#z¡��s}zv]�yM[�yM�va��pa�©­^�jlgty\m�^�ZMa�xlZM[lhkaXmMmMa���stz7[QZ_�paXZ�y\[�xlZM[l�pj¡h�a�yM�lagt[#]QsihI^�g /=T657^�z¡�»yM�la�aX§#aIzpy"1�G6+iWY / T65 7y-�8 Y�¯C�lsih\��mMst]Qz¡^�gtm'Z_^�s}m\stzl]�a�p]#aXm{[�© / T65;¸;¹C�la�xvZM[lhkaIm\m�,Q X 5�G6+ ��7 Y�G�Q X7[�©�¹�^�qlgtab�»s}m�stzp§#[#®Qa�;w�^�z¡��stz=h�[#`bxr[#m\a��¯Csty\�=y\�la�xlZM[lhkaXmMm �'kl�8 T�w!¯C�vsªh\�¾s}m^QhkyMst§#a�a^QhM�»yMst`�a � zh+ T�7 Y�s}mFaIzpyMaIZ\a�;w!^�z¡�.s}m'stzpyMaIZ\ZMjlxvyMa�»qpo /=T�5 s,+ T�7�� ?Á¯C�laIz»yM�la�hkolhkgta��¡^�mZ\a^#h\�la�»sty\m�aXz¡��¯Csty\�l[#jly�^QhM�vs}aX§�stzl]�yM�la�yMZ\a^�y\`baIzpy'[�©%yM�la��pak©­^�jlgty�@F[#ZFqpoau XK3 /=T65 76-�8 Y%?Á¯C�laIzy\�la{�pak©±^�jlgtyC�pstm_^�xvx¡a^�ZMmC¯C�lstgta'yM�la'qlZ\a^�®QaIZCstmWhkgt[#m\a��@I¸v¹C�la'[#xraIzlstzl]�[�©!yM�la�qvZMa^�®#aIZCstmCZMa�u#jvaImMy\a�qpo & T�� w { T�X)w;stz-yM�va�^�qvmMaIz¡h�a�[�© /=T�5 s,+ T�7�� m wn¯C�laIz¾aIzpyMaIZ\stzl]�yM�la�yMZ\a^�y\`baIzpy�xl�¡^�m\a�^�z¡�-^�g}m\[¯C�laXz7^�Z\auQjlaIm\y�stmCaI`�styMyMa���stzlmMsi�pa'y\�la�hkolhkgta#¸

¹C�vs}m'hk[#`�xlgtaIyMaXmWyM�va{m\x¡ah�s¨¤;hI^�y\s}[Qz7[�©�yM�lstm'mMst`bxvg}s¥¤¡a���§#aXZMmMst[Qz�[�©�y\�la�q¡aI�r^�§�st[QZW[�©%yM�la�hkstZ_hkjvs}yqlZ\a^�®QaIZW[�©�^�xr[�¯�aXZCyMZ_^�zlm±©Á[#ZM`�aIZCmMyk^�y\s}[Qz)¸

��" � ��0@5+2$7)0.1�2+3�4���� E�> 0 ��&)2 �=065 �2$C /)5$0.1B2$3�4�pst`�jlgi^�yMst[#z�s}m'jlm\ak©°jlg9©°[QZ�y\�la�§#^�gtsi�l^�y\s}[Qz�[�©CmMxrahks¥¤¦hI^�yMst[#zlm�¯C�laIZMa�©Á[#ZM`�^�gn§#aIZ\s¨¤;hI^�y\s}[Qz7¯%[#jvgª�.q¡a�ps���hkjvg}y�a#¸ ]¡¸twr©°[QZ�h�[#`bxvg}a�À7q¡aX�¡^�§ps}[QZMm�¯C�vaIZMa�yM�va�akÀlxlZMaIm\mMst[#z¼[�©�xlZ\[#xraIZMy\staIm�¯�[Qjlgi��qrahk[Q`ba�y\[�[�ps���hkjvg}y�wlgtst®#a�hk[Q`bxlgtakÀ�m_h\�la�pjvg}stzl]Qmwr[#ZCstz7hX^�mMa�[�©�stzlm\j��hkstaIzpyW®pzl[�¯Cgta�p]Qa'[#z�y\�la�aIzp§pstZM[#zv`baIzpy¸¹C�laXZMak©°[QZMa�sty�hX^�zbqra�^�jlm\ak©°jlg)hk[Q`bxlgtaI`�aIzpy!yM['©°[QZM`�^�gl§QaIZMs¥¤¦hI^�yMst[#zn¸ \FyM�vaIZCakÀ¡^�`�xlgtaIm�[�©)]QZ_^�xl�lsihI^�g

ö�âkàØè\çIè±å�ìÁí # � ëkå#ð #�� ��ì þ è�è��Xï�à­è\í°íîä¨âkå � �����$��� ����� # ���:&����������� #�� � ð�è±é�å#è\í;ì þ è9í°è\ì)íîÞ�ñ#ìià±ëIêMìîä¨âkåWâ��rì þ è¬äæàâ�êMê¬Þ�à°à±è±å#ê\èMí�äi÷ èX÷ �Iì þ è;â�êMê¬Þ�à°à±è±å#ê\èMíQâ�� #�� äæåWì þ è;ëkñ#íÁè±å#ê\è¡â � # � ÷ ø å#ð�èMèMð��\á þ è±å # � ä¨írï�à±èMíÁè±å�ì��±ä¨ì þ ëIílì þ è)çkë õ Þ#è� ������ �þ è¬å#êMè ����� # � ä¨ínï�à­è\í°è¬å ì;ëkå#ð������������Qëkå#ð'ï�àÁä¨âkà°ä¨ìÁëkà±ò�äæå�ì þ è & ������������� ì þ è¬à­è �}âkà±è���ì þ à±âkÞ�� þ ì þ è � ����� âkå������������QëïpâIí°íîäæñ õ è)â�êMê¬Þ�à°à±è±å#ê\è;â�� #�� ð�âè\ílå#âIì;ê\âkýWè)ì þ à±âkÞ�� þ ÷

únú åVU�W�X�W �

Page 19: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

�#R � ����������4�����51 ���M��� ��V���$���!23�$�"������4������%� ��� �3���

� � �5�� �� � � �� � � �����'� � � � ������ � � � ��� �2� ��� � � � � � � �� � � ��� �2����� � ����� � � ��� � �� � . � �������� � � � ����� � �

�5� ���� � ��� � ��� �� ��� ���������� ��������&�� �� � � ��&�� #$ � � � ������������� � ��� �� ������������ �2�� �����A� � � � �� � � ��� � ���"� � � �� ��� # � & � � �������������

�"!@0�� � �� � � ����� ��� � ���B&����������� � � ����� � 0�"! � ���;# ��� � � � � �!�� � ���*#%� � �������! � ����� � � � ��������� �$#%�$� � ����� � ��� ��� & ��� ��� � ���)� �����/+���� � ��� �!4�

! ������ ����� � � � ��� � � ����� ��� �� � � ������� � �� � ������� ���"�0 ����� ����� ���B� � � � � ��� ��� � ��� � � ��& �������+���� � �� �B0

!7+���� � �� � #%�/. � ���"� ������A� � ����� � � �����&����������� # �2& � � �����������.! ��2� ���)� � � �� � ����� � � � � � � � � � �������6+���� � �� �

! ���� �� ����� # ��� ��������7��� � � ����� � � �����)�9&�����������(��� � ����� +���� � �� �"�&�������������� � �� ������� ��� �����5���

!4�� ��� � � � ����� � � � ��+���� � ��� � � � � ������� � � &���� ���� � �� ��� � ��� � � � � ��� � � ���� &B0�� � �� � � �����'0

¹�^�qlgta��lºp¹C�va�z,+ST�7 Y �=T;X�Y�xlZM[lhkaXmMm¸

m\s}`�jvgª^�yMst[#z�[�©�mMxrahks¥¤¦h�²l³Á´)µ;¶;·�xlZ\[#]QZ_^�`�mC�¡^�§#a�q¡aIaXz7y\ZMa^�yMa�;wßa#¸ ]¡¸;^�Zk^�stg¥«­Z\[�^#��hkZM[QmMm\s}zv].h�[#zpyMZ\[#gm\o�m\yMaI` ; � <Mwl^�mMxraIah\�»xlZM[lhkaXmMmMstzl]�mMopmMy\aI` ;}�Q�P<�^�z¡�b^�Z\[#qr[#yC§pstmMst[#z�mMopmMy\aI`bmO;t���<M¸

( a ( a,+ ��_!É7� c � �.1Á�l��ciÍ ]7É];d�cÁ��Í ].��É]n�=±z»yM�la�²l³°´nµ;¶;·�xlZ\[#]QZ_^�`�`bs¥zl]{aXz�§pstZM[Qzl`baXz�y�wly\�laIZMa�zv[�¯ akÀls}m\yMm�^�]#aIzvaIZMsih�qljlstgty±«±s}z�]QZ_^�xv�lsihI^�g!mMs¥«`�jlgi^�yMst[#z¾aIzp§�stZ\[#zl`�aIzpy�©°[QZ�²l³°´nµ;¶;·¼mMxrahks¥¤¦hI^�yMst[#zvm¸!=±y�xraIZ±©°[QZM`�mbyM�va ^�jlyM[Q`�^�y\sihb^�zr�Ç]QaIzlaIZk^�ghk[QzlmMy\ZMj¡h�yMst[#z�[�©�]QZ_^�xv�lsihI^�g!stzlxljly'Z\a^#�pstzl]�^�z¡��[QjlyMxvjly��pstmMxlgi^�opstzl]b¯Cstz¡�p[�¯Cm�wv©°[#Z�^�zpo�[�©CyM�va�s}z�«y\aIZ±©­^Qhka�mMst]Qz¡^�gtmC[�©C^�xlZ\[#]#Zk^�`»wps}z»^�z�[Qm_hkstgtgt[#m_h�[#xrak«­gtst®#aF©­^�mM�lst[Qz)w¡^�m�stgtgtjlmMy\Z_^�yMa��stz�Ænst]#jlZ\aImORb^�zr��v¸

£�a�¯C^�zpy�yM[��pstmMxlgi^�o»yM�la�xlZMaXmMaIz¡h�a ^�z¡��§#^�g}jvaIm{[�©WmM[Q`ba�[�©Wy\�la�stz�y\aIZM§#^�gtm{[�©WyM�la�qraI�¡^�§pst[#Zw^�z¡��[�©WmM[#`�a�aI§#aXz�y\m¸ =±z-[#Zk�paIZ�yM[��pstmMxlgi^�o»yM�laX` [#z¾[#m_h�s}gtgt[#mkhk[#xrak«±gts}®Qa�¯Cstz¡�p[�¯�wn¯�a�aI`�q¡a��»yM�lahk[QzpyMZM[Qgtg}aXZ�stzpyM[b^*xlZM[lhkaXmMm�y\Z_^�zvm±©°[QZM`bstzl]�y\�laI`(qpo�aIz¡hk[l�pstzl]�y\�laI`1^�mWstzpyMaI]QaIZMm'xlZ\aImMaXz�y�^�yWaX§#aIZ\ostzlm\y_^�zpy\m¸C=±z�y\aIZM§#^�gtm{^�Z\a�aIz¡hk[l�pa�¼^�mb��¯C�laIz4G�X�i,G63STlw�S���¯C�laIz Qy-�Yi,G�3 T�^�z¡� ��¯C�laIz¼^�qlm\aIzpy¸g!§QaIzpyMmW^�ZMaCaIz¡h�[���a��^�m'�C¯C�laIz�xlZMaIm\aIzpy7?°¯C�lsih\��gi^�m\yMm�[Qzlgto{[QzlaWstzlm\y_^�zpy�^�z¡��^�xvx¡a^�ZMm%]#Zk^�xl�lsihI^�gtg}o^�m�^�xra^�®�@Iwr^�z¡� ��¯C�laXz7^�qlm\aIzpy¸r¹C�la�stzlxvjlyCgt[#]#sihI^�gtm�^�ZMa�^�gt¯C^�o�mCxvZMaIm\aIzpyw;^�z¡��^�ZMa{�pstm\xlgi^�o#a��^�m�'¯C�laXz Q�4�536�^�z¡� ��¯C�laXz7^�qlm\aIzpy¸

( a ( a*) �\c � �.1Á�l��ciÍ ]�Í�^W��_!É. �ÍS].-�� ���l��c°Í ]�f@_!�¡�IɹC�la�g}a�©°yWhk[#gtjl`�z�[�©�Ænst]#jlZ\a R��paImkhkZMstqraIm�y\�la'yMZ_^Qhka�[�©�y\�la��ps"!¦aXZMaIzpyMm'stzlxljvyMm7?°s±¸ a#¸py\�la�yM�vZMaIa�®pstz¡�pm[�©�gt[Q]#sihI^�g;�pak©±^�jlgtyMm����¦w���^�z¡� �;wl^�zr�by\�la�aI§QaIzpyWstzlxljvy u LY /=T65K7y-�8 Y�@I¸p¹C�la'ZMst]Q��yWh�[#gtjl`bz�mM�l[�¯Cm

øiùnú)øiû

Page 20: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

��������� ��� ����������������� ��� ��������������� ������ ���!���"�#���$���%�&�'���(������)*�����+���,�-����)iÂ�Ã*� � �

Ænst]#jvZMaORlºp¹C�la'm\s}`�jvgª^�yMst[#z�[�©�y\�la�hk[#zp¤rZM`�^�yMst[#z�xv�¡^�m\a#¸

y\�la'�lstaIZ_^�Z_h\�lsihI^�g;xvZMaIaI`�xlyMst§QaCmMyMZ\j¡hky\jlZMa�[�©)yM�la'stzpyMaIZ\§#^�gtm��pjvZMstzl]�yM�la'hk[#zp¤rZM`�^�yMst[#z�xv�¡^�m\a#wl^�m%¯�aXg}g^�mCyM�la�[QjlyMxvjlyCaI§#aXz�y8/=T65 �,Q X 5¦¸=±z�yM�vaCx¡^�Z\yMsihkjlgi^�Z9mMst`�jlgi^�y\s}[QzWy\Z_^#h�aWstgtg}jvmMyMZk^�y\a��stz�Æns}]QjlZMa6Rvw�yM�la%¤¡Z\mMy%aI§#aXz�y9[�hXhkjlZMmC^�y!y\s}`�a�c �

[QzbyM�va��v[#ZMs(AI[Qzpy_^�g;mkhI^�gta#ºpy\�la'gt[#]#sihI^�glstzlxljly ��qrahk[#`�aImiQ�4�536#¸pe%[#zlm\auQjlaIzpyMgtopwpyM�la'stzpyMaIZ\§#^�g ��XBY ���?±hk[#Z\ZMaIm\x¡[Qz¡�pstzl]�yM[�y\�labstzpyMaIZ\§#^�g � ��� s}zD��ahkyMst[Qz=�l¸æcv¸}�#@Cstm�[Qx¡aIzva�;w!^�z¡� ��X�Y �7stm�stz�styMm�stzlsty\sª^�gm\y_^�y\a Qy-�Y�i,G63 Tl¸�>CyCy\�la'aIz¡��[�©./ T�8,7'k ���'?î©°[#ZCy\�lstmCmMst`�jlgi^�y\st[#z)º�� �3@%s±¸ aQ¸�^�yCyMst`ba6R��lw Q { T;X �;X�Y �[lhIhkjvZMmwn^�z¡��y\�la�s}zpy\aIZM§#^�g � ��stmWstz�styMm'stzlstyMsi^�g;§#^�g}jva Qy-�Yi,G�3 Tl¸�>Cy'yM�la�aIz¡� [�© /=Ty8,7'k � ?i©°[QZWyM�vs}mm\s}`�jvgª^�yMst[#znº#� �3@%s­¸ a#¸r^�yCy\s}`�a����lw Q { T;X �;X�Y �b[lhIh�jlZMm�¸��9ak©°[QZMa�y\�la�aIzr��[�© /=T�8h7'k �¦wr^�yCy\s}`�a{�Q� �lwy\�la��pa�©­^�jlgty ����qrahk[#`�aIm�Q�4�536#ºßs}y�hI^�jlmMaXm{stzpyMaIZ\ZMjlxvyMst[#z�[�©�y\�labhk[#z�¤¡ZM`�^�yMst[Qz�[#z»[#y\�laIZ{�pa�©­^�jlgty\mw^�z¡��aI`bstmMm\st[#zb[�©:s /=T65 �,Q X 5;¸

( a ( a ( �\c � �.1Á�l��ciÍ ]�Í�^W��_!É�����Ép�l� ��É ]n��f6_!�¡�XÉÆnst]#jlZ\a �*stg}gtjlm\yMZk^�yMaXm�^*yMZk^#hka�[�©�y\�la�q¡aI�r^�§�st[QZ�[�©�yM�va z,+ T�7 Y �=T�X�Y�xlZM[lhkaIm\m¸n£Ç�laIz»yM�va��pa�©­^�jlgtyFs}mhk[Qzp¤¡Z\`ba��^�y�y\st`ba�c��Wstz�yM�lstm!m_hX^�gta7?­^�y�yM�laCxra^�®�©°[QZ s /=T65 �,QWX 5�@Iw'Q { T�X�� z,+ Ty7 Y�^�zr� &ST�� w { T;X[lhIhkjvZ¸r¹C�la'stz�y\aIZM§#^�g � s,+ Ty7��bstm%aIzpyMaIZ\a��stz�s}y\mCstzlstyMsi^�grmMyk^�yMa G;X�i,G63 T�wp^�zr�bstzpyMaXZM§#^�g � w { T�Xbs}z�styMm

únú åVU�W�X�W �

Page 21: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

� � � ����������4�����51 ���M��� ��V���$���!23�$�"������4������%� ��� �3���

Ænst]#jvZMa �lºp¹C�la�mMst`�jlgi^�y\s}[Qz{[�©Øy\�la�yMZ\a^�y\`baIzpy%xl�¡^�mMa

stzlstyMsi^�glmMyk^�yMa ��2�� ���$���X¸p£Ç�laXz w { T;X=T63�s}m%ZMa�hkaIst§#a�ßwl^�y%yMst`baWcQ�lw,Q { T�X�� w { T;X�[lhIhkjlZ\mO?±^�z¡��^��paIgi^�ostm�^QhkyMst§#^�yMa��@X¸ >CybyM�va7aIzr�Ç[�©�y\�lstm��paXgª^�o ? / T�8,7'k � � �¾s}m»��»stzÇy\�lstmbmMst`�jlgi^�yMst[#z�@XwØ^�yby\s}`�a�� �lw& T�� �h8,QniTbstm'aI`bstyMy\a�;¸��,8,Q iT63�stm'ZMah�aIst§#a�½s}`�`�a�psi^�y\aIgto�wpaXz�yk^�stgtstzl]al�8,Qni T�� w { T�X ^�zr��l�8,Qni T� s,+ T�7�� ?Á¯C�lsih\�7stm�^�gtmM[ � w { T;X*� mWxvZMaIm\aIz¡hka�s}zpy\aIZM§#^�g,@X¸=\Wz l�Q�� { � s,+ST�7��)w /=T�8,7�k � ?±c �*s}z»yM�vs}mm\s}`�jvgª^�yMst[#zM@laIgi^�xlmMaIm�^�y)yMst`�a R �vw^�z¡��hI^�jlmMaIm9[�hXhkjlZMZ\aIz¡hkaF[�©*& T�� w { T�X)w�Q { T;X � s,+ T�7���^�zr��� w { T;XqraIstzl]bxvZMaIm\aIzpy�^�zr�bstzlstyk^�gtgto`Qy-�YihG63 Tl¸p¹C�lstmCaI§#aXz�yFstmW^#hky\j¡^�gtgto�yM�la�mMy_^�ZMy\s}zv]�[�©�^�zvaI¯Rhkolhkgta#wl¯Csty\�Z\ahkaIxly\st[#z�[�©)w { T�X=T63{^�y � �vw#aIgi^�xlmMstzl]�[�© /=T�8,7�k � " ��?­cQ��stz�y\�lstm�m\s}`�jvgª^�yMst[#zM@)^�y'� ���lwp^�z¡��aXgª^�xlmMstzl][�© /=T�8,7'k ��^�y��c �v¸p¹C�laIz�hk[#`�aImCyM�va�yM�lstZk��hkolhkgta�¯CstyM��Z\ahkaIxvyMst[#z�[�© w { T;X=T63b^�y���� ��aIgi^�xlmMstzl]�[�©/=T�8,7�k ��� �'?­�Q��s}z�y\�lstmCmMst`�jlgi^�y\s}[Qz�@!^�y��#R#�lwl^�z¡��aIgi^�xlm\stzl]�[�© /=T�8h7'k �b^�y�� � �l¸3>CyWyM�vs}mCm\y_^�]#a#wvyM�lagi^�m\yWhkolhkgta�stm�[�§QaIZwr^�z¡�9/=T65 sh+ T�7���[lhIh�jlZMm�w¡aXz�yk^�stgtstzl]�l�8,QniT�� zh+ T�7 Y;¸

øiùnú)øiû

Page 22: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

��������� ��� ����������������� ��� ��������������� ������ ���!���"�#���$���%�&�'���(������)*�����+���,�-����)iÂ�Ã*� ��

g!§QaIz�s¥©�yM�va{m\s}`�jvgª^�yMst[#z�stm�jvmMak©°jvg!©°[#Z�^*x¡^�Z\yMsi^�g!§#^�gtsi�l^�yMst[#z�[�©C^bm\x¡a�hks¥¤¦hI^�y\st[#z)w;¯%a�hk[#jlgi� zl[#yxlZ\[�§#a�y\�¡^�y�y\�la�mMopm\yMaI` �¡^�m�yM�la»]#[p[l�¾q¡aI�r^�§�st[QZw%q¡a�hI^�jlm\a-^�gtgCyM�va7mkhM�va�pjlgtstzl]#m�hk[#jvgª� zl[#y�q¡ahk[QzlmMsi�paXZMa�;¸r¹C�la�[#zlgto�¯C^�o�s}mCy\[{jvmMa'©°[QZM`�^�g¡^�z¡^�gtopmMstm¸

� � "��%$&��,»���'�%���7�F�'�%�"��+���&% � � � ���

=±zÇy\�lstm �pahky\st[#z)w9¯�a�qvZMstak¿¡o¾xlZMaIm\aIzpy�yM�la�`�[l�paIgtm�^�z¡�¾yM�la `baIy\�l[l�pm�jlmMa��¾©°[#Z�y\�la7^�jlyM[Q`�^�y\a�^�z¡^�gtopmMstm![�©¡xvZM[#]QZ_^�`bmØ^�z¡�'y\�laCxlZM[p[�©¡[�©;yM�laXs}Z!xlZ\[#xraIZMy\staIm¸Q¹C�laIo{^�ZMaCjlm\a��stz�yM�vaCxlZM[p[�©r`baIy\�l[l�F©°[#Z�popz¡^�`bsihI^�g�xvZM[#xraIZ\yMstaIm%[�©!²l³°´nµ;¶;·#xlZ\[#]#Zk^�`�m ; R�<M¸�¹C�laCa�u#jr^�yMst[Qz¡^�glzr^�yMjvZMaC[�©;yM�va'²l³°´nµ;¶;·{gi^�zv]#j¡^�]#agta^Q�pm)z¡^�yMjlZk^�gtgtoWy\[WyM�va�jlm\a�[�©l`baIy\�l[l�pm;q¡^�m\a��[#z�m\o�m\yMaI`�m)[�©�xr[#gtopzl[Q`bsi^�g��popz¡^�`�sih;auQj¡^�yMst[#zlmn[�§#aIZ� ��� � � � ^�m�^ ©°[#Z\`�^�g�`b[l�paIgp[�©;yM�va�qraI�¡^�§pst[#Z![�©;yM�vaCxlZM[Q]#Z_^�`bm ;}��c�<M¸¹C�vs}m�^�mMxrahky%s}m�^�z{[QZMst]#stz¡^�g}sty±oC[�©y\�la'²l³°´nµ;¶;·{^�xvxlZM[p^#h\��h�[#`bxr^�ZMa��'yM['[#y\�laIZ\mwQa#¸ ]¡¸Q� D�E8F�G8Fl·rw�jlmMstzl]F¤¡zvs}y\a�m\y_^�yMaW^�jvyM[#`�^�yk^7; ��<M¸�¹C�lam\o�m\yMaI`�m'[�©�xr[#gtopzl[#`�si^�grauQj¡^�y\s}[Qzlm�hI^�Zk^#hky\aIZMs(AIa�m\aIyMm�[�©�m\[#gtjlyMst[Qzlmwr¯C�lsih\�7^�Z\a{m\y_^�yMaIm{^�z¡��aI§QaIzpyMm�¸¹C�la'y\ah\�lzlsiuQjlaImCjlm\a��s}z�yM�laF`baIy\�l[l�bhk[QzlmMstm\y�stzb`�^�zlstxljvgª^�yMstzl]FyM�laFauQj¡^�y\s}[Qzbm\o�m\yMaI`�m�stzlm\yMa^Q��[�©y\�la�mM[QgtjlyMst[#zvm�m\aIyMm�w¡¯C�vsªh\��^�§#[Qsi�pm�y\�la'aIzpjl`baXZ_^�y\st[#zb[�©Øy\�la�mMyk^�y\a�m\x¡^#h�a#¸

��"$# %8>�0@4���� 3�>�C 2+4)E 0 T!L+*�D ? , ��>�3�E�>�0@C 2+4F1B3 0 ����� 1B(.C 3�� � 3�5 �)4)3�C�2$0@5(.-�/)0.1�2+3�4��

��cM`S]!� 1±�Wa =±zb[#Zk�paIZCy\[{xlZ\[�§#aFs}y\mW�popz¡^�`�sihI^�glxvZM[#xraIZ\yMstaImwr^�²l³Á´)µ;¶;·�xvZM[lhkaIm\mMaIm'stm�y\Z_^�zlmMgi^�y\a��stz�y\[^½mMopmMy\aI`�[�©{xr[#gtopzl[Q`bsi^�g�a�u#jr^�yMst[Qzlmb[�§QaIZ � ��� � � � w�s±¸ a#¸�stzpyMaI]QaIZMm�`�[���jlgt[7�lº mI«I�#w �lwt�6p ;t� ��<M¸!¹C�laxlZ\stz¡hkstxlgta's}m%yM[bh�[���a�y\�la'yM�lZ\aIa�xr[#m\mMstqlgta'§#^�gtjlaIm%[�©�^�qr[p[#gta^�z�mMst]#zr^�g=K'?°s±¸ a#¸tw3�����5����� �Ø^�z¡� � ��2 �Xwp[#Z�M���5�������Ø^�z¡� ���) ���Iwp[QZQ���5������� @%stz.^+���(������)C�-�����$����)N��qpo»º�� �� 4�6�� 6�� Q��qQ�4�536 � �{�� 4�6�� 6�� Q�� f�������6 � S������� 6�� Q � �

Æv[#ZCy\�la'zl[#zp«±qr[�[Qgta^�z�mMst]Qz¡^�gtmwQ¯%a�[Qzlgto�hk[l�pa'y\�la'©­^QhkyCyM�¡^�yCyM�la'm\s}]Qz¡^�g;stm!�M���5�������;[#ZQ� ���������±º! � 4�6�� 6�� Q"� #������� 6�� Q � �

� [#yMa�yM�¡^�y�yM�va�m_uQj¡^�Z\ab[�© � 4�6�� 6�� Q�s}m��#w;¯C�¡^�yMaI§QaIZ�s}y\m�§#^�gtjlaQw;¯C�laIz�sty�stm�xlZ\aImMaXz�y�¸)vCaIzrhka#wn©°[QZ�^m\s}]Qz¡^�g K¦w�s}y\m�hkgt[lh\®�hI^�z�q¡aWh�[���a��qpo$ p ¸�=±y!©°[#gtgt[�¯Cm)y\�¡^�y9y±¯�['mMopz¡h\�lZ\[#zl[Qjlm%mMst]#z¡^�gtm6K�^�z¡�B��mk^�y\s}m¬©°oy\�la{hk[QzlmMy\Z_^�stzpyCauQj¡^�yMst[#z)º% p j'& p ¸l¹C�lstm9©­^#hkyCstmCjlm\a��akÀly\aIzlmMst§QaIgtobstz�yM�laF©°[Qg}gt[�¯Cstzl]r¸�'�6c ��cÁ��c�d¡É�f!��Í) �É����XÉ�� a g�^Qh\�=[�©�y\�la�xlZMst`bsty\s}§Qa{xvZM[lhkaIm\mMaIm�[�©�²l³°´nµ;¶;·-hI^�z¾q¡a�aIzrhk[l�pa�¼stz=^xr[#gtopzl[#`�si^�g;auQj¡^�yMst[#z)¸rÆl[QZWakÀ¡^�`bxlgta � !�#)(%$'&=T;X%s¦wr¯C�lsih\��`�a^�zlm�>�� *� j � � 1 ���,+ j � ��) ���+ j �y>bhI^�z»qra�ZMaI¯CZ\styMyMaXz�s}z,+ j � ?�S-� S.� p @XºlyM�va{m\[#gtjlyMst[QzlmW[�©�y\�lstm�^�ZMa�yM�la�mMaIy'[�©�qraI�¡^�§pst[#Z\mW[�©y\�la�xlZ\s}`�styMst§#aCxlZ\[lhkaImMm�$'& T�X)¸

¹C�vaW�paIgi^�o Erw�¯C�lsih\��stm�^'�popz¡^�`�sªh�[#xraIZ_^�yM[#Z�w#stm���s !;aIZ\aIzpy�qrahI^�jlmMaFs}y!Z\auQjlstZMaImC`�aI`b[QZMs(AIstzl]%yM�lax¡^�mMyC§#^�g}jvaC[�©Øy\�laWm\st]#z¡^�g¡stzpyM[�^ ��� �-� � �-�����$����)N�0/¡¸�=±z�[#Z_��aIZCyM[�aXz¡hk[l�pa��D!�# K(E �4G�X�GWY4� J¡wQ¯%a

únú åVU�W�X�W �

Page 23: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

c�� � ����������4�����51 ���M��� ��V���$���!23�$�"������4������%� ��� �3���

�¡^�§Qa'yM[�stzpyMZM[l�pjrhka'yM�la�y\�lZMaXa'©°[#gtgt[�¯Cstzl]'auQj¡^�y\st[#zlm�º

/�� j � ?_��S p @ / ?_��@& j /� p ?­c�@/ C j & C ?­��@

g�uQj¡^�yMst[#z0?_�#@��paImkhkZMstqraImW¯C�¡^�y�¯CstgtglqraWy\�la'zlakÀly�§#^�gtjla/ � [�©)y\�laWm\y_^�y\a'§#^�ZMsi^�qlgta#¸�=Á©��stm �������������­w / �stmCauQj¡^�g;yM[ ?Áq¡ahX^�jlm\a�?_��S p @ j �3@Iwl[QyM�laXZM¯CstmMa / � stm%auQj¡^�gnyM[�y\�la'gª^�mMy%§#^�gtjla'[�© )wp`�aI`b[QZMs(AIa�qpo /¡¸�g�uQj¡^�y\st[#z'?­c3@n]#st§#aIm9yM[ & y\�laWgi^�mMy!§#^�gtjla%[�©� ?Ás­¸ a#¸�yM�laF§#^�gtjla%[�©�/ @�^�z¡��h�[#zlm\yMZ_^�stzlm�yM�vaWhkgt[�h\®pm& ^�z¡� �y\['q¡aCauQj¡^�g±¸�=±z¡�paIa��;w & p j / p ��#w#^�z¡��stz � ��� � � � ¯�aC�¡^�§Qa �� j ?°qrahI^�jvmMa ?�S���@�� j S��#@Iws±¸ a#¸ � j p wlm\[ & p j / p p T�/ p j �'qrahI^�jlmMa /bstmW^�gt¯�^�opm%xlZMaXmMaIzpywr�laXz¡hka & p j p ¸g�uQj¡^�y\s}[Qz ?­��@hk[QZMZ\aImMxr[#z¡��m�y\[�yM�la'stzlstyMsi^�g¡§#^�g}jva�[�©�/¡wp¯C�lsih\��ZMaIxvZMaIm\aIzpyMm�y\�la's}zvs}y\si^�gr§#^�gtjlaW[�© & ¸

¹C�vaCy_^�qvg}aC�r¸t��m\�l[�¯Cm%�l[�¯=^�g}gvyM�laFxlZMst`bsty\s}§Qa�[#xraIZk^�yM[QZMmC^�Z\aCyMZ_^�zlmMgi^�yMa�*s}zpy\[�xr[#gtopzl[Q`bsi^�gQauQj¡^�«y\s}[Qzlm¸

��[p[#gta^�z�s}zvmMyMZ\j¡hky\s}[Qzlm� º j X�Q Y K & j S 0 º j Kq7 X 34� � j & ? & S BS & S �#@ p j & p0 º j KqQ'+4� � j & ?k��S BS & S & @ p j & p0 º j K(3 T65 7y-n8 Y9� � j � ?k��S p @ &0 º j K($'&=T�X(� � j ?�S & S & p @� º j KqE��Z�G�X�GWY & C�_ / � j � ?k��S. p @ /& j p //�C j kKC

zv[#zp«±q¡[p[Qg}a�^�zbstzlm\yMZ\j¡hkyMst[Qzlm� º j f8?Mk m h#B#B�Bsh$k t @ & p j p m j����Wj pt0 º j K(3 T65 7y-n8 Y9� �

p j p � & p S. p & p0 º j K($'&=T�X(� �

p j p ?�S & S & p @� º j KqE��Z�G�X�GWY & C�_ & p j p

¹�^�qvg}aORvºp¹ØZk^�zlm\gi^�yMst[Qz�[�©�yM�la'xlZ\st`bstyMst§#aC[Qx¡aXZ_^�y\[#Z\mWstzpyM[�x¡[Qg}opzl[Q`bsi^�gpauQj¡^�yMst[#zvm¸

�'��Í) �Él��XÉl�Wa ��o-h�[#`bxr[#m\stzl]�yM�la�auQj¡^�y\s}[Qzlm�Z\aIxlZMaXmMaIzpyMstzl]�y\�labaXg}aX`baIzpy_^�ZMo»xlZM[lhkaXmMmMaXmw�^�zpo-²l³i�´nµ;¶;·¼mMxrahks¥¤¦hI^�yMst[#z hI^�zÇq¡a»yMZk^�zlm\gi^�yMa��¼stz�y\[-^�m\aIy�[�©�auQj¡^�y\st[#zlm�hI^�gtgta�¼xr[#gtopzl[#`�si^�gC�popz¡^�`�sªhm\o�m\yMaI`»¸ � mMstzl]�y\�lstm�aXz¡hk[l�pstzl]¡wQyM�vaWZMa�^#hky\s}[QzbaI§QaIzpyMm%[�©)y\�laWxlZ\[#]QZ_^�`»w�s­¸ a#¸QyM�vaW§#^�gtjlaC[�©)a^#h\��[�©)yM�la� ���(������) �-�����$� ��)(����^�z¡� � ��� �-� �+�-�����$� ��)(���Iw)^�ZMa�ZMaXxlZMaIm\aIzpyMa�¾qpo7^�§#a�hkyM[QZ�stz ? � ��� � � � @ t ��� ¸;Æl[QZ±«`�^�gtgto�wk^Cxr[#gtopzl[#`�si^�g�popz¡^�`bsihnmMopmMy\aI` hX^�z�qra�Z\aI[#Z\]�^�zls(AIa�'stzpyM[FyM�lZ\aIa�m\jlqp«±mMopmMy\aI`bm![�©�xr[#gtopzl[Q`bsi^�g

øiùnú)øiû

Page 24: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

��������� ��� ����������������� ��� ��������������� ������ ���!���"�#���$���%�&�'���(������)*�����+���,�-����)iÂ�Ã*� cl�

auQj¡^�yMst[#zvmC[�©�yM�laF©°[QZM`»º �� � ?lk�h$e @ j �

k � j ] ?lk�h$eQ@��C�?Mk @ j �

¯C�laXZMa#º

b kHs}mC^�mMaXyW[�© ��§#^�ZMsi^�qvg}aXmwlhI^�g}gta� ��� �-� �:�-�����$� ��)(���IwpZMaXxlZMaIm\aIzpyMa� qpo�^�§QahkyM[QZCstz4? � ��� � � � @ t Tb e4s}mW^�mMaXyW[�© � §#^�Z\sª^�qlgtaImwphI^�g}gta� ���-�����!�-�����$� ��)(���IwpZMaXxlZMaIm\aIzpyMa� qpo�^�§#ah�yM[#ZCstz ? � ��� � � � @ � Tb k � j ] ?lk�h$eO@;stm;yM�va9������) 23� �$��� ����2��#���$���C[�©lyM�la�m\opmMyMaX`4TIsty)hI^�z�qra�hk[#zvmMsi�paIZ\a�{^�m)^%§#ah�yM[#Z\si^�g©°jlz¡h�yMst[#z ; ]Fm;h#B#B�B$h ]�� <¡©ÁZM[#` ? � � � � � � @ t ��� y\[ ? � ��� � � � @ t ¸�=±y�]QZM[#jvxlm�^�gtglyM�la'auQj¡^�yMst[#zvm�[Qz�yM�lamMyk^�yMa�§#^�ZMsi^�qlgtaImwl^�z¡�bhI^�Z_^QhkyMaIZ\s(AIaIm'yM�la��popz¡^�`�sªhX^�g¡^�mMxrahky'[�©!yM�la'mMopm\yMaI` T

b � ?lk�h$eQ@ j ��stm�yM�la ����� ��������� ��� � ����2��-� �$���¼[�©{y\�la�mMopm\yMaI`»w�sty�stm�^-§Qahky\[#ZMsi^�g�a�u#jr^�yMst[Qz;��8m;h#B�B#Bsh������N<¬¸�=±yC]QZM[QjlxlmCyM�va�auQj¡^�y\st[#zlmWhI^�Z_^QhkyMaIZ\s(AIstzl]�yM�la�mMy_^�yMsihI^�g)^�mMxrahkyF[�©�yM�va�m\opmMyMaX`4T

b ��C�?lk%@ j �¾s}m�y\�la �&���(���$��) �J��#���$��� ����2��#���$���¼[�©{yM�la�m\opmMyMaX`7w%stybstm�^-§Qahky\[#ZMsi^�g�a�u#jr^�yMst[Qz;�� C � h#B#B�Bsh�� C�� � � <M¸�=±yC]#ZM[QjlxlmCy\�la�auQj¡^�yMst[#zlmWhX^�Z_^QhkyMaXZMs(AIstzl]�yM�va�stzlstyMsi^�gts(A^�y\st[#z�[�©Øy\�la�m\o�m\yMaI`»¸

>¼xr[#gtopzl[#`�si^�g#�popz¡^�`bsih!mMopm\yMaI`�hI^�z{qraCmMaIaXz�^�m�^ ¤¡zlsty\aCyMZ_^�zlmMsty\s}[Qz{m\opmMyMaX`7¸�¹C�la%stzlstyMsi^�gpm\y_^�y\aIm[�©¡yM�lstm�^�jvyM[#`�^�y\[#z�^�Z\a�y\�la�m\[#gtjly\s}[Qzlm)[�©¡yM�va�auQj¡^�yMst[#z��C�?Mk%@ j �v¸�£Ç�laIz�yM�la%mMopm\yMaI`@s}m!stz{^ mMy_^�yMa�4? � ��� � � � @ t wp^�zpo�aI§#aXz�y & 4? � ��� � � � @ � mMj¡h\��yM�¡^�y�� ? [h & @ j ��hI^�z�hk[#zvmMyMsty\jlyMa�^�yMZ_^�zlmMsty\s}[Qz)¸3=±zy\�lstmWhI^�m\a#wryM�la'mMopm\yMaI`(aI§Q[#gt§#aXmCyM[b^�mMy_^�yMa$ � mMjrhM� yM�¡^�y � j ] ? .h & @I¸

£�a!y\��jvmØ�r^�§#a�^ `�^�y\�laI`�^�yMsihI^�g`�[l�paIg�h\�¡^�Z_^QhkyMaIZ\s(AIstzl]'yM�la%q¡aX�¡^�§ps}[QZ)[�©v��o�zr^�`bsihI^�g�mMopmMy\aI`bm�¸#=±zy\�la�xraIZ\mMxrahkyMst§QaW[�©¡^�z¡^�gtopmMstzl]Cy\�laImMaCqraI�¡^�§pst[#Znqpo�y\�la�aI§#^�gtj¡^�y\s}[Qz'[�©¡y\�la�mk^�y\s}m¬©­^#h�yMst[#z'[�©rxlZM[Qx¡aIZ\yMstaIm�w¯%aWzlaXa��[#xraIZ_^�yMst[#zvm�[Qz{m\o�m\yMaI`�m�[�©)xr[#gtopzl[Q`bsi^�g¥mwI¯C�vsªh\��¯Cstgtglhk[#Z\ZMaIm\x¡[Qz¡��yM['yM�laF`�^�zlstxljlgi^�y\s}[QzW[�©y\�la'mMaIy\mC[�©)yM�vaIstZ�m\[#gtjlyMst[Qzlm¸Q¹C�lstm�¯C^�o�¯�a'hI^�z�akÀlxlZMaIm\mW[QjlZMm\aIgt§#aImC^�qr[#jly%mMaXyMmC[�©)qraI�¡^�§pst[#Z\mwpm\y_^�y\aIm^�z¡��yMZk^�zlm\s}y\st[#zlm�w#¯C�lstgtaCmMy\stg}gvZMaI`�^�stzlstzl]Wstz�y\�la��p[Q`�^�s}z�[�©;x¡[Qg}opzl[Q`bsi^�g�©°jlz¡h�yMst[#zlm�w�^�z¡��zl[Qy��¡^�§pstzl]y\[�aIzpjl`baIZk^�y\a�y\�laI`»¸

��" ! � (.>�0.1�2+3�4�� 3�4 1�&)( � 3�5 �)4�3�C�2$065�7 �)4)0@C�2 �=0@5������ 1B(.C��¹C�la'y\�laI[#Z\o�[�©Øxr[#gtopzl[Q`bsi^�gl�popz¡^�`bsihI^�gvmMopmMy\aI`bmCjlm\aImW[Qx¡aXZ_^�y\st[#zlm%stz�^�gt]QaIqlZ_^�sihW]QaI[#`�aIyMZ\o{m\j¡h\�7^�m§#^�ZMstaIyMstaIm�wlsi�pa^�gtm�^�z¡��`b[#Z\xl�lstmM`�m6;t�cpw;����<¬¸

b�Él� ��6cYf!��c°Í ]�Í ^���_!É��!�¡� c­ �Ír����É� �� ����]�μÍf�Ép���l��c°Í ]��Wa ;aXyWjlm'�pak¤¡zla�yM�va�uQjl[QyMstaIzpyCZMstzl]�[�©xr[#gtopzl[#`�si^�gp©°jvz¡hkyMst[Qzlm�� ; k�h+e7< j � � � � � � ; k�h+e < ����� � @ ��� � � @ ��� p ºpsty%stmCyM�la'mMaXyW[�©!x¡[Qgto�zv[#`bsi^�g¨m!stz� ��� � � � ©°[#ZC¯C�lsih\�by\�la{�paX]#ZMaXa�stz�a�^#h\��§#^�ZMsi^�qlgtaWstm�� c�qrahI^�jvmMa�[�©Øy\�la'©­^QhkyCyM�r^�y�k � j k�¸ ;aIy��qra{^�mMaIyF[�©�aI§#aXz�yW^�z¡��mMyk^�yMa�§#^�ZMsi^�qlgtaIm�stz0? � � � � � � @ t ��� ¸p¹C�vaW©Á[#gtgt[�¯Cs}zv]�mMaIyF[�©!x¡[Qg}opzl[Q`bsi^�g¥mº

� ?��O@ j m � � ; k�h$e7< � g ? [h & @!"�qh � ? .h & @ j �Kp#�$�%�&�$(' à±èMíîïl÷*) %�& )�+rð�è¬å#âIì°è\í¡ë õæõ ì þ è;ï�â õ òIå#âkýCä¨ë õ í $�%, &$ , ' à­è\íiïl÷-) %, & ) , +¬÷

únú åVU�W�X�W �

Page 25: Specifying and verifying a transformer station in Signal and … · 2016-12-27 · Herv e Marchand, Eric Rutten, Mazen Samaan To cite this version: Herv e Marchand, Eric Rutten, Mazen

cQc � ����������4�����51 ���M��� ��V���$���!23�$�"������4������%� ��� �3���

stm�hI^�gtgta�'y\�la7�$������)X[�© � s}z �Q; k�h+e <¬¸�¹C�lstmnmMaIy�Z\aIxlZ\aImMaIzpy\m�^�g}gQyM�la%xr[#gtopzl[#`�sª^�gtmw¬©°[#Zn¯C�lsihM��yM�laCm\aIy �stm�^FmM[QgtjlyMst[#zn¸�=±z{y\aIZM`�m�[�©)�popz¡^�`bsihI^�gQmMopmMy\aI`bm�w#sty!ZMaXxlZMaIm\aIzpyMmCy\�laWm\aIy�[�©;auQj¡^�yMst[#zlm%hM�r^�Z_^QhkyMaXZMs(AIstzl]y\�la�mMyk^�y\aIm�^�z¡��aI§#aIzpy\mWstz ��¸

� ahkstxlZ\[�hX^�gtgto�wQyM[b^�z�o�mMaIyF[�©�xr[#gtopzl[#`�sª^�g¨m��*wp¯�a{hX^�z�^�m\mM[lhksi^�y\a{^�mMaIyFstz4? � ��� � � � @ t ��� w¡hI^�gtg}a��y\�la �������$�5��C[�©���wl�pa�¤¡zla��^�m%©°[#gtgt[�¯CmºAO?��O@ j m3? .h & @� ? � � � � � � @ t ��� � g � ��qh � ? .h & @ j �Kp

¹C�lstm'mMaXy{Z\aIxlZMaXmMaIzpyMm�^�gtg!yM�va�mM[#gtjly\st[#zlmF©°[QZ�^�]Qs}§QaIz�m\aIy�[�©Cxr[#gtopzl[#`�sª^�gtm¸�=±z»yMaIZ\`bm'[�©���o�zr^�`bsihI^�gm\o�m\yMaI`�mw;styFZMaIxlZ\aImMaXz�y\m{y\�la�mMaIy�[�©�mMyk^�y\aIm{^�zr��aI§#aXz�y\m{^#��`bstmMm\s}qvg}a'qpo�yM�la��popz¡^�`bsihI^�gnmMopmMy\aI`bmFstz��¸

¹C�vab^#�p§#^�z�yk^�]Qa{[�©�jlm\stzl]�sª��a^�gtm�stm'yM�¡^�y�yM�vaIZMa�akÀls}m\yMm�^��pstZMahky�hk[QZMZMaXmMxr[#z¡�l^�z¡hka�qraIy±¯�aXaIz=^�zsi�pa^�g�^�z¡�¼yM�va7^�m\mM[lhksi^�y\a�¼§#^�Z\staIy±o�¸ =±z¾©­^#hky�w%¯�a�hI^�zÇa^�m\aIgto¼xlZM[�§Qa�yM�¡^�yw9s}z yM�la7uQjl[QyMstaIzpy�ZMstzl]� ; k�h$e7<Mº

A ?���? �O@"@ j �4^�zr� � ?�A ?�����6@P@ j ����¯C�laXZMa#wn©°[QZ�^�mMaIy�[�©Cx¡[Qg}opzl[Q`bsi^�gtm���w �����4stm�yM�va�mMaIy�[�©�^�gtg!gts}zva^�Z�hk[Q`�qlstz¡^�y\s}[QzlmW[�©�xr[#gtopzl[�«`�sª^�gtmCs}z���ºryM�lstmW`�a^�zvmWyM�r^�y'yM�laXs}Z'm\[#gtjlyMst[QzlmWstz¡hkgtj¡��a�yM�l[QmMa�[�©���¸l¹C�vs}m'¯C^�o�wv¯�a�hI^�z�yMZk^�zlm\gª^�yMaxlZ\[#xraIZMy\staIm'[�©�mMaIy\mWstzpyM[�auQjlst§#^�gtaIzpyCxlZ\[#xraIZMy\s}aXmW[�©�^�mMmM[lhksi^�yMa��si�pa�^�gtmC[�©!x¡[Qg}opzl[Q`bsi^�gtm�¸�vCaIzrhka#wrstzlm±«y\a^#��[�©)`�^�zlstxljvgª^�yMstzl]FakÀlxlgtsªh�s}y\aIgtob^�z¡��aXz�jv`baIZk^�yMstzl]�yM�la'mMyk^�y\aImwvyM�lstmC^�xlxlZ\[�^QhM��`�^�zlstxljlgi^�y\aIm!yM�laxr[#gtopzl[#`�si^�gr©°jlzrhkyMst[#zvm�h\�¡^�Z_^QhkyMaIZ\s(AIstzl]�yM�vaIstZ�m\aIyMm�¸J>Fz7[QyM�laXZ�st`bxr[#ZMyk^�zpyW^�m\x¡a�hky{stm'yM�r^�y�^�z»si�pa^�ghI^�z�q¡a'ZMaXxlZMaIm\aIzpyMa� qpo�^�mMstzl]QgtaWxr[#gtopzl[#`�sª^�g±whI^�g}gta� �$1��!�M��� ����� ����) �����������-� ���I¸p¹C�lstm�xr^�ZMy\sihkjlgi^�Z\s}y±ostmCjlm\a��stzby\�la�xlZk^�yMsihI^�g;st`bxlgtaI`�aIzpy_^�y\st[#z�[�©�y\�la�^�gt]#[QZMstyM�v`bm�[Qz�si�pa�^�gtm¸

Æv[#Z!akÀ¡^�`bxlgta#wX©°[QZ�yM�laWh�[#zpyMZk^�stzpy�auQj¡^�y\st[#z � [�©)^'x¡[Qgto�zv[#`bsi^�g#�popz¡^�`�sªh9mMopm\yMaI`»º�yM�laCa�u#jr^�yMst[Qz� ?Mk�h+e @ j ��Z\aIxlZ\aImMaIzpy\m�^�m\aIyW[�©Øxr[#gtopzl[#`�si^�gpauQj¡^�y\st[#zlm�w¡�pah�[#`bxr[#m\a��^�m%©°[Qgtg}[�¯Cm�º�� �8m�?lk�h$eQ@ j �

B�B#B����� ?lk�h$eQ@ j �

=Á©��@stmCyM�la'mMaXyW[�©!mM[Qg}jvyMst[#zlmC[�©Øy\�lstmCmMopmMy\aI` [�©�auQj¡^�y\s}[QzlmwpstyCstmChkgta^�ZFyM�¡^�y� j AO?�� � m h#BNB(B(BJh�� � ���6@C^�z¡� ��?��:@ j � � m h#BNB(B(BJh�� � ���

�p[�stzlmMy\a^#��[�©�`�^�zlstxljlgi^�y\stzl]�yM�va�mMaIy'[�©�m\[#gtjly\s}[QzlmW[�©�yM�la�hk[#zpy\Z_^�stzpyWa�u#jr^�yMst[Qz��*w¡Z\aIxlZ\aImMaIzpy\a�»stz[QjlZ�hX^�mMa'qpob^'§#^�ZMstaIy±opw#¯%a�hI^�zba^�mMaIgtobhk[Qzp§#aIZ\yCs}y%stzpyM[{^�z�sª��a^�g�� ?��O@Fwp¯C�lsih\�bhI^�z�qraWZMaXxlZMaIm\aIzpyMa�qpoÇ^»mMstzl]Qg}a x¡[Qg}opzl[Q`bsi^�gÁ¸)¹C�vs}m�¯C^�opw�¹C�la�Z\aIgi^�y\s}[Qzlmw9gts}®Qa�s}zrhkgtjlmMst[#z¼[�©�m\aIy�[�©�mMyk^�y\aImw%qraIy±¯�aXaIz�ps"!;aIZMaXz�y\m'mMaIy\mwl¯Cstgtg;qra�h�[#`bxvjlyMa��qpo�[#xraIZk^�yMst[QzlmC[#z�xr[#gtopzl[#`�sª^�gtm¸

�Bf�Ép���l��cÁÍ ]��9Í ] ÎnÊ=]!� ��c± �� 1r��É_!� d�c°Ír�#� aU¹![�hI^�xlyMjlZ\aCyM�laC�popz¡^�`bsihI^�g#^�mMxrahky�[�©¦^Cxr[#gtopzl[Q`bsi^�g�popz¡^�`bsihI^�glmMopmMy\aI`7wp¯%aWstzpyMZ\[l�pj¡hka'yM�va�zv[#yMst[Qzb[�©)`�[#Z\xl�lstmM`�^�zr�bhk[Q`b[#Z\xl�lstmM`»¸#> ������� 1 �(��� stm�^xr[#gtopzl[#`�si^�gQ©°jlz¡h�yMst[#z*] ©°Z\[#` ? � ��� � � � @ t ��� yM[ ? � � � � � � @ t ?°y\�la ������) 2����$���4����2��#���$���{[�©)yM�la'm\o�m\yMaI`k � j ] ?Mk�h+e @IwQ©°[QZCakÀ¡^�`bxvg}a#@I¸

£ s}y\��yM�la�`b[QZMxl�lstm\` ]2stm{^�m\mM[lhksi^�y\a�¼^ ����������� 1 �(��� ]���©°Z\[#` � � � � � � ; k <CyM[ � � � � � � ; k�h+e <�pa�¤¡zla��qpo;º

øiùnú)øiû