eml-stdlib 0.4.0__py3-none-any.whl

eml_stdlib/circuits/buck_converter.eml

@@ -0,0 +1,74 @@
+// buck_converter.eml -- step-down DC-DC buck converter (CCM).
+//
+// In continuous-conduction mode the steady-state output voltage is
+//
+//   V_out = duty * V_in
+//
+// Output ripple is set by the inductor and output cap:
+//
+//   delta_I_L = (V_in - V_out) * duty / (L * f_sw)
+//   delta_V_out = delta_I_L / (8 * Cout * f_sw)
+//
+// The LC corner sets the closed-loop bandwidth (~1/10 of f_sw).
+
+module buck_converter;
+
+@spice_voltage(name = "Vin",  a = "vin",   b = "0",   value = 12.0)
+@spice_inductor(name = "L1",  a = "sw",    b = "out", value = 22.0e-6)
+@spice_capacitor(name = "Cout", a = "out", b = "0",   value = 47.0e-6)
+@spice_resistor(name = "Rload", a = "out", b = "0",   value = 5.0)
+fn circuit() -> Real
+    where chain_order <= 0
+{
+    0.0
+}
+
+// ── Mathematical certificates ─────────────────────────────────
+
+@verify(lean, theorem = "buck_output_voltage_below_input")
+fn output_voltage(duty: Real, v_in: Real) -> Real
+    where chain_order <= 0,
+          domain: v_in > 0.0
+    requires (duty >= 0.0)
+    requires (duty <= 1.0)
+    ensures (result >= 0.0)
+    ensures (result <= v_in)
+{
+    duty * v_in
+}
+
+// Inductor ripple current.
+@verify(lean, theorem = "buck_inductor_ripple_nonneg")
+fn inductor_ripple(v_in: Real, v_out: Real, duty: Real,
+                   inductance: Real, f_sw: Real) -> Real
+    where chain_order <= 0,
+          domain: inductance > 0.0 && f_sw > 0.0 && v_in >= v_out
+    requires (duty >= 0.0)
+    requires (duty <= 1.0)
+    ensures (result >= 0.0)
+{
+    (v_in - v_out) * duty / (inductance * f_sw)
+}
+
+// Output voltage ripple.
+@verify(lean, theorem = "buck_output_ripple_nonneg")
+fn output_ripple(delta_il: Real, c_out: Real, f_sw: Real) -> Real
+    where chain_order <= 0,
+          domain: c_out > 0.0 && f_sw > 0.0 && delta_il >= 0.0
+    ensures (result >= 0.0)
+{
+    delta_il / (8.0 * c_out * f_sw)
+}
+
+// Critical inductance -- below this, the buck enters DCM.
+@verify(lean, theorem = "buck_critical_inductance_positive")
+fn critical_inductance(v_out: Real, duty: Real,
+                        i_load: Real, f_sw: Real) -> Real
+    where chain_order <= 0,
+          domain: v_out > 0.0 && f_sw > 0.0 && i_load > 0.0
+    requires (duty >= 0.0)
+    requires (duty <= 1.0)
+    ensures (result >= 0.0)
+{
+    (1.0 - duty) * v_out / (2.0 * i_load * f_sw)
+}

eml_stdlib/circuits/cmos_inverter.eml

@@ -0,0 +1,75 @@
+// cmos_inverter.eml -- TIER 2: ELECTRONICS, second demo.
+//
+// CMOS inverter transfer characteristic.  Two MOSFETs (one
+// n-type, one p-type) share a gate and a drain; the gate is the
+// input node, the shared drain is the output. The output is
+// V_DD when V_in is low and 0 when V_in is high -- a digital
+// inverter.
+//
+// In the simple complementary regime (deep enough V_in that
+// only one transistor conducts), the transfer is binary:
+//
+//   V_out(0)    = V_DD       (PMOS on, NMOS off)
+//   V_out(V_DD) = 0          (NMOS on, PMOS off)
+//
+// Chain order 0 -- step function (or a smoothed sigmoid in the
+// transition region we don't model here).
+
+module cmos_inverter;
+
+const V_DD: Real = 3.3        // supply rail (V), 3.3V CMOS
+
+// Output at logic-low input.  PMOS conducts, NMOS off, output
+// pulled to the supply rail.
+fn vout_at_low_input(v_dd: Real) -> Real
+    where chain_order <= 0
+{
+    v_dd
+}
+
+// Output at logic-high input.  NMOS conducts, PMOS off, output
+// pulled to ground.
+fn vout_at_high_input() -> Real
+    where chain_order <= 0
+{
+    0.0
+}
+
+// Switching point in a symmetric sized inverter (W_p / W_n
+// chosen so the drive currents match): V_M = V_DD / 2.
+fn switching_threshold(v_dd: Real) -> Real
+    where chain_order <= 0
+{
+    v_dd * 0.5
+}
+
+// ── Mathematical certificates (Lean) ────────────────────────
+
+// At a logic-low input the output rides exactly the rail.
+@verify(lean, theorem = "cmos_low_in_high_out")
+fn low_input_certificate(v_dd: Real) -> Real
+    where chain_order <= 0
+    ensures (result == v_dd)
+{
+    v_dd
+}
+
+// At a logic-high input the output sits at ground.
+@verify(lean, theorem = "cmos_high_in_low_out")
+fn high_input_certificate() -> Real
+    where chain_order <= 0
+    ensures (result == 0.0)
+{
+    0.0
+}
+
+// Symmetric switching threshold sits at half the supply -- the
+// design point that maximises noise margin on both rails.
+@verify(lean, theorem = "cmos_threshold_positive_when_supply_positive")
+fn vm_certificate(v_dd: Real) -> Real
+    where chain_order <= 0
+    requires (v_dd > 0.0)
+    ensures (result > 0.0)
+{
+    v_dd * 0.5
+}

eml_stdlib/circuits/h_bridge.eml

@@ -0,0 +1,69 @@
+// h_bridge.eml -- DC-motor H-bridge driver.
+//
+// Four MOSFETs (Q1..Q4) form an H around the load. Two control
+// signals determine the four valid quadrants:
+//
+//   forward  : Q1, Q4 on -- current flows + -> motor + -> motor - -> -
+//   reverse  : Q2, Q3 on -- reversed
+//   brake    : Q3, Q4 on (low-side) or Q1, Q2 on (high-side)
+//   coast    : all off
+//
+// PWM the gate signal at 20-50 kHz to control torque. Avoid the
+// shoot-through condition where a high-side and matching low-side
+// device are both ON -- the dead-time ensures a brief moment with
+// both off between transitions.
+
+module h_bridge;
+
+@spice_voltage(name = "Vbus",  a = "vbus",   b = "0",      value = 12.0)
+@spice_resistor(name = "Rmot", a = "out_a",  b = "out_b",  value = 2.0)
+@spice_capacitor(name = "Cdc", a = "vbus",   b = "0",      value = 100.0e-6)
+fn circuit() -> Real
+    where chain_order <= 0
+{
+    0.0
+}
+
+// ── Mathematical certificates ─────────────────────────────────
+
+// Output voltage as a function of duty cycle for forward direction.
+//   V_motor = duty * V_bus
+@verify(lean, theorem = "h_bridge_forward_proportional_to_duty")
+fn forward_voltage(duty: Real, v_bus: Real) -> Real
+    where chain_order <= 0,
+          domain: v_bus > 0.0
+    requires (duty >= 0.0)
+    requires (duty <= 1.0)
+    ensures (result >= 0.0)
+    ensures (result <= v_bus)
+{
+    duty * v_bus
+}
+
+// Reverse direction.
+@verify(lean, theorem = "h_bridge_reverse_proportional_to_duty")
+fn reverse_voltage(duty: Real, v_bus: Real) -> Real
+    where chain_order <= 0,
+          domain: v_bus > 0.0
+    requires (duty >= 0.0)
+    requires (duty <= 1.0)
+    ensures (result <= 0.0)
+    ensures (result >= -v_bus)
+{
+    -duty * v_bus
+}
+
+// Dead-time compensation -- the motor sees a slightly smaller
+// voltage than the commanded duty due to the dead-band.
+//   V_eff = duty * V_bus * (1 - f_pwm * t_dead * 2)
+@verify(lean, theorem = "h_bridge_dead_time_loss_nonneg")
+fn dead_time_loss(duty: Real, v_bus: Real,
+                  f_pwm: Real, t_dead: Real) -> Real
+    where chain_order <= 0,
+          domain: v_bus > 0.0 && f_pwm > 0.0 && t_dead >= 0.0
+    requires (duty >= 0.0)
+    requires (duty <= 1.0)
+    ensures (result >= 0.0)
+{
+    duty * v_bus * (2.0 * f_pwm * t_dead)
+}

eml_stdlib/circuits/ldo.eml

@@ -0,0 +1,66 @@
+// ldo.eml -- low-dropout linear regulator.
+//
+// Output voltage is set by the feedback divider:
+//
+//   V_out = V_ref * (1 + R1 / R2)
+//
+// The pass element drops V_in - V_out at full load current; LDO
+// efficiency is V_out / V_in (the rest is dissipated as heat).
+// PSRR (power-supply rejection ratio) is set by the loop gain;
+// stability requires a tame load capacitor with a particular ESR.
+
+module ldo;
+
+@spice_voltage(name = "Vin",  a = "vin",  b = "0", value = 5.0)
+@spice_resistor(name = "R1",  a = "out",  b = "fb", value = 10000.0)
+@spice_resistor(name = "R2",  a = "fb",   b = "0",  value = 10000.0)
+@spice_capacitor(name = "Cout", a = "out", b = "0", value = 10.0e-6)
+fn circuit() -> Real
+    where chain_order <= 0
+{
+    0.0
+}
+
+// ── Mathematical certificates ─────────────────────────────────
+
+@verify(lean, theorem = "ldo_output_voltage_above_reference")
+fn output_voltage(v_ref: Real, r1: Real, r2: Real) -> Real
+    where chain_order <= 0,
+          domain: v_ref > 0.0 && r1 >= 0.0 && r2 > 0.0
+    ensures (result >= v_ref)
+{
+    v_ref * (1.0 + r1 / r2)
+}
+
+@verify(lean, theorem = "ldo_efficiency_in_unit_interval")
+fn efficiency(v_in: Real, v_out: Real) -> Real
+    where chain_order <= 0,
+          domain: v_in > 0.0 && v_out > 0.0 && v_in >= v_out
+    ensures (result >= 0.0)
+    ensures (result <= 1.0)
+{
+    v_out / v_in
+}
+
+// Power dissipated in the pass element at load current i_load.
+@verify(lean, theorem = "ldo_dissipation_nonneg")
+fn dissipation(v_in: Real, v_out: Real, i_load: Real) -> Real
+    where chain_order <= 0
+    requires (v_in >= v_out)
+    requires (i_load >= 0.0)
+    ensures (result >= 0.0)
+{
+    (v_in - v_out) * i_load
+}
+
+// Dropout voltage -- the minimum (V_in - V_out) the LDO needs to
+// stay in regulation at i_load. Linear approximation.
+@verify(lean, theorem = "ldo_dropout_nonneg")
+fn dropout_voltage(r_ds_on: Real, i_load: Real) -> Real
+    where chain_order <= 0,
+          domain: r_ds_on > 0.0
+    requires (i_load >= 0.0)
+    ensures (result >= 0.0)
+{
+    r_ds_on * i_load
+}

eml_stdlib/circuits/mosfet_iv.eml

@@ -0,0 +1,59 @@
+// mosfet_iv.eml -- TIER 2: ELECTRONICS (electron carrier)
+//
+// MOSFET drain-current saturation model:
+//
+//   I_D = (1/2) * mu * C_ox * (W/L) * (V_GS - V_th)^2
+//
+// Chain order 0 (polynomial). The carrier is the electron drift
+// current; the wave equation reduces to a quasi-static
+// constitutive relation. This is the equation that built every
+// chip you've ever owned.
+//
+// EML demonstration: same compiler that emits ferron and magnon
+// equations also emits this one. Carrier-substrate-independent.
+
+module mosfet_iv;
+
+// Process constants for a representative 65nm NMOS.
+const MU_N:    Real = 0.045    // m^2/V*s, electron mobility
+const C_OX:    Real = 1.7e-2   // F/m^2, gate oxide capacitance
+const W_OVER_L: Real = 10.0    // device geometry ratio
+const V_TH:    Real = 0.4      // V, threshold voltage
+
+// Saturation drain current vs. gate-source overdrive.
+fn drain_current_sat(v_gs: Real, v_th: Real,
+                     mu: Real, c_ox: Real, w_over_l: Real) -> Real
+    where chain_order <= 0
+    requires (v_gs >= v_th)
+{
+    let vov = v_gs - v_th;
+    0.5 * mu * c_ox * w_over_l * (vov * vov)
+}
+
+// ── Mathematical certificates (Lean) ────────────────────────
+
+// At threshold (V_GS = V_th) the drain current vanishes.  This
+// is the textbook "device just turning on" boundary; any
+// subthreshold model must agree with it at the matching point.
+@verify(lean, theorem = "mosfet_zero_overdrive_zero_current")
+fn id_at_threshold(mu: Real, c_ox: Real, w_over_l: Real) -> Real
+    where chain_order <= 0
+    ensures (result == 0.0)
+{
+    0.5 * mu * c_ox * w_over_l * ((0.0) * (0.0))
+}
+
+// Mobility, capacitance, geometry are all positive by
+// construction (process parameters); positivity of the prefactor
+// 0.5 * mu * C_ox * W/L is a precondition for a well-formed
+// device model.
+@verify(lean, theorem = "mosfet_prefactor_positive")
+fn id_prefactor(mu: Real, c_ox: Real, w_over_l: Real) -> Real
+    where chain_order <= 0
+    requires (mu > 0.0)
+    requires (c_ox > 0.0)
+    requires (w_over_l > 0.0)
+    ensures (result > 0.0)
+{
+    mu * c_ox * w_over_l
+}

eml_stdlib/circuits/pll_loop.eml

@@ -0,0 +1,63 @@
+// pll_loop.eml -- TIER 2: ELECTRONICS, third demo.
+//
+// Phase-locked loop dynamics, type-1 (no integrator).  In the
+// linearised tracking regime the phase-error obeys:
+//
+//   d_phi(t) / dt = -K * sin(d_phi(t)) ~ -K * d_phi(t)   (small-angle)
+//
+// where K = K_VCO * K_PD is the loop gain.  A locked PLL has
+// d_phi -> 0; the locked steady-state phase error is zero, the
+// VCO control voltage is constant, and the output frequency
+// matches the reference.
+//
+// Chain order 0 (algebraic; small-angle approximation pulls the
+// trig out of the chain).
+
+module pll_loop;
+
+const K_VCO: Real = 1.0e6     // Hz/V, VCO sensitivity
+const K_PD:  Real = 0.5       // V/rad, phase-detector gain
+
+// Loop gain.  Larger K -> faster lock, smaller residual phase
+// error in the steady state, higher loop bandwidth.
+fn loop_gain(k_vco: Real, k_pd: Real) -> Real
+    where chain_order <= 0
+{
+    k_vco * k_pd
+}
+
+// Steady-state phase error in a locked, type-1 PLL with a
+// constant frequency offset df: e_ss = df / K. Demonstrated
+// here with df = 0 (matched reference) -> error = 0.
+fn steady_state_error_at_zero_offset(k: Real) -> Real
+    where chain_order <= 0
+    requires (k > 0.0)
+{
+    0.0 / k
+}
+
+// ── Mathematical certificates (Lean) ────────────────────────
+
+// Loop gain is positive whenever both stage gains are.  The
+// witness for "the loop will lock" -- a non-positive K either
+// stalls (K=0) or runs away (K<0).
+@verify(lean, theorem = "pll_loop_gain_positive")
+fn loop_gain_certificate(k_vco: Real, k_pd: Real) -> Real
+    where chain_order <= 0
+    requires (k_vco > 0.0)
+    requires (k_pd > 0.0)
+    ensures (result > 0.0)
+{
+    k_vco * k_pd
+}
+
+// At zero frequency offset the locked steady-state phase error
+// is exactly zero -- the lock IS the proof of zero residual.
+@verify(lean, theorem = "pll_zero_offset_zero_phase_error")
+fn ss_error_certificate(k: Real) -> Real
+    where chain_order <= 0
+    requires (k > 0.0)
+    ensures (result == 0.0)
+{
+    0.0 / k
+}

eml_stdlib/circuits/rc_filter.eml

@@ -0,0 +1,98 @@
+// rc_filter.eml -- single-pole RC low-pass filter, the canonical
+// SPICE-backend smoke test, now also carrying the mathematical
+// certificate kernels the Lean backend turns into proof obligations.
+//
+// Topology:
+//   Vin  -> in
+//   R1   in -> out  (1 kOhm)
+//   C1   out -> 0   (1 uF)
+//   .tran 1u 10m
+//
+// Cut-off frequency is 1 / (2*pi*R*C) ~= 159 Hz. Run with:
+//
+//   eml-compile rc_filter.eml --target spice -o rc_filter.cir
+//   ngspice -b rc_filter.cir
+//
+// The @verify(lean, ...) kernel functions below capture the
+// continuous-time properties of the filter that Phase E4 proves
+// against MachLib (see ~/monogate/machlib/foundations/MachLib/
+// Discovered/rc_filter.lean).
+//
+// (Phase E4 -- the SPICE backend emits the netlist; the KiCad
+// backend emits a schematic; the JLCPCB mapper emits a BOM; and
+// the Lean backend emits the proof obligations. Same source, four
+// downstream artifacts.)
+
+module rc_filter;
+
+// ── Circuit netlist (E1+E2+E3 backends) ─────────────────────
+
+@spice_resistor(name = "R1",  a = "in",  b = "out", value = 1000.0)
+@spice_capacitor(name = "C1", a = "out", b = "0",   value = 1.0e-6)
+@spice_voltage(name = "Vin",  a = "in",  b = "0",   value = 5.0)
+@spice_analysis(tran = "1u 10m")
+fn circuit() -> Real
+    where chain_order <= 0
+{
+    0.0
+}
+
+// ── Mathematical certificates (E4: Lean) ────────────────────
+
+// Time constant τ = R * C. Definitional — used by every other
+// claim in this module as the reference time scale.
+@verify(lean, theorem = "rc_time_constant_def")
+fn tau(r: Real, c: Real) -> Real
+    where chain_order <= 0
+    requires (r > 0.0)
+    requires (c > 0.0)
+    ensures (result == r * c)
+{
+    r * c
+}
+
+// Steady-state output (t -> infinity): the capacitor is fully
+// charged and the output equals the input.  This is the hard
+// asymptote any RC step response approaches.
+@verify(lean, theorem = "rc_steady_state_equals_input")
+fn vout_steady(vin: Real) -> Real
+    where chain_order <= 0
+    ensures (result == vin)
+{
+    vin
+}
+
+// Initial output (t = 0):  the capacitor starts empty so the
+// output is zero regardless of the input voltage.
+@verify(lean, theorem = "rc_initial_output_zero")
+fn vout_initial() -> Real
+    where chain_order <= 0
+    ensures (result == 0.0)
+{
+    0.0
+}
+
+// Step-response decay (closed form): V_out(t) = V_in * (1 - exp(-t/tau))
+// The @verify here proves only the definitional shape; the
+// monotonicity-in-t and bounded-by-vin properties are extracted as
+// separate kernels below so each carries an independent obligation.
+@verify(lean, theorem = "rc_step_response_form")
+fn vout_charging(vin: Real, t: Real, tau_val: Real) -> Real
+    where chain_order <= 1
+    requires (tau_val > 0.0)
+    ensures (result == vin * (1.0 - exp(-t / tau_val)))
+{
+    vin * (1.0 - exp(-t / tau_val))
+}
+
+// Output at t = 0 of the closed-form solution: V_out(0) = 0.
+// Combines the definition of vout_charging with exp(0) = 1.
+// (Proof closes against MachLib's exp_zero axiom.)
+@verify(lean, theorem = "rc_step_response_at_zero")
+fn vout_charging_at_zero(vin: Real, tau_val: Real) -> Real
+    where chain_order <= 1
+    requires (tau_val > 0.0)
+    ensures (result == 0.0)
+{
+    vin * (1.0 - exp(-0.0 / tau_val))
+}

eml_stdlib/circuits/voltage_divider.eml

@@ -0,0 +1,68 @@
+// voltage_divider.eml -- the textbook resistive divider, the
+// simplest non-trivial SPICE deck, now also carrying the
+// mathematical certificate kernels the Lean backend turns into
+// proof obligations.
+//
+// Topology:
+//   Vin -> in
+//   R1  in -> mid (10 kOhm)
+//   R2  mid -> 0  (10 kOhm)
+//   .op
+//
+// Theory: V(mid) = Vin * R2 / (R1 + R2). With R1 = R2 the
+// midpoint sits at exactly Vin / 2.
+
+module voltage_divider;
+
+// ── Circuit netlist (E1+E2+E3 backends) ─────────────────────
+
+@spice_resistor(name = "R1", a = "in",  b = "mid", value = 10000.0)
+@spice_resistor(name = "R2", a = "mid", b = "0",   value = 10000.0)
+@spice_voltage(name = "Vin", a = "in",  b = "0",   value = 5.0)
+@spice_analysis(op = "")
+fn circuit() -> Real
+    where chain_order <= 0
+{
+    0.0
+}
+
+// ── Mathematical certificates (E4: Lean) ────────────────────
+
+// Voltage-divider law: V_out = V_in * R2 / (R1 + R2).
+// Definitional — the closed-form expression IS the body, so the
+// theorem is provable by `rfl` after `unfold`.
+@verify(lean, theorem = "voltage_divider_law")
+fn vout_divider(vin: Real, r1: Real, r2: Real) -> Real
+    where chain_order <= 0
+    requires (r1 > 0.0)
+    requires (r2 > 0.0)
+    ensures (result == vin * r2 / (r1 + r2))
+{
+    vin * r2 / (r1 + r2)
+}
+
+// Sum of the two resistances is strictly positive.  Used as a
+// hypothesis in every downstream proof that needs to divide by
+// (R1 + R2).
+@verify(lean, theorem = "voltage_divider_denom_pos")
+fn rsum(r1: Real, r2: Real) -> Real
+    where chain_order <= 0
+    requires (r1 > 0.0)
+    requires (r2 > 0.0)
+    ensures (result > 0.0)
+{
+    r1 + r2
+}
+
+// Midpoint at the symmetric divider (R1 = R2 = R): V_out = V_in / 2.
+// Captures the most-common design point.  Not provable by `rfl`
+// alone (algebra: 2R*x / (R+R) = x reduces to x = x via cancel),
+// but the proof closes against MachLib's mul_inv + div_def axioms.
+@verify(lean, theorem = "voltage_divider_symmetric_half")
+fn vout_symmetric(vin: Real, r: Real) -> Real
+    where chain_order <= 0
+    requires (r > 0.0)
+    ensures (result == vin * r / (r + r))
+{
+    vin * r / (r + r)
+}

eml_stdlib/control/bangbang.eml

@@ -0,0 +1,34 @@
+// bangbang.eml -- bang-bang (relay) controller.
+//
+// The simplest possible feedback controller:
+//   u = u_max if error > 0 else u_min
+//
+// Used in thermostats, on/off relays, and as a sanity-check
+// reference for more sophisticated controllers. Chain order 0;
+// branchless under the optimiser via clamp(sign(...)*range, ...).
+
+module bangbang;
+
+@verify(lean, theorem = "bangbang_in_actuator_band")
+fn bangbang(error: Real, u_max: Real, u_min: Real) -> Real
+    where chain_order <= 0
+    requires (u_max >= u_min)
+    ensures (result >= u_min)
+    ensures (result <= u_max)
+{
+    let s = clamp(error * 1.0e30, -1.0, 1.0);
+    let mid = 0.5 * (u_max + u_min);
+    let amp = 0.5 * (u_max - u_min);
+    mid + s * amp
+}
+
+// Symmetric bang-bang -- output is +/- u_amp.
+@verify(lean, theorem = "bangbang_sym_in_band")
+fn bangbang_symmetric(error: Real, u_amp: Real) -> Real
+    where chain_order <= 0
+    requires (u_amp >= 0.0)
+    ensures (abs(result) <= u_amp)
+{
+    let s = clamp(error * 1.0e30, -1.0, 1.0);
+    s * u_amp
+}

eml_stdlib/control/deadband.eml

@@ -0,0 +1,28 @@
+// deadband.eml -- two-sided dead-zone (deadband) saturation.
+//
+// If |x| <= threshold the output is 0; otherwise the output is x
+// shifted toward zero by `threshold`. Equivalent to
+//   y = x - clamp(x, -threshold, threshold)
+//
+// Chain order 0. Used to suppress sensor noise around a setpoint
+// and to keep PIDs from chattering.
+
+module deadband;
+
+@verify(lean, theorem = "deadband_zero_inside")
+fn deadband(x: Real, threshold: Real) -> Real
+    where chain_order <= 0
+    requires (threshold >= 0.0)
+{
+    x - clamp(x, -threshold, threshold)
+}
+
+// Asymmetric deadband: distinct upper/lower thresholds.
+@verify(lean, theorem = "deadband_asym_zero_inside")
+fn deadband_asymmetric(x: Real, low: Real, high: Real) -> Real
+    where chain_order <= 0
+    requires (low <= 0.0)
+    requires (high >= 0.0)
+{
+    x - clamp(x, low, high)
+}

eml_stdlib/control/hysteresis.eml

@@ -0,0 +1,28 @@
+// hysteresis.eml -- Schmitt-trigger / hysteresis switching.
+//
+//   if state == 0 (off):  switch on  iff x > threshold_on
+//   if state == 1 (on):   switch off iff x < threshold_off
+//
+// Caller threads `state` through frames as a 0/1 Real. The kernel
+// returns the new state. Chain order 0.
+//
+// The asymmetry threshold_on > threshold_off prevents chatter --
+// ubiquitous in thermostat / relay / battery-charger logic.
+
+module hysteresis;
+
+@verify(lean, theorem = "hysteresis_state_in_zero_one")
+fn hysteresis_step(x: Real, state: Real,
+                   threshold_on: Real, threshold_off: Real) -> Real
+    where chain_order <= 0
+    requires (threshold_on > threshold_off)
+    requires (state == 0.0 || state == 1.0)
+    ensures (result >= 0.0)
+    ensures (result <= 1.0)
+{
+    let on_via_x  = clamp((x - threshold_on)  * 1.0e30, 0.0, 1.0);
+    let off_via_x = clamp((threshold_off - x) * 1.0e30, 0.0, 1.0);
+    let next_when_off = on_via_x;
+    let next_when_on  = 1.0 - off_via_x;
+    state * next_when_on + (1.0 - state) * next_when_off
+}