| Anti-islanding — a solar inverter must never energize a "dead" line | 107 | a state machine, a memory invariant, try / catch |
| Battery dispatch — the charge window is a wall, not a setpoint | 83 | a memory invariant, try / catch |
| Black start — you cannot boot a power plant from a dead grid out of order | 118 | a state machine, a memory invariant, try / catch |
| Recloser — a trip is permanent until a human walks the line | 94 | a state machine, a memory invariant, try / catch |
| Demand response — no payment before measurement, and settlement is final | 124 | a state machine, a memory invariant, try / catch |
| Ev charging — no current before the handshake, no session past the cap | 124 | a state machine, a memory invariant, try / catch |
| Gas turbine light-off — purge before every ignition attempt, no exceptions | 134 | a state machine, a memory invariant, try / catch |
| Generator paralleling — sync-check before the breaker, always | 137 | a state machine, a memory invariant, try / catch |
| Load shedding — the transformer's nameplate is a wall, hospitals shed last | 112 | a memory invariant, try / catch |
| Meter billing — you are billed exactly what the meter read, once | 115 | a state machine, a memory invariant, match, try / catch |
| Spillway gates — a dam may never lose its last release path | 121 | a state machine, a memory invariant, try / catch |
| Spinning reserve — every megawatt you sell must claim real iron | 109 | a memory invariant, try / catch |
| Lockout-tagout — test before touch, and nobody re-energizes over a lock | 137 | a state machine, a memory invariant, try / catch |
| Transformer emergency loading — overload only with every fan running | 134 | a state machine, a memory invariant, try / catch |
| Wind turbine overspeed — after an emergency brake, inspection or nothing | 136 | a state machine, a memory invariant, try / catch |