Turing-incomplete.
On purpose.

# ...
CELL PumpHole {
  INTERFACE {
    INPUT  temp:       FLOAT [celsius] RANGE(-40, 300);
    OUTPUT pump_power: FLOAT [pct]     RANGE(0, 100);
  }
  INVARIANTS {
    RULE power: pump_power <= 80;
  }
  HAZARDS {
    HAZARD overheat: temp > 250;
  }
}

# ...
CELL MCAS {
  META { STANDARD: "DO-178C"; }
  INTERFACE {
    INPUT  aoa_left:  FLOAT [deg] RANGE(-30, 90);
    INPUT  aoa_right: FLOAT [deg] RANGE(-30, 90);
    OUTPUT trim_cmd:  FLOAT [deg] RANGE(-5, 5);
  }
  INVARIANTS {
    RULE authority: abs(trim_cmd) <= 2.5;
  }
  HAZARDS {
    HAZARD runaway: abs(aoa_left - aoa_right) > 5.5 and trim_cmd < 0;
  }
}