Clarke et al. (1986) have developed a model-based verification method and have applied it to validation of VLSI circuits. We have used the method to test automatically the safety and operability of discrete chemical process control systems. The technique involves: (1) a “system model” describing the process and its software; (2) “assertions” in temporal logic expressing user-supplied questions about the system behavior with respect to safety and operability; and (3) a “model checker” that determines if the system model satisfies each of the assertions and provides a counterexample to locate the error if one exists. Temporal logic is used for reasoning about occurrence of events over time. To reveal discrete event errors, we have applied the verification method to a simple combustion system and an alarm acknowledge system.