Experience with Z Developing a Control Program for a Radiation Therapy Machine

We are developing a control program for a unique radiation therapy machine. The program is safety-critical, executes several concurrent tasks, and must meet real-time deadlines. Development employs both formal and traditional methods: we produce an informal speciication in prose (supplemented by tables, diagrams and a few formulas) and a formal description in Z. The Z description includes an abstract level that expresses overall safety requirements and a concrete level that serves as a detailed design, where Z paragraphs correspond to data structures, functions and procedures in the code. We validate the Z texts against the prose speciication by inspection. We derive most of the code from the Z texts by intuition and verify it by inspection but a small amount of code is derived and veriied more formally. We have produced about 250 pages of informal speciication and design description, about 1200 lines of Z and about 6000 lines of code. Experiences developing a large Z speciication and writing the program are reported, and some errors we discovered and corrected are described. This work may not be copied or reproduced in whole or part for any commercial purpose. Permission to photocopy in whole or part without payment of fee is granted for nonproot educational and research purposes provided that all such copies include the following notice: a notice that such copying is by permission of the authors; an acknowledgment of the authors of the work; and all applicable portions of this copyright notice. All rights reserved.