Book contents
- Frontmatter
- Contents
- Preface
- I Why Z?
- II Introducing Z
- III Elements of Z
- IV Studies in Z
- 16 Document control system
- 17 Text processing
- 18 Eight queens
- 19 Computer graphics and computational geometry
- 20 Rule-based programming
- 21 Graphical user interface
- 22 Safety-critical protection system
- 23 Modelling large systems
- 24 Object-oriented programming
- 25 Concurrency and real time
- Further reading
- V Programming with Z
- Further reading
- A Glossary of Z notation
- B Omitted features
- C Operator precedence
- D The Z mathematical tool-kit
- E Selected Laws
- F Solutions to selected exercises
- G Other formal notations
- Bibliography
- Index
22 - Safety-critical protection system
Published online by Cambridge University Press: 06 July 2010
- Frontmatter
- Contents
- Preface
- I Why Z?
- II Introducing Z
- III Elements of Z
- IV Studies in Z
- 16 Document control system
- 17 Text processing
- 18 Eight queens
- 19 Computer graphics and computational geometry
- 20 Rule-based programming
- 21 Graphical user interface
- 22 Safety-critical protection system
- 23 Modelling large systems
- 24 Object-oriented programming
- 25 Concurrency and real time
- Further reading
- V Programming with Z
- Further reading
- A Glossary of Z notation
- B Omitted features
- C Operator precedence
- D The Z mathematical tool-kit
- E Selected Laws
- F Solutions to selected exercises
- G Other formal notations
- Bibliography
- Index
Summary
In this chapter we pursue the safety issues introduced in the therapy machine study from Chapter 6. To ensure that patients are treated as directed by their prescriptions, many machine settings must be set properly. The radiation beam should only be allowed to turn on when the correct settings have been achieved. This chapter presents a formal specification for the control software that permits the beam to turn on. It is an example of a safety-critical protection system because it prevents some potentially hazardous action from occurring unless particular safety requirements are satisfied.
This study also illustrates how Z can express two important design strategies: partitioning a complex system into largely independent subsystems or modules and refining from an abstract model to a detailed design.
Partition
First we develop a more detailed model of the therapy machine system Machine that we introduced in Chapter 21. Much of the apparent complexity of the therapy machine arises from the interaction of several subsystems which, by themselves, are simpler. We partition the system into subsystems and describe simple operations on each. For each operation on the system as a whole, we define a separate operation on each affected subsystem. The complex behaviors of the whole system emerge when we compose these simpler operations together.
The advantages of this approach arise because many operations involve only a few of the subsystems, and many complex operations can emerge when simpler operations appear together in different combinations.
- Type
- Chapter
- Information
- The Way of ZPractical Programming with Formal Methods, pp. 211 - 217Publisher: Cambridge University PressPrint publication year: 1996