Formal Specification for Design Diversity: Two Case Histories, One Approach

Diverse programming is a recommended approach in the preparation of logic used to drive railway control systems, whereby different representations and processes are used to configure and validate the logic. This paper describes how two formal specifications have been used for the construction of a precise model of the logic, alternative to those represented using the user and machine notations, and for the construction of software tools to process the logic, following a rigorous refinement approach. The first specification was used to develop a redundant tool to check the results of a logic generator. The second specification was used to verify a logic compiler, both as an abstract representation, to compare against the compiled code, and as the design of a diverse code checker.