The paper presents a formal specification in the Z notation for a safety-critical control system. It describes a particular medical device but is quite generic and should be widely applicable. The specification emphasizes safety interlocking and other discontinuous features that are not considered in classical control theory. A method for calculating interlock conditions for particular operations from system safety assertions is proposed; it is similar to ordinary Z precondition calculation, but usually results in stronger preconditions. The specification is presented as a partially complete framework that can be edited and filled in with the specific features of a particular control system. Our system is large but the specification is concise. It is built up from components, subsystems, conditions and modes that are developed separately, but also accounts for behaviors that emerge at the system level. The specification illustrates several useful idioms of the Z notation, and demonstrates that an object-oriented specification style can be expressed in ordinary Z.>

We used an object-oriented design to build a large scientific application: simulation of radiation therapy treatments for cancer. We provide features familiar in the graphics workstation world, including graphic editing of the proposed treatment, multiple views of the treatment in different windows, and computations which proceed concurrently as the input data are being edited. To make our system practical for the typical clinic we used a popular minicomputer and the vendor's operating system and compiler. This paper describes how we implemented objects, inheritance, message passing, windows, and concurrency in (almost) standard Pascal on a VAX under VMS.