What’s the point of Formal Methods?

Railway signaling systems are surprisingly expensive to produce. Why did this happen?
In the early days of railway history there were no interlocking systems. It was considered enough to have personnel at the train stations manually observing trains and operating signals. The need for automatic signalling eventually became evident: human beings tend to make mistakes, which can lead to serious accidents, and the capacity of railroads was reduced by all manual procedures.

The drawback of automatic signalling were however obvious: huge investments were needed, and although automatic systems were not as error–prone as manual processes, reliance on automatic systems led to potentially even more dangerous errors. Therefore, the construction of automatic signalling systems had to be extremely safety-conscious.

A tradition of strict development processes with thorough reviewing was introduced, requiring even reviews of the reviewing process, thus resulting in the production of an enormous amount of documents. Needless to say, this made automatic signalling even more expensive and hard to maintain. But there seemed to be no alternative.

Formal methods have however emerged as a way to cut costs and increase safety at the same time. Huge amounts of requirements can be maintained and automatically checked using formal methods.