A computer-implemented method for implementing a set of redundant pieces of software within a safety control system, wherein at least two redundant pieces of software are engineered from function block diagrams (120, 196) with a plurality of interconnected function blocks, wherein the safety control system comprises several redundant divisions, each division executing at least one safety function specified in at least one of said function block diagrams, and wherein for said two pieces of software the following steps are applied: a) generating a first instance of compilable source code from a first plurality of function diagrams (70, 74, 78) by virtue of a first automatic code generator obeying to a first set of sequentialization rules; b) parsing said first instance of source code and identifying the set of all function block I/O ports and junction points - nodes - and the set of all connections between them - arcs - of the data flow; c) using the information from step b) to reconstruct a first data flow graph of said first instance of source code in the upstream direction; d) generating a second instance of compilable source code from a second plurality of function block diagrams (90, 94, 98) by virtue of the same or a second automatic code generator obeying a second set of sequentialization rules; e) parsing said second instance of source code and identifying the set of all function block I/O ports and junction points - nodes - and the set of all connections between them - arcs - of the data flow; f) using the information from step e) to reconstruct a second data flow graph of said second instance of source code in the upstream direction; g) comparing said first identified data flow graph and said second identified data flow graph with each other, node by node, thereby checking if the transitive closure of input up to that node in said second instance of source code is the same as in said first instance of source code, and thereby checking the functional equivalence of the two pieces of software. a) generating a first instance of compilable source code from a first plurality of function diagrams (70, 74, 78) by virtue of a first automatic code generator obeying to a first set of sequentialization rules; b) parsing said first instance of source code and identifying the set of all function block I/O ports and junction points - nodes - and the set of all connections between them - arcs - of the data flow; c) using the information from step b) to reconstruct a first data flow graph of said first instance of source code in the upstream direction; d) generating a second instance of compilable source code from a second plurality of function block diagrams (90, 94, 98) by virtue of the same or a second automatic code generator obeying a second set of sequentialization rules; e) parsing said second instance of source code and identifying the set of all function block I/O ports and junction points - nodes - and the set of all connections between them - arcs - of the data flow; f) using the information from step e) to reconstruct a second data flow graph of said second instance of source code in the upstream direction; g) comparing said first identified data flow graph and said second identified data flow graph with each other, node by node, thereby checking if the transitive closure of input up to that node in said second instance of source code is the same as in said first instance of source code, and thereby checking the functional equivalence of the two pieces of software.