“The Role of Formal Techniques: Past, Current and Future or How Did Software Get so Reliable without Proof?”

Twenty years ago it was reasonable to predict that the size and ambition of software products would be severely limited by the unreliability of their component programs. Crude estimates suggest that professionally written programs delivered to the customer can contain between one and ten independently correctable errors per thousand lines of code; and any software error in principle can have spectacular effect (or worse, a subtly misleading effect) on the behaviour of the entire system. Dire warnings have been issued of the dangers of safety-critical software controlling health equipment, aircraft, weapons and industrial processes, including nuclear power stations. The arguments were sufficiently persuasive to trigger a significant research effort devoted to the problem of program correctness. A proportion of this research was based on the ideal of certainty achieved by mathematical proof.