Providing Trusted Components to the Industry

T he software industry stands on feet of clay. However carefully we may strive to build correct and reliable software, we have no way of guaranteeing the quality of the result. Building correct and reliable software depends on the quality of so much else, from the hardware and the operating system to the compiler and the runtime libraries. And any significant software system has so many details and components of its own that we can hardly expect to get everything right if we do it all by ourselves. None of the commonly suggested approaches suffices to quell these worries: " Test, test, and retest, " the implicit motto of much of the industry, is expensive and wasteful. Yet as any user of PC software knows all too well, the result of all this sweat is far from ideal. Software companies systematically and openly ship software that has a large number of known bugs. On the academic side, much progress has been made toward formal methods, through which it is possible (in principle) to prove the correctness of program elements using mathematical techniques. But results from this important field have had only limited effect on the practice of the industry for several reasons: • It is too difficult to build mathematical models of the most delicate aspects of " real " programs, from floating-point computation to pointers. • There are few powerful tools to assist this effort. • Even more fundamentally, it is just too expensive and difficult to apply formal techniques thoroughly. The recent push for reuse and compo-nentware has raised the hope that by relying on reusable components we can gain quality and reliability. But without excellent techniques to build the components themselves, this nirvana is a mirage. In fact, the spread of less-than-optimal components could lead to a worsening of the situation. At least one major industrial disas-ter—to the tune of half a billion US dol-lars—has already been ascribed to the reuse of an improperly specified component. With the progress of incompletely designed approaches to reuse, more catastrophes are likely to happen, leading to a broad rejection of the very idea of reusability, unless the industry takes measures to guarantee component quality. Formal methods, because of their cost, only make sense when applied to widely reused components, which can recoup the investment through effects of scale. (Possible exceptions are the mission-critical systems for which the stakes are so …