< Prev Next >
NATO SOFTWARE ENGINEERING CONFERENCE 1968
71
7. Special Topics

Graham: I do not believe that the problems are related solely to on-line systems. It is my understanding that an uncritical belief in the validity of computer-produced results (from a batch-processing computer) was at least a contributory cause of a faulty aircraft design that lead to several serious air crashes.
Perlis: Many of us would agree that Multics and TSS/360 have taken a lot longer to develop than we would have wished, and that OS/360 is disappointing. However, perhaps we are exaggerating the importance of these facts. Is bad software that important to society? Are we too worried that society will lose its confidence in us?
Randell: Most of my concern stems from a perhaps over-pessimistic view of what might happen directly as a result of failure in an automated air traffic control system, for example. I am worried that our abilities as software designers and producers have been oversold.
Opler: As someone who flies in airplanes and banks in a bank I’m concerned personally about the possibility of a calamity, but I’m more concerned about the effects of software fiascos on the overall health of the industry.
Kolence: I do not like the use of the word ‘crisis’. It’s a very emotional word. The basic problem is that certain classes of systems are placing demands on us which are beyond our capabilities and our theories and methods of design and production at this time. There are many areas where there is no such thing as a crisis — sort routines, payroll applications, for example. It is large systems that are encountering great difficulties. We should not expect the production of such systems to be easy.
Ross: It makes no difference if my legs, arms, brain and digestive tract are in fine working condition if I am at the moment suffering from a heart attack. I am still very much in a crisis.
Fraser: We are making great progress, but nevertheless the demands in the industry as a whole seem to be going ahead a good deal faster than our progress. We must admit this, even though such an admission is difficult.
Dijkstra: The general admission of the existence of the software failure in this group of responsible people is the most refreshing experience I have had in a number of years, because the admission of shortcomings is the primary condition for improvement.

7.1.3. THE UNDERLYING CAUSES
Several basic causes for what many believed were serious problem areas were suggested.
Kinslow: In my view both OS/360 and TSS/360 were straight-through, start-to-finish, no-test-development, revolutions. I have never seen an engineer build a bridge of unprecedented span, with brand new materials, for a kind of traffic never seen before — but that’s exactly what has happened on OS/360 and TSS/360. At the time TSS/360 was committed for delivery within eighteen months it was drawn from two things:
1. Some hardware proposed, but not yet operational, at M.I.T.
2. Some hardware, not quite operational, at the IBM Research Center.
Buxton: A possibly fairly fundamental cause of the gap between the specifications of a large software system and what one gets in practice is a deep confusion between producing a software system for research and producing one for practical use. Instead of trying to write a system which is just like last year’s, only better implemented, one invariably tries to write an entirely new and more sophisticated system. Therefore you are in fact continually embarking on research, yet your salesmen disguise this to the customer as being just a production job.
David and Fraser: (from their Position paper)
»The causes of this ‘software gap’ are many, but a basic one lies in the unfortunate telescoping of research, development and production of an operational version within a single project effort. This practice leads to slipped schedules, extensive rewriting, much lost effort, large numbers of bugs, and an inflexible and unwieldy product. It is unlikely that such a product can ever be brought to a satisfactory state of reliability or that it can be maintained and modified. Though this mixing of research, development, and production is a root cause of the