Harlan D. Mills

Cleanroom Software Engineering

Software quality can be engineered under statistical quality control and delivered with better quality. The Cleanroom process gives management an engineering approach to release reliable products.

Certifying the reliability of software

A description is given of a procedure for certifying the reliability of software before its release to users. The ingredients of this procedure are a life cycle of executable product increments, representative statistical testing, and a standard estimate of the MTTF (mean time to failure) of the product at the time of its release. The authors also discuss the development of certified software products and the derivation of a statistical model used for reliability projection. Available software test data are used to demonstrate the application of the model in certification process.

The new math of computer programming

Structured programming has proved to be an important methodology for systematic program design and development. Structured programs are identified as compound function expressions in the algebra of functions. The algebraic properties of these function expressions permit the reformulation (expansion as well as reduction) of a nested subexpression independently of its environment, thus modeling what is known as stepwise program refinement as well as program execution. Finally, structured programming is characterized in terms of the selection and solution of certain elementary equations defined in the algebra of functions. These solutions can be given in general formulas, each involving a single parameter, which display the entire freedom available in creating correct structured programs.

Engineering software under statistical quality control

Eight common misconceptions of software quality are examined and refuted. The concept of cleanroom engineering of software is introduced. Cleanroom engineering achieves intellectual control by applying rigorous, mathematics-based engineering practices, establishes an errors-are-unacceptable attitude and a team responsibility for quality, delegates development and testing responsibilities to separate teams, and certifies the softwares mean time to failure through the application of statistical quality-control methods. A typical project is used to explain the concepts and procedures.<<ETX>>

Stepwise refinement and verification in box-structured systems

The author proposes that the formality of specifications and designs be developed together in box structures with many sponsor and user interfaces. Box structures of data abstractions allow the stepwise refinement and verification of hierarchical system designs from their specifications at formal and informal levels. He discusses the features and advantages of the approach. He used a navigation and weather buoy case study and gives a detailed, step-by-step application of the method.<<ETX>>

Planning and certifying software system reliability

An approach to software reliability and certification is presented that is based on the use of three mathematical models: the sampling, component, and certification models. The approach helps reduce reliability analysis to a problem that can be evaluated and manipulated through a series of spreadsheets. This approach was motivated by interest in applying the cleanroom software-engineering method in environments that require extensive code reuse.<<ETX>>

Structured Programming: Retrospect and Prospect

Structured programming has changed how programs are written since its introduction two decades ago. However, it still has a lot of potential for more change.

Correction to 'Certifying the reliability of software' (Jan. 1986 3-11)

The authors correct several typographical errors, and misinterpretations in their abovementioned paper (see ibid., vol.SE-12, no.1, p.3-11, Jan. 1986). >

Data structured programming: Program design without arrays and pointers

Structured programming introduced a new discipline for accessing the instructions of a program. In suitable programming languages, this discipline can be described in terms of program design without gotos. It can be shown, for example, that any functional result achievable in a programming language with gotos can be achieved in that same language without gotos if sequence, selection, and iteration control constructs are present. The gotos permit random access to the instructions while sequence, selection, and iteration provide much more limited and disciplined access. The authors introduce a new discipline for accessing the data of a program. Any functional result achievable in a programming language with arrays and pointers can be achieved in that same language without arrays and pointers if set, stack, and queue data types are present. The arrays and pointers permit random access to the data while sets, stacks, and queues provide much more limited and disciplined access.

Theory of Modules

Because large-scale software development is a struggle against internal program complexity, the modules into which programs are divided play a central role in software engineering. A module encapsulating a data type allows the programmer to ignore both the details of its operations, and of its value representations. It is a primary strength of program proving that as modules divide a program, making it easier to understand, so do they divide its proof. Each module can be verified in isolation, then its internal details ignored in a proof of its use. This paper describes proofs of module abstractions based on functional semantics, and contrasts this with the Alphard formalism based on Hoare logic.