L Peter Deutsch
445
achievement was that he and a guy at SRI named Bob Boyer built a really
kick-ass theorem prover. And he built up a whole group around this piece
of software and built up these big libraries of theorems and lemmas about
particular domain areas.
So they had this thriving little group doing theorem proving, which was the
subject of my PhD thesis and which had always interested me. And they had
this amazing result on the arithmetic unit of the AMD CPU. So I thought,
“Hey, this is a group that has a lot of right characteristics: they’re doing
something that I’ve always been interested in; they’re run by a guy that I
know and like; their technology is Lisp-based. It’ll be really congenial to me.”
So, I went down there and gave a talk about how, if at all, could theorem
proving have helped improve the reliability of Ghostscript? By that time, we
had a big history in the bug tracker for Ghostscript. So I picked 20 bugs,
more or less at random, and I looked at each one and I said, “OK, for
theorem-proving technology to have been helpful in finding or preventing
this problem, what would have had to happen? What else would have had
to be in place?”
The conclusion I came to is that theorem-proving technology probably
wouldn’t have helped a whole lot because in the few places where it could
have, formalizing what it was that the software was supposed to do
would’ve been a Herculean job.
That’s the reason why theorem-proving technology basically has—in my
opinion—failed as a practical technology for improving software reliability.
It’s just too damn hard to formalize the properties that you want to
establish.
So I gave this talk and it was pretty well received. I talked with a couple of
the graduate students, talked with J. a little bit, and then I went away. I
thought to myself, “The checklist items all look pretty good. But I’m just not
excited about this.”
I was kind of flailing around. I’ve sung in a chorus for years. In the summer
of 2003 we were on a tour where we actually sang six concerts in old
churches in Italy. My partner was with me on that trip and we decided to
stay in Europe for two or three weeks afterwards.