Making good software is hard. Making software that has to work without defects on a different planet is extremely hard. Today Gerard Holzmann explained how NASA does it during his keynote at OOPSLA.
I think Gerard said they only use Spin on a very small part of the codebase whereas a portfolio of commercial tools like Coverity and GrammaTech in particular along with Gerard's own Uno and a battery of shell scripts are run on everything every night.
Thanks Ron for pointing that out. I've modified the blog to indicate that SPIN is not the only tool.
If you are an ACM member, Communications subscriber, Digital Library subscriber, or use your institution's subscription, please set up a web account to access comments, premium content and additional site features.
If you are a SIG member or member of the general public, you may set up a web account to comment on free articles and sign up for email alerts.