Software can be entrusted with high consequence functionality

Some observers believe it is the nature of software to be inherently unreliable. Others are more hopeful, but doubt we can ever analyze software systems sufficiently well to justify dependability. Both of these viewpoints are overly pessimistic. Although building a high consequence system is not a casual undertaking, emerging assurance technologies promise improved dependability. The decision to deploy such systems must consider these assurances as well as weigh the expected benefits against the residual risk of trusting a digital control mechanism. Increased functionality can be a powerful motivation while simultaneously enhancing operational safety itself. Formal methods can give us the strong assurances we need to follow this path.