Trip report E.W.Dijkstra 16th April/7th May, U.S.A. and Canada.
With a Boeing 707, which can remain in the air for 11 hours and 45 minutes, our flying time from Amsterdam to Los Angeles was 11 hours and 30 minutes. One of the advantages of that flight is that upon arrival at Los Angeles no more time is wasted upon circling above the airport! At Immigration I found myself speeding up the proceedings by acting as a German-English interpreter between elderly Lufthansa passengers and the young (and beautiful) female U.S.Immigration officer, all in my own interest, because I wanted to catch my connection to San Francisco. (It worked.) For the benefit of my readers who enter the USA at Los Angeles as transit passenger the following advice:
1) get your luggage booked through to at least your next destination in the USA: already in the Custom's Area, your luggage will be placed on an "Express Belt". It works!
2) try to get TWA as your next carrier: from the International Arrivals to the TWA-building is really within walking distance (and on US airports, walking distances are very rare indeed!).
I caught my connection and at 22.00 (their time!) I was picked up by my host, Tony Wasserman, who drove me to his home. After some talking, two hard-boiled eggs, a glass of cold milk and a few glasses of whiskey I went to bed and slept from midnight until 6 o'clock in their morning. At 7 o'clock we had breakfast and then my host —who was Chairman of ACM Pacific 75— and his wife disappeared and I was left to myself. For one and a half hour I studied the Vol.1 nr.1 of the IEEE Transactions on Software Engineering. (With the exception of the Liskov-Zilles paper that was at least instructive, that first issue seemed to me alarmingly weak and I was glad to have refused to join its Editorial Board. The biographical blurbs about the members of that board —no doubt supplied by the subjects themselves— were very amusing when compared against each other! At Los Angeles, next week, many others would express their disappointment about that first issue.) Vol.1, nr.1 proved sufficiently soporific on that Thursday morning for another two hours of undisturbed sleep on the family couch. The net effect was that, at noon, I had had eight hours time shift. That was fine and reassuring, for it was with considerable trepidation that I had been looking forward to my commitments: a lecture on that Thursday at Berkeley at 4 o'clock (= midnight) and the next Friday at 4 o'clock a lecture at Stanford.
At Berkeley, the lecture room overflowed, and I had very little blackboard space. The sound system, however, was adequate and I was not expected to speak for more than 50 minutes. It was an acceptable performance. The Chinese restaurant where we should have meal together and where Tony Wasserman would pick me up during the evening having had a fire, we ended up in a Japanese restaurant. Between the talk and the dinner I was rescued by Sue Graham and Michael Harrison, with whom I drank a few glasses of nice, white wine in a cool and peaceful living room. For the last glass we were joined by Vuillemin, who had asked a question after my talk. (It turned out that I had had him in my audience at the Summer School in Le Breau-sans-Nappe, some five years ago: as usual, I did not remember, but, thank goodness, he did not blame me. Otherwise, he would not have turned up.)
On Friday morning I joined Tony Wasserman while going to the ACM Pacific 75. I bought a small, cheap camera and have not attended any of the sessions, except the Luncheon Banquet, where I had to read —no problem therefore— my Luncheon Speech. (It had been printed in the Conference Proceedings and under such a circumstance I find it always a little bit silly just to read my text: as if one's audience cannot read! I have used the Railway Parable by way of introduction. It all went very well.) I walked through the corridors, was introduced to Codd (we had never met) and encountered Lyle, Cowan and Barton from Burroughs. They invited me for an informal meeting near San Diego (with Holt and Petri), but next week I discovered that I could not make it.
Immediately after the Conference Banquet I was taken to Stanford, where I met Jim Eve as expected; I also found there Brian Randell and Peter Henderson —what I could have expected— and Rod Burstall —what was a pleasant surprise—. As Stanford had asked for the same lecture as Berkeley, I gave the same lecture again. This time we had been moved to a larger auditorium, so that it did not overflow. The sound system was not of a convincing quality —it was in the EE Department— and the old blackboards were of the type that cannot be cleaned anymore. I suffered less from these minor disturbing influences than the previous day and the lecture went very smooth. (I fear that I am getting quite spoiled by the lecturing facilities at the THE!) In the evening there was a party at Jim and Margaret Eve's (temporary) Castle and at 11 o'clock I disappeared with Don and Jill Knuth, where I woke up at four o'clock in the morning, awake beyond redemption. At 6 o'clock in the morning I was writing a letter to Ria at their dinner table and when it was nearly completed, Jill came down for breakfast. The morning was devoted to an exchange of problems and solutions, views and opinions between Don and me, the afternoon to walking over the Stanford Campus and piano playing —his organ was going to be installed within a few weeks— and early in the evening Don and Jill Knuth brought me back to Tony Wasserman's house, where we joined a party. There I met Richard Karp from Berkeley, Bob Floyd from Stanford and John Backus from IBM. Bob Floyd was very excited because he had just derived the exact minimum number of steps needed for addition in number systems with unique representation (by pushing a lower bound and an upper bound until they coincided). It had taken him about a year to do so and he was clearly still absolutely excited that he had been able to do so. (Without denying the brilliancy of the argument, I must confess that I am not convinced of the central importance of the problem as far as computing science is concerned: it strikes me more as pure mathematics.)
After having been shown the San Francisco surroundings on Sunday morning, I flew under Tony Wasserman's guidance from San Francisco to Los Angeles in order to attend from Monday through Wednesday the International Conference on Software Reliability. Those were three busy days: besides being the first speaker —that is, after the Keynote Address by Ruth Davies from the NBS, a Keynote Address that I did not understand— I was also the last speaker and it was intended that I should try to use the last slot for a summing up. (My printed text in the Proceedings was only an "Emergency Exit" in case that I had not figured out what to say. I fell a little bit shaky at that last session, confronted by an audience of about a thousand people and intending to speak without written text. As the audience was very mixed, I have mainly spoken about the various forms of pressure to do the wrong things, about the false hopes and the lies that are the curse of our profession and about the strains, tensions and pains caused by the fact that a craft is changing into a science. It was that kind of talk. At the end I have used only five paragraphs or so from the Emergency Exit. Three days later I heard —to my surprise!— that I had been "so bitter". I don't think so: "honest" would have been a better term. It was a quite risky performance, but quite a few came to me afterwards and thanked me. I hope that I have not offended or disturbed more people than necessary.)
The International Conference on Software Reliability was, to start with, a circus with about a thousand participants instead of the estimated four hundred. At a closer inspection it was a very mixed lot, as mixed as the title item "Software Reliability" was lousy. One lesson is clear: when organizing a conference, don't use a vague title like that.
There were mainly three groups of people:
a) the correctness guys
b) the program testers and other engineering pragmatists
c) the software project managers.
The three categories are presumably listed in order of increasing magnitude and decreasing quality. Category c) felt itself very clearly threatened by the technicians of the other two categories, and showed this in various ways. One way was to deny flatly that —at least today and for the next years to come— the technicians could contribute, e.g. L.M.Culpepper's postulate (Naval Ship Research and Development Center): "For the present, reliable software must be produced by people whose primary skills and interests lie outside the field of programming." A specially sickening performance was R.D.Williams's (from TRW) salestalk "... In fact, at TRW, where the search has been intense and continuous over the years, a great deal of progress has been made, a lot has been learned and we can say conservatively (sic!) that we have come a long way. [...] Despite having introduced unprecedented rigor into the task of specifying and reaching mutual agreement on unambiguous requirements, we fully appreciate the need for even more rigor and a comprehensive technology to guide and control the requirement specification effort." Etc. There was at least one other TRW-paper in the same vein, and more than one has asked himself (or others) whether this conference was in part a piece of TRW's sales promotion. (Boehm, the program chairman, is from TRW.) If so, it must have had some negative effects as well, for I saw many people leaving the room in absolute disgust. Classifying programmer mistakes according various (ill-defined) categories was also a beloved pastime, and, of course, there was Weinberg, who does not know that anecdotes are only a poor substitute for conversation.
The type c) people thought mainly in terms of power. The type b) people were a little bit more pathetic, because they felt clearly threatened in their technical skills: on the whole they had at least the lurking suspicion that their approach was not fully right. It was here that we had a number of statistical papers based on the assumption that software errors caused malfunctioning subject to a Poisson distribution (what else?) and from then onwards, etc..... They had a tendency of defending themselves by putting on the hat of the "reasonable, reliable engineer", pointing out —sometimes at great length— that "correctness", although of course important, was only a very small aspect of the task. Too much of that was presented in terms of the vulgar controversy —vulgar because fruitless— of "common sense" versus "mathematics", of "the practical problems of the real world" versus "theory"; Parnas' paper had too much of that flavour for my taste.
The type a) speakers felt most secure. They showed proof techniques, either by hand or (partly) mechanized, to be applied during or after program development and, in general, they did not oversell too much. They derived their sense of security clearly from the firm mathematical basis of their work and some of their relative modesty from previous failures of Artificial Intelligence. I myself found the methods less convincing, the more they relied upon mechanical assistance. Various people showed how they tried to debug programs by "symbolic execution" (James C.King "A new approach to program testing" and Robert S.Boyer, Bernard Elspas and Karl N.Levitt "SELECT— a formal system for testing and debugging programs by symbolic execution.") but I have grave doubts whether these efforts make much sense: I fear that a combinatorial explosion will quickly prevent their application and thus reduce their significance. They tend to partition the input space according to the resulting flow of control ("the control path") and that seems self-defeating. A sentence like "each loop can be executed as many times as a user feels necessary to convince himself of its correctness" is taken as a support of my doubts! Shmuel Katz and Zohar Manna ("Towards automatic debugging of programs") state "The main tool we use will be the invariants of the program, which express the relationships among the variables at pre-chosen cutpoints during execution of the program" and that seems to make more sense. My judgement will be postponed until I have made a sufficiently thorough study of their paper; I hope that its presentation can be simplified! I was more attracted by Susan L.Gerhart's paper "Knowledge about programs: a model and case study." Susan L.Gerhart was also co-author (with John B.Goodenough) of "Towards a theory of test data selection"; while reading that I found myself somewhat depressed when I observed that these authors thought it still necessary to show that a program may be wrong, although testcases exercising the whole program text have been processed correctly. Later, while reading other papers, I became still more depressed when I discovered that this warning is still necessary! I came home with a fat, green bible of more than 560 pages, containing more than 60 papers of which perhaps 10 per.cent worth studying. I left the Conference rather depressed, but in retrospect it is perhaps not so bad at all (To quote Strachey's quotation "After all, 95 per.cent of everything is rubbish"; 10 percent worthwhile is then not bad at all!) Chairman Yeh was absolutely convinced that the conference had been a great success, but he seemed to judge primarily by the number of paying participants.
The next two days were passed at ISI where Ralph London had invited a small number of people for an informal gathering. I do not remember all that were present, for we came from eight different countries, and I remember only Manna, Ershov, Burstall, Randell, Bledsoe, Luckham, Good, London, Turski, Wulf and Musser. On Thursday morning I showed the on-the-fly garbage collection, proof included and the audience was duly impressed (Bill Wulf was even delighted, for he felt that he could use the solution very well). Bledsoe showed some mechanical proofs from normal analysis, using "extended reals", Burstall did his IFIP paper again, Randell showed the implementation of recovery blocks, London and his crew gave a demonstration of their verification system. My feelings with respect to that project are still very mixed, for a great variety of reasons. Their screens were beautiful and the whole system seemed nicely engineered, but .... the demonstration had to take place during lunch, because then we could have a dedicated PDP10 at our disposal with 256K words. The demonstration took nearly an hour, the program was a program for the binary search and got stuck in most of the proofs. After the demonstration I studied the program text that I found hard to understand, so I decided to program it myself and I delivered formally a much more beautiful (and more "efficient") program on the backside of an envelope in two minutes. This contrast gave me the uneasy feeling that with the economy of their system, something is still very wrong. One thing is certain: the stress on mechanical proofs is because they want a certified and (on what justification?) trust a machine better than a human being. That a proof is also the carrier of our understanding and that the joy of understanding is the last one we should delegate to machine is hardly stressed, probably because it cannot serve as a basis for funding.
On Friday afternoon I flew to Phoenix, Arizona, where I was due to perform on Saturday morning and afternoon on the invitation of the Phoenix Chapter of the ACM. Upon arrival in Phoenix my host, dr.Susan Brewer and her husband invited me for a concerto given by the Borodin Quartet. This was quite a surprise! The performance took place in the building of the Phoenix Chamber Music Society —or something very similar— and I was exposed to music and a new aspect of American social life. After the performance we had a late dinner with the soloists. My performance on Saturday morning was not too successful: in an overloaded room with the doors open (for reasons of ventilation) I had to fight the airport noise, only assisted by what was described as "a weak microphone". I had to work with an overhead projector, but the pen had a very blunt point and this was difficult to combine with my subject that required rather lengthy formulae. It was a distressing battle. During lunch I retrieved from my luggage a pen with a sharper point and used some of the prepared "visuals" that I had used at my first talk in Los Angeles. The second one went much better. Early in the evening I flew back to Los Angeles, where Bob Merrell and his wife were at the airport to pick me up and to take me to Mission Viejo, where I stayed in the Mission Viejo Hilton Inn.
(The room number on Mission Viejo was 242; in Los Angeles my room number had been 338 and as I am used to factorizing room numbers, this was a surprise! The Mission Viejo Hilton Inn was better than the International Hotel in Los Angeles, which was just terrible: "Two eggs any style", I discovered in Los Angeles, excludes hard boiled.... Both their bars had music and hardly any illumination, but in the International Hotel the volume was such as to make conversation nearly impossible.)
For a week I stayed in Mission Viejo at the Burroughs Large Systems Plant: it felt like coming home, most people I encountered I had met before. On the one hand it was hard work, about forty per.cent of the time I have been standing in front of a blackboard. But there were no communication difficulties: on one of the first mornings we entered the plant at about 8 o'clock in the morning and after having accepted coffee from one of the secretaries, they showed me what they wanted to ask me, at ten past nine we were down to essentials. Yet it all took place in a relaxed manner, orders of magnitude less hectic than the preceding ten days. My presence was responsible for a few social events and I saw a few very nice homes, often with a beautiful view. (I wondered whether that climate would make me utterly irresponsible!) I was, however, severely tempted to offer the plant something like the "Edsger W.Dijkstra Blackboard", but I have done no more than expressing the intention. On the anniversary of Her Majesty our Queen I took half an afternoon off; that evening I have eaten in solitude and written all evening.
I left Mission Viejo on Saturday morning. At a quarter to seven in the morning Bob Merrell was at the Hilton Inn's doorstep and took me to the airport in Los Angeles, from where I flew to Montreal. I had another four days to go and the stay in Canada enabled me to absorb at least three of the eight hours time shift in advance. The flight to Montreal was interrupted by a stop in Toronto, chasing my luggage, when at last it turned up, just in time for getting on the flight again. In Montreal I was picked up by someone from IBM who drove me to the Castle Montebello.
From Monday through Wednesday IBM sponsored there a conference on Software Engineering Education, and in my innocence I had expected an audience of computer scientists. My driver, however, was a manager, who opened the conversation with something like "So you are the world expert on structured programming and chief programmer teams." Then I knew that I was out in the wilderness and politely refused to be associated with Harlan D.Mills. During that car ride I have heard more about hockey than I ever wanted to know. I felt very low when we arrived at Montebello. Upon arrival I found the scene considerably brightened by the broad shoulders and similar neck of Wlad Turski.
The Montebello conference was very instructive for me, although I learned a lot without which I would have been happier. The participants were at most for fifty per.cent computing scientists, for the rest they were either IBM officials or managers of the automatic data processing department of large IBM customers. I had the full opportunity to observe all the intricate love/hate relations between the angles of the triangle "university-manufacturer-customer". It was all very frightening and I wish that I had a mastery of my pen like Arthur Koestler, for then I could have written a companion volume to his "The Call Girls".
The central victims in this drama are the so-called MBA's (short for "Master of Business Administration"), and the firms dependent on their services, in short their employers. They really have painted themselves into a corner with very sticky molasses! They have made a number of mistakes that are hard to forgive. The one mistake is that they have based their full automation upon the IBM 360. When that machine was announced, it was immediately clear to many —even inside IBM!— that it would be practically impossible to write decent software for that hardware, for the latter contained too many too serious blunders. You cannot program a crooked machine to go straight and a hardened piece of junk propagates all through the system. As the software cannot be acceptable, stability of it was the last that could be expected. Yet they chose that shaky basis as their starting point. The next thing is that they decided to program all of it in COBOL. And now they find the administration of these big firms dependent on 5 million lines of COBOL! That would already be terrible all by itself, but on top of that misery they find IBM coming with a next release of OS/360 by the time that they have hardly managed to adjust their program library to the changes introduced at the previous release. They have set up gigantic administrations and have made their firms fully dependent on them, but have done so in the absence of the necessary competence to do so. It is absolutely terrible and one of these days something terrible is bound to happen. It is irresponsibility on the verge of lunacy, but, believe me or not: the MBA's seem to believe that they have done something very clever! But now, quite unexpectedly it seems, they are in trouble. One of those speakers made the duty of the university quite clear: IBM came with its confusing releases at a greater speed than the system programmers in the business could cope with, customer training was also defective, and therefore the universities (who had lots of experts in the area of operating systems, all of them with a lot of educational experience) should give crash courses in "How to live with the next release of OS 360." Perhaps the government could mediate between the vendor and the universities so that the universities could get advance information, etc. And what can the University do? To quote C.A.R.Hoare: "And simplicity is the unavoidable price which we must pay for reliability." We know that this is going to collapse, it must, crushed under the weight of its own unwieldiness. And things are not going to improve, they will become worse. Herbert Schorr, now one of IBM's vice-presidents, announced in his keynote address —so bad, that many Canadians felt obliged to offer me their apologies on behalf of that American, and if you know something about the Canadian/American relations that is saying a good deal!— better times: primary memory would become so cheap that OS 360 could at last grow from 2.5 million something (bytes or words, does not matter) to 4 million somethings! Only more and more of the same, becoming demonstrably more intertwined. It is no longer "logical spaghetti", but "logical barbed wire". In the middle of the morning, Herbert Schorr thought it fit to intervene by shouting "Why is everybody so damned pessimistic?". Tome Hull gave, as the next speaker in the discussion, him the answer "Because all of us have heard this morning's keynote address." He did that perfectly.
But on the whole it was ghastly; unreal. I was severely shocked by the cultural level of the business participants. Their jokes were stale and sordid and —for people in business this amazed me— they could not drink their alcohol with style (and alcohol was provided by IBM plenty: "whiskey galore"; also this lavishness was somewhat appalling). But also technically they were absolutely uneducated. I remember one extremely fruitless discussion with a man, who talked all the time about "the user". I suggested to him that he should not use that term and that he should separate his concerns: on the one hand try to make you system meet the requirements —and during that phase it is wise to consider yourself as the user— and if the system's customer happens to be someone else than yourself, deal with the problem of discovering his needs and intentions as a separate issue. He absolutely refused to make this separation of concerns.
Later I heard Harlan Mills give a summing up of some of the things I had said —together with some Harlanesk additions— for that business audience. It was terrible, a misuse of language to which to the best of my powers I could not give a meaning. So, every third terrible phrase I interrupted Harlan "please could you explain or restate what you tried to say" but it was hopeless. Tom Hull helped me and I was very grateful to him. Later, when it was all over, our eyes met, and Tom gasped "Jezus!". It was the first time that I had heard him use strong language. How to sell empty but impressive slogans under the cloak of academic respectability...
Turski's comments were short "They don't want computer scientists, nor software engineers, they want brainwashed mental cripples." It is too true...
On the last morning, our great Harlan gave the summing up talk. It was again very much of the same, but, remarkably enough, I learned something from him, viz. the expression "entry level jobs". His argument was that the university should not train experts —as an aside: training and education were constantly confused— because the jobs those experts should get were no "entry level jobs". This may be a profound difference between the academic community and (at least some of) the business community: there is not the slightest objection to giving the most responsible university function, viz. a full professorship, to a youngster who has just got his Ph.D. It does not happen so very often, because really brilliant people are rare: but nothing in the university environment forbids it as soon as a really brilliant man emerges. On the contrary, I am tempted to add! But to the business communities represented it was unthinkable to give a youngster any real responsibility....
The most frightening thing —and that made it all so unreal— was that all those business blokes, although in great trouble, were so little alarmed. They said that they were trying to dig themselves out of the hole again, but only wished to try to do so by well-established practice. So they will only sink deeper into the mud. If they really want to get out of the mess, something drastic has to be done and if they don't, something drastic will happen all by itself. But this was clearly beyond their imagination.