Earlier quoted context omitted.
Architectural blueprints are very precise. What gets built is a more detailed form of what is in the blueprint. That is not the case for the TLA+ spec and your 1MLOC Java Database. You hope with fingers crossed that you've implemented the design, but have you? I can measure that a physical wall has the same dimensions as specified in the blueprint. How do I know my program follows the TLA+ spec? I'm not being facetio…
> That is not the case for the TLA+ spec and your 1MLOC Java Database. That is the case. Of course, nobody bothers to write the TLA+ proof that that is the case, because even if somebody had the resources to do it, the ROI on doing that is not good. If you can avoid 4 major bugs with 10 hours of work, you probably won't want to work an extra 10,000 hours to avoid two additional minor ones. That most people choose to…
Can we extend that to large scale software? There's no obvious barrier to it, beyond a lack of existing provably correct code to build upon.
I don't expect this to change, however, since the cost/benefit ratio just isn't there. And that makes me sad. We build everything on quicksand.