What is an injected defect in Software Engineering?

Convincing references to truly error-free code methodologies

• I've a disagreeable client. He's the CIO of a public company. I'm his software vendor. He gets very upset when his users find bugs in the software I provide him. At a meeting last week, I told him that I take every bug seriously, and will work to fix all bugs that are discovered. I also told him that I cannot guarantee bug-free code, as such a thing is impossible. He became livid at my answer. Bug-free systems are indeed possible, he claims. In fact, the Software Engineering Institute at Carnegie Mellon in Pittsburgh has a program called the Capability Maturity Model that ensures against all errors in any code produced by the highest levels of the process. In his words, "zero-defect environments exist where quality is critical: they're the environment where the bomb finds the right window." I know this to be a misconception on his part, and told him so. He was insistent, claming that a local (and very large) financial institution has adopted the SEI's practices, and as a result produces systems with no bugs. His background is as CIO, and not as a software developer. I can certainly understand how, given a lack of developpment experience, a CIO might think that bug-free code is possible. But this guy got his job because he was famous as a CIO. He was even a professor within a nationally-ranked business school (top 5) of a large university. His job: teaching would-be CIOs. I would hope he would have some insight on software products and processes. On to my question: I can find many references to authorities, from Steven McConnell to Kurt Goedel, that bug-free code is not possible. Or, more accurately, that we can never be assured that our code is free of bugs. What I can't find is very convincing references to the possibility of bug-free code. Some companies profess it, some documents say we should strive for bug-free code (a dangerous sentiment in itself). But I can't find anything that doesn't have a cheesy web site or links to third-rate magazines that claims zero defects as a true possibility. What I'm looking for is some high authority on maintaining bug-free code. Someone who truly believes that a particular, real-life useful system can be free of all bugs, and that zero defects can be guaranteed. Someone that others take very seriously: perhaps he's written up in many prominent magazines, or holds a position at a university or at a very large US company. Your job as a researcher of this question: take my personal conviction zero defects cannot be guaranteed. Show me how wrong I am.

• Answer:

  Doug, Do you think that your CIO would accept the word of Steve Cross, the Director and CEO of Carnegie Mellon's Software Engineering Institute (SEI) ( http://www.sei.cmu.edu ), which created the Capability Maturity Model? "Stephen E. Cross is the Director and Chief Executive Officer (CEO) of the Software Engineering Institute (SEI), a United States Department of Defense sponsored Federally Funded research and Development Center (FFRDC) situated as a college level unit at Carnegie Mellon University. He was appointed to this position on November 1, 1996. He joined the university in 1994 as a member of the research faculty. He also holds an appointment in Carnegie Mellon's School of Computer Science as a Principal Research Scientist in the Robotics Institute. Dr. Cross is the past chairman of the Defense Advanced Research Projects Agency (DARPA) Information Science and Technology panel (ISAT) and continues to serve on the executive committee. He is also a member of the Naval Post Graduate School's (NPS) Software Engineering Advisory Board. He has published more than 50 papers on technology and the applications of advanced information processing technology. He received his Ph.D. from the University of Illinois, his M.S.E.E. from the Air Force Institute of Technology, and his B.S.E.E. from the University of Cincinnati. He is a graduate of the U.S. Air Force (USAF) Test Pilot School (Flight Test Engineer Program), the Air War College, and the National Defense University. He retired from the USAF in 1994. Dr. Cross was profiled in a January 4, 2002 article in the on-line version of Business Week entitled "Gurus of Tomorrow's Technology." http://www.sei.cmu.edu/staff/sc/ --------------------------------------------- From : aceresearcher To : [email protected] Subject : Capability Maturity Model Date : Fri, 15 Nov 2002 16:17:51 -0500 Mr. Cross, I am in need of written verification from someone who would be considered an authority on the Capability Maturity Model (could be a co-author, co-designer, CMM support person, etc) that the Model does NOT in fact say that it is possible to create complex software that is completely bug-free. (This is to respond to someone who is insisting that the Capability Maturity Model DOES say that it is possible to create complex software that is completely bug-free.) If you would be willing to dash of 1 or 2 sentences to that effect, or to pass this e-mail on to someone who could do the dashing and reply to me, I would be MOST appreciative. THANKS VERY MUCH! --------------------------------------------- From : Steve Cross <[email protected]> To : aceresearcher CC : Bill Peterson <[email protected]> Subject : Re: Capability Maturity Model Date : Sun, 17 Nov 2002 05:04:41 -0500 "You could refer the person who asked you the question to our web site (www.sei.cmu.edu) for appropriate statements. The rest of the message is my personal opinion. A model does not guarantee anything. It can only provide guidance as to what is possible. The CMMI, as the SW-CMM before it, provides an approach for an organization to define its engineering and engineering management work processes and to improve them over time. What needs to be improved should be guided by the business goals of the organization (this is more explicit via than the CMMI which replaces the SW-CMM). If that business goal is defect free software, the CMMI will help the organization move to that goal, but will not guarantee it will be achieved. We have introduced the PSP and TSP to help the individual engineering and teams of engineers to produce near defect free software. PSP and TSP provide individual and team experience in using CMM-based processes in the design and development of software. PSP and TSP are also described on our web site. Having said all this, it is our strongest position that software development organizations are better off adopting and using the CMMI than not and that individual engineers and teams should be PSP trained and use TSP in the individual work. Thanks for contacting me. Steve P.S. You and the person contacting you may want to engage with your local Software Process Improvement Network (SPIN). The list of SPINs are also listed on our web site. Many of these groups have monthly meetings and serve as defacto CMM user groups. P.S. cc'd is Bill Peterson, Program Director of the SEI process group. If you have any further questions, please contact him." --------------------------------------------- Note Mr. Cross' remarks: "A model does not guarantee anything." "If that business goal is defect free software, the CMMI will help the organization move to that goal, but will not guarantee it will be achieved." "We have introduced the PSP and TSP to help the individual engineering and teams of engineers to produce ***near defect free*** software." --------------------------------------------- "CMMI Adoption", from SEI's website: http://www.sei.cmu.edu/cmmi/adoption/adoption.html Software Engineering Institute (SEI) Carnegie Mellon University Pittsburgh, PA 15213-3890 (412) 268-5800 http://www.sei.cmu.edu/cgi-bin/contactus.cgi/sei-home.html?owner=webmaster Search Strategy "Carnegie Mellon" "Software Engineering Institute" "Capability Maturity Model" ://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=%22Carnegie+Mellon%22+%22Software+Engineering+Institute%22+%22Capability+Maturity+Model%22&btnG=Google+Search Before Rating my Answer, if you have questions or need additional information, please post a Request for Clarification, and I will be glad to see what I can do for you. I hope this Answer provides you with exactly the information you needed! Good Luck!!! aceresearcher