Formal methods are a big success at
AWS, helping us prevent subtle but serious bugs from reaching production,
bugs we would not have found through
any other technique. They have helped
us devise aggressive optimizations to
complex algorithms without sacrificing quality. At the time of this writing,
seven Amazon teams have used TLA+,
all finding value in doing so, and more
Amazon teams are starting to use it.
Using TLA+ will improve both time-
to-market and quality of our systems.
Executive management actively encourages teams to write TLA+ specs
for new features and other significant
design changes. In annual planning,
managers now allocate engineering
time to TLA+.
While our results are encouraging, some important caveats remain.
Formal methods deal with models of
systems, not the systems themselves,
so the adage “All models are wrong,
some are useful” applies. The design-
er must ensure the model captures the
significant aspects of the real system.
Achieving it is a special skill, the acquisition of which requires thoughtful practice. Also, we were solely
concerned with obtaining practical
benefits in our particular problem do-
main and have not attempted a comprehensive survey. Therefore, mileage
may vary with other tools or in other
problem domains.
Formal methods are a big success atAWS, helping us prevent subtle but serious bugs from reaching production,bugs we would not have found throughany other technique. They have helpedus devise aggressive optimizations tocomplex algorithms without sacrificing quality. At the time of this writing,seven Amazon teams have used TLA+,all finding value in doing so, and moreAmazon teams are starting to use it.Using TLA+ will improve both time-to-market and quality of our systems.Executive management actively encourages teams to write TLA+ specsfor new features and other significantdesign changes. In annual planning,managers now allocate engineeringtime to TLA+.While our results are encouraging, some important caveats remain.Formal methods deal with models ofsystems, not the systems themselves,so the adage “All models are wrong,some are useful” applies. The design-er must ensure the model captures thesignificant aspects of the real system.Achieving it is a special skill, the acquisition of which requires thoughtful practice. Also, we were solelyconcerned with obtaining practicalbenefits in our particular problem do-main and have not attempted a comprehensive survey. Therefore, mileagemay vary with other tools or in otherproblem domains.
การแปล กรุณารอสักครู่..
