View article

During the years that I have worked on this thesis I've often wandered around the o ce, looking for people who could tell me why my computer or the programs I was running on it weren't working as I expected them to work. For example, some time ago I sent a message by electronic mail to about eighty people, and then went to lunch. When I came back from lunch I found that the mailer had just started sending the message for the eighth time to the rst fty people on the address-list, and if I hadn't found somebody who could stop the mailer, it would have gone on sending the message forever. The reason why the mailer kept sending the message was that it worked as follows. It sent the message to the rst fty addresses on the address-list, then it got an error message stating that some bu er could not contain more than fty addresses, and as a consequence, it started sending the message again. Clearly, there was an error in the mailer.

Anybody who has worked for some time with computers can tell you this kind of story. For me, obviously, the experience described above was annoying, but not disastrous. However, few people will nd it di cult to recall disasters caused by malfunctioning computers. It is generally acknowledged that reliable computers (hardware) and reliable computer programs (software) are very desirable. Since hardware and software are constructed and used by people, the construction and use of reliable software and reliable hardware depends on the existence ofreliable people': sensible people that are well educated in the performance of their task. This thesis is concerned with one of the important tasks that can be distinguished in …