Group items tagged

When scientists first saw the data suggesting that they’d captured a gravitational wave, they thought the results seemed to good to be true. Past claims of gravitational waves have proven unreliable, and there are many possible sources of error.

Gravitational waves confirmedAstrophysicists have announced the discovery of gravitational waves, ripples that travel at the speed of light through the fabric of space-time. A 1916 theory of Albert Einstein’s predicted their existence. .oembed-asset-photo-image { width: 100%; }

The bizarre episode illustrates how easily misinformation spreads online, often with the help of the president himself. Right-wing websites that seek to support the president’s baseless claims, or simply attract clicks so they can sell more ads, often eschew the traditional principles of journalism, such as simple fact-checking. And the social media companies aid the cycle by making it simple to share misinformation, including via fake accounts, and by training their algorithms to promote material that attracts more attention, as sensational and divisive posts often do.

As a result we end up with the most bizarre health-insurance system imaginable: One ever better designed to avoid sick people.

America’s giant health insurers are now busily consolidating into ever-larger behemoths.

In reality, they’re becoming huge to get more bargaining leverage over everyone they do business with — hospitals, doctors, employers, the government and consumers. That way they make even bigger profits.

researchers found, for example, that after Aetna merged with Prudential HealthCare in 1999, premiums rose 7 percent higher than had the merger not occurred.

The real choice in the future is either a hugely expensive for-profit oligopoly with the market power to charge high prices even to healthy people and stop insuring sick people.

Or else a government-run single payer system — such as is in place in almost every other advanced economy — dedicated to lower premiums and better care for everyone.

When I wrote in August 2015 that Mr. Trump was a cartoon version of every left-wing media stereotype of the reactionary, nativist, misogynist right, I thought that I was well within the mainstream of conservative thought — only to find conservative Trump critics denounced for apostasy by a right that decided that it was comfortable with embracing Trumpism.

relatively few of my listeners bought into the crude nativism Mr. Trump was selling at his rallies.

What they did buy into was the argument that this was a “binary choice.” No matter how bad Mr. Trump was, my listeners argued, he could not possibly be as bad as Mrs. Clinton. You simply cannot overstate this as a factor in the final outcome

Even among Republicans who had no illusions about Mr. Trump’s character or judgment, the demands of that tribal loyalty took precedence. To resist was an act of betrayal.

In this binary tribal world, where everything is at stake, everything is in play, there is no room for quibbles about character, or truth, or principles.

If everything — the Supreme Court, the fate of Western civilization, the survival of the planet — depends on tribal victory, then neither individuals nor ideas can be determinative.

As our politics have become more polarized, the essential loyalties shift from ideas, to parties, to tribes, to individuals. Nothing else ultimately matters.

For many listeners, nothing was worse than Hillary Clinton. Two decades of vilification had taken their toll: Listeners whom I knew to be decent, thoughtful individuals began forwarding stories with conspiracy theories about President Obama and Mrs. Clinton — that he was a secret Muslim, that she ran a child sex ring out of a pizza parlor. When I tried to point out that such stories were demonstrably false, they generally refused to accept evidence that came from outside their bubble. The echo chamber had morphed into a full-blown alternate reality silo of conspiracy theories, fake news and propaganda.

In this political universe, voters accept that they must tolerate bizarre behavior, dishonesty, crudity and cruelty, because the other side is always worse; the stakes are such that no qualms can get in the way of the greater cause.

When it became clear that I was going to remain #NeverTrump, conservatives I had known and worked with for more than two decades organized boycotts of my show. One prominent G.O.P. activist sent out an email blast calling me a “Judas goat,” and calling for postelection retribution.

And then, there was social media. Unless you have experienced it, it’s difficult to describe the virulence of the Twitter storms that were unleashed on Trump skeptics. In my timelines, I found myself called a “cuckservative,” a favorite gibe of white nationalists; and someone Photoshopped my face into a gas chamber. Under the withering fire of the trolls, one conservative commentator and Republican political leader after another fell in line.

we had succeeded in persuading our audiences to ignore and discount any information from the mainstream media. Over time, we’d succeeded in delegitimizing the media altogether — all the normal guideposts were down, the referees discredited.

That left a void that we conservatives failed to fill. For years, we ignored the birthers, the racists, the truthers and other conspiracy theorists who indulged fantasies of Mr. Obama’s secret Muslim plot to subvert Christendom, or who peddled baseless tales of Mrs. Clinton’s murder victims. Rather than confront the purveyors of such disinformation, we changed the channel because, after all, they were our allies, whose quirks could be allowed or at least ignored

We destroyed our own immunity to fake news, while empowering the worst and most reckless voices on the right.

This was not mere naïveté. It was also a moral failure, one that now lies at the heart of the conservative movement even in its moment of apparent electoral triumph. Now that the election is over, don’t expect any profiles in courage from the Republican Party pushing back against those trends; the gravitational pull of our binary politics is too strong.

The public started drawing comparisons between the Inner Party's regime and Trump's presidency when his adviser used the phrase "alternative facts" in an interview. Kellyanne Conway was being quizzed after the White House press secretary Sean Spicer apparently lied about the number of people who attended Trump's inauguration. The presenter asked why President Trump has asked Spicer to come out to speak to the press and "utter a falsehood". Conway responded that Spicer didn't utter a falsehood but gave "alternative facts". People drew comparisons with "newspeak" which was aimed at wiping out original thought. Her chose of language was also accused of representing "doublespeak" - which Orwell wrote "means the power of holding two contradictory beliefs in one's mind simultaneously." Washington Post reporter Karen Tumulty said: "Alternative facts is a George Orwell phrase".

Sales of 1984 also soared in 2013 when news broke of the National Security Administration's Prism surveillance scandal.

a reduction in REM sleep (or less “dreaming”) influences our ability to understand complex emotions in daily life – an essential feature of human social functioning

Dreams seem to help us process emotions by encoding and constructing memories of them. What we see and experience in our dreams might not necessarily be real, but the emotions attached to these experiences certainly are. Our dream stories essentially try to strip the emotion out of a certain experience by creating a memory of it. This way, the emotion itself is no longer active.  This mechanism fulfils an important role because when we don’t process our emotions, especially negative ones, this increases personal worry and anxiety.

In short, dreams help regulate traffic on that fragile bridge which connects our experiences with our emotions and memories.

But perhaps the paper by Liao, Sandberg and Roache will turn out to be a prank played on the journal, like the Sokal hoax, named after the physicist whose paper deploying post-modern gobbledegook to show that “quantum gravity is a social and linguistic construct” was published in a cultural studies journal.

It’s easy to imagine academics sitting around swapping the most outrageous solutions to climate change and then daring one another to have them published. I hope this will turn out to be the case. In the meantime I cringe at the thought of what the long-dead giants of Western philosophy would make of their discipline’s response to the climate crisis.

Scalia’s opinion thus makes the neutrality problem even worse—because it suggests it’s all bias, all the way down, even for the most professional of us. Is that true? And how do you preserve neutral courts–or, to switch to another sector, trust in the findings of the scientific community–if that is indeed the case?

describe bizarre situations, like physical systems existing simultaneously in multiple states, such as different positions or velocities. It gives very precise probabilities for the possible outcomes of laboratory experiments, but it defies an intuitive interpretation.

But the theorems show that this explanation simply cannot work.

“At one point, I heard someone screaming, and it wasn’t until I felt the hands of one of the friendlier guards on my face, trying to revive me, that I realised the screams were my own.”

We’ve known for a while that isolation is physically bad for us. Chronically lonely people have higher blood pressure, are more vulnera

In the 1950s and 1960s, China was rumoured to be using solitary confinement to “brainwash” American prisoners captured during the Korean War, and the US and Canadian governments were all too keen to try it out.

It is gratifying to see the National Review mobilize against Trump, decrying his “free-floating populism” and disdain for the details of public policy. But where were the magazine’s editors when Sarah Palin put these same forces on full display eight years ago? Loudly cheering her on.

We still see this denial, with the truly bizarre claim by some in the media that the rise of Trump is really all the fault of . . . Obama. The logic is varied.

Here is a much simpler explanation for Donald Trump: Republicans have fed the country ideas about decline, betrayal and treason. They have encouraged the forces of anti-intellectualism, obstructionism and populism. They have flirted with bigotry and racism. Trump merely chose to unashamedly embrace all of it, saying plainly what they were hinting at for years. In doing so, he hit a jackpot.

The problem is not that Republican leaders should have begun to condemn Trump last year. It is that they should have condemned the ideas and tactics that led to his rise when they began to flourish 20 years ago.

researchers collected millions of dream reports. After studying the data, Professor Wiseman discovered that the soundscapes did indeed influence people's dreams

people's dreams were especially bizarre around the time of a full moon

the team also found that certain soundscapes produced far more pleasant dreams

Having positive dreams helps people wake-up in a good mood, and boosts their productivity. We have now discovered a way of giving people sweet dreams, and this may also form the basis for a new type of therapy to help those suffering from certain psychological problems, such as depression

Magicians have long used such cognitive biases to their advantage, and in recent years scientists have been following in their footsteps, borrowing techniques from the conjurer’s playbook in an effort not to mystify people but to study them.

Scientists have found a way to induce change blindness, with a machine called a transcranial magnetic stimulator, which uses a magnetic field to disrupt localized brain regions

Such blind spots confirm what many philosophers have long suspected: reality and our perception of it are incommensurate to a far greater degree than is often believed. For all its apparent fidelity, the movie in our heads is a “Rashomon” narrative pieced together from inconsistent and unreliable bits of information. It is, to a certain extent, an illusion.

It is too late for me, and it’s too late for pretty much everyone my age. We are so brainwashed. And as imperfect as the body positivity movement may be, just remember: We didn’t even have one.

the really painful message our daughter will receive is that we're embarrassing. For most people who aren't New Atheists, or old atheists, and have no passion invested in the subject, either negative or positive, believers aren't weird because we're wicked. We're weird because we're inexplicable; because, when there's no necessity for it that anyone sensible can see, we've committed ourselves to a set of awkward and absurd attitudes that obtrude, that stick out against the background of modern life, and not in some important or respectworthy or principled way, either.

Believers are people who try to insert Jee-zus into conversations at parties; who put themselves down, with writhings of unease, for perfectly normal human behaviour; who are constantly trying to create a solemn hush that invites a fart, a hiccup, a bit of subversion. Believers are people who, on the rare occasions when you have to listen to them, like at a funeral or a wedding, seize the opportunity to pour the liquidised content of a primary-school nativity play into your earhole, apparently not noticing that childhood is over.

What goes on inside believers is mysterious. So far as it can be guessed at it appears to be a kind of anxious pretending, a kind of continual, nervous resistance to reality.

to me, it's belief that involves the most uncompromising attention to the nature of things of which you are capable. Belief demands that you dispense with illusion after illusion, while contemporary common sense requires continual, fluffy pretending – pretending that might as well be systematic, it's so thoroughly incentivised by our culture.

The atheist bus says: "There's probably no God. So stop worrying and enjoy your life."

the word that offends against realism here is "enjoy". I'm sorry – enjoy your life?

If you based your knowledge of the human species exclusively on adverts, you'd think that the normal condition of humanity was to be a good-looking single person between 20 and 35, with excellent muscle-definition and/or an excellent figure, and a large disposable income. And you'd think the same thing if you got your information exclusively from the atheist bus

The implication of the bus slogan is that enjoyment would be your natural state if you weren't being "worried" by us believers and our hellfire preaching. Take away the malignant threat of God-talk, and you would revert to continuous pleasure

What's so wrong with this, apart from it being total bollocks? Well, in the first place, that it buys a bill of goods, sight unseen, from modern marketing. Given that human life isn't and can't be made up of enjoyment, it is in effect accepting a picture of human life in which those pieces of living where easy enjoyment is more likely become the only pieces that are visible.

But then, like every human being, I am not in the habit of entertaining only those emotions I can prove. I'd be an unrecognisable oddity if I did. Emotions can certainly be misleading: they can fool you into believing stuff that is definitely, demonstrably untrue. Yet emotions are also our indispensable tool for navigating, for feeling our way through, the much larger domain of stuff that isn't susceptible to proof or disproof, that isn't checkable against the physical universe. We dream, hope, wonder, sorrow, rage, grieve, delight, surmise, joke, detest; we form such unprovable conjectures as novels or clarinet concertos; we imagine. And religion is just a part of that, in one sense. It's just one form of imagining, absolutely functional, absolutely human-normal. It would seem perverse, on the face of it, to propose that this one particular manifestation of imagining should be treated as outrageous, should be excised if (which is doubtful) we can manage it.

suppose, as the atheist bus goes by, you are povertystricken, or desperate for a job, or a drug addict, or social services have just taken away your child. The bus tells you that there's probably no God so you should stop worrying and enjoy your life, and now the slogan is not just bitterly inappropriate in mood. What it means, if it's true, is that anyone who isn't enjoying themselves is entirely on their own. What the bus says is: there's no help coming.

Enjoyment is great. The more enjoyment the better. But enjoyment is one emotion. To say that life is to be enjoyed (just enjoyed) is like saying that mountains should only have summits, or that all colours should be purple, or that all plays should be by Shakespeare. This really is a bizarre category error.

A consolation you could believe in would be one that wasn't in danger of popping like a soap bubble on contact with the ordinary truths about us. A consolation you could trust would be one that acknowledged the difficult stuff rather than being in flight from it, and then found you grounds for hope in spite of it, or even because of it

The novelist Richard Powers has written that the Clarinet Concerto sounds the way mercy would sound, and that's exactly how I experienced it in 1997. Mercy, though, is one of those words that now requires definition. It does not only mean some tyrant's capacity to suspend a punishment he has himself inflicted. It can mean – and does mean in this case – getting something kind instead of the sensible consequences of an action, or as well as the sensible consequences of an action.

from outside, belief looks like a series of ideas about the nature of the universe for which a truth-claim is being made, a set of propositions that you sign up to; and when actual believers don't talk about their belief in this way, it looks like slipperiness, like a maddening evasion of the issue.

I am a fairly orthodox Christian. Every Sunday I say and do my best to mean the whole of the Creed, which is a series of propositions. But it is still a mistake to suppose that it is assent to the propositions that makes you a believer. It is the feelings that are primary. I assent to the ideas because I have the feelings; I don't have the feelings because I've assented to the ideas.

what I felt listening to Mozart in 1997 is not some wishy-washy metaphor for an idea I believe in, and it's not a front behind which the real business of belief is going on: it's the thing itself. My belief is made of, built up from, sustained by, emotions like that. That's what makes it real.

I think that Mozart, two centuries earlier, had succeeded in creating a beautiful and accurate report of an aspect of reality. I think that the reason reality is that way – that it is in some ultimate sense merciful as well as being a set of physical processes all running along on their own without hope of appeal, all the way up from quantum mechanics to the relative velocity of galaxies by way of "blundering, low and horridly cruel" biology (Darwin) – is that the universe is sustained by a continual and infinitely patient act of love. I think that love keeps it in being.

That's what I think. But it's all secondary. It all comes limping along behind my emotional assurance that there was mercy, and I felt it. And so the argument about whether the ideas are true or not, which is the argument that people mostly expect to have about religion, is also secondary for me.

No, I can't prove it. I don't know that any of it is true. I don't know if there's a God. (And neither do you, and neither does Professor Dawkins, and neither does anybody. It isn't the kind of thing you can know. It isn't a knowable item.)

let's be clear about the emotional logic of the bus's message. It amounts to a denial of hope or consolation on any but the most chirpy, squeaky, bubble-gummy reading of the human situation

It's got itself established in our culture, relatively recently, that the emotions involved in religious belief must be different from the ones involved in all the other kinds of continuous imagining, hoping, dreaming, and so on, that humans do. These emotions must be alien, freakish, sad, embarrassing, humiliating, immature, pathetic. These emotions must be quite separate from commonsensical us. But they aren't

The emotions that sustain religious belief are all, in fact, deeply ordinary and deeply recognisable to anybody who has ever made their way across the common ground of human experience as an adult.

It's just that the emotions in question are rarely talked about apart from their rationalisation into ideas. This is what I have tried to do in my new book, Unapologetic.

You can easily look up what Christians believe in. You can read any number of defences of Christian ideas. This, however, is a defence of Christian emotions – of their intelligibility, of their grown-up dignity.

Code is too hard to think about. Before trying to understand the attempts themselves, then, it’s worth understanding why this might be: what it is about code that makes it so foreign to the mind, and so unlike anything that came before it.

Technological progress used to change the way the world looked—you could watch the roads getting paved; you could see the skylines rise. Today you can hardly tell when something is remade, because so often it is remade by code.

Software has enabled us to make the most intricate machines that have ever existed. And yet we have hardly noticed, because all of that complexity is packed into tiny silicon chips as millions and millions of lines of cod

The programmer, the renowned Dutch computer scientist Edsger Dijkstra wrote in 1988, “has to be able to think in terms of conceptual hierarchies that are much deeper than a single mind ever needed to face before.” Dijkstra meant this as a warning.

As programmers eagerly poured software into critical systems, they became, more and more, the linchpins of the built world—and Dijkstra thought they had perhaps overestimated themselves.

What made programming so difficult was that it required you to think like a computer.

“The problem is that software engineers don’t understand the problem they’re trying to solve, and don’t care to,” says Leveson, the MIT software-safety expert. The reason is that they’re too wrapped up in getting their code to work.

Though he runs a lab that studies the future of computing, he seems less interested in technology per se than in the minds of the people who use it. Like any good toolmaker, he has a way of looking at the world that is equal parts technical and humane. He graduated top of his class at the California Institute of Technology for electrical engineering,

“The serious problems that have happened with software have to do with requirements, not coding errors.” When you’re writing code that controls a car’s throttle, for instance, what’s important is the rules about when and how and by how much to open it. But these systems have become so complicated that hardly anyone can keep them straight in their head. “There’s 100 million lines of code in cars now,” Leveson says. “You just cannot anticipate all these things.”

a nearly decade-long investigation into claims of so-called unintended acceleration in Toyota cars. Toyota blamed the incidents on poorly designed floor mats, “sticky” pedals, and driver error, but outsiders suspected that faulty software might be responsible

software experts spend 18 months with the Toyota code, picking up where NASA left off. Barr described what they found as “spaghetti code,” programmer lingo for software that has become a tangled mess. Code turns to spaghetti when it accretes over many years, with feature after feature piling on top of, and being woven around

Using the same model as the Camry involved in the accident, Barr’s team demonstrated that there were actually more than 10 million ways for the onboard computer to cause unintended acceleration. They showed that as little as a single bit flip—a one in the computer’s memory becoming a zero or vice versa—could make a car run out of control. The fail-safe code that Toyota had put in place wasn’t enough to stop it

. In all, Toyota recalled more than 9 million cars, and paid nearly $3 billion in settlements and fines related to unintended acceleration.

The problem is that programmers are having a hard time keeping up with their own creations. Since the 1980s, the way programmers work and the tools they use have changed remarkably little.

“Visual Studio is one of the single largest pieces of software in the world,” he said. “It’s over 55 million lines of code. And one of the things that I found out in this study is more than 98 percent of it is completely irrelevant. All this work had been put into this thing, but it missed the fundamental problems that people faced. And the biggest one that I took away from it was that basically people are playing computer inside their head.” Programmers were like chess players trying to play with a blindfold on—so much of their mental energy is spent just trying to picture where the pieces are that there’s hardly any left over to think about the game itself.

The fact that the two of them were thinking about the same problem in the same terms, at the same time, was not a coincidence. They had both just seen the same remarkable talk, given to a group of software-engineering students in a Montreal hotel by a computer researcher named Bret Victor. The talk, which went viral when it was posted online in February 2012, seemed to be making two bold claims. The first was that the way we make software is fundamentally broken. The second was that Victor knew how to fix it.

This is the trouble with making things out of code, as opposed to something physical. “The complexity,” as Leveson puts it, “is invisible to the eye.”

in early 2012, Victor had finally landed upon the principle that seemed to thread through all of his work. (He actually called the talk “Inventing on Principle.”) The principle was this: “Creators need an immediate connection to what they’re creating.” The problem with programming was that it violated the principle. That’s why software systems were so hard to think about, and so rife with bugs: The programmer, staring at a page of text, was abstracted from whatever it was they were actually making.

“Our current conception of what a computer program is,” he said, is “derived straight from Fortran and ALGOL in the late ’50s. Those languages were designed for punch cards.”

WYSIWYG (pronounced “wizzywig”) came along. It stood for “What You See Is What You Get.”

Victor’s point was that programming itself should be like that. For him, the idea that people were doing important work, like designing adaptive cruise-control systems or trying to understand cancer, by staring at a text editor, was appalling.

With the right interface, it was almost as if you weren’t working with code at all; you were manipulating the game’s behavior directly.

When the audience first saw this in action, they literally gasped. They knew they weren’t looking at a kid’s game, but rather the future of their industry. Most software involved behavior that unfolded, in complex ways, over time, and Victor had shown that if you were imaginative enough, you could develop ways to see that behavior and change it, as if playing with it in your hands. One programmer who saw the talk wrote later: “Suddenly all of my tools feel obsolete.”

hen John Resig saw the “Inventing on Principle” talk, he scrapped his plans for the Khan Academy programming curriculum. He wanted the site’s programming exercises to work just like Victor’s demos. On the left-hand side you’d have the code, and on the right, the running program: a picture or game or simulation. If you changed the code, it’d instantly change the picture. “In an environment that is truly responsive,” Resig wrote about the approach, “you can completely change the model of how a student learns ... [They] can now immediately see the result and intuit how underlying systems inherently work without ever following an explicit explanation.” Khan Academy has become perhaps the largest computer-programming class in the world, with a million students, on average, actively using the program each month.

The ideas spread. The notion of liveness, of being able to see data flowing through your program instantly, made its way into flagship programming tools offered by Google and Apple. The default language for making new iPhone and Mac apps, called Swift, was developed by Apple from the ground up to support an environment, called Playgrounds, that was directly inspired by Light Table.

“Typically the main problem with software coding—and I’m a coder myself,” Bantegnie says, “is not the skills of the coders. The people know how to code. The problem is what to code. Because most of the requirements are kind of natural language, ambiguous, and a requirement is never extremely precise, it’s often understood differently by the guy who’s supposed to code.”

In a pair of later talks, “Stop Drawing Dead Fish” and “Drawing Dynamic Visualizations,” Victor went one further. He demoed two programs he’d built—the first for animators, the second for scientists trying to visualize their data—each of which took a process that used to involve writing lots of custom code and reduced it to playing around in a WYSIWYG interface.

Victor suggested that the same trick could be pulled for nearly every problem where code was being written today. “I’m not sure that programming has to exist at all,” he told me. “Or at least software developers.” In his mind, a software developer’s proper role was to create tools that removed the need for software developers. Only then would people with the most urgent computational problems be able to grasp those problems directly, without the intermediate muck of code.

Victor implored professional software developers to stop pouring their talent into tools for building apps like Snapchat and Uber. “The inconveniences of daily life are not the significant problems,” he wrote. Instead, they should focus on scientists and engineers—as he put it to me, “these people that are doing work that actually matters, and critically matters, and using really, really bad tools.”

Bantegnie’s company is one of the pioneers in the industrial use of model-based design, in which you no longer write code directly. Instead, you create a kind of flowchart that describes the rules your program should follow (the “model”), and the computer generates code for you based on those rules

In a model-based design tool, you’d represent this rule with a small diagram, as though drawing the logic out on a whiteboard, made of boxes that represent different states—like “door open,” “moving,” and “door closed”—and lines that define how you can get from one state to the other. The diagrams make the system’s rules obvious: Just by looking, you can see that the only way to get the elevator moving is to close the door, or that the only way to get the door open is to stop.

. In traditional programming, your task is to take complex rules and translate them into code; most of your energy is spent doing the translating, rather than thinking about the rules themselves. In the model-based approach, all you have is the rules. So that’s what you spend your time thinking about. It’s a way of focusing less on the machine and more on the problem you’re trying to get it to solve.

“Everyone thought I was interested in programming environments,” he said. Really he was interested in how people see and understand systems—as he puts it, in the “visual representation of dynamic behavior.” Although code had increasingly become the tool of choice for creating dynamic behavior, it remained one of the worst tools for understanding it. The point of “Inventing on Principle” was to show that you could mitigate that problem by making the connection between a system’s behavior and its code immediate.

On this view, software becomes unruly because the media for describing what software should do—conversations, prose descriptions, drawings on a sheet of paper—are too different from the media describing what software does do, namely, code itself.

for this approach to succeed, much of the work has to be done well before the project even begins. Someone first has to build a tool for developing models that are natural for people—that feel just like the notes and drawings they’d make on their own—while still being unambiguous enough for a computer to understand. They have to make a program that turns these models into real code. And finally they have to prove that the generated code will always do what it’s supposed to.

tice brings order and accountability to large codebases. But, Shivappa says, “it’s a very labor-intensive process.” He estimates that before they used model-based design, on a two-year-long project only two to three months was spent writing code—the rest was spent working on the documentation.

uch of the benefit of the model-based approach comes from being able to add requirements on the fly while still ensuring that existing ones are met; with every change, the computer can verify that your program still works. You’re free to tweak your blueprint without fear of introducing new bugs. Your code is, in FAA parlance, “correct by construction.”

“people are not so easily transitioning to model-based software development: They perceive it as another opportunity to lose control, even more than they have already.”

The bias against model-based design, sometimes known as model-driven engineering, or MDE, is in fact so ingrained that according to a recent paper, “Some even argue that there is a stronger need to investigate people’s perception of MDE than to research new MDE technologies.”

“Human intuition is poor at estimating the true probability of supposedly ‘extremely rare’ combinations of events in systems operating at a scale of millions of requests per second,” he wrote in a paper. “That human fallibility means that some of the more subtle, dangerous bugs turn out to be errors in design; the code faithfully implements the intended design, but the design fails to correctly handle a particular ‘rare’ scenario.”

Newcombe was convinced that the algorithms behind truly critical systems—systems storing a significant portion of the web’s data, for instance—ought to be not just good, but perfect. A single subtle bug could be catastrophic. But he knew how hard bugs were to find, especially as an algorithm grew more complex. You could do all the testing you wanted and you’d never find them all.

An algorithm written in TLA+ could in principle be proven correct. In practice, it allowed you to create a realistic model of your problem and test it not just thoroughly, but exhaustively. This was exactly what he’d been looking for: a language for writing perfect algorithms.

TLA+, which stands for “Temporal Logic of Actions,” is similar in spirit to model-based design: It’s a language for writing down the requirements—TLA+ calls them “specifications”—of computer programs. These specifications can then be completely verified by a computer. That is, before you write any code, you write a concise outline of your program’s logic, along with the constraints you need it to satisfy

Programmers are drawn to the nitty-gritty of coding because code is what makes programs go; spending time on anything else can seem like a distraction. And there is a patient joy, a meditative kind of satisfaction, to be had from puzzling out the micro-mechanics of code. But code, Lamport argues, was never meant to be a medium for thought. “It really does constrain your ability to think when you’re thinking in terms of a programming language,”

Code makes you miss the forest for the trees: It draws your attention to the working of individual pieces, rather than to the bigger picture of how your program fits together, or what it’s supposed to do—and whether it actually does what you think. This is why Lamport created TLA+. As with model-based design, TLA+ draws your focus to the high-level structure of a system, its essential logic, rather than to the code that implements it.

But TLA+ occupies just a small, far corner of the mainstream, if it can be said to take up any space there at all. Even to a seasoned engineer like Newcombe, the language read at first as bizarre and esoteric—a zoo of symbols.

this is a failure of education. Though programming was born in mathematics, it has since largely been divorced from it. Most programmers aren’t very fluent in the kind of math—logic and set theory, mostly—that you need to work with TLA+. “Very few programmers—and including very few teachers of programming—understand the very basic concepts and how they’re applied in practice. And they seem to think that all they need is code,” Lamport says. “The idea that there’s some higher level than the code in which you need to be able to think precisely, and that mathematics actually allows you to think precisely about it, is just completely foreign. Because they never learned it.”

“In the 15th century,” he said, “people used to build cathedrals without knowing calculus, and nowadays I don’t think you’d allow anyone to build a cathedral without knowing calculus. And I would hope that after some suitably long period of time, people won’t be allowed to write programs if they don’t understand these simple things.”

Programmers, as a species, are relentlessly pragmatic. Tools like TLA+ reek of the ivory tower. When programmers encounter “formal methods” (so called because they involve mathematical, “formally” precise descriptions of programs), their deep-seated instinct is to recoil.

Formal methods had an image problem. And the way to fix it wasn’t to implore programmers to change—it was to change yourself. Newcombe realized that to bring tools like TLA+ to the programming mainstream, you had to start speaking their language.

he presented TLA+ as a new kind of “pseudocode,” a stepping-stone to real code that allowed you to exhaustively test your algorithms—and that got you thinking precisely early on in the design process. “Engineers think in terms of debugging rather than ‘verification,’” he wrote, so he titled his internal talk on the subject to fellow Amazon engineers “Debugging Designs.” Rather than bemoan the fact that programmers see the world in code, Newcombe embraced it. He knew he’d lose them otherwise. “I’ve had a bunch of people say, ‘Now I get it,’” Newcombe says.

In the world of the self-driving car, software can’t be an afterthought. It can’t be built like today’s airline-reservation systems or 911 systems or stock-trading systems. Code will be put in charge of hundreds of millions of lives on the road and it has to work. That is no small task.