On the Proof of Correctness of a Calendar Program - Lamport, Leslie (Communications of the ACM 22, 1979)
In the May, 1978 CACM, Matthew Geller published a paper titled Test Data as an Aid in Proving Program Correctness. He argued that there were some programs whose correctness is so hard to state formally that formally verifying them is useless because the specification is likely to be wrong. He gave as an example a program to compute the number of days between two dates in the same year, claiming that it would be hard to check the correctness of a precise statement of what it meant for the program to be correct. This paper proved him wrong. (It also makes the amusing observation that Geller's solution is wrong because it fails for dates before the advent of the Gregorian calendar.) As a bonus, readers of this paper were alerted well in advance that the year 2000 is a leap year.