"Not until a program has been in production for at least six months will its most harmful error be discovered."