In Elephant 2000, we associate to the right, so the above statement is equivalent to Even for this simple reservation program it is worthwhile to distinguish between input-output and accomplishment specifications. If we interpret it as ordering the admission, then it's an illocutionary act. If we interpret is as making sure the passenger can actually get on, then it is a perlocutionary act. It is an input-output specification of the program that it not order the admission of more passengers than the capacity of the flight. It is an external fact that the plane will hold its capacity and not more.
Similar considerations apply to a minimal program for a control tower.
It receives requests to land. It can perceive the positions of the airplanes. Its input-output specifications involve only its perceptions and its inputs and outputs. The verification of the input-output specifications involve facts about the program itself. The accomplishment specifications provide that the airplanes should land safely and as promptly as is compatible with safety.