Copyright John C. Knight SOFTWARE ENGINEERING FOR DEPENDABLE SYSTEMS John C. Knight Department of Computer Science University of Virginia

Copyright John C. Knight Overview My General Interest: Systems that are REALLY important. Systems where failure means: injury, death, destruction, chaos, etc. Safety-critical Embedded Systems Crucial Application Networks Two halves of overall research program

Copyright John C. Knight Electronic Automobile Systems Brakes Suspension Engine Control Traction Control Steering Transmission By wire…With no physical backup…

Copyright John C. Knight Digital Fly By Wire Failure Rate < /hour Wire Not Plumbing....

Copyright John C. KnightPage 5 03/6/02 System Complexity M* 2M* Analog Avionics Hybrid Avionics Digital Avionics Integrated Digital Avionics Relative Complexity 1996 *Lines of Code From Steve Miller, Rockwell Collins

Copyright John C. Knight Critical Infrastructure These are safety-critical systems

Copyright John C. Knight Wide Area Augmentation System Free flight Precision approaches

Copyright John C. Knight Sizewell B Nuclear Plant Primary protection system 100,000 lines of code Over 600 processors…. 50,000 test cases “Failed” 52% Real problem was inability to determine correct response

Copyright John C. Knight Wide Area Augmentation System Original cost est. $892.4 Current estimate $2,900 Orig. del. date 1998 Current estimate 2003 Many other major modernization programs in similar states (STARS, AMASS)

Copyright John C. Knight What Are The Areas Of Research? Formal methods, especially specification System architectures Verification Tools Other miscellaneous things that are fun

Copyright John C. Knight Specification About 60% of defects in practice are specification errors Community solution approach: Formal languages, i.e., languages with semantics defined in mathematics Powerful mechanism for communication and analysis Rarely used…

Copyright John C. Knight The Situation At Present We think we understand this

Copyright John C. Knight The Situation In The Future

Copyright John C. Knight Specific Research Integration of formal and informal languages: They are different, both are needed in all systems How should they be combined? How do you analyze the combination? Embedded system survivability: Don’t make it reliable, make it survivable Complex combination of specification, analysis & arch Tool support: Powerful toolsets developed See:

Copyright John C. Knight SPECIFICATION Zeus Specification Tools Manipulation & Analysis Manipulation & Analysis Manipulation & Analysis Manipulation & Analysis Analysis: Symbol defns Symbols uses Invariants Etc. Analysis: Symbol defns Symbols uses Invariants Etc. MEANING Natural Language MEANING Natural Language FUNCTION Formal Language FUNCTION Formal Language MAP Formal Structure MAP Formal Structure

Copyright John C. Knight The Network Problem Very Large Networks Interdependent Networks Heterogeneous Nodes Non-Local Faults Sequential Faults

Copyright John C. Knight Survivability As Control Control Function “Sensor” Signals “Actuator” Commands From Sensors To Actuators

Copyright John C. Knight Dynamic Reconfiguration Single Component Reconfiguration ? ? ? Application Reconfiguration

Copyright John C. Knight Willow Architecture Logical View Reactive Active Control Active Control Proactive Active Management Active Management New Postures New Postures Commands Operator Administrator Intelligence Analysis Development Trust boundary During Attack Before and After Attack

Copyright John C. Knight Critical Networked Application Critical Networked Application Sensors Actuators Application State & Analysis Model Self Healing Tolerate Anticipated Faults Planned Posture Change System Update System Deployment External Input Approach to Fault Treatment

Copyright John C. Knight Critical Networked Application Critical Networked Application Sensors Actuators Willow Architectural Issues Hierarchic faults Control loop interactions: Asynchronous Priority & resources Conflicting goals Network scale: Volume of software State model Wide area change Exceptions and results: Dynamic app’l membership Absolute vs. statistical Result “harvesting” Target system actuation: Lightweight Standard interface & protocol Network State &Analysis Model Self Healing Tolerate Anticipated Faults Planned Posture Change System Update System Deployment External Input

Copyright John C. Knight Summary Lots of crucial applications—many more than most people think Very challenging engineering Very significant research problems Many exciting ideas here at UVA Lots of opportunities to contribute Breakout session: Thursday at 5:00PM Olsson 236D

Copyright John C. Knight Questions?