1. Copyright 2004 - John C. Knight SOFTWARE ENGINEERING FOR DEPENDABLE SYSTEMS John C. Knight Department of Computer Science University of Virginia

2. Copyright 2004 - John C. Knight Overview My General Interest: Systems that are REALLY important. Systems where failure means: injury, death, destruction, chaos, etc. Safety-critical Embedded Systems Crucial Application Networks Two halves of overall research program

3. Copyright 2004 - John C. Knight Electronic Automobile Systems Brakes Suspension Engine Control Traction Control Steering Transmission By wire…With no physical backup…

4. Copyright 2004 - John C. Knight Digital Fly By Wire Failure Rate < 10 -9 /hour Wire Not Plumbing....

5. Copyright 2004 - John C. KnightPage 5 03/6/02 System Complexity1971 1972 1980 1984 1989 1992 1987 1987 1989 1.5M* 2M* Analog Avionics Hybrid Avionics Digital Avionics Integrated Digital Avionics Relative Complexity 1996 *Lines of Code From Steve Miller, Rockwell Collins

6. Copyright 2004 - John C. Knight Critical Infrastructure These are safety-critical systems

7. Copyright 2004 - John C. Knight Wide Area Augmentation System Free flight Precision approaches

8. Copyright 2004 - John C. Knight Sizewell B Nuclear Plant Primary protection system 100,000 lines of code Over 600 processors…. 50,000 test cases “Failed” 52% Real problem was inability to determine correct response

9. Copyright 2004 - John C. Knight Wide Area Augmentation System Original cost est. $892.4 Current estimate $2,900 Orig. del. date 1998 Current estimate 2003 Many other major modernization programs in similar states (STARS, AMASS)

10. Copyright 2004 - John C. Knight What Are The Areas Of Research? Formal methods, especially specification System architectures Verification Tools Other miscellaneous things that are fun

11. Copyright 2004 - John C. Knight Specification About 60% of defects in practice are specification errors Community solution approach: Formal languages, i.e., languages with semantics defined in mathematics Powerful mechanism for communication and analysis Rarely used…

12. Copyright 2004 - John C. Knight The Situation At Present We think we understand this

13. Copyright 2004 - John C. Knight The Situation In The Future

14. Copyright 2004 - John C. Knight Specific Research Integration of formal and informal languages: They are different, both are needed in all systems How should they be combined? How do you analyze the combination? Embedded system survivability: Don’t make it reliable, make it survivable Complex combination of specification, analysis & arch Tool support: Powerful toolsets developed See: http://www.cs.virginia.edu/zeus

15. Copyright 2004 - John C. Knight SPECIFICATION Zeus Specification Tools Manipulation & Analysis Manipulation & Analysis Manipulation & Analysis Manipulation & Analysis Analysis: Symbol defns Symbols uses Invariants Etc. Analysis: Symbol defns Symbols uses Invariants Etc. MEANING Natural Language MEANING Natural Language FUNCTION Formal Language FUNCTION Formal Language MAP Formal Structure MAP Formal Structure

16. Copyright 2004 - John C. Knight The Network Problem Very Large Networks Interdependent Networks Heterogeneous Nodes Non-Local Faults Sequential Faults

17. Copyright 2004 - John C. Knight Survivability As Control Control Function “Sensor” Signals “Actuator” Commands From Sensors To Actuators

18. Copyright 2004 - John C. Knight Dynamic Reconfiguration Single Component Reconfiguration ? ? ? Application Reconfiguration

19. Copyright 2004 - John C. Knight Willow Architecture Logical View Reactive Active Control Active Control Proactive Active Management Active Management New Postures New Postures Commands Operator Administrator Intelligence Analysis Development Trust boundary During Attack Before and After Attack

20. Copyright 2004 - John C. Knight Critical Networked Application Critical Networked Application Sensors Actuators Application State & Analysis Model Self Healing Tolerate Anticipated Faults Planned Posture Change System Update System Deployment External Input Approach to Fault Treatment

21. Copyright 2004 - John C. Knight Critical Networked Application Critical Networked Application Sensors Actuators Willow Architectural Issues Hierarchic faults Control loop interactions: Asynchronous Priority & resources Conflicting goals Network scale: Volume of software State model Wide area change Exceptions and results: Dynamic app’l membership Absolute vs. statistical Result “harvesting” Target system actuation: Lightweight Standard interface & protocol Network State &Analysis Model Self Healing Tolerate Anticipated Faults Planned Posture Change System Update System Deployment External Input

22. Copyright 2004 - John C. Knight Summary Lots of crucial applications—many more than most people think Very challenging engineering Very significant research problems Many exciting ideas here at UVA Lots of opportunities to contribute Breakout session: Thursday at 5:00PM Olsson 236D

23. Copyright 2004 - John C. Knight Questions?