INVARIANTS

25
INVARIANTS EEN 417 Fall 2013

description

INVARIANTS. EEN 417 Fall 2013. When is a Design of a System “ Correct ” ?. A design is correct when it meets its specification (requirements) in its operating environment “ A design without specification cannot be right or wrong, it can only be surprising! ” - PowerPoint PPT Presentation

Transcript of INVARIANTS

Page 1: INVARIANTS

INVARIANTS

EEN 417Fall 2013

Page 2: INVARIANTS

When is a Design of a System “Correct”?

•A design is correct when it meets its specification (requirements) in its operating environment

•“A design without specification cannot be right or wrong, it can only be surprising!”

•Simply running a few tests is not enough!

•Many embedded systems are deployed in safety-critical applications (avionics, automotive, medical, …)

Page 3: INVARIANTS

Ariane disaster, 1996$500 million software failure

FDIV error, 1994$500 million

Estimated worst-case worm cost: > $50 billion

Page 4: INVARIANTS

Ariane 5 Flight 501

• 4 June 1996, the first test flight of the Ariane 5 rocket system

• Rocket self-destructed 37 seconds after launch.

Page 5: INVARIANTS

Ariane 5 Flight 501

• What caused the disaster?

• A data conversion from 64-bit floating point to 16-bit signed integer

Page 6: INVARIANTS

Ariane 5 Flight 501

• Max value for 16-bit signed integer– 32,768

• Max value for a 64-bit floating point?– 1.79*10^308

Page 7: INVARIANTS

Ariane 5 Flight 501

• Software had been written and tested for the Ariane 4, where the variables had been protected by a handler.

• Code was include in Ariane 5 for reuse, despite the fact that the software was not required for the Ariane 5.

Page 8: INVARIANTS

Pentium FDIV Bug

• Intel’s Pentium 5– Professor Thomas Nicely noticed inconsistencies in

calculations when addingPentiums to his cluster

– Floating-point divisionoperations didn’t quite comeout right.Off by 61 parts per million

Page 9: INVARIANTS

Pentium FDIV Bug

• Intel acknowledged the flaw, but claimed it wasn’t serious. Wouldn’t affect most users.

• Byte magazine estimatedonly 1 in 9 billion floatingpoint operations wouldsuffer the error.

Page 10: INVARIANTS

Pentium FDIV Bug

• Total cost to Intel?

$450 million

Page 11: INVARIANTS

Korean Air Flight 801

• Air Traffic Control Minimum Safe Altitude Warning system – lets pilots know when they are too close to the ground.

• System in Guam had been giving off spurious alarms, and prevented the airport’s other systems from detecting aircrafts approaching below minimum safe altitude

• Engineers modified the system to limit alarms.

Page 12: INVARIANTS

200 Deaths

Page 13: INVARIANTS

High Frequency Trading

• Algorithmic trading, seeks to exploit small differences in prices, millions of programs running

• How do they interact?• How does something

written by Company Aaffect somethingwritten by Company B?

Page 14: INVARIANTS

High Frequency Trading

• 2010 Flash Crash – largest intraday point loss– Losses recovered in minutes, but scared regulatory

bodies• US SEC and CFTC

consluded that HFTcontributed to thevolatility.

Page 15: INVARIANTS

High Frequency Trading

• SEC and FTC stated – “market makers and other liquidity providers widened their quote spreads, reduced liquidity, and withdrew from the market”

• Some signal set offtheir algorithms,caused a jointmovement whichhelped cause the crash

Page 16: INVARIANTS

HOW DO WE PREVENT THESE PROBLEMS?

Page 17: INVARIANTS

Specification, Verification, and Control

•Specification•A mathematical statement of the design objective (desired properties of the system)

•Verification•Does the designed system achieve its objective in the operating environment?

•Controller Synthesis•Given an incomplete design, synthesize a strategy to complete the system so that it achieves its objective in the operating environment

Page 18: INVARIANTS

Propositional Logic

•Atomic formulas: Statements about an input, output, or state of a state machine. Examples:

•These are propositions (true or false statements) about a state machine with input or output x and state s.

formula meaningx x is presentx = 1 x is present and has value 1s machine is in state s

Page 19: INVARIANTS

Propositional Logic

•Propositional logic formulas: More elaborate statements about an input, output, or state of a state machine. Examples:

•Here, p1 and p2 are either atomic formulas or propositional logic formulas.

formula meaning

Page 20: INVARIANTS

Execution Trace of a State Machine

Page 21: INVARIANTS

Propositional Logic on Traces

Page 22: INVARIANTS

Example: Specification of the SpaceWire Protocol (European

Space Agency standard)

Page 23: INVARIANTS

The problem with most specifications

• Specifications tend to be written by non-engineers, and tend to be written in English.

• Why is this a problem?

Page 24: INVARIANTS

WRAP UP

Page 25: INVARIANTS

For next time

Read Chapter 12 – Invariants and Temporal Logic