why study principles of computer systems ? candea principles of computer systems safety security...

Prof. George CandeaSchool of Computer & Communication Sciences

Why Study Principles of Computer Systems ?

George Candea Principles of Computer Systems 2

George Candea Principles of Computer Systems

Toyota Entune The revolutionary in-car experience that keeps you connected

Register your Entune™ account and link your existing apps to Entune™, then download the Entune™

app from your favorite App Store, such as iTunes®, Android™ Market or Blackberry® Appworld™.

3


SafetySecurity

ReliabilityPerformance

Manageability

Samsung Cell Phones May Fail To Dial 911- Software Update Required May 26, 2009 !

Flashback)Trojan)Is)Latest)A4ack)on)Apple)Systems

April)16,)2012

4


NetworkingOpe

ratin

gsy

stem

s

Databases

Programming

languages

Computer

architecture

• Safety• Security• Reliability• Performance• Manageability Hardware

Operating systemRuntime / Libraries

ApplicationsMiddleware


LANs Rings, Hubnet

Ethernet, Datakit, Autonet

LANs, switched Ethernet

Graphical User Interfaces

Workstations

Graphics Sketchpad, Utah

GM/IBM, Xerox, Microsoft

E&S, SGI, ATI, Adobe

Lisp machine, Stanford

Xerox Alto

Xerox Star, Apollo, Sun

Engelbart / Rochester

Alto, Smalltalk

Star, Mac, Microsoft

Timesharing CTSS, Multics / BSD

Unix

SDS 940, 360/67, VMS

Arpanet, Aloha, Internet

Pup

DECnet, TCP/IP

RISC processors Berkeley, Stanford

IBM 801

SUN, SGI, IBM, HP

VLSI design Berkeley, Caltech, Mosis

many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000

Client/server computing Berkeley, CMU, CERN

Parc, DEC, IBM

Novell, EMC, Sun, Oracle

Entertainment

Spacewar (MIT), Trek (Rochester)

Atari, Nintendo, SGI, Pixar

The topics are ordered roughly by increasing date of $1B industry University Industry research Products $1B market

Interplay of university research, industrial research, and development for IT in the US (A)

to World Wide Web

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web


LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web


LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

RAID / disk servers

Relational databases Berkeley, Wisconsin

IBM

Oracle, IBM, Sybase

Berkeley

Striping / Datamesh, Petal

many

1965 1970 1975 1980 1985 1990 1995 2000

World Wide Web

Alta Vista

Netscape, Yahoo

1965 1970 1975 1980 1985 1990 1995 2000

Speech recognition CMU, SRI, MIT

Bell, IBM, Dragon

Dragon, IBM, L&H Broadband last mile

Bellcore

Amati, Alcatel, Broadcom

Stanford, UCLA

Portable communication

Linkobit, Hughes

Qualcomm

Berkeley, Purdue (CDMA)

Parallel databases Tokyo, Wisconsin, UCLA

IBM, ICL

ICL, Teradata, Tandem

Parallel computing Illiac 4, CMU, Caltech, HPC

IBM, Intel

CM-5, Teradata, Cray T3D

Data mining Wisconsin, Stanford

IBM, Arbor

IRI, Arbor, Plato

CERN, Illinois (Mosaic)


from Internet

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web


LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web

RAID / disk servers

Relational databases Berkeley, Wisconsin

IBM

Oracle, IBM, Sybase

Berkeley

Striping / Datamesh, Petal

many

1965 1970 1975 1980 1985 1990 1995 2000

World Wide Web

Alta Vista

Netscape, Yahoo

1965 1970 1975 1980 1985 1990 1995 2000

Speech recognition CMU, SRI, MIT

Bell, IBM, Dragon

Dragon, IBM, L&H Broadband last mile

Bellcore

Amati, Alcatel, Broadcom

Stanford, UCLA

Portable communication

Linkobit, Hughes

Qualcomm

Berkeley, Purdue (CDMA)

Parallel databases Tokyo, Wisconsin, UCLA

IBM, ICL

ICL, Teradata, Tandem

Parallel computing Illiac 4, CMU, Caltech, HPC

IBM, Intel

CM-5, Teradata, Cray T3D

Data mining Wisconsin, Stanford

IBM, Arbor

IRI, Arbor, Plato

CERN, Illinois (Mosaic)


from Internet

... fromInternet

LANs Rings, Hubnet




Workstations





Xerox Alto



Alto, Smalltalk



Unix

SDS 940, 360/67, VMS


Pup

DECnet, TCP/IP


IBM 801

SUN, SGI, IBM, HP


many

1965 1970 1975 1980 1985 1990 1995 2000

1965 1970 1975 1980 1985 1990 1995 2000


Parc, DEC, IBM


Entertainment





to World Wide Web


Why Is A Computer System ?


What is a Computer System ?

A group of interconnected components that exhibits an expected collective behavior observed at the interfaces with its environment.

2

SystemEnvironment

Interface


Examples of Systems

• Examples of systems• a smartphone or tablet

• the Internet

• ticket reservation system

• shared calendaring system

• air traffic control

• an e-commerce site

• smart home

• self-driving cars

3

George Candea

2/3 profile viewof instructor

Principles of Computer Systems

What Is A Computer System ?

• Three parts• system components

• surrounding environment

• interface

• Litmus test of good system• predict system behavior from

component-level behaviors ?

7


The Complexity Challenge


gear = gear+1rpm = 0.5*rpm

autoShift (int rpm)

if (rpm > 1000)

gear = gear+1

rpm = 0.5*rpm

if (rpm < 700)

gear=0

return rpm < 700 rpm < 700

rpm > 1000

TrueFalse

return gear=0return

TrueFalse

return gear=0return

TrueFalse

rpm > 1000

rpm < 700rpm < 700

2


autoShift (int rpm)

if (rpm > 1000)

gear = gear+1

rpm = 0.5*rpm

if (rpm < 700)

gear=0

return


rpm > 1000

TrueFalse

return gear=0return

TrueFalse

return gear=0return

TrueFalse

rpm=1200

rpm < 700

rpm=1800

rpm < 700 rpm < 700

3



autoShift (int rpm)

if (rpm > 1000)

gear = gear+1

rpm = 0.5*rpm

if (rpm < 700)

gear=0

return

rpm > 1000

TrueFalse

return gear=0return

TrueFalse

return gear=0return

TrueFalse

rpm ∈ {0,350,944,1200,1800}

rpm < 700rpm < 700

4

Software Testing

Software Testing


paths ≃ 2 program size


autoShift (int rpm)

if (rpm > 1000)

gear = gear+1

rpm = 0.5*rpm

if (rpm < 700)

gear=0

return

rpm > 1000

TrueFalse

return gear=0return

TrueFalse

return gear=0return

TrueFalse

rpm < 700rpm < 700

5


paths ≃ 2 program size

>5,000,000 lines of code1 (LOC) ⇒ ~2500,000 paths

1 Black Duck Software, Inc. Mozilla Firefox Code Analysis, http://www.ohloh.net/p/firefox/analyses/latest

Can we test 2 500,000 paths?• 30 picoseconds/test ⇒ 2

499,968 years to finish• planet Earth is ~2 32 years old

• 1 bit/test ⇒ 2 499,957 Terabytes to store the answer

• Universe contains ~2 266 atoms in total

6

Software Testing

George Candea



• Testing• most basic form of software verification

• naive approach does not offer a lot of confidence

• Correct by construction ?• mathematical view of software engineering

• Proofs of correctness ?• write code and prove it correct before running it

7

The Complexity Challenge


System Verification

George Candea



• Testing• most basic form of software verification

• naive approach does not offer a lot of confidence

• Human proofs• mathematical view of software engineering

• write code and prove it correct before using it

• Machine proofs• do the same as human proofs, but using a computer

• key element is to automatically prove correctness

2

Software Verification


program: 7 LOCproof: by hand

Human proof

LOC

void bubbleSort( int array[], int length )

{

for (int x=0; x<n; x++) {

for (int y=0; y<n-1; y++) {

if (array[y]>array[y+1]) {

int temp = array[y+1];

array[y+1] = array[y];

array[y] = temp;

}

}

}

}

3


program: 24 LOCproof: 626 steps 30 human-provided lemmasmachine-generated proof1

Theorem prover


1 J-C Filliatre and N. Magaud, Certification of Sorting Algorithms in the Coq System, in “Theorem Proving in Higher Order Logics: Emerging Trends” (1999)

LOC

void heapSort( int numbers[], int arraySize ) { int i, temp; for (i = (arraySize / 2); i >= 0; i--) { siftDown(numbers, i, array_size - 1); } for (i = arraySize-1; i >= 1; i--) { temp = numbers[0]; numbers[0] = numbers[i]; numbers[i] = temp; siftDown(numbers, 0, i-1); }} void siftDown( int numbers[], int root, int bottom ) { int maxChild = root * 2 + 1; if (maxChild < bottom) { int otherChild = maxChild + 1; if (numbers[otherChild] > numbers[maxChild]) maxChild = otherChild; } else { if (maxChild > bottom) return; } if (numbers[root] >= numbers[maxChild]) return; int temp = numbers[root]; numbers[root] = numbers[maxChild]; numbers[maxChild] = temp; siftDown(numbers, maxChild, bottom);}

4


program: 24 LOCproof: 626 steps 30 human-provided lemmasmachine-generated proof


program: 7,500 LOCproof: 200,000 linestime: 20 person-yearsmachine-checkable proof1

seL4

LOC

Proved that C code correctly implements an abstract specification2

Refinement proof

5

2 G. Klein et al., seL4: formal verification of an OS kernel, in SOSP 2009


LOC

program: 7,500 LOCproof: 200,000 linestime: 20 person-yearsmachine-checkable proof

7 LOC

(by h

and)

24 LO

C (m

achin

e-ge

nera

ted)

Parts of code free of...

• arithmetic overflows

• out-of-bounds array accesses

• invalid pointer arithmetic

• assertion violations

program: ~100,000 LOCproof size: ???low-level propertiesassisted machine-generated1

Abstract interpretation

1 J, Souyris and D. Delmas, Experimental Assessment of Astrée on Safety-Critical Avionics Software. Proc. Int. Conf. on Computer Safety, Reliability, and Security (2007)

6


LOC

7,500

LOC

(mac

hine-

chec

kable

)

~100

,000 L

OC (lo

w-lev

el pr

oper

ties)

> 5,000,000 LOC> 120 shared libraries

~ 50,000,000 LOC C, C++, C#, assembly, ...

7 LOC

(by h

and)

24 LO

C (m

achin

e-ge

nera

ted)

7

George Candea

Front viewof instructor


System Verification

8

• System complexity grows fast• typically at least exponential in number of branches

• Cannot rely only on testing and proofs• we also need design principles and discipline

• Key ideas for managing complexity• modularity, abstraction, layering, etc.


Sources of Complexity


From

The

CHA

OS

Repo

rts, T

he S

tand

ish

Gro

up In

tern

atio

nal,

1994

- 20

09

2

Software Projects Success Rate = f (Budget)

Success Rate

Budget


Many Requirements ⇒ Complexity

3

Number ofrequirements

Subjectivecomplexity


Quest for Efficiency ⇒ Complexity

4

Desired efficiency

Complexity



4

Desired efficiency

Complexity

Buffer cache



4

Desired efficiency

Complexity

Buffer cacheWriteback buffer cache



4

Desired efficiency

Complexity

Buffer cacheWriteback buffer cache

fsync()


System Evolution ⇒ Complexity

• Changes in requirements• same system design, different environments

• users want new things, but replacing the system is costly

• Changes to address these = Evolution• changes introduce complexity

5

Systemlifetime

Complexity


Legacy Systems = Complex Systems

6

• Evolution• is a process of satisfying new requirements

• successful systems evolve fast

Android codebase size(in millions of lines, over its first 4 years)

5.0

2.5

02009 2010 2011 2012

George Candea



Sources of Complexity

• Exponential path/state explosion

• Large number of requirements

• Quest for high efficiency

• System evolution

7

why study principles of computer systems ? candea principles of computer systems safety security...

Documents