<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]--><o:SmartTagType
namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="country-region"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="City"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PlaceType"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PlaceName"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="place"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0pt;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";
color:black;}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:blue;
text-decoration:underline;}
p
{mso-margin-top-alt:auto;
margin-right:0pt;
mso-margin-bottom-alt:auto;
margin-left:0pt;
font-size:12.0pt;
font-family:"Times New Roman";}
pre
{margin:0pt;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:Arial;
color:windowtext;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
@page Section1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor=white lang=EN-US link=blue vlink=blue>
<div class=Section1>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:windowtext'>I agree with Raj. If we can (i) certify
individual system components via traditional testing and (ii) provide a sound theory
and compatible run-time infrastructure for *<b><span style='font-weight:bold'>composing</span></b>*
the components into different system configurations, we will be able to certify
numerous combinations of the components based on the theory instead of testing.
<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:windowtext'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:windowtext'>The fundamental benefit is the
capability to certify a huge number of *<b><span style='font-weight:bold'>combinations</span></b>*
by testing only a small number of individual components. <o:p></o:p></span></font></p>
<div>
<p><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>Chenyang<br>
<br>
<st1:PlaceName w:st="on">Washington</st1:PlaceName> <st1:PlaceType w:st="on">University</st1:PlaceType>
in <st1:place w:st="on"><st1:City w:st="on">St. Louis</st1:City></st1:place><br>
<a href="http://www.cse.wustl.edu/~lu">http://www.cse.wustl.edu/~lu</a></span></font><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p></o:p></span></font></p>
</div>
<div style='border:none;border-left:solid blue 1.5pt;padding:0pt 0pt 0pt 4.0pt'>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=2
color=black face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:windowtext'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 color=black face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:windowtext;font-weight:bold'>From:</span></font></b><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:windowtext'> cadynce-bounces@list.isis.vanderbilt.edu
[mailto:cadynce-bounces@list.isis.vanderbilt.edu] <b><span style='font-weight:
bold'>On Behalf Of </span></b>Raj Rajkumar<br>
<b><span style='font-weight:bold'>Sent:</span></b> Friday, March 09, 2007 12:54
PM<br>
<b><span style='font-weight:bold'>To:</span></b> Cross, Joseph<br>
<b><span style='font-weight:bold'>Cc:</span></b>
cadynce@list.isis.vanderbilt.edu<br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: [cadynce] Meditations
on Learning and a Big Back End<o:p></o:p></span></font></p>
</div>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial'>Cross, Joseph wrote: <o:p></o:p></span></font></p>
<pre wrap=""><font size=2 color=black face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Patrick -<o:p></o:p></span></font></pre><pre><font size=2
color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>Okay, very cool. We're down to touching up the face powder on our Miss<o:p></o:p></span></font></pre><pre><st1:country-region
w:st="on"><st1:place w:st="on"><font size=2 color=black face=Arial><span
style='font-size:10.0pt;font-family:Arial'>America</span></font></st1:place></st1:country-region><font
face=Arial><span style='font-family:Arial'> contestant.<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'> <o:p></o:p></span></font></pre>
<blockquote style='margin-top:5.0pt;margin-bottom:5.0pt' type=cite><pre wrap=""><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>We are talking about how to deploy a configuration that have <o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>never been tested in the lab. <o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'> <o:p></o:p></span></font></pre></blockquote>
<pre wrap=""><font size=2 color=black face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></pre><pre><font size=2
color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>Right. And looked at another way, we're talking about how to certify a<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>configuration that has never been tested.<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'> <o:p></o:p></span></font></pre>
<blockquote style='margin-top:5.0pt;margin-bottom:5.0pt' type=cite><pre wrap=""><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>I conjecture that there is no way to do that with anything other than<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'> <o:p></o:p></span></font></pre></blockquote>
<pre wrap=""><font size=2 color=black face=Arial><span style='font-size:10.0pt;
font-family:Arial'>a <o:p></o:p></span></font></pre><pre><font size=2
color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'> <o:p></o:p></span></font></pre>
<blockquote style='margin-top:5.0pt;margin-bottom:5.0pt' type=cite><pre wrap=""><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>statistical assurance. The goal is to first give them a 1000 tested <o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>configurations and use the novel generation method as a back up when <o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>none of them fit.<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'> <o:p></o:p></span></font></pre></blockquote>
<pre wrap=""><font size=2 color=black face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></pre><pre><font size=2
color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>If we're being Bayesian, where probability is used to express strength<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>of belief, then you're saying that we'll never achieve 100% certainty<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>that our system will work. Sure. <o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>But yea verily we never had 100% certainty and we never will. (Drat!<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>There goes another one of those pesky alpha particles!) <o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>If we say to the Navy "Our process will deploy configurations for which<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>we have only statistical assurance of correctness," they'll hear "...<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>configurations that aren't as reliable as your old-school certified<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>configurations." And that's not true. <o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>Old-school certification provides only statistical assurance of<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>correctness. And it would be boorish of us to rub our customers' noses<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>in that fact.<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>We're talking public relations here, not technology.<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>Obviously we must not oversell our product. But I believe that we can<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>honestly say that we're going to provide mechanisms that will enable the<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>certification of untested configurations. (Then the means by which we<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>chose one of these certified configurations at run-time is an<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>engineering detail.) If somebody asks whether the cert board will have<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>to loosen its standards to accept our configurations, we say no.<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>In this way we avoid emphasizing the<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>statistical/not-mathematically-certain nature of the entire<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>certification process, with or without CADynCE.<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'><o:p> </o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>- Joe<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>_______________________________________________<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'>Cadynce mailing list<o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'><a
href="mailto:Cadynce@list.isis.vanderbilt.edu">Cadynce@list.isis.vanderbilt.edu</a><o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'><a
href="http://list.isis.vanderbilt.edu/mailman/listinfo/cadynce">http://list.isis.vanderbilt.edu/mailman/listinfo/cadynce</a><o:p></o:p></span></font></pre><pre><font
size=2 color=black face=Arial><span style='font-size:10.0pt;font-family:Arial'> <o:p></o:p></span></font></pre>
<p class=MsoNormal style='margin-bottom:12.0pt'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'>Dear Joe, Patrick
and Gautam:<br>
<br>
(I apologize for missing the telecon yesterday; had a visitor.)<br>
<br>
I agree 100% with the above comments. And wanted to add a couple more
thoughts:<br>
<br>
In bin-packing, we pack objects and declare victory if all objects fit within
available bins and no bin constraints (single-dimensional or multi-dimensional)
are violated. In the embedded real-time systems domain, there are other
aspects that are not necessarily captured in the simple bin-packing
model. These include the notion of execution patterns (periodic, sporadic
or aperiodic), local and end-to-end deadlines, schedulability requirements, OS
overheads, interrupt latencies, interactions among resources (e.g. processing
latency when a network packet arrives at a network interface and then has to go
up the protocol processing stack but the network and CPU resources are
scheduled as two different policies using two different schedulers), and
potential non-negligible sources of non-determinism (caching interactions among
multiple concurrent processes). We can (and should) take care
of requirements such as schedulability in the bin-packing phase. I
also believe that an appropriate run-time infrastructure is needed to (a)
schedule the various processes/threads to meet their deadlines when run
concurrently (b) enforce/isolate the run-time behaviors of each process/thread,
and (c) the policies/mechanisms of the run-time infrastructure should match the
assumptions of the bin-packing phase. Together, the certification of the
feasible (but potentially untested) configurations becomes
possible. <br>
<br>
Thanks,<br>
<br>
---<br>
Raj<o:p></o:p></span></font></p>
</div>
</div>
</body>
</html>