1. The Uses of Computers: What is Past is Merely Prologue Butler Lampson Microsoft 21 st Century Computing Conference November, 2008

2. Context: Moore’s Law and Friends months for 2 x 10 years11/2008 best 11/2008 cost Processing18100 x6x4 GIPS$10/GIPS Storage (disk) 121,000 x1 TB$0.20/GB LAN BW18100 x10 GB/s$1/MB/s WAN BW121,000 x4 GB/s$1000/MB/s/mo Display pixels36010 x4 M$100/M Implication: spend hardware to simplify software. Huge components work (operating system, database, browser) Better hardware enables new applications. Complexity goes into software.

3. What is computing good for? Simulation1950- today nuclear weapons, protein folding, payroll, games, virtual reality Communication (storage) 1980- today email, airline tickets, books, movies, Google, Terraserver Embodiment (physical world) 2010-... factories, cars, robots, smart dust

4. Simulation: Protein Folding UNFOLDING OF THE DNA BINDING DOMAIN OF HIV INTEGRASE HIV uses proteins to insert its genetic code into our DNA. The DNA binding domain of HIV integrase (below) is the protein which HIV uses to grab onto our DNA such that it can then connect its genetic code into ours.

5. Communication: Maps and Pictures

6. Embodiment: Roomba Vacuum 256 bytes of RAM, $199

7. The Future: Motherhood Challenges nCorrectness nScaling nParallelism nReuse nTrustworthiness nEase of use

8. Jim Gray’s application challenges 1.The Turing test: win the impersonation game 30% of the time. Read and understand as well as a human. Think and write as well as a human. 2.Hear and speak as well as a person: speech↔text. 3.See and recognize as well as a person. 4.Remember what is seen and heard; quickly return it on request. 5.Answer questions about a text corpus as well as a human expert. Then add sounds, images.

9. Jim Gray’s systems challenges 6.Be somewhere else: Observe (tele-past), interact (tele-present). 7.Devise an architecture that scales up by 10 6. 8.Programming: Given a specification, build a system that implements the spec. Do it better than a team of programmers. 9.Build a system used by millions, administered by ½ person. Prove it only services authorized users. Prove it is always available: (out < 1 sec/100 years)

10. A Grand Challenge: nA pure computer science problem nNeeds o Computer vision o World models for roads and vehicles o Dealing with uncertainty about sensor inputs, vehicle performance, changing environment o Dependability nDARPA Grand Challenges a start Reduce highway traffic deaths to zero

11. Dealing with Uncertainty nUnavoidable in dealing with the physical world o Need good models of what is possible o Need boundaries for the models nUnavoidable for “natural” user interfaces: speech, writing, language o The machine must guess; what if it guesses wrong? nGoal: see, hear, speak, move as well as a person. Better? nTeach as well as a person?

12. Example: Speech “Understanding” nAcoustic input: waveform (speech + noise) n“Features”: compression nPhonemes nWords: dictionary nPhrases: Language model nMeaning: Domain model Uncertainty at each stage.

13. Example: Robots nWhere am I? nWhat is going on? nWhat am I trying to do? nWhat should I do next? nWhat just happened?

14. Paradigm?: Probability Distributions nCould we have distributions as a standard data type? o Must be parameterized over the domain (like lists) nWhat are the operations? nBasic problem (?): Given distribution of x, compute distribution of f(x). o Hard when x appears twice in f – independence

15. What is Dependability? nFormally, the system meets its spec o We have the theory needed to show this formally o But doing it doesn’t scale o And worse, we can’t get the formal spec right ▬ Though we can get partial specs right ▬ “Sorry, can’t find any more bugs.” nInformally, users aren’t surprised o Depends on user expectations ▬ Compare 1980 AT&T with cellphones ▬ How well does the market work for dependability? nMeasure: Probability of failure × Cost of failure

16. Impossible goals nNever lose a life. o Maybe OK for radiation o No good for driving nNo terrorist incidents nNo downtime

17. Dependable  No Catastrophes nA realistic way to reduce aspirations o Focus on what’s really important nWhat’s a catastrophe? o It has to be very serious o Must have some numeric measure ▬ Dollars, lives? Say $100B, 1000 for terrorism ▬ Less controversial: Bound it by size of CCB nMust have a “threat model”: what can go wrong o Probabilities must enter o But how?

18. Examples of Catastrophes nUSS Yorktown o Because of database failure, ship can’t run engines nTerac 25 and other medical equipment o Patients die nDestruction of big power transformers

19. Architecture — Catastrophe Mode nNormal operation vs. catastrophe mode o Catastrophe mode  high assurance CCB nCatastrophe mode requires o Clear, limited goals = limited functionality ▬ Hence easier than security o Strict bounds on complexity ▬ Less than 50k lines of code? nCatastrophe mode is not a retrofit

20. The Failure of Systems Research nWe didn’t invent the Web nWhy not? Too simple o Old idea ▬ But never tried o Wasteful ▬ But it’s fast enough o Flaky ▬ But it doesn’t have to work nDenial: It doesn’t scale o Only from 100 to 100,000,000

21. Conclusions for Engineers nUnderstand Moore’s law nAim for mass markets o Computers are everywhere nLearn how to deal with uncertainty nLearn how to avoid catastrophe