Computer Reliability

Computer Reliability Intro 2016- single network router in Southwest Airlines data center failed- hundreds of software apps became unusable o Disrupted 700 planes and 20,000 pilots and flight attendants o 2,300 flight cancellations Knight Capital bugs in software for automatic stock trades- generate $440 million in losses We depend on computers and computerized systems to facilitate our daily activities o Integral part of modern communication, transportation, retail, banking, finance, and health care systems o When they work, they save us time and money, but when they fail, benefits turn into harms- loss of time, money, injury, or death * Purpose of this chapter is to familiarize you w/ the ways in which computerized systems have proven to be unreliable Systems typically have many components, of which the computer is just one A well engineered system can tolerate the malfunction of any single component without causing harm o But many cases where the computer or the computer-human interface was a weak link and an error led to harm Computer simulations- playing increasingly important role in modern science and engineering o Simulations can validate the underlying models? The discipline of software engineering emerged when organizations began constructing large software systems and encountered problems meeting project goals with respect to reliability, cost, and schedule Software engineering * - refers to the use of processes and tools that allow programs to be created in a more structured manner Chapter describes the software development process and provides evidence that more software projects are being completed on time and on budget Software warranties- software manufacturers typically disclaim any liability for lost profits or other consequential damages resulting from the use of their products o Discuss how much responsibility software manufacturers ought to take for the quality of their products 8.2 Data Entry or Data Retrieval Errors Sometimes computerized systems fail bc the wrong data have been entered into them or bc ppl incorrectly interpret the data they receive Disenfranchised voters- 2000 election, Fl disqualified thousands of voters bc prelection screening identified them as felons o Records in database were incorrect, they were charged with misdemeanors o Forbidden from voting, which may have affected outcome of election False Arrests o Databases of the National Crime Information Center contain records related to stolen automobiles, wanted ppl, etc. o Numerous stories of police making false arrests based on info they retrieved from the NCIC o Shelia Jackson Stossier arrested bc confused for Shirley Jackson, who was wanted in Texas, spent a night in jail o Confused Roberto Hernandez for another, same features, same bday, similar SS numbers, off by 1 digit o Enter crimes of someone under their false identity named Terry Rogan- the real Terry Rogan was arrested multiple times even though they tried to correct the records after the first arrest Utilitarian Analysis- Accuracy of NCIC Records Stepping away from the Privacy Act of 1974, the Justice Dept announced in March 2003 that it would no longer require the FBI to ensure the accuracy of information about criminals and crime victims before entering it in the NCIC database Should the US gov take responsibility for the accuracy of info in NCIC databases? Dept of Justice says it is impractical for it to be responsible for the info: much of the info entered is provided by other law enforcement and intelligence agencies FBI has no way of verifying that all the info is accurate If the FBI strictly followed the Privacy Act and verified the accuracy of every record entered into the NCIC, the amount of info in the database would be greatly curtailed, o Database would be a much less useful tool for law-enforcement agencies o Result in decrease in the number of criminals Privacy advocates say that the accuracy is important bc of the increasing amount of records stored in the databases o As more false records are entered, probability of innocent Americans are arrested increases Let’s look at database of stolen vehicles Total amount of harm caused by automobile theft is great o 1 million stolen vehicles each year, financial loss, emotional stress o Prevalence of automobile theft harms everyone who owns a car by raising insurance rates o The NCIC database contains info about stolen vehicles throughout the country, allowing law enforcement officials to identify cars stolen anywhere in the nation At present time, just half of all stolen vehicles are recovered o The NCIC has at least increased the percentage of recovered cars by 20%, or 100,000 per year o Recovery has its benefits- owner doesn’t need a new vehicle, police apprehend a criminal o Annual positive impact of NCIC stolen car database is 500 million dollars a year Harmful consequences of database o If error leads to false arrest- harm caused to innocent driver is great o But there aren’t many false arrest stories stemming from errors in database o -$55,000 per false arrest, usually 1 per year o So the creation and maintenance of the database is the right course of action 8.3 Software and Billing Error Even if data entered into a computer are correct, the system may still produce the wrong result or collapse entirely if there are errors in the computer programs manipulating the data Errors leading to system malfunctions o Bug in Qwest’s billing software charged some customers as much as $600 per minute for the use of their phones o USDA software error to understate the prices the meatpackers were receiving for beef, cost beef producers 15 to 20 million o Postal service return 50,000 pieces of mail to sender o Study found that computer spelling checkers actually increased errors o NY families charged too much for rent bc of error in program that calculated bills, the Housing Authority didn’t believe it and threatened them with eviction o 450 Cali inmates mistakenly released, could not return them bc granted “nonrevocable parole” Errors leading to system failures o London ambulance dispatch system- emergency calls put on holds and losing track of some calls- 20 ppl died o Japan air traffic- cancelled 32 flights o Lab computer and USC medical center was backlogged, doctors could not get access to the laboratory results they needed  “It’s like practicing 3rd world medicine, we rely so much on computers it was like we were blinded” ** o Malaysia Airlines flight autopilot bug, flight computers received faulty info about plane’s speed and acceleration o NASDAQ had to close for 3 hours bc of bug o Jay Radcliffe demonstrate could easily hack into insulin pumps o Can hack into Jeep Cherokee and gain control of its vital systems, all Chrysler vehicles with a touch screen had this vulnerability, recall 1.4 million vehicles Analysis: E-retailer posts wrong price, refuses to deliver Amazon Britain shut down bc error sold iPAQ handheld computer for 7 pounds instead of 275 Amazon said they wouldn’t deliver unless they paid full price Was Amazon wrong to refuse to fill the order of the ppl who bought the iPAQ for cheap? Rule utilitarian analysiso Moral rule- a person or org selling a product must always honor the advertised price o What happens if this was universally followed?- more time and effort would be spent proofreading advertisements, companies would take out insurance policies to guard against the catastrophic losses that could result from a typo o To pay for these additional costs, the prices of the products sold by these companies would be higher o The proposed rule would harm every consumer who ended up paying more for products o The rule would benefit very few consumers that took advantage of misprints to get good deals o The rule has more harms than benefits, so Amazon did the right thing by refusing to ship the iPAQ Kantian- the knowledgeable consumers who ordered the iPAQs did something wrong, if they understood it was an error, then they were taking advantage of Amazon’s stockholders by ordering the iPAQ before the error was corrected, were not acting in good faith 8.4 Notable Software System Failures Shift focus to complicated devices or systems controlled at least on part by computers Embedded system- computer used as a component of a larger system o Like microprocessor-based embedded systems in microwave ovens, traffic lights, etc. o Because computers need software to execute, every embedded system has a software component Software is playing an even larger role in system functionality There are several reasons why hardware controllers are being replaced by microprocessors controlled by software o Software controllers are faster o They can perform more sophisticated functions, taking more input data into account o They cost less, use less energy, and don’t wear out o * Unfortunately, while hardware controllers have a reputation for high reliability, the same cannot be said for their software replacements Most embedded systems are also real-time systems- computers that process data from sensors as events occur o Microprocessor that controls the air bags in a car- must instantly react to readings from its sensors to deploy air bags at collision o Microprocessor in a cell phone- is another example if a real time system that converts electrical signals into radio waves and vice versa This section contains 7 examples of computer system failures- all examples of embedded, real time systems Patriot Missile Patriot missile system was designed by army to shoot down planes in Gulf War Was only 9% effective at destroying Scud missiles launched at Israel and Saudi Arabia, just got lucky that the missiles fell apart as they approached target Failure- Scud missile hit US Army barracks in Dhahran, Saudi Arabia, killing 28 soldiers o The Patriot missile defense never even fired at the incoming Scud Failure traced to a software error- missile battery did detect the missile, but after scanning it once, it scanned the wrong range, so it said it did not detect the Scud o First do wide area search, then isolates the target, but error caused the system to produce a faulty range gate. The system loses track of the missile because it does not fly through this gate Wrong range gate bc of truncation- the longer the system ran, the more the truncation errors added up o Designed to operate for only a few hours at a time, but it ran for 100 hours, off by . 3433 seconds Ariane 5 Ariane 5 was a satellite launch vehicle designed by French space agency and ESA 40 seconds into flight, software error cause the nozzles on the boosters and the main rocket engine to swivel, veered sharply off course and self destructed o Carried satellite worth $500 million Error- exception when converting 64 bit float to 16 bit signed int- no exception handling Code was duplicated from Airane 4, error bc Ariane 5 was faster than Ariane 4 so need bigger int AT&T Long Distance Network 1990- AT&T long distance network suffered a significant disruption of service Half of the computerized telephone routing switches crashed 70 mil calls could not go through Crash caused by a single faulty line of code in an error-recovery procedure If there’s an error, switch reboot and send OK message to other switches, bug caused when busy switch received an OK message, which would cause it to reboot and send an OK message to even more busy switches When a switch went down, it pushed more long distance traffic to other switches, making them busier, and when it came up, it broadcast OK message which caused some of them to fail Could have been worse by left the old System 6 software running on 34 switches just in case which were fine Robot Missions to Mars NASA Mars Climate Orbiter to facilitate communications between Earth and automated probes on the surface of Mars Lost bc of a miscommunication between two support teams on Earth Lockheed Martin- imperial/English units Jet Propulsion lab used metric units One foot pound equals 4.45 newtons, so navigation team specified 4.45 times too much thrust, flew too close to surface and burned in atmosphere Mars Polar Lander- got a false signal from landing gear and shut down the engines 100 ft above the planet’s surface Tony Spear- project manager of Pathfinder mission – “It’s still hard to do Mars missions, software is the #1 problem” NASA successfully landed 2 Mars Exploration rovers, Opportunity and Spirit o Great successes, lasted long found evidence of former saltwater lake Denver International Airport Ambitious plan to create a state of the art automated baggage handling system for the Denver International Airport Computers route bags along belts, scanners read destination info from label, route to correct unloading point 56 bar code scanners and 5,000 electric eyes Problems o Underground tunnels were small and had sharp turns o Timeline too short Complexity of the system exceeded the ability of the development team to understand it o Luggage carts were misrouted o Computers lost track of where carts were o Bar code printers didn’t print tags clearly enough to be read by scanners o Luggage had to be correctly positions on conveyors to load properly o Workers painted over electric eyes or knocked photo sensors out of alignment o Design did not consider the problem of fairly balancing the number of available carts among all the locations needing them o And more … Try to solve one at a time, but too complicated for trial and error, should have looked at the big picture Use conventional baggage system instead 16 month delay in opening the airport Delay cost 1 million dollars a day in interest on bonds and operating costs So charged all the airlines a flight fee of $20 per passenger, which they responded by raising ticket prices Most software projects are not completed on time and on budget * Tokyo Stock Exchange Sell 610,000 shares at 1 yen instead of 1 share for 610,000 yen- warning overridden by tapping enter Couldn’t cancel the order bc of a bug in the TSE trading program Impossible for Mizuho to provide 96,000 shares to buyers bc J-Com only had 14,500 publicly traded shares Mizuho Securities lost $225 million buying back shares Mizuho sued the TSE, and won but compensation was reduced bc it was the error of the Mizuho employee Bug was undetected for 5 years because it only occurred when 7 different unusual conditions all happened simultaneously Direct Recording Electronic Voting Machines Close election in Florida in 2000 To avoid a repeat, Bush signed the Help America Vote Act of 2002 (HAVA)- provided money to states to replace punch card voting systems and improve standards for administering elections Many states used HAVA funds to purchase direct-recording electronic (DRE) voting machines o Voters indicate choice by touching screen or button o Shows the ballot to voter for review before submitting Brazil and India have run national elections using DRE voting machines exclusively 2006- 1/3 of US voters cast ballots on DRE Proponents of DRE- speed, accuracy of counting, tamper resistant more than paper ballots, avoid errors of selecting too many or too few candidates Ppl against it- concerns about errors and the lack of a paper audit trail- a record of the original ballots cast Voting irregularities linked to DRE machines o Error caused to fail to record 436 ballots in NC in 2002 o Boone County, Indiana, said 144,000 ballots were cast, but only had 19,000 registered voters  After fixing the error, got better result, but no way to know if results were correct bc of no paper audit trail o Fl 2004- reported 134 voters had not voted and the winner won by 12, no recount bc no trail o Fl- Democratic candidates were replaced with republican opponents Some believe DRE vulnerable to tampering o Harri Hursti discovered he could use a readily available agricultural scanning device to change the vote counts without leaving a trace Herbert Thompson examined the centralized Diebold machine that tallies the votes from the DREs. Said the system lacked a rudimentary authentication mechanism- able to access the system’s program without a login name or password o Switched 5,000 votes to a different candidate with 5 lines of code WinVote DRE system- used Wi-Fi to simplify setting up voting machines and counting the votes from the many machines at a single precinct o Assessment by Virginia revealed that WinVote had a number of serious security weaknesses- obsolete WEP wireless encryption, hardwired key of “abcde”, lacked logs to detect if database had been replaced o Modify results by capturing the wireless traffic between voting machines, breaking encryption, connecting to machines, downloading the databases containing the votes, changing the votes, uploading the modified databases to the voting machines Did not release source code to touch screen systems- can’t test how secure they are, say the code is a trade secret o Ppl criticize corporate control of elections in US and advocate use of open source software to make elections open and transparent Critics of touch screen voting systems claimed these systems make possible an unprecedented level of election fraud o Th old lever style mechanical voting machines were susceptible to fraud at a local level bc an official could vote multiple times, but by changing the programming of an electronic voting system, a single person could change votes across thousands of precincts Supporters argue that the criticisms are overblown- report maintained that DRE voting systems are more secure than traditional paper ballots, which can be tampered with by election officials Most states had second thoughts about DRE voting machines- in 2007, Florida switched to optical scan ballots- left a paper audit trail for possible manual recounts of disputed elections By 2014, 70% of Americans were back to casting old fashioned paper ballots 8.5 Therac-25 Wilhelm Roentgen- discovered X-ray in 1895 Use radiation to treat cancer- destroy cancer cells or relieve pain Linear accelerator create high energy electron beams to treat shallow tumors and x ray beams to reach deeper tumors Therac-25 linear accelerator was notoriously unreliable, malfunction 40 times a day 1985 to 1987- administered massive overdoses to 6 patients, killing 3 of them Therac-6 and 20 developed by Atomic Energy of Canada Limited and CGR Distinguishing feature of the Therac series was the use of a DEC PDP 11 minicomputer as a “front end” o By adding the computer, the linear accelerators were easier to operate Therac 6 and 20 were actually capable of working independently of the PDP 11, and all of their safety features were built into the hardware AECL moved ahead with Therac-25, and unlike its predecessors, AECL designed the PDP to be an integral part of the device o Incapable of operating without the computer o Enabled AECL to reduce costs by replacing some of the hardware safety features with software safety features * Reused some of the old code to save time and money * o Theoretically, “tried and true” software is more reliable than newly written code, but this was wrong in this case Marietta, GAo Breast cancer patient complained she was burned o AECL said this is not possible Hamilton Ontarioo Cervical cancer, complained about burn, machine malfunctioned a lot o Hospitalized for radiation overdosed, but died from her cancer First AECL inspection- unable to reproduce overdoes, but did uncover design problems related to microswitch- which was fixed ** Yakima Washingtono Radiation overdose, inflammation / rash o 2 pages explained why it was impossible for Therac-25 to produce an overdose * o Lived, but left with a mild disability Tyler Texas o Accidently enter X for Xray instead of E for electron beam, quickly fixed her mistake using arrow keys o Malfunction 54- said it was a low priority problem o Felt like someone poured hot coffee on him, received 80 to 125 times the prescribed amount of radiation- died of complications of the overdose Second investigation o Found nothing wrong, put it back into service * Tyler Texas 2 o Same technician, same problem, dose to the brain, died * Yakim Washingtono Parallel red stripes, matched slots in blocking tray, died * FDA declared Therac-25 to be defective in 1987q o To get back on the market, made revisions, included hardware interlocks to prevent machine from delivering overdoses, or activating the beam when the turntable was not in the correct position Software Errors Race condition- two ore more concurrent tasks share a variable, and the order in which they read or write the value can affect the behavior of the program * o Hard to identify and fix, because usually the two tasks don’t interfere with each other and nothing goes wrong Accidents occurred bc of a race condition with the command screen o One task responsible for handling keyboard input and making changes to the command screen o Second task responsible for monitoring the command screen for changes and moving the magnets into position o The crucial substitution of electron beam for X ray goes unnoticed bc change it before magnets are in place, so cursor ends up in same place before 8 seconds so its like nothing changed ** o Software knows its ready when cursor is in lower right hand corner * Bug only occurs with faster, more experienced operators * o Slower operators would not be able to complete the edit and get the cursor back to the lower right hand corner of the screen in only eight seconds o If the cursor was anywhere else on the screen when the magnets stopped moving, the software would check for a screen edit and there would be no overdoes * o It is ironic that the safety of the system actually decreased as the experience of the operator increased Second race condition- occurred when the machine was putting the electron beam gun back into positiono Variable was supposed to be 0 if gun was ready to fire * o As long as the electron beam gun was out of position, one task kept incrementing that var o But the var could only store up to 255, and it would roll over to 0 o Slight chance that the var would roll over when the operator hit the SET button, in this case, the accelerator would emit a charge, even though the system was not ready Postmortem When accidents were reported, AECL focused on identifying and fixing particular software bugs- this approach was too narrow o Most accidents are system accidents- stem from complex interactions between various components and activities o Entire system was broken, not just software * o A strategy of eliminating bugs assumes that at some point the last bug will be eradicated, but there is always another bug Real problem was that system was not designed to be fail safe o Good practice is to design system so that no single point of failure leads to a catastrophe * o And they relied completely on software for protection against overdoses- bad Lack of software or hardware to detect and report overdoses and shut down the accelerator immediately * o Instead, left it to the patient to report wen they had received overdoses Hard to find software errors in programs where multiple tasks execute at the same time and interact through shared variables Design decisions need to be documented to aid in the maintenance of the system Reusing code does not always increase the quality of the final producto Earlier code contained errors that were undetected bc earlier machines had hardware interlocks that preventing erroneous commands from harming patients * Moral responsibility Should the developers and managers at AECL be held morally responsible for the deaths resulting from the use of the Therac-25? For a moral agent to be responsible for a harmful event, two conditions must hold: o Causal condition- the actions, or inaction, of the agent must have caused the harm o Mental condition: the actions, or inactions, must have been intended or willed by the agent Causal is easy to establish- created the machine and did not withdraw it Mental- they did not intend to, but mental condition can include unintended harm f the actions were the result of carelessness, recklessness, or negligence * So yes Postscript 3 decades later, computer errors related to radiation machines continued to kill patients NYC death n 2006- Scott Jerome-Parks Tesla Version 7.0 (Autopilot) Tesla sold sedans with a technology package containing sensors, camera, radar, and digitally controlled brakes The package allowed the car to stop before crashing Update- car control its speed and steering wheel While truly driverless cars are years away, Autopilot functions like the systems that airplane pilots use when conditions are clear. Driver is still responsible for and in control of the car Tesla Version 7.0 became the first automaker to releasee a product exhibiting Level 3 automation o SAE Level 0 – no automation o Level 1 – Driver assistance o 2- partial automation o Level 3- conditional automation- human expected to respond appropriately to a request to intervene o 4- high automation o 5- full automation May 2016 fatal accident Joshua Brown crash with autopilot engaged Truck turned in front of the Tesla, it was high enough off the ground that the car continued under the semitrailer, shearing off its roof Speeding by 9 miles Hands only used for 25 seconds, received 77 warnings to put his hands on steering wheel Neither autopilot nor Brown applied the brakes before the crash Brown should have had 7 seconds to apply the brakes Automatic braking didn’t occur bc system was designed to avoid rear-end collisions, not to avoid vehicles crossing laterally Trailer was white, making it hard to see, and it was tall, making its radar signature similar to the radar signature of an overhead sign Hand off problem Ken Washington at Ford said it was skipping over Level 3 automation because of its inherent difficulties, namely: how can the computer ensure the driver is paying enough attention that it can pass control over in the case of an emergency? **** It takes an average of 3 to 7 seconds, but sometimes as many as ten seconds, for a driver to regain attention and take control of a vehicle in an emergency In many emerg4cny situations, there may not be 7 to 10 seconds for the driver to retake control of the vehicle before an accident occurs o This is called the hand off problem o Volvo and Google have joined Ford in deciding to skip over level 3 automation and develop self-driving cars that never expect humans to take over in an emergency situation Passing over control from the computer to the human is more difficult when a driver is distracted o Did not have a mechanism to ensure the driver kept attention on the road while autopilot was engaged Assigning Moral Responsibility How is truck driver, engineers, managers, and Brown himself responsible? Driver of truck- should have seen the Tesla, but he said he didn’t, but the Tesla was speeding, usually the car making the turn in front of another vehicle is at fault Brown was flouting traffic laws and Tesla’s instructions, evidence he was not keeping eyes on road Engineers and managers- contributed to the harm bc emergency braking system failed to stop the car and demonstrated carelessness/recklessness o Could have restricted its use to freeways where there is no lateral traffic o Decided to allow driver to set cruising speed well over the speed limit o Decided to release level 3 automation without solving the hands off problem o Did not require drivers to demonstrate a minimal level of attention by keeping their hands on the steering wheel Fixed this by disengaging if more than 3 warnings in 1 hour Company is advertising how cool a driverless car is, but yet they say that the driver should remain in control of car Managers and engineers should not be legally liable, but they do carry some moral responsibility Moral responsibility should be shared by all the parties 8.7 Uber Test-Vehicle Accident Travis Kalanick- co founder and CEO of Uber, saw autonomous vehicles as threat to Uber Wanted to develop it first Produced self-driving cars, but not autonomous, so engineers still needed to be up front to take over if necessary Run out of CA bc run red light It put two safety operators when testing Removed the second operator responsible for monitoring performance / logging events, so it might be hard for just 1 operator to stay alert bc of long shifts and repetitive drives Research shows that humans get bored when required to oversee highly automated systems that require few interactions ** Uber vehicles needed human intervention about every 13 miles- which is too low Bad experiences like braking too quickly False positive- incorrectly identifying a danger when there is none If you eliminate the false positives, more prone to false negatives- failing to identify a dangerous situation, which is worse March 18 2018 Accident Running test route, woman cross street wearing dark clothes at night, no crosswalk Determined that emergency braking is required, but it depended on the human operator to perform it, and did not alert the operator bc no alert mechanism Safety operator was watching TV instead of paying attention High on meth and weed Gov put the brakes on Uber’s program in AZ Computer Simulations 8.8 Even systems kept behind the locked doors of a computer room can cause harm Errors in computer simulations can result in poorly designed products, mediocre science, and bad policy decisions We rely on computer simulations for designing products, understanding our world, and even predicting the future Computer simulation plays a role in contemporary science and engineering Many reasons why a scientist may not be able to perform a physical experiment- too expensive, too unethical, impossible Computer simulations have been used to design nuclear weapons, search for oil, create pharmaceuticals, and design safer, more fuel efficient cars, design products like diapers Some computer simulations model past events, like evolution of universe 2nd use of simulations is to understand the world around us o One of the first important uses- aid in the exploration of oil o Drilling is expensive, so geologists lay out networks of microphones, and computers analyze the echoes to produce representations of underground Predict future- modern weather predictions are based on computer simulations Every computer simulations has an underlying mathematical model The Limits to Growth- book that predicted that a continued exponential increase in world population would lead to shortages of minerals and farm land, higher food prices, and pollution o The book’s predictions were far too pessimistic- the amount of tilled land has barely increased, food and mineral prices have dropped, and pollution is in decline, even though population has increased by more than 80% in the past 40 years o The underlying computer model was flawed- assumed all deposits of essential resources had already been discovered o Model ignored the technological improvements that allow society to decrease its use of resources, such as reducing demand for oil by improving fuel efficiency A computer simulation may produce wrong results for 2 different reasons o May have bug, or the model the program is based on is flawed Verification- process of determining if the computer program correctly implements the model Validation- process of determining if the model is an accurate representation of the real system One way to validate a model is to make sure it duplicates the performance of the actual system o Crashing an automobile on a computer is faster and less expensive than crashing an actual car o To validate their models, manufacturers compare the results of crashing an actual vehicle with the results predicted by the computer model Validating a model that predicts the future is tricky- validate by using it to predict the present o Use old data so you know the outcome it should predict Final way to validate- see if it has credibility with experts and decision makers o A model is valuable only if it is believed by those who have the power to use its results to reach a conclusion or make a decision Software Engineering 8.9 Field of software engineering grew out of a growing awareness of a software crisis In 1960s- computer architects took advantage of commercial integrated circuits to design powerful mainframe computers that could execute larger programs Programmers responded by designing powerful applications, but their programming efforts were plagued by problems o Behind schedule, too costly, contained bugs, hard to modify o The informal methods of programming that worked fine for early software systems broke down when these systems reached a certain level of complexity Software engineering- engineering discipline focused of production of software, as well as the development of tools, methodologies, and theories supporting software production Software engineers follow a four step process to develop a software product o 1- Specification- defining the functions to be performed by the software o 2- Development- Producing the software that meets the specifications o 3- Validation- testing the software o 4- Evolution- modifying the software to meet the changing needs of the customer Specification Specification focuses on determining the requirements of the system and the constraints under which it must operate Communicate with the intended users to determine what their needs are Results in a high-level statement of requirements and perhaps a mockup of the UI Also produce low level requirements that provides details needed by those who are actually going to implement the system Development Development phase- the software engineers produce a working software system that matches the specifications First design is based on high level abstract view, which reveals ambiguities and errors Fixing mistakes is quicker and cheaper when the design is still at a higher, more abstract level Gradually add levels of detail to the design A variety of structured design methodologies have been developed Many organizations use computer-assisted software engineering (CASE) tools to support the process of developing and documenting an ever-more detailed design Another noteworthy improvement in software engineering methodologies is object-oriented design o In traditional design, the software system is viewed as a group of functions manipulating a set of shared data structures o In object oriented design- the software system is seen as a group of objects passing messages to each other  Each object has its own state and manipulates its own data based on the messages it receives Advantages of object oriented system o Bc each object is associated with a particular component of the system, object oriented designs can be easier to understand, which saves time testing and programming o Bc each object hides its state and private data from other objects, other obj cant accidentally modify its data items- fewer errors like race conditions o Bc obj are independent of each other, it is easier to reuse components of an object oriented system Object oriented programming languages- C++, Java, C# Validation Purpose of validation/testing is to ensure that the software satisfies the specification and meets the needs of the user Good testing requires lots of skill Testing software is hard o Testing a program with a small problem can reveal bugs, but it cannot prove that the program will work when it is fed a much larger problem Programs that appear fine may fail when only a single parameter is changed by a small amount Yet programmers cannot exhaustively test programs- even small programs have a virtually infinite number or inputs Since exhaustive testing is impossible, programs can never be completely tested Software testers strive to put together suites of test cases that exercise all the capabilities of the component or system being validated To reduce complexity of validating a large software system, testing is usually performed in stages o First stage- each individual module is tested independently o Modules are combined into larger subsystems for testing o Subsystems combined into complete system o When an error is detected in a module, all the test cases related to the module should be repeated to see if the fix caused another bug Evolution Software systems evolve over time to meet the changing needs to their users Evolution of software system resembles the creation of a software system in many ways Improvement in Software Quality Evidence that the field of software engineering is becoming more mature The Standish Group tracks thousands of IT projects 1994- only 1/6 of projects were completed on time and budget 2009 – probability of a software project being completed on time and on budget doubled1/3 Ability of companies to produce software on time and on budget improved over the 15 year period Rapid change is a fact of life in the software industry- to stay competitive, must release projects quickly, many orgs feel tension between meeting tight deadlines and strictly following software engineering methodologies Gender Bias When a profession is dominated by men, unconscious gender bias can affect design decisions Seatbelts don’t protect pregnant women and their unborn children properly o Crash dummies are designed to model average adult male Research shows women and men have different approaches to writing and debugging code Even if there are women on the team, they may not feel free to express themselves o Ideas get voted down? o If nearly all developers are men, female perspective may not be heard One way to address gender bias is to increase the percentage of women actively engaged in the process Currently, about ¾ of IT jobs are held by men Title VII of civil Rights Act of 1964 made it illegal for job advertisements to indicate a preferences for male or female applicants o But ppl creating job ads in male dominated fields continue to convey the gender of the ideal candidate o Women are less likely to apply when the ad contains masculine themed words, like active, adventurous, aggressive, ambitious, assertive, leader, etc. o Interestingly, men are just as likely to apply for a position when the ads contains a lot of feminine themed words, like loyal, polite, interpersonal Culture of these companies needs to change o More than half of women who enter tech field drop out by midcareer, driven out by hostile work environments and extreme job pressures, feel isolated o Experience sexual harassment Bias in Training Data sets for AI Systems When a data set used to train an artificial intelligence system is biased, the performance of the system across a diverse population can vary dramatically In data set for facial recognition- 75% of faces are males, 80% are white o Misidentify dark skinned females up to 35% Google photos- labeled black Jacky Alcine as a gorilla Machine learning systems can amplify biases 8.10 Software Warranties and Vendor Liability What should the rights of consumers be to get compensation when programs malfunction? In US, contracts and warranties are primarily governed by the states, rather than the fed gov * The Uniform Commercial Code represents an attempt to harmonize laws governing commercial transactions across 50 sates- nearly every states has adopted UCC with only minor variations Shrink Wrap Warranties Traditional consumer software was called shrink-wrap software because of the plastic wrap surrounding the box containing the software and manuals In early years of personal computers, consumer software manufacturers provided no warranty for their products, purchasers had to accept shrink-wrap software as is Today many software manufacturers provide a replacement or money back guarantee if the program fails Gathering of Developers made warranty for Railroad Tycoon that only promised that you would be able to install the software “Does not warrant that the software will meet your requirements or error free “ In other words- don’t blame us if the program doesn’t do what you hoped it would do, or if it crashes all the time, and we aren’t promising to fix those bugs Are Software Warranties Enforceable? How can software manufacturers get away with disclaiming any warranties on what they have sold? – It’s not clear if they can If the software is mass marketed or included in a sale of hardware, it is likely to be considered a good by a court of law The damages and warranty positions of the UCC can often apply to the sale of goods, despite what the warranties say Step-Saver Data Systems v. Wyse Technology and The Software Link seemed to affirm the notion that software manufacturers could beheld responsible for defective programs, despite what they put in their warranties However, ProCD v. Zeidenberg seemed to indicate the opposite- ruled that the customer could be bound to the license agreement, even if the license agreement does not appear on the outside of the box Mortenson v. Timberline Software showed that a warranty disclaiming the manufacturer’s liability could hold in court Step-Saver Data Systems v. Wyse and The Software Link Step-Saver sold computers consisting of Wyse terminals and OS provided by Software Link Software Link disclaimed all warranties Step-Saver’s time sharing systems did not work properly, was sued, so Step-Saver sued Wyse and TSL Rule din favor of Step-Saver- original contract between Step-Saver and TSL consisted of the purchase and the oral statements made by the TSL representative, and Step-Saver did not agree to terms “In the absence of a party’s express assent to the additional or different terms of the writing, UCC provides a default rule that the parties intended” Oral statements and the purchase constituted the contract, not the license agreement Procd Inc. v. Zeidenberg ProCD invested more than 10 mil to construct computer databases containing info from more than 3,000 telephone directories Created app enabling users to search the database for records matching criteria they specified (SelectPhone) o Targeted to companies interested in generating mailing lists and individuals interested in finding the phone numbers or addresses of ppl they wanted to call or write Included a license in the consumer version that prohibited the commercial use of the database program Matthew Zeidenberg purchased the consumer version of SelectPhone ad formed a company called Silken Mountain Web Services Inc, which resold the info in the SelectPhone database o Sued for violating the licensing agreement Defense argued that Zeidenberg could not be held to the terms of the licensing agreement since they were not printed on the outside of the box o Ruled in favor of ProCD- judge Easterbrook wrote “shrink-wrap licenses are enforceable unless their terms are objectionable on grounds applicable to contracts in general” Mortenson v. Timberline Software Mortenson Company was a national construction contractor Timberline software produced software for construction industry Mortenson had used software from Timberline for years, bought 8 copies of a bidding package called Precision Bid Analysis Timberline said they are not responsible for any damages or losses Motenson used the software to prepare a bid, software malfunctioned, bid too low Mortenson sued Timberline for breach of express and implied warranties o Timberline was aware of the bug o Timberline said it is dismissed bc the licensing agreement limited the consequential damages that Mortensen’s could recover from Timberline o Timberline won Should software be considered a product? When software is judged to be a good, the provisions of the UCC regarding damages and warranty can apply If software were to be considered a product, then the theory of strict liability would apply to the software manufacturer o According to theory of strict liability, the manufacturer is liable for personal injury or property damage caused by a product when it’s being used in a reasonable way o Bc the theory of strict liability focuses on personal injury and property damage, but not economic loss, the primary impact of treating software as a product would be in those situations where software is part of an embedded system, like a car o To date, US courts have resisted treating software as a product subject to theory of strict liability, in part bc a software controlled device may cause harm through no fault of the programmer *  Is it reasonable to put all liability on manufacturer when others, like hospital physicians, may share some responsibility?  * The theory of strict liability seems to put too much liability on the software manufacturer in many cases Case Study: Incredible Bulk Peter Griffin downloads a copy of the game Incredible Bulk of $50 The game has bugs Incredible Bulk 2 is another $50 but has no bugs Kant- company did nothing wrong, never promised to make patches to fix bugs o Users should have waited until reviews came out if they were that concerned Social Contract- arrangement is unfair o Peter was purchasing a license to use the software, not the software o AT some point in development, manufacturer fixed the bugs o Peter’s license should have given him the right to play the original version with bug fixes Summary Computers are part of larger systems, and it’s the reliability of the entire system that is important Well0engineered system can tolerate the malfunction of any single component without failing Two sources of failure are data entry and data retrieval errors A well-engineered system does not fail when a single component fails o Easier to apply this principle with hardware o When it comes to software, goal is harder to meet o A software bug that causes one computer to fail will cause both computers to fail, like collapse of ATT network o Redundancy?  A paper audit trail is a practical way to add redundancy to an electronic voting machine It may be infeasible to provide redundant software systems, but safety-critical systems should never completely rely upon a single piece of software Ariane 5 and Therac failures- dangerous to reuse code Difficulty of debugging a complex system- DIA Systems can fail bc of miscommunications among ppl- Mars climate orbiter Computer simulations are used to perform numerical experiments that lead to new scientific discoveries and help engineers create better products o Validated by comparing predicted results with reality Discipline of software engineering emerged from a software crisis o Large programs must be carefully constructed if they are to be reliable Courts seem willing to treat software as goods, which means the damages and warranty provisions of the UCC may apply, despite what may appear in a software warranty ** o However, courts have been reluctant to treat software programs as products, which would expose software manufactures to the theory of strict liability **