Re: How to get Ada to “cross the chasm”?

[Paul Rubin <no.email@nospam.invalid>]

"Dan'l Miller" <optikos@verizon.net> writes:
> Embedded realtime systems are going to be going mainstream in data
> processing with FPGAs in the datacenter.

Hmm.  FPGAs in the datacenter are usually about doing specialized
computation efficiently: examples include things like machine learning
using the DSP blocks on the FPGA's, or (famously) bitcoin mining.
So I wouldn't count that as either realtime or embedded.

Embedded usually means the processor is there to perform some
specialized computation to control hardware.  So seeing FPGA's in the
data center used for general purpose computation is actually cool
because it means FPGA's have escaped from the embedded realm.  They are
instead computing something and sending the answer over the internet.

Similarly, realtime to me means the answer must be delivered within some
specific deadline, usually measured in microseconds, or else disaster
ensues.  If the answer is being delivered over the internet, they any
interruption in network connectivity means the deadline is missed.    

So I can't consider anything running in a data center to be realtime
enough to need formal verification.  If your network reliability is
99.99% (on average it is out less than 1 second a day, including for
reasons like power failures) you are doing great.  Therefore it is
sufficient if your software delivers answers with 99.999% reliability, a
level you can easily reach with traditional testing methods.  The
likelihood of software failure is then swamped by the likelihood of
network failure.

Note that the 0.0001% failure allowance above doesn't mean that the
program is allowed to ever deliver wrong answers.  It just means that
the possibility of a deadline miss (where the program takes longer than
you expected, or fails to give you an answer at all) can be tolerated if
the likelihood is low enough.  Formal assurance against wrong answers is
most easily done by methods that are in tension with realtime
guarantees.  So deciding what methods to use requires understanding what
the complete system has to do.