SLIDE 1
Properties of Chaos
Nathan Aschbacher @gen_nja
Properties of Chaos Nathan Aschbacher @gen_nja _ we suspect - - PowerPoint PPT Presentation
Properties of Chaos Nathan Aschbacher @gen_nja _ we suspect - - PowerPoint PPT Presentation
Properties of Chaos Nathan Aschbacher @gen_nja _ we suspect most users are not working on these kinds of safety-critical systems. -- Chaos Engineering the Book Must Be at Least this 26262 to Ride Functional Safety in
SLIDE 2
SLIDE 3
“ ”
- - Chaos Engineering
the Book …we suspect most users are not working on these kinds of safety-critical systems.
SLIDE 4
Must Be at Least this 26262 to Ride
SLIDE 5
“Functional Safety in AI Controlled Vehicles: If Not ISO 26262, Then What?”
Joseph Dailey Global Functional Safety Manager Mentor
SLIDE 6
SLIDE 7
Autonomy / ML / AI Libraries Kernel Drivers Hypervisor Hardware
SLIDE 8
Curry-Howard
“227 issues”
SLIDE 9
Libraries Kernel Autonomy / ML / AI Drivers Hypervisor Hardware
SLIDE 10
On-Vehicle Toolchain
SLIDE 11
2019
Must Be at Least this 26262 to Ride
SOTIF
SLIDE 12
Fail-Operational
SLIDE 13
π Π 𐀆
Dependent Types Higher Order Logic Join Calculus
Mathematical Proof ϕ
Temporal Logic
SLIDE 14
SLIDE 15
Chaos Engineering is about engineering practices that help us surface those systemic effects.
- - Casey Rosenthal
Co-author of Chaos Engineering Book
“ ”
SLIDE 16
”
- - Principles of Chaos
“ ”
Chaos strongly prefers to experiment directly
- n production traffic.
- - Chaos Engineering
the Book
“ We don’t expect engineers to inject noise into
the sensors of self-driving cars containing unsuspecting passengers!
SLIDE 17
Property Chaosed Testing
SLIDE 18
Background:
Given a process Alice And a process Bob And an arbitrary vector of processes Carls And a message capability from Bob to Alice And a message capability from Alice to Bob And the Carls continuously send arbitrary messages to Alice
Scenario: Message delay from unauthorized IPC storm
When Alice sends an arbitrary message to Bob And Bob replies to message from Alice Then the message delay from Bob to Alice must be < 1 ms
SLIDE 19
impl Arbitrary for message { fn arbitrary<G: Gen>(g: &mut G) -> message { message { id: u32::arbitrary(g), dlc: u8::arbitrary(g), timestamp: u32::arbitrary(g), data: [u8::arbitrary(g); 8], } } }
SLIDE 20
Common Cause Cascading Interference Common Mode
SLIDE 21
Perceiving Planning Performing
SLIDE 22
∞
Time <
SLIDE 23
Before > After
SLIDE 24
Autonomy / ML / AI Libraries Kernel Drivers Hypervisor Hardware
Necessarily Probabilistic Terrifyingly Probabilistic
SLIDE 25
The robots are coming.
SLIDE 26