Resurrecting Laplace's Demon: The Case for Deterministic Models · 2018-04-03 · Nevertheless, Laplace’s Demon cannot exist. In 2008, David Wolpert, then at NASA, now at the Santa

Resurrecting Laplace's Demon: The Case for Deterministic Models

Edward A. Lee Robert S. Pepper Distinguished Professor UC Berkeley Keynote Talk: MODELS October 4, 2016 St. Malo, France

MODELS2010Oslo,Norway

Keynotetalk:DisciplinedHeterogeneousModeling

Lee, Berkeley 2

Notjustinforma.ontechnology:•  Cyber+Physical•  Computa@on+Dynamics•  Security+SafetyProper.es:•  Highlydynamic•  Safetycri@cal•  Uncertainenvironment•  Physicallydistributed•  Sporadicconnec@vity•  Resourceconstrained

Doesitmakesensetotalkaboutdeterminis;cmodelsforsuchsystems?

Automotive

Context:Cyber-PhysicalSystemsApar@cularlychallengingcasefordeterminism

Biomedical

Military

Energy

Manufacturing

Avionics

Buildings

3 Lee, Berkeley

Modelsvs.Reality

Inthisexample,themodelingframeworkiscalculusandNewton’slaws.Fidelityishowwellthemodelanditstargetmatch

Lee, Berkeley 4

The model

The target (the thing being modeled).

Solomon Wolf Golomb

You will never strike oil by drilling through the map!

Lee, Berkeley 5

Engineers often confuse the model with its target

But this does not in any way diminish the value of a map!

Determinacy

Someofthemostvaluablemodelsaredeterminis;c.

Amodelisdeterminis;cif,giventheini@alstateandtheinputs,themodeldefinesexactlyonebehavior.

Determinis@cmodelshaveprovenextremelyvaluableinthepast.

Lee, Berkeley 6

Laplace’sDemon

“Wemayregardthepresentstateoftheuniverseastheeffectofitspastandthecauseofitsfuture.Anintellectwhichatacertainmomentwouldknowallforcesthatsetnatureinmo@on,andallposi@onsofallitemsofwhichnatureiscomposed,ifthisintellectwerealsovastenoughtosubmitthesedatatoanalysis,itwouldembraceinasingleformulathemovementsofthegreatestbodiesoftheuniverseandthoseofthe@niestatom;forsuchanintellectnothingwouldbeuncertainandthefuturejustlikethepastwouldbepresentbeforeitseyes.”— PierreSimonLaplace

Lee, Berkeley 7

Pierre-Simon Laplace (1749–1827). Portrait by Joan-Baptiste Paulin Guérin, 1838

Didquantummechanicsdashthishope?

“Atfirst,itseemedthatthesehopesforacompletedeterminismwouldbedashedbythediscoveryearlyinthe20thcenturythateventslikethedecayofradioac@veatomsseemedtotakeplaceatrandom.ItwasasifGodwasplayingdice,inEinstein’sphrase.Butsciencesnatchedvictoryfromthejawsofdefeatbymovingthegoalpostsandredefiningwhatismeantbyacompleteknowledgeoftheuniverse.”(StephenHawking,2002)

Lee, Berkeley 8

Nevertheless,Laplace’sDemoncannotexist.

In2008,DavidWolpert,thenatNASA,nowattheSantaFeResearchIns@tute,usedCantor’sdiagonaliza@ontechniquetoprovethatLaplace’sdemoncannotexist.Hisproofreliesontheobserva@onthatsuchademon,wereittoexist,wouldhavetoexistintheveryphysicalworldthatitpredicts.

Lee, Berkeley 9

David Wolpert

The Koptez Principle

Many properties that we assert about systems (determinism, timeliness, reliability) are in fact not properties of the system, but rather properties of a model of the system. If we accept this, then it makes no sense to talk about whether the physical world is deterministic. It only makes sense to talk about whether models of the physical world are deterministic.

Hermann Kopetz Professor (Emeritus) TU Vienna

Theques@onswitchesfromwhetheramodelisTruetowhetheritisUseful

“Essen@ally,allmodelsarewrong,butsomeareuseful.”

Box,G.E.P.andN.R.Draper,1987:EmpiricalModel-BuildingandResponseSurfaces.WileySeriesinProbabilityandSta@s@cs,Wiley.

Lee, Berkeley 11

Physicistscon@nuetodebatewhethertheworldisdeterminis@c

Determinismisapropertyofmodels,notapropertyofthesystemstheymodel.

Lee, Berkeley 12

Deterministic model

Deterministic system?

Schema@cofasimpleCyber-PhysicalSystem

Lee, Berkeley 13

What kinds of models should we use? Let’s look at the most successful kinds of models from the cyber and the physical worlds.

SoewareisaModel

PhysicalSystem Model

Single-threadedimpera;veprogramsaredeterminis;cmodels

Lee, Berkeley 14

Considersingle-threadedimpera@veprograms

Thetargetofthemodeliselectronssloshingaroundinsilicon.Ittakes@me,consumesenergy,andfailsifdroppedintheocean,noneofwhichareproper@esofthemodel.

This program defines exactly one behavior, given the input x. Note that the modeling framework (the C language, in this case) defines “behavior” and “input.”

Lee, Berkeley 15

Soewarereliesonanotherdeterminis@cmodelthatabstractsthehardware


Instruction Set Architectures (ISAs) are deterministic models

Lee, Berkeley 16

Image: Wikimedia Commons Waterman, et al., The RISC-V Instruction Set Manual, UCB/EECS-2011-62, 2011

…whichreliesonyetanotherdeterminis@cmodel


Synchronousdigitallogicisadeterminis;cmodel

Lee, Berkeley 17

Determinis@cModelsforthePhysicalSideofCPS


Signal Signal

Differen;alEqua;onsaredeterminis;cmodels

Lee, Berkeley 18

Image: Wikimedia Commons

Signal Signal

19 Image: Wikimedia Commons Lee, Berkeley

AmajorproblemforCPS:combina@onsofdeterminis@cmodelsarenondeterminis@c

Correct execution of a program in all widely used programming languages, and correct delivery of a network message in all general-purpose networks has nothing to do with how long it takes to do anything.

Programmers have to step outside the programming abstractions to specify timing behavior. CPS designers have no map!

Lee, Berkeley 20

Timing is not part of software and network semantics

AStory

In“flybywire”aircrae,computerscontroltheplane,media@ngpilotcommands.

Abstrac@onLayersAllofwhicharemodelsexceptthebohom

Thepurposeofanabstrac@onistohidedetailsoftheimplementa@onbelowandprovideaplaiormfordesignfromabove.

Abstrac@onLayersAllofwhicharemodelsexceptthebohom

Everyabstrac@onlayerhasfailedfortheaircraedesigner.Thedesignistheimplementa@on.

Determinism?Really?

CPSapplica@onsoperateinanintrinsicallynondeterminis@cworld.Doesitreallymakesensetoinsistondeterminis;cmodels?

24 Lee, Berkeley

•  Inscience,thevalueofamodelliesinhowwellitsbehaviormatchesthatofthephysicalsystem.

•  Inengineering,thevalueofthephysicalsystemliesinhowwellitsbehaviormatchesthatofthemodel.

Lee, Berkeley 25

In engineering, model fidelity is a two-way street!

For a model to be useful, it is necessary (but not sufficient) to be able to be able to

construct a faithful physical realization.

TheValueofModels

AModel

Lee, Berkeley 26

APhysicalRealiza@on

Lee, Berkeley 27

ModelFidelity

•  Toascien;st,themodelisflawed.

•  Toanengineer,therealiza@onisflawed.

I’manengineer…

Lee, Berkeley 28

ForCPS,weneedtochangetheques@on

Theques@onisnotwhetherdeterminis@cmodelscandescribethebehaviorofcyber-physicalsystems(withhighfidelity).Theques@oniswhetherwecanbuildcyber-physicalsystemswhosebehaviormatchesthatofadeterminis@cmodel(withhighprobability).

Lee, Berkeley 29

Determinism?Whataboutresilience?Adaptability?

Determinis@cmodelsdonoteliminatetheneedforrobust,fault-tolerantdesigns.

Infact,theyenablesuchdesigns,becausetheymakeitmuchclearerwhatitmeanstohaveafault!

Lee, Berkeley 30

Existenceproofsthatusefuldeterminis@cmodelsforCPSexist

Determinis@cmodelsforCPSwithfaithfulimplementa@onsexist:

•  PTIDES:distributedreal-@mesoeware–  hhp://chess.eecs.berkeley.edu/p@des

•  PRET:@me-determinis@carchitectures–  hhp://chess.eecs.berkeley.edu/pret

Thesetwoprojectsendedin2015.

Lee, Berkeley 31

Together,thesetechnologiesgiveaprogrammingmodelfordistributedandconcurrentreal-;mesystemsthatisdeterminis;cinthesenseofsingle-threadedimpera;veprograms,andalsodeterminis;cw.r.t.to;mingofexternalinterac;ons.

But…

Determinismhasitslimits.

Lee, Berkeley 32

• Complexity • Uncertainty • Chaos •  Incompleteness

Complexity

•  Somesystemsaretoocomplexfordeterminis@cmodels.

•  Nondeterminis@cabstrac@onsbecomeuseful.

Lee, Berkeley 33

“Iron wing” model of an Airbus A350.

Complexity

•  Somesystemsaretoocomplexfordeterminis@cmodels.

•  Nondeterminis@cabstrac@onsbecomeuseful.

Lee, Berkeley 34

Deep Learning, draft book in preparation, by Yoshua Bengio, Ian Goodfellow, and Aaron Courville. http://www.deeplearningbook.org/

But…


Lee, Berkeley 35


Uncertainty

•  Wecan’tconstructdeterminis@cmodelsofwhatwedon’tknow.

•  Forthis,nondeterminismisuseful.

•  Bayesianprobability(whichismostlyduetoLaplace)quan@fiesuncertainty.

Lee, Berkeley 36

Portrait of Reverend Thomas Bayes (1701 - 1761) that is probably not actually him.

But…


Lee, Berkeley 37


Determinismdoesnotimplypredictability

Lee, Berkeley 38

Edward Lorenz


Lee, Berkeley 39

Edward Lorenz

The position of a point is not meaningfully predictable even though the system is deterministic.


[ThieleandKumar,EMSOFT2015]

Lee, Berkeley 40

But…


Lee, Berkeley 41


IncompletenessofDeterminism

Anysetofdeterminis@cmodelsrichenoughtoencompassNewton’slawsplusdiscretetransi@onsisincomplete.[Lee,FundamentalLimitsofCyber-PhysicalSystemsModeling,toappear,ACMTr.onCPS,2017]

Lee, Berkeley 42

Illustra@onoftheIncompletenessofDeterminism

Lee, Berkeley 43


Lee, Berkeley 44


Lee, Berkeley 45


Lee, Berkeley 46


Lee, Berkeley 47


Lee, Berkeley 48


Lee, Berkeley 49


Lee, Berkeley 50


Lee, Berkeley 51


Lee, Berkeley 52


Lee, Berkeley 53

ArbitraryInterleavingYieldsNondeterminism

Lee, Berkeley 54

RecalltheHeisenbergUncertaintyPrinciple

Lee, Berkeley 55

IsDeterminismIncomplete?

•  InLee(2017),IshowthatthissequenceofmodelsisCauchy,sothespaceofdeterminis@cmodelsisincomplete(itdoesnotcontainitsownlimitpoints).

•  InLee(2014),Ishowthatadirectdescrip@onofthisscenarioresultsinanon-construc@vemodel.Thenondeterminismarisesinmakingthismodelconstruc@ve.

Lee, Berkeley 56

Rejec@ngdiscretenessleadstodeterminis@cchaos

Acon@nuousdeterminis@cmodelthatmodelstheballsasspringsischao@c.

Lee, Berkeley 57

Discretebehaviorscannotbeexcludedunlesswealsorejectcausality

Lee, Berkeley 58

Example from Lee, “Constructive Models of Discrete and Continuous Physical Phenomena,” IEEE Access, 2014

Summary

•  Determinis@cmodelsareextremelyuseful.

•  Combiningofourbestdeterminis@ccybermodelsandphysicalmodelstodayyieldsnondeterminis@cmodels.

•  Butdeterminis@cmodelswithfaithfulimplementa@onsexist(inresearch)forcyber-physicalsystems.

•  Determinis@cmodelsaren’talwayspossibleorprac@calduetocomplexity,unknowns,chaos,andincompleteness.

•  Determinismisapowerfulmodelingtool.Useitifyoucan.Backoffonlywhenyoucan’t.

Lee, Berkeley 59

Conclusion

Modelsplayacentralroleinreasoningaboutanddesigningengineeredsystems.Determinismisavaluableandsubtlepropertyofmodels.

Lee, Berkeley 60

Plato and the Nerd On Technology and Creativity

Edward Ashford Lee

MIT Press, 2017

Forthcoming book My first for a general audience

Documents

Resurrecting Laplace's Demon: The Case for Deterministic Models · 2018-04-03 · Nevertheless, Laplace’s Demon cannot exist. In 2008, David Wolpert, then at NASA, now at the Santa