A position talk given at the Smart Designing of Smart Systems workshop: https://sdpsnet.org/sdps-2020/ws8.html Engineers necessarily make assumptions during design and implementation of complex systems. These assumptions often set the expectations of one component towards the environment and other components. Assumptions are typically seen as implicit weak points of the system: should they be violated at run time, the system is likely to fall short of its required performance and safety. Although some recent work makes the assumptions explicit, they are still seen as liabilities. This talk will take a complementary perspective and explore how engineering assumptions enable intelligent behaviour in systems and design processes -- and how their violations can be managed at design time and run time.

1. 1
On the Role of Assumptions
in Engineering Smart Systems
Ivan Ruchkin
PRECISE Center
Computer and Information Science
University of Pennsylvania
Smart Designing of Smart Systems Workshop
Society of Design and Process Science
November 20, 2020

2. 2
Position statement
Engineering
assumptions
enable
Intelligible
complexity
enables
Smart behavior
Smart design

3. 3
Position statement
Engineering
assumptions
enable
Intelligible
complexity
enables
Smart behavior
Smart design

4. 4
Defining assumptions
●
“Statement [...] taken for granted to be true” [1]
●
“Needs or decisions [...] not yet validated” [2]
Many taxonomies:
Problem- vs solution-oriented [3]
Implicit vs explicit [4]
Whether invalidation leads to defects [2]
[1] Marincic, Mader, Wieringa. Classifying Assumptions Made During Requirements Verification of Embedded Systems, REFSQ 2008.
[2] Bulandran. An Exploration of Assumptions in Requirements Engineering. PhD thesis, University of Western Australia, 2012.
[3] Dewar. Assumption-Based Planning A Tool for Reducing Avoidable Surprises, RAND, Cambridge University Press, 2002.
[4] Saqui-Sannes, Ludovic. Making Modeling Assumptions an Explicit Part of Real-Time Systems Models, ERTS 2016.

5. 5
Defining assumptions
●
“Statement [...] taken for granted to be true” [1]
●
“Needs or decisions [...] not yet validated” [2]
●
Many taxonomies:
– Problem- vs solution-oriented [3]
– Implicit vs explicit [4]
– Whether violation leads to defects [2]
[1] Marincic, Mader, Wieringa. Classifying Assumptions Made During Requirements Verification of Embedded Systems, REFSQ 2008.
[2] Bulandran. An Exploration of Assumptions in Requirements Engineering. PhD thesis, University of Western Australia, 2012.
[3] Dewar. Assumption-Based Planning A Tool for Reducing Avoidable Surprises, RAND, Cambridge University Press, 2002.
[4] Saqui-Sannes, Ludovic. Making Modeling Assumptions an Explicit Part of Real-Time Systems Models, ERTS 2016.

6. 6
Intuition about assumptions

7. 7
Intuition about assumptions
From: Hehenberger, Egyed, Zeman. Consistency Checking of
Mechatronic Design Models, DETC 2009

8. 8
Intuition about assumptions
From: Hehenberger, Egyed, Zeman. Consistency Checking of
Mechatronic Design Models, DETC 2009
●
Define a scope:
– Component
– Model
– System
Assumptions:
fixed expectations
of the scope’s inside
from its outside

9. 9
Intuition about assumptions
From: Hehenberger, Egyed, Zeman. Consistency Checking of
Mechatronic Design Models, DETC 2009
●
Define a scope:
– Component
– Model
– System
●
Assumptions:
– fixed expectations
– of the scope’s inside
– from its outside

10. 10

11. 11
Canonical role: “ticking bomb”
●
An assumption can be violated, leading to undesired
consequences
Long history of critical failures due to unmet assumptions:
Mars climate orbiter: assumption about metric/imperial system
Challenger space shuttle: assumption about O-rings in cold
temps
GM ignition switch: assumption about mechanical/electrical
interaction

12. 12
Canonical role: “ticking bomb”
●
An assumption can be violated, leading to undesired
consequences
●
Long history of critical failures due to unmet assumptions:
Mars climate orbiter: assumption about metric/imperial system
Challenger space shuttle: assumption about O-rings in cold
temps
GM ignition switch: assumption about mechanical/electrical
interaction

13. 13
Canonical role: “ticking bomb”
●
An assumption can be violated, leading to undesired
consequences
●
Long history of critical failures due to unmet assumptions:
– Mars climate orbiter: assumption about metric/imperial system
– Challenger space shuttle: assumption about O-rings in cold
temps
– GM ignition switch: assumption about mechanical/electrical
interaction

14. 14
Response to “ticking bombs”
Document, model, and manage [1, 4, 5]
Validate at design time [2]
Monitor [6] and adapt [3] at run time
[1] Marincic, Mader, Wieringa. Classifying Assumptions Made During Requirements Verification of Embedded Systems, REFSQ 2008.
[2] Bulandran. An Exploration of Assumptions in Requirements Engineering. PhD thesis, University of Western Australia, 2012.
[3] Dewar. Assumption-Based Planning: A Tool for Reducing Avoidable Surprises, RAND, Cambridge University Press, 2002.
[4] Saqui-Sannes, Ludovic. Making Modeling Assumptions an Explicit Part of Real-Time Systems Models, ERTS 2016.
[5] Fu. A Framework for Managing Unspecified Assumptions in Safety-Critical Cyber-Physical Systems, PhD thesis, UChicago, 2020.
[6] Cimatti, Tian, Tonetta. Assumption-Based Runtime Verification with Partial Observability and Resets, RV 2019.

15. 15
Response to “ticking bombs”
●
Document, model, and manage [1, 4, 5]
Validate at design time [2]
Monitor [6] and adapt [3] at run time
[1] Marincic, Mader, Wieringa. Classifying Assumptions Made During Requirements Verification of Embedded Systems, REFSQ 2008.
[2] Bulandran. An Exploration of Assumptions in Requirements Engineering. PhD thesis, University of Western Australia, 2012.
[3] Dewar. Assumption-Based Planning: A Tool for Reducing Avoidable Surprises, RAND, Cambridge University Press, 2002.
[4] Saqui-Sannes, Ludovic. Making Modeling Assumptions an Explicit Part of Real-Time Systems Models, ERTS 2016.
[5] Fu. A Framework for Managing Unspecified Assumptions in Safety-Critical Cyber-Physical Systems, PhD thesis, UChicago, 2020.
[6] Cimatti, Tian, Tonetta. Assumption-Based Runtime Verification with Partial Observability and Resets, RV 2019.

16. 16
Response to “ticking bombs”
●
Document, model, and manage [1, 4, 5]
●
Validate at design time [2]
Monitor [6] and adapt [3] at run time
[1] Marincic, Mader, Wieringa. Classifying Assumptions Made During Requirements Verification of Embedded Systems, REFSQ 2008.
[2] Bulandran. An Exploration of Assumptions in Requirements Engineering. PhD thesis, University of Western Australia, 2012.
[3] Dewar. Assumption-Based Planning: A Tool for Reducing Avoidable Surprises, RAND, Cambridge University Press, 2002.
[4] Saqui-Sannes, Ludovic. Making Modeling Assumptions an Explicit Part of Real-Time Systems Models, ERTS 2016.
[5] Fu. A Framework for Managing Unspecified Assumptions in Safety-Critical Cyber-Physical Systems, PhD thesis, UChicago, 2020.
[6] Cimatti, Tian, Tonetta. Assumption-Based Runtime Verification with Partial Observability and Resets, RV 2019.

17. 17
Response to “ticking bombs”
●
Document, model, and manage [1, 4, 5]
●
Validate at design time [2]
●
Monitor [6] and adapt [3] at run time
[1] Marincic, Mader, Wieringa. Classifying Assumptions Made During Requirements Verification of Embedded Systems, REFSQ 2008.
[2] Bulandran. An Exploration of Assumptions in Requirements Engineering. PhD thesis, University of Western Australia, 2012.
[3] Dewar. Assumption-Based Planning: A Tool for Reducing Avoidable Surprises, RAND, Cambridge University Press, 2002.
[4] Saqui-Sannes, Ludovic. Making Modeling Assumptions an Explicit Part of Real-Time Systems Models, ERTS 2016.
[5] Fu. A Framework for Managing Unspecified Assumptions in Safety-Critical Cyber-Physical Systems, PhD thesis, UChicago, 2020.
[6] Cimatti, Tian, Tonetta. Assumption-Based Runtime Verification with Partial Observability and Resets, RV 2019.

18. 18
Position statement
Engineering
assumptions
enable
Intelligible
complexity
enables
Smart behavior
Smart design

19. 19
Position statement
Engineering
assumptions
enable
Intelligible
complexity
enables
Smart behavior
Smart design

20. 20
Position statement
Engineering
assumptions
enable
Intelligible
complexity
enables
Smart behavior
Smart design

21. 21
Another role: “enabler of complexity”
Often, assumptions are made for simplification
E.g., braking deceleration bounds simplify the analysis by limiting the state space
But assumptions can also lead to intelligible complexity
I.e., complexity understandable enough to serve as a foundation of complex design
As opposed to unintelligible complexity: “anything can happen”
Examples:
“All samples is i.i.d” → sequential probability ratio test
“Preemption is deadline-monotonic” → CPU frequency-scaling analysis
“Gaussian error in sensors” → probabilistic analysis of false positives in monitors
“Power consumption is a polynomial over the durations of robotic tasks”→ power-based planning

22. 22
Another role: “enabler of complexity”
●
Sometimes, assumptions are made for simplification
– E.g., bounds on braking deceleration simplify the state space
But assumptions can also lead to intelligible complexity
I.e., complexity understandable enough to serve as a foundation of complex design
As opposed to unintelligible complexity: “anything can happen”
Examples:
“All samples is i.i.d” → sequential probability ratio test
“Preemption is deadline-monotonic” → CPU frequency-scaling analysis
“Gaussian error in sensors” → probabilistic analysis of false positives in monitors
“Power consumption is a polynomial over the durations of robotic tasks”→ power-based planning

23. 23
Another role: “enabler of complexity”
●
Sometimes, assumptions are made for simplification
– E.g., bounds on braking deceleration simplify the state space
●
But assumptions can also lead to intelligible complexity
– I.e., complexity understandable enough to serve as a foundation of complex design
– As opposed to unintelligible complexity: “anything can happen”
Examples:
“All samples is i.i.d” → sequential probability ratio test
“Preemption is deadline-monotonic” → CPU frequency-scaling analysis
“Gaussian error in sensors” → probabilistic analysis of false positives in monitors
“Power consumption is a polynomial over the durations of robotic tasks”→ power-based planning

24. 24
Another role: “enabler of complexity”
●
Sometimes, assumptions are made for simplification
– E.g., bounds on braking deceleration simplify the state space
●
But assumptions can also lead to intelligible complexity
– I.e., complexity understandable enough to serve as a foundation of complex design
– As opposed to unintelligible complexity: “anything can happen”
– Examples:
●
“All samples are i.i.d” → sequential probability ratio test
●
“Preemption is deadline-monotonic” → CPU frequency-scaling analysis
●
“Gaussian error in sensors” → analysis of false positives in perception
●
“Power consumption is a polynomial over the durations of robotic tasks”→ power-based planning

25. 25
Complexities enabled by assumptions

26. 26
Complexities enabled by assumptions
●
Usage of multiple models
– A formalism may require certain assumptions
A variety of analyses
Fault-related and model-based
Certain system behaviors
Responses to violations of assumptions

27. 27
Complexities enabled by assumptions
●
Usage of multiple models
– A formalism may require certain assumptions
●
A variety of analyses
– Fault-related and model-based
Certain system behaviors
Responses to violations of assumptions

28. 28
Complexities enabled by assumptions
●
Usage of multiple models
– A formalism may require certain assumptions
●
A variety of analyses
– Fault-related and model-based
●
Certain system behaviors
– Responses to violations of assumptions

29. 29
Position statement
Engineering
assumptions
enable
Intelligible
complexity
enables
Smart behavior
Smart design

30. 30
Position statement
Engineering
assumptions
enable
Intelligible
complexity
enables
Smart behavior
Smart design

31. 31
Position statement
Engineering
assumptions
enable
Intelligible
complexity
enables
Smart behavior
Smart design

32. 32
Smartness enabled by complexity
●
Smart: “capable of making adjustments that resemble those resulting
from human decisions” (The Free Dictionary)
– Smartness arises when intelligence meets context
Complexity allows for adjustment
Smart systems can adjust their assumptions
Smart design can adjust its assumptions
E.g., the same robot used for delivery tasks and disaster relief
Different response to human behavior, mechanical/software breakdowns, ...

33. 33
Smartness enabled by complexity
●
Smart: “capable of making adjustments that resemble those resulting
from human decisions” (The Free Dictionary)
– Smartness arises when intelligence meets context
●
Complexity allows for smart adjustment
– Smart systems can adjust their assumptions
– Smart design can adjust its assumptions
●
E.g., the same robot used for delivery tasks and disaster relief
– Different response to human behavior, mechanical/software breakdowns, ...

34. 34
Smart design via assumptions
●
Not only document/model/validate, but also
automatically evaluate and choose assumptions
Example: a design environment that helps find an
appropriate assumption for sensor errors
“All independent” → safe system but mismatch w/ data
“Sequentially dependent” → better data fit but lower safety
“All dependent” → best fit but intractable analysis

35. 35
Smart design via assumptions
●
Not only document/model/validate, but also
automatically evaluate and choose assumptions
●
Example: a design environment that helps find an
appropriate assumption for sensor errors
“All independent” → safe system but mismatch w/ data
“Sequentially dependent” → better data fit but lower safety
“All dependent” → best fit but intractable analysis

36. 36
Smart design via assumptions
●
Not only document/model/validate, but also
automatically evaluate and choose assumptions
●
Example: a design environment that helps find an
appropriate assumption for sensor errors
– “All independent” → safe system but mismatch w/ data
– “Sequentially dependent” → better data fit but lower safety
– “All dependent” → best fit but intractable analysis

37. 37
Smart behavior via assumptions
●
Not only monitor/plan for violations, but also dynamically
adapt assumptions
E.g., an autonomous car notices that pedestrians in this
area are not consistent with the usual model
A database of plausible assumptions: “a sports game ended”
Quantification of assumption fit to perceived situation
Effect analysis for changing assumptions: “new assumption
increases commute time; old assumption increases crash chance”

38. 38
Smart behavior via assumptions
●
Not only monitor/plan for violations, but also dynamically
adapt assumptions
●
E.g., an autonomous car notices that pedestrians in some
area act inconsistently with the usual model
A database of plausible assumptions: “a sports game ended”
Quantification of assumption fit to perceived situation
Effect analysis for changing assumptions: “new assumption
increases commute time; old assumption increases crash chance”

39. 39
Smart behavior via assumptions
●
Not only monitor/plan for violations, but also dynamically
adapt assumptions
●
E.g., an autonomous car notices that pedestrians in some
area act inconsistently with the usual model
– A database of plausible assumptions: “a sports game ended”
– Quantification of assumption fit to the perceived situation
– Effect analysis for changing assumptions: “new assumption
increases commute time; old assumption increases crash chance”

40. 40
Remaining challenges
●
Difficult-to-specify/validate/monitor assumptions
●
Vast pools of potential assumptions
●
Limited data and computing capacity at run time

41. 41
Summary
●
Assumptions are usually interpreted as
potential causes of system failure
– Need to be managed, validated, and monitored
●
A complementary viewpoint:
Engineering
assumptions
enable
Intelligible
complexity
enables
Smart behavior
Smart design

42. 42
References
[1] Marincic, Mader, Wieringa. Classifying Assumptions Made During Requirements Verification
of Embedded Systems, REFSQ 2008.
[2] Bulandran. An Exploration of Assumptions in Requirements Engineering. PhD thesis,
University of Western Australia, 2012.
[3] Dewar. Assumption-Based Planning: A Tool for Reducing Avoidable Surprises, RAND,
Cambridge University Press, 2002.
[4] Saqui-Sannes, Ludovic. Making Modeling Assumptions an Explicit Part of Real-Time
Systems Models, ERTS 2016.
[5] Fu. A Framework for Managing Unspecified Assumptions in Safety-Critical Cyber-Physical
Systems, PhD thesis, University of Chicago, 2020.
[6] Cimatti, Tian, Tonetta. Assumption-Based Runtime Verification with Partial Observability and
Resets, RV 2019.