COMMUNICATIONS

ACM
CACM.ACM.ORG OF THE 08/2016 VOL.59 NO.08

Computational
Biology in the
21st Century
Scaling with
Compressive
Algorithms

The Hidden Dividends

of Microservices
Smart Cities
Smartphone Apps for Social Good
Teamwork in Computing Research Association for
Computing Machinery
this.splash 2016
Amsterdam Sun 30 October – Fri 4 November 2016
ACM SIGPLAN Conference on Systems, Programming, Languages and Applications:
Software for Humanity (SPLASH)

OOPSLA Novel research on software development and programming

Onward! Radical new ideas and visions related to programming and software

SPLASH-I World class speakers on current topics in software, systems, and languages research

SPLASH-E Researchers and educators share educational results, ideas, and challenges

DLS Dynamic languages, implementations, and applications

GPCE Generative programming: concepts and experiences

SLE Principles of software language engineering, language design, and evolution

Biermann

SPLASH General Chair: Eelco Visser SLE General Chair: Tijs van der Storm
OOPSLA Papers: Yannis Smaragdakis SLE Papers: Emilie Balland, Daniel Varro
OOPSLA Artifacts: Michael Bond, Michael Hind GPCE General Chair: Bernd Fischer
Onward! Papers: Emerson Murphy-Hill GPCE Papers: Ina Schaefer
Onward! Essays: Crista Lopes Mövenpick
Student Research Competition: Sam Guyer, Patrick Lam
SPLASH-I: Eelco Visser, Tijs van der Storm Posters: Jeff Huang, Sebastian Erdweg
SPLASH-E: Matthias Hauswirth, Steve Blackburn Publications: Alex Potanin Amsterdam
DLS: Roberto Ierusalimschy Publicity and Web: Tijs van der Storm, Ron Garcia
Workshops: Jan Rellermeyer, Craig Anslow Student Volunteers: Daco Harkes

@splashcon 2016.splashcon.org bit.ly/splashcon16

Text Data Management and Analysis covers the major concepts, techniques, and ideas in
Text Data Management and Analysis covers the major concepts, techniques, and ideas in
information retrieval
information retrieval texttext
andand data
datamining.
mining. ItItfocuses
focuses ononthe
thepractical
practical viewpoint
viewpoint and and includes
includes
many many
hands-on exercises
hands-on designed
exercises designed with
witha acompanion softwaretoolkit
companion software toolkit (i.e.,
(i.e., MeTA)
MeTA) to help
to help readers
readers
learn how
learnto apply
how techniques
to apply of information
techniques of informationretrieval andtext
retrieval and textmining
mining to to real-world
real-world text text
data.data.
It It
also shows readers
also shows howhow
readers to experiment
to experiment with
withandandimprove
improve somesomeofofthe
the algorithms
algorithms for interesting
for interesting
application tasks. The book can be used as a text for computer science
application tasks. The book can be used as a text for computer science undergraduates undergraduates and graduates,
and graduates,
library and information scientists, or as a reference for practitioners working on
library and information scientists, or as a reference for practitioners working on relevant problems relevant problems in in
managing and analyzing text data.
managing and analyzing text data.
COMMUNICATIONS OF THE ACM

Departments News Viewpoints

5 Editor’s Letter
From the New ACM President
By Vicki L. Hanson

7 Cerf’s Up
Star Struck in Lindau
By Vinton G. Cerf

8 Letters to the Editor

Future Cyberdefenses Will
Defeat Cyberattacks on PCs

10 BLOG@CACM
Inside the Great Wall
During a trip to China, Jason Hong 15 28
watches for signs of new technologies.
12 Reinforcement Renaissance 22 Privacy and Security
25 Calendar The power of deep neural networks Computer Security Is Broken:
has sparked renewed interest Can Better Hardware Help Fix It?
101 Careers in reinforcement learning, with Computer security problems have
applications to games, robotics, far exceeded the limits of the human
and beyond. brain. What can we do about it?
Last Byte By Marina Krakovsky By Paul Kocher

104 Future Tense 15 Open Source Software 26 Education

Gut Feelings No Longer Optional From Computational Thinking
Even a little genetic engineering Open development and sharing to Computational Participation
can render us too comfortable of software gained widespread in K–12 Education
for our own good. acceptance 15 years ago, and Seeking to reframe computational
By Ken MacLeod the practice is accelerating. thinking as computational
By Gary Anthes participation.
By Yasmin B. Kafai
18 Smartphone Apps for Social Good
Mobile apps make it easier, faster, 28 Kode Vicious
and cheaper to create massive Chilling the Messenger
impact on social causes ranging from Keeping ego out
world hunger to domestic violence. of software-design review.
By Logan Kugler By George V. Neville-Neil

30 Viewpoint
Teamwork in Computing Research
Considering the benefits and
downsides of collaborative research.
By Ben Shneiderman
PH OTO BY M ARYNA PL ESH KUN

Association for Computing Machinery

Advancing Computing as a Science & Profession

2 COMMUNICATIO NS O F THE ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 08/2016 VOL. 59 NO. 08

Practice Contributed Articles Review Articles

72 Computational Biology in
the 21st Century: Scaling with
Compressive Algorithms
Algorithmic advances take advantage
of the structure of massive biological
data landscape.
By Bonnie Berger, Noah M. Daniels,
and Y. William Yu

Watch the authors discuss

their work in this exclusive
Communications video.
http://cacm.acm.org/videos/
computational-biology-in-
the-21st-century
32 64

Research Highlights
32 Debugging Distributed Systems 46 Smart Cities: Concepts, Architectures,
ShiViz is a new distributed system Research Opportunities 82 Technical Perspective
debugging visualization tool. The aim is to improve cities’ Toward Reliable Programming
By Ivan Beschastnikh, Patty Wang, management of natural and for Unreliable Hardware
Yuriy Brun, and Michael D. Ernst municipal resources and in turn By Todd Millstein
the quality of life of their citizens.
38 The Singular Success of SQL By Rida Khatoun and Sherali Zeadally 83 Verifying Quantitative Reliability
SQL has a brilliant future for Programs that Execute on
as a major figure in the pantheon 58 Adaptive Computation: Unreliable Hardware
of data representations. The Multidisciplinary Legacy By Michael Carbin, Sasa Misailovic,
By Pat Helland of John H. Holland and Martin C. Rinard
John H. Holland’s general theories
42 The Hidden Dividends of adaptive processes apply 92 Technical Perspective
of Microservices across biological, cognitive, social, Why Didn’t I Think of That?
Microservices aren’t for every and computational systems. By Philip Wadler
company, and the journey isn’t easy. By Stephanie Forrest
By Tom Killalea and Melanie Mitchell 93 Ur/Web: A Simple Model
for Programming the Web
Articles’ development led by 64 Skills for Success at Different Stages By Adam Chlipala
queue.acm.org
of an IT Professional’s Career
The skills and knowledge that
earn promotions are not always Watch the author discuss
enough to ensure success in his work in this exclusive
Communications video.
the new position. http://cacm.acm.org/
By Leon Kappelman, Mary C. Jones, videos/ur-web
About the Cover: Vess Johnson, Ephraim R. Mclean,
Researchers today
are able to amass and Kittipong Boonme
unprecedented amounts
of biological data,
IMAGES F ROM SH UTT ERSTOCK. CO M

a state that offers

as many challenges
as opportunities.
This month’s cover story
explores ways to harness
this explosion of data
in order to analyze it in
meaningful, valuable ways.
Cover illustration by Peter
Crowther Associates.

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF THE ACM 3

 COMMUNICATIONS OF THE ACM
Trusted insights for computing’s leading professionals.

Communications of the ACM is the leading monthly print and online magazine for the computing and information technology fields.
Communications is recognized as the most trusted and knowledgeable source of industry information for today’s computing professional.
Communications brings its readership in-depth coverage of emerging areas of computer science, new trends in information technology,
and practical applications. Industry leaders use Communications as a platform to present and debate various technology implications,
public policies, engineering challenges, and market trends. The prestige and unmatched reputation that Communications of the ACM
enjoys today is built upon a 50-year commitment to high-quality editorial content and a steadfast dedication to advancing the arts,
sciences, and applications of information technology.

ACM, the world’s largest educational STA F F EDITORIAL BOARD ACM Copyright Notice
and scientific computing society, delivers DIRECTOR OF GROUP PU BLIS HING E DITOR- IN- C HIE F Copyright © 2016 by Association for
resources that advance computing as a Scott E. Delman Moshe Y. Vardi Computing Machinery, Inc. (ACM).
science and profession. ACM provides the [email protected] [email protected] Permission to make digital or hard copies
computing field’s premier Digital Library of part or all of this work for personal
and serves its members and the computing Executive Editor NE W S or classroom use is granted without
profession with leading-edge publications, Diane Crawford Co-Chairs fee provided that copies are not made
conferences, and career resources. Managing Editor William Pulleyblank and Marc Snir or distributed for profit or commercial
Thomas E. Lambert Board Members advantage and that copies bear this
Executive Director and CEO Senior Editor Mei Kobayashi; Michael Mitzenmacher; notice and full citation on the first
Bobby Schnabel Andrew Rosenbloom Rajeev Rastogi page. Copyright for components of this
Deputy Executive Director and COO Senior Editor/News work owned by others than ACM must
VIE W P OINTS
Patricia Ryan Larry Fisher be honored. Abstracting with credit is
Director, Office of Information Systems Co-Chairs permitted. To copy otherwise, to republish,
Web Editor Tim Finin; Susanne E. Hambrusch;
Wayne Graves David Roman to post on servers, or to redistribute to
Director, Office of Financial Services John Leslie King lists, requires prior specific permission
Rights and Permissions Board Members
Darren Ramdin Deborah Cotton and/or fee. Request permission to publish
Director, Office of SIG Services William Aspray; Stefan Bechtold; from [email protected] or fax
Donna Cappo Michael L. Best; Judith Bishop; (212) 869-0481.
Art Director Stuart I. Feldman; Peter Freeman;
Director, Office of Publications
Andrij Borys Mark Guzdial; Rachelle Hollander;
Bernard Rous For other copying of articles that carry a
Associate Art Director Richard Ladner; Carl Landwehr;
Director, Office of Group Publishing code at the bottom of the first or last page
Margaret Gray Carlos Jose Pereira de Lucena;
Scott E. Delman or screen display, copying is permitted
Assistant Art Director Beng Chin Ooi; Loren Terveen; provided that the per-copy fee indicated
Mia Angelica Balaquiot Marshall Van Alstyne; Jeannette Wing
ACM CO U N C I L in the code is paid through the Copyright
Designer
President Clearance Center; www.copyright.com.
Iwona Usakiewicz
Alexander L. Wolf Production Manager P R AC TIC E
Vice-President Subscriptions
Lynn D’Addesio Co-Chair
Vicki L. Hanson An annual subscription cost is included
Director of Media Sales Stephen Bourne
Secretary/Treasurer in ACM member dues of $99 ($40 of
Jennifer Ruzicka Board Members
Erik Altman which is allocated to a subscription to
Publications Assistant Eric Allman; Peter Bailis; Terry Coatta;
Past President Communications); for students, cost
Juliet Chance Stuart Feldman; Benjamin Fried;
Vinton G. Cerf is included in $42 dues ($20 of which
Pat Hanrahan; Tom Killalea; Tom Limoncelli; is allocated to a Communications
Chair, SGB Board Columnists Kate Matsudaira; Marshall Kirk McKusick;
Patrick Madden subscription). A nonmember annual
David Anderson; Phillip G. Armour; George Neville-Neil; Theo Schlossnagle; subscription is $269.
Co-Chairs, Publications Board Michael Cusumano; Peter J. Denning; Jim Waldo
Jack Davidson and Joseph Konstan Mark Guzdial; Thomas Haigh;
Members-at-Large The Practice section of the CACM ACM Media Advertising Policy
Leah Hoffmann; Mari Sako; Communications of the ACM and other
Eric Allman; Ricardo Baeza-Yates; Editorial Board also serves as
Pamela Samuelson; Marshall Van Alstyne ACM Media publications accept advertising
Cherri Pancake; Radia Perlman; the Editorial Board of .
Mary Lou Soffa; Eugene Spafford; in both print and electronic formats. All
CO N TAC T P O IN TS C ONTR IB U TE D A RTIC LES advertising in ACM Media publications is
Per Stenström Copyright permission
SGB Council Representatives Co-Chairs at the discretion of ACM and is intended
[email protected] Andrew Chien and James Larus to provide financial support for the various
Paul Beame; Jenna Neefe Matthews; Calendar items
Barbara Boucher Owens Board Members activities and services for ACM members.
[email protected] William Aiello; Robert Austin; Elisa Bertino; Current advertising rates can be found
Change of address Gilles Brassard; Kim Bruce; Alan Bundy; by visiting http://www.acm-media.org or
BOARD C HA I R S [email protected] Peter Buneman; Peter Druschel; Carlo Ghezzi; by contacting ACM Media Sales at
Education Board Letters to the Editor Carl Gutwin; Yannis Ioannidis; (212) 626-0686.
Mehran Sahami and Jane Chu Prey [email protected] Gal A. Kaminka; James Larus; Igor Markov;
Practitioners Board Gail C. Murphy; Bernhard Nebel; Single Copies
George Neville-Neil W E B S IT E
http://cacm.acm.org Lionel M. Ni; Kenton O’Hara; Sriram Rajamani; Single copies of Communications of the
Marie-Christine Rousset; Avi Rubin; ACM are available for purchase. Please
REGIONA L C O U N C I L C HA I R S AU T H O R G U ID E L IN ES Krishan Sabnani; Ron Shamir; Yoav contact [email protected].
ACM Europe Council http://cacm.acm.org/ Shoham; Larry Snyder; Michael Vitale;
Dame Professor Wendy Hall Wolfgang Wahlster; Hannes Werthner; COMMUN ICATION S OF THE ACM
ACM India Council ACM ADVERTISIN G DEPARTM E NT Reinhard Wilhelm (ISSN 0001-0782) is published monthly
Srinivas Padmanabhuni 2 Penn Plaza, Suite 701, New York, NY by ACM Media, 2 Penn Plaza, Suite 701,
ACM China Council 10121-0701 RES E A R C H HIGHLIGHTS New York, NY 10121-0701. Periodicals
Jiaguang Sun T (212) 626-0686 Co-Chairs postage paid at New York, NY 10001,
F (212) 869-0481 Azer Bestovros and Gregory Morrisett and other mailing offices.
PUB LICATI O N S BOA R D
Co-Chairs Board Members
Director of Media Sales Martin Abadi; Amr El Abbadi; Sanjeev Arora; POSTMASTER
Jack Davidson; Joseph Konstan Jennifer Ruzicka Please send address changes to
Board Members Nina Balcan; Dan Boneh; Andrei Broder;
[email protected] Doug Burger; Stuart K. Card; Jeff Chase; Communications of the ACM
Ronald F. Boisvert; Anne Condon; 2 Penn Plaza, Suite 701
Nikil Dutt; Roch Guerrin; Carol Hutchins; For display, corporate/brand advertising: Jon Crowcroft; Sandhya Dwaekadas;
Matt Dwyer; Alon Halevy; Norm Jouppi; New York, NY 10121-0701 USA
Yannis Ioannidis; Catherine McGeoch; Craig Pitcher
M. Tamer Ozsu; Mary Lou Soffa; Alex Wade; [email protected] T (408) 778-0300 Andrew B. Kahng; Sven Koenig; Xavier Leroy;
Keith Webster William Sleight Steve Marschner; Kobbi Nissim;
[email protected] T (408) 513-3408 Steve Seitz; Guy Steele, Jr.; David Wagner; Printed in the U.S.A.
ACM U.S. Public Policy Office Margaret H. Wright; Andreas Zeller
Renee Dopplick, Director Media Kit [email protected]
1828 L Street, N.W., Suite 800 WEB
Washington, DC 20036 USA Association for Computing Machinery Chair
T (202) 659-9711; F (202) 667-1066 (ACM) James Landay
2 Penn Plaza, Suite 701 Board Members A
SE
REC
Y

Computer Science Teachers Association New York, NY 10121-0701 USA Marti Hearst; Jason I. Hong;
E

CL
PL

Mark R. Nelson, Executive Director T (212) 869-7440; F (212) 869-0481 Jeff Johnson; Wendy E. MacKay
NE
TH

S
I

Z
I

M AGA

4 COMMUNICATIO NS O F THE ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 letter from the president

DOI:10.1145/2967359 Vicki L. Hanson

From the New ACM President

I thank all of you who recently sent along
good wishes upon my election to ACM
president. Many also asked “What do you
want to accomplish during your presidency?”
To begin to answer this, I refer back to In terms of publications, I look for- cent election of the first all-female team of
the recent message from outgoing Presi- ward to our Digital Library continuing to ACM Executive Officers is an opportunity
dent Alex Wolf as he looked back on his evolve. Under the direction of ACM’s Pub- to highlight the contributions that wom-
two years in office (Communications, June lications Board, this community resource en have made to computing and to inspire
2016, p. 5). He noted that the founda- will be moving from a static repository young women to view computing as a ca-
tions of ACM are in excellent shape; we of documents and videos to one that in- reer. While we can be proud of this mile-
have committed volunteers, dedicated cludes computing artifacts such as data stone, we must be mindful that diversity
headquarters staff, and a reliable revenue and software as well as new services. The involves many issues and professionals at
stream. I thank him for his efforts in guid- Digital Library underpins ACM’s finan- all career stages. We will expand the scope
ing ACM to this position of strength. My cial stability but the drive toward open for our diversity efforts, including accessi-
goals are to build on this foundation, be- access will continue to challenge assump- bility and diversity concerns globally.
ing responsive to changing demograph- tions about the exchange of information ACM must also continue to serve the
ics, finding new ways to add value to both and data in the scientific community. worldwide computing community in all
our student and professional members, Questions of how ACM as an academic our activities. Our publishing, profession-
and balancing the desire for open access publisher will derive needed funding in al development, conferences, and other
to our Digital Library with the need to this changing content and services envi- efforts must not just be available to global
maintain our economic health. ronment will continue to dominate dis- professionals, but also must take into ac-
While there are over two million cussions with multiple stakeholders. count varying regional priorities. I am
global students and professionals who In my candidate statement, I men- deeply committed to the fostering of this
benefit from our publishing, profession- tioned that ACM’s efforts related to in- global perspective.
al development, education curricula, creased diversity and inclusion need to This year marked the 50th anniversa-
worldwide conferences, and networking be fully woven into our core fabric. The re- ry of the ACM A.M. Turing award. We can
opportunities, most of these individuals be deservedly proud of the honorees who
do not join ACM. All of our work, howev- have made such profound impacts on
er, is only possible through the volunteer In rapidly technology and society. Throughout the
efforts and the organizational stability of coming year we will be celebrating the
membership. We need to reconsider the changing academic, achievements of these pioneers. More
benefits of membership in a professional entre­preneurial, information on these celebrations will
society. For this, we will be seeking input be forthcoming.
in the coming months to clarify what our practitioner, and In sum, during my presidency I will
community most values. global computing work to develop new initiatives to ensure
One demographic that has been slow that ACM provides ever-greater value to
to join ACM is early career professionals. environments, the global computing community. Over
I will be spearheading efforts to increase networking through the next two years, I look forward to meet-
the involvement of this cohort. In rap- ing many of you and exploring how, to-
idly changing academic, entrepreneurial, ACM can provide gether, we can achieve this.
practitioner, and global computing envi- real value. Vicki L. Hanson ([email protected]) is ACM President,
ronments, networking through ACM can
Distinguished Professor at Rochester Institute of
provide real value. In the coming months, Technology, and a professor at the University of Dundee.
new initiatives for these young profession- Twitter: @ACM_President

als will be formulated and announced. Copyright held by author.

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF THE ACM 5

 SHAPE THE FUTURE OF COMPUTING.
JOIN ACM TODAY.
ACM is the world’s largest computing society, offering benefits and resources that can advance your career and
enrich your knowledge. We dare to be the best we can be, believing what we do is a force for good, and in joining
together to shape the future of computing.

SELECT ONE MEMBERSHIP OPTION

ACM PROFESSIONAL MEMBERSHIP: ACM STUDENT MEMBERSHIP:
q Professional Membership: $99 USD q Student Membership: $19 USD
q Professional Membership plus q Student Membership plus ACM Digital Library: $42 USD
ACM Digital Library: $198 USD ($99 dues + $99 DL) q Student Membership plus Print CACM Magazine: $42 USD
q ACM Digital Library: $99 USD q Student Membership with ACM Digital Library plus
(must be an ACM member) Print CACM Magazine: $62 USD

q Join ACM-W: ACM-W supports, celebrates, and advocates internationally for the full engagement of women in
all aspects of the computing field. Available at no additional cost.
Priority Code: CAPP
Payment Information
Payment must accompany application. If paying by check
or money order, make payable to ACM, Inc., in U.S. dollars
Name or equivalent in foreign currency.

ACM Member # q AMEX q VISA/MasterCard q Check/money order

Mailing Address
Total Amount Due

Credit Card #
City/State/Province
Exp. Date
ZIP/Postal Code/Country
Signature
Email

Return completed application to:

Purposes of ACM ACM General Post Office
ACM is dedicated to: P.O. Box 30777
1) Advancing the art, science, engineering, and New York, NY 10087-0777
application of information technology
Prices include surface delivery charge. Expedited Air
2) Fostering the open interchange of information Service, which is a partial air freight delivery service, is
to serve both professionals and the public available outside North America. Contact ACM for more
3) Promoting the highest professional and information.
ethics standards Satisfaction Guaranteed!

BE CREATIVE. STAY CONNECTED. KEEP INVENTING.

1-800-342-6626 (US & Canada) Hours: 8:30AM - 4:30PM (US EST) [email protected]
1-212-626-0500 (Global) Fax: 212-944-1318 acm.org/join/CAPP
 cerf’s up

DOI:10.1145/2964341 Vinton G. Cerf

Star Struck in Lindau posed to deliver the molecules. The

cells encompass a molecular package
switching system (ok, bad pun)! I have
Among the innovations pioneered by John not yet learned enough about the way
White during his years as CEO of ACM was in which the addressing is done, but it
is apparently multi-layered and even
a new relationship with the Klaus Tschira has the property that a molecule can be
Foundation that sponsors the Heidelberg targeted to get stuck in an intracellular
membrane in addition to being deliv-
ered to a target organelle.
Laureate Foruma [HLF] in the third ments to determine whether the theo- The cell uses DNA and RNA to guide
quarter of each year. The attendees retical predictions match the experi- the production of proteins by assem-
include about 200 math or computer mental evidence. The 2013 Nobel Prize bling amino acids and by delivering
science students and recipients of the in Chemistry, however, underscored them on the intracellular highway to
mathematics Fields Medal, the Nevan- the potential for using computers to their destinations. The DNA is used to
linna Prize, the Abel Prize, and ACM’s predict biochemical interactions on produce so-called “messenger RNA”
A.M. Turing award for computer sci- the basis of computer-based model- that is used in the process of generat-
ence. I have had the pleasure of attend- ing. Three chemists won the Nobel ing proteins using the cell’s ribosomes
ing the first three meetings of the HLF. Prize in Chemistry in 2013c “for mul- to interpret the RNA and to assemble
Since 1951, however, there has been tiscale models for complex chemical the prescribed molecular structure. Of
an annual meeting of Nobel laureatesb systems.” As I meet other basic and course Theorem 206d applies here and
with support from several organiza- experimental scientists at this week- I have left out the roles of transfer-RNA
tions including the aforementioned long event, I am struck by how often and ribosomal-RNA in this process.
Klaus Tschira Foundation. The HLF computers play a key role in discovery As we learn more about the internal
is patterned after the Nobel meeting: science. That our discipline touches al- functionality of cells, and succeed in
students meet with a collection of par- most everything in the scientific world modeling their operation, we will shed
ticipating laureates. It was decided last is not an overstatement. additional light on the plausible paths
year to link these two events by having I met Martin Karplus at this event. by which this functionality has evolved.
a Nobel laureate address the partici- He was among the 2013 Nobel laure- Research is under way to discover by ex-
pants of the HLF and to have an HLF ates and opened my eyes to the incred- periment the simplest form of replicat-
laureate address the participants of the ible complexity of processes found ing cells and to use computer models to
Nobel annual meeting. As I write this inside cells. This is not a simple sea of help postulate plausible origins of life.
column, I am in the midst of the Nobel liquid in which organelles and chemi- It would be difficult to overstate the
meeting in Lindau and, frankly, star cals are swimming. The cell actually excitement I feel for the role our disci-
struck at meeting people whose names has a very complex structure, includ- pline is playing in surveying the scien-
have been in the news for their extraor- ing so-called microtubules that help to tific discovery landscape and modeling
dinary work. I have the honor to be the guide the transport of molecules where the processes we find to understand
first of the HLF participants to address they are needed in the cell. They are like the “how” and maybe the “why” of
the Nobel meeting and if you think this highways inside the cell. There are mo- their operation. This underscores for
is not a daunting prospect, think again! lecular robots (I am not kidding!) that me and I hope for you, the importance
My theme, however, is not just literally travel along these highways, of advancing the state of the art of com-
the amazing collection of brilliance carrying specific molecules to targets puting and its capacity to analyze and
at both meetings but the clear and in the cell. This looks sort of like Multi- model the complex phenomena that
increasing role that computing and protocol Label Switching guiding pack- we are finding all around us at the mi-
computer science are playing in basic ets along optical channels! Moreover, cro and the macro levels.
research. To be sure, computers have like the Internet, there are “addresses”
long been utilized to make predictions to indicate where the robots are sup- d Theorem 206: “Everything is more complicated.”
based on theory and to assess measure-
Vinton G. Cerf is vice president and Chief Internet Evangelist
c http://www.nobelprize.org/nobel_prizes/ at Google. He served as ACM president from 2012–2014.
a http://www.heidelberg-laureate- forum.org/ chemistry/laureates/2013/; Martin Karplus,
b http://www.lindau-nobel.org/ Arieh Warshel, and Michael Levitt. Copyright held by author.

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF THE ACM 7

letters to the editor

DOI:10.1145/2963167

Future Cyberdefenses Will

Defeat Cyberattacks on PCs

H
IGHLY CLASSIFIED INFOR- trols how memory can be used. Tagged However, they are typically difficult to
on personal com-
M AT I O N memory can make it much more diffi- design, expensive to manufacture, reduce
puters in the U.S. today is cult for a cyberattacker to find and ex- performance, and are unavailable in most
largely protected from the ploit software vulnerabilities because commercial and consumer contexts.
attacks Daniel Genkin et compromising a Linux kernel object or Moreover, their security depends on
al. described in their article “Physical a Java application object does not auto- understanding the feasible attacks. Faraday
Key Extraction Attacks on PCs” (June matically give power over any other ob- cages, optical couplers, and power filters
2016). Here, I outline cost-effective ject. Security-access operations by such would not stop acoustic leakage through
defenses that will in the future com- objects can be strengthened through vents or self-amplification attacks that
pletely defeat such attacks, while “inconsistency robustness” providing induce leakage at frequencies below the
making even stronger cyberattacks technology for valid formal inference filter’s design specification. The problem of
extremely difficult. on inconsistent information.1 Such in- creating inexpensive hardware or software
For example, tiny Faraday cages can consistency robust inference is impor- that adequately mitigates all feasible side-
be constructed in a processor pack- tant because security-access decisions channel attacks thus remains open.
age so encryption/decryption can be are often made on the basis of conflict- Daniel Genkin, Lev Pachmanov,
performed without the possibility of ing and inconsistent information. Itamar Pipman, Adi Shamir,
inadvertent emanations that could be Such individual processor-package and Eran Tromer, Tel Aviv, Israel
measured or exploited, because all ex- cyberdefense methods and technolo-
ternal communication to a cage would gies will make it possible, within, say,
be through optical fiber and the cage’s the next five years, to construct a highly Fewer Is Better Than More
power supply is filtered.1 This way, en- secure board with more than 1,000 gen- Samples When Tuning Software
cryption keys and encryption/decryp- eral-purpose coherent cores, greatly di- The emphasis on visualizing large
tion processes would be completely minishing dependence on datacenters numbers of stack samples, as in, say,
protected against the attacks described and thereby decreasing centralized flame graphs in Brendan Gregg’s article
in the article. In such a Faraday cage, points of vulnerability.1 “The Flame Graph” (June 2016) actu-
advanced cryptography (such as Learn- These technologies promise to pro- ally works against finding some perfor-
ing With Errors) could not be feasibly vide a comprehensive advantage over mance bottlenecks, resulting in sub-
attacked through any known method, cyberattacks. The U.S., among all coun- optimal performance of the software
including quantum computing. tries, has the most to lose through its being tuned. Any such visualization
Hardware can likewise help protect current cyberdefense vulnerabilities. must necessarily discard information,
software, including operating systems In light of its charter to defend the resulting in “false negatives,” or failure
and applications, through RAM-proc- nation and its own multitudinous cy- to identify some bottlenecks. For exam-
essor package encryption. All traffic berdefense vulnerabilities, the Depart- ple, time can be wasted by lines of code
between a processor package and RAM ment of Defense is the logical agency to that happen to be invoked in numerous
can be encrypted using a Faraday cage initiate an urgent program to develop places in the call tree. The call hierar-
to protect a potentially targeted app and deploy strong cyberdefenses using chy, which is what flame graphs display,
(which is technically a process) from these technologies and methods. In- cannot draw attention to these lines of
operating systems and hypervisors, dustry and other government agencies code.1 Moreover, one cannot assume
other apps, and other equipment, in- should then quickly incorporate them the bottlenecks can be ignored; even a
cluding baseband processors, disk into their own operations. particular bottleneck that starts small
controllers, and USB controllers. Even does not stay small, on a percentage ba-
a cyberattack that compromises an Reference sis, after other bottlenecks have been
1. Hewitt, C. Security Without IoT Mandatory Backdoors:
entire operating system or hypervisor Using Distributed Encrypted Public Recording to removed. Gregg made much of 60,000
would permit only denial of service to Catch & Prosecute Suspects. Social Science Research samples and how difficult they are to
Network, June 16, 2016; http://papers.ssrn.com/sol3/
its applications and not give access to papers.cfm?abstract_id=2795682 visualize. However, he also discussed
any application or related data storage. finding and fixing a bottleneck that re-
Similarly, every-word-tagged exten- Carl Hewitt, Palo Alto, CA sulted in saving 40% of execution time.
sions of ARM and X86 processors can That means the fraction of samples dis-
be used to protect each Linux kernel playing the bottleneck was at least 40%.
object and each Java object in an app Authors Respond: The bottleneck would thus have been
from other such objects by using a We agree that high-security designs displayed, with statistical certainty, in a
tag on each word of memory that con- can mitigate physical side channels. purely human examination of 10 or 20

8 COMMUNICATIO NS O F THE ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 letters to the editor

random stack samples—with no need tion. Spend time in the mind-set of the

Coming Next Month in COMMUNICATIONS

for 60,000. This is generally true of any user. The scenario code used to confirm
bottleneck big enough, on a percent- the API can also be reused as the founda-
age basis, to be worth fixing; moreover, tion of test code and user examples.
every bottleneck grows as others are re- Myers and Stylos recommended
moved. So, if truly serious performance avoiding patterns. Creation patterns
tuning is being done, it is not necessary involve API complications beyond us-
or even helpful to visualize thousands ability. Gamma et al.1 defined creation-
of samples. method names that suggest how the
returned object was constructed; for
Reference
1. Dunlavey, M.R. Unknown events in nodejs/v8
example, factory-, singleton-, and pro-
flamegraph using perf_events; http://stackoverflow. totype-created objects are acquired
com/a/27867426/23771
through create, instance, and
Michael R. Dunlavey, Needham, MA clone, respectively. Not only do these
different object-acquisition-method
names create more API confusion, they
Author Responds: violate encapsulation, since they sug-
More samples provide more benefits. gest the creation mechanism to a user. Why Data Citation
One is that performance wins of all This naming constraint limits the de- Is a Computational
magnitudes can be accurately quantified signer’s ability to switch to a different Problem
and compared, including even the 1%, design-pattern mechanism. Gamma et
2%, and 3% wins, finding more wins al. also failed to define creation-pattern Dynamic Presentation
and wasting less engineering time clean-up mechanisms that are critical
investigating false negatives. Samples are in C++, one of their example languages. Consistency Issues
cheap. Engineering time is not. Another I prefer to unify my creation-pat- in Smartphone
benefit is quantifying the full code flow, tern objects by defining acquire to Mapping Apps
illustrating more tuning possibilities. acquire an object and release to
There are other benefits, too. As for code release an object when it is no longer Learning Executable
invoked in numerous places, my article being used. These unification meth-
discussed two techniques for identifying ods encapsulate the creation pattern Semantic Parsers
them—searching and merging top-down. and provide for clean up, as well. They for Natural Language
Brendan Gregg, Campbell, CA yield a consistent API based on user Understanding
need rather than on an implementa-
tion-creation mechanism. Designing AI Systems
When Designing APIs They also affect usability, how-
Take the User’s View ever, since they are not standard no- that Obey Our Laws
I doubt many software developers were menclature, so I take it one step fur- and Values
surprised by Brad A. Myers’s and Jef- ther for APIs used by others. I use the
frey Stylos’s conclusions in their article Pointer to IMPLementation, or PIM- A New Look at
“Improving API Usability” (June 2016). PL, idiom to create a thin API class the Semantic Web
I anecdotally suspect most poor API that wraps the functionality. The API
designs are based on what the imple- class calls acquire in its construc-
mentation does rather than what the tor and release in its destructor. Helping Conference
user needs. Wrapping the unification methods Attendees Better
API designers know the implemen- within the constructor and destruc- Understand Research
tation too well, suffering from the curse tor results in an API that uses the Presentations
of knowledge. The API makes sense source language’s natural creation
to them because they understand the syntax yet still offers the advantages
context. They do not consider how an of the creation design patterns with- Femto-Photography
API can be confusing to users without in the underlying implementation.
it. Worse yet, implementation details An Interview with
could leak into the API without the de- Reference Stefan Savage
1. Gamma, E., Helm, R., Johnson, R., and Vlissides, J.
signer noticing, since the delineation Design Patterns. Addison-Wesley, Reading, MA, 1995.
of the API and feature implementation
might be blurred. Jim Humelsine, Neptune, NJ
I agree with Myers and Stylos that the Plus the latest news about
unraveling the Kadison-Singer
API should be designed first. Design and Communications welcomes your opinion. To submit a problem, GPUs in machine
code operational scenarios to confirm Letter to the Editor, please limit yourself to 500 words or learning, and chatbots,
less, and send to [email protected]. robots, and being too human.
API usability before diving too deeply
into feature design and implementa- © 2016 ACM 0001-0782/16/08 $15.00

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF THE ACM 9

 The Communications Web site, http://cacm.acm.org,
features more than a dozen bloggers in the BLOG@CACM
community. In each issue of Communications, we’ll publish
selected posts or excerpts.

Follow us on Twitter at http://twitter.com/blogCACM

DOI:10.1145.2950111 http://cacm.acm.org/blogs/blog-cacm

Inside the Great Wall

During a trip to China, Jason Hong
watches for signs of new technologies.

Jason Hong A cool feature of WeChat is the abil- almost turned around, but decided
The Emerging ity to send virtual red envelopes to to see how well he could do just with
Technology Landscape others. Real red envelopes are given his smartphone. It turns out he did
in China by close friends and family members perfectly fine, even being able to buy
http://bit.ly/1Rtm2SR on birthdays and Chinese New Year, food from street vendors without any
May 25, 2016
and contain money. I remember al- problems.
I have been in China about two weeks ways looking forward to getting these I found the popularity of mobile
so far, and have been amazed at how envelopes as a kid. WeChat’s virtual payment in China amazing, especially
much the technology landscape has envelopes can also be used to transfer since I have yet to directly see anyone
changed since I last spent time here in money to others, and this feature is in the U.S. use any smartphone mo-
2008. I wanted to share some of these already very popular for these special bile payment apps (other than Square,
observations because they represent occasions. There is even a Wikipedia which addresses a different payment
some really unique and compelling page about these virtual red envelopes space). I have only heard secondhand
uses of technology. (http://bit.ly/1r4gwAc) reporting over stories from a few of students at my
a billion were sent last year for Chi- university about using Venmo or other
WeChat Mobile Social Networking nese New Year. payment apps.
Perhaps the most obvious change is My best explanation is relative ad-
the ubiquity of WeChat, a combina- Mobile Payment Systems vantage. In the U.S., credit cards are
tion of mobile chat and social net- Another obvious change is the wide- already very popular, and so mobile
working app. Pretty much every Chi- spread adoption of mobile payment payment apps only offer a small ad-
nese person I met used WeChat, and systems. Many people who hosted us vantage in this context. In contrast, in
I saw people using it in restaurants, for dinner used their smartphones to China, credit cards were not very com-
on the subway, waiting for the bus, pay, just by taking a picture of a QR mon, and so mobile payment systems
pretty much everywhere. WeChat was code on the receipt. One person told conveniently filled in the gap, allow-
developed by powerhouse Tencent, us how you can use AliPay (from Ali- ing China to leapfrog ahead.
and its features are basically the same baba, a major e-commerce company),
as any social networking site: you can WeChat, or several other apps to buy Taxi Hailing Systems
add friends, post status updates that things from vending machines, again Didi is a very popular app for hailing
friends can see, and send messages to through QR codes. The fact they were taxis. It is only about four years old,
friends. The app feels much cleaner compatible was really cool, since I and in about half the taxis I was in, the
than Facebook’s mobile app, though, would have expected companies to try drivers had a holder for their smart-
probably because WeChat started mo- to do proprietary systems. phone and were actively using it. One
bile first and as a result had to be very Another person told us how he driver even had his app in some kind
simple. forgot his wallet at home one day. He of active mode, where you could see

10 COMMUNICATIO NS O F TH E AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 blog@cacm

and hear every single nearby request, popular apps were offering deep cuts as much as two months of salary, but
and it was going off about every 20 sec- in prices to gain market share. I still saw Apple’s smartphone almost
onds. (I should also note driving safety Compounding things is the fact everywhere.
is a dodgy concept in China. Half the that a lot of similar companies exist. Chinese people also have a strong
taxis I was in didn’t have safety belts, Many friends I talked with observed affinity for numbers. One interesting
pedestrians walk anytime across that if you come up with a good start- quirk is that most telephone numbers
the street, and motorcycles often go up idea, it does not take very long for in China do not have any dashes or
against traffic.) copycat companies to appear and of- spaces, just a string of 10 or 11 digits.
Didi used to be two competing taxi fer their VC-funded discounts. One One colleague explained Chinese peo-
hailing companies, but they merged a person commented how there used ple have a strong capacity for remem-
short while back. I do not know much to be a dozen companies that would bering numbers. However, I can as-
about Chinese law, but there do not wash your car overnight (for about sure readers this is not genetic, given
seem to be antitrust laws to prevent 20 RMB, or about $3), but now it has my lack of this facility.
large mergers like this. Some people dropped to about two. So competition More interestingly, many “holi-
I talked to also said taxi hailing was is very stiff, and it is going to be excit- days” have been created based on
much better before the merger, since ing to see how things play out in the special numbers. You may know how
the two companies offered heavy dis- next few years. Chinese people avoid the number 4
counts, making it very cheap to get (since it sounds like the word “death”
around, but no longer. Same- or Next-Day Delivery in Chinese) and really like the number
Didi is also really interesting when If you walk on a major street of any 8 (since it sounds like “good fortune”).
compared with Uber’s business mod- Chinese city, you will likely see a dozen Riffing on this idea, May 20 (5/20) has
el. Unlike Uber, which takes a cut out motorized bikes with logos like TMall, been advanced by companies as a new
of the fare, Didi does not seem to; in- JD.com, or even Amazon. Same- or kind of Valentine’s Day, since if you
stead, people told me Didi analyzes next-day delivery is very common and say the individual digits it sounds a lit-
and sells the data from riders. For convenient in China. My wife and I tle bit like “I love you.” Yeah, it is sort
example, they can determine origin used these services to buy diapers and of a stretch, but WeChat has taken full
and destination pairs easily, making clothes, and they deliver right to your advantage of this by making it easy to
it possible to infer demographics and door. You can also pay on delivery, send 520 RMB (about $75) to one’s sig-
interests of riders. They can then sell probably because of the lack of online nificant other; there is no option for
that data and even use it for highly tar- payment infrastructure, though the 5.20 or 52.00 RMB. From what I was
geted advertisements or offers. I was mobile payment systems described told, 5/20 was invented just a few years
told Didi recently closed a major deal earlier can also be used. ago, but it has already caught on.
with some banks to do some offers. The density of cities in China is November 11 is another new “hol-
Apple also announced it will be invest- one clear reason these delivery ser- iday,” representing single people
ing US$1 billion into Didi, perhaps vices work. One VC explained another (11/11, or all 1’s). Students I talked to
to help with Apple Pay in China, to non-obvious reason: in the U.S., retail said it was very similar to Black Friday
improve their maps, and to sell other infrastructure is mostly saturated, in the U.S., the day of frenzied shop-
software and services. meaning e-commerce offers limited ping after Thanksgiving, because what
It is also not clear to me how well relative advantage over what already better way is there to celebrate being
Uber can do in China. Uber was re- exists, and often works by cannibal- single than going shopping? Appar-
ported to have lost about $1 billion in izing brick-and-mortar stores. In con- ently, Alibaba has been breaking sales
China last year because of its heavy trast, retail infrastructure in China records every year on this date.
discounts to win market share. It is not is not as well established, meaning
clear to me if Uber China also works e-commerce has a lot more room for Parting Thoughts
with taxis, but Uber’s standard model potential growth. These factors, along I hope I have conveyed some of the en-
of having everyday people act as drivers with relatively low labor and delivery ergy and excitement I have been see-
might not work as well in China, since costs, make same- or next-day delivery ing the past few weeks in China. Even
the density of taxis in major Chinese in China very effective in practice. though I am supposed to be on vaca-
cities is already pretty high. tion, it is hard to miss all of the inno-
Another interesting story I heard Other Odds and Ends vation and advances everyday people
is many of these companies are suf- A few more observations about the are making use of. I am really looking
fering from fraud. For example, one tech landscape in China that did not forward to seeing what the next de-
friend told me how Uber was essen- fit in the above categories. One friend cade of change will bring.
tially paying riders to use their service, told me how the iPhone was some-
and how one person had 100 smart- times called the “kidney” because Jason Hong is an associate professor in the School of
phones and colluded with drivers to one teen literally sold his kidney so Computer Science at Carnegie Mellon University.

do fake rides to cash in. In fact, a lot he could buy an iPhone; he figured he
of people commented how all of these had two kidneys and really wanted an
discounts were essentially VCs fuel- iPhone. More surprisingly, I was told
ing the economy, since a lot of these that for many people, the iPhone costs © 2016 ACM 0001-0782/16/08 $15.00

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 11
N
news

Science | DOI:10.1145/2949662 Marina Krakovsky

Reinforcement
Renaissance
The power of deep neural networks has sparked renewed
interest in reinforcement learning, with applications to games,
robotics, and beyond.

E
has an-
ACH T I M E D EE PM I N D
nounced an amazing accom-
plishment in game-playing
computers in recent months,
people have taken notice.
First, the Google-owned, London-
based artificial intelligence (AI) re-
search center wowed the world with
a computer program that had taught
itself to play nearly 50 different 1980s-
era Atari games—from Pong and
Breakout to Pac-Man, Space Invaders,
Boxing, and more—using as input
nothing but pixel positions and game
scores, performing at or above the hu-
man level in more than half these var-
ied games. Then, this January, Deep-
Mind researchers impressed experts
with a feat in the realm of strategy
games: AlphaGo, their Go-playing pro-
gram, beat the European champion in
the ancient board game, which poses a
much tougher AI challenge than chess.
Less than two months later, AlphaGo elicits gee-whiz reactions from the “Reinforcement learning is a mod-
scored an even greater victory: it won 4 general public, and DeepMind’s tri- el of learning where you’re not given
games in a best-of-5 series against the umphs have heightened academic a solution—you have to discover it by
best Go player in the world, surprising and commercial interest in the AI trial and error,” explains Sridhar Ma-
IMAGE BY MA XUSER

the champion himself. field behind DeepMind’s methods: hadevan, a professor at the University
The idea that a computer can learn a blend of deep neural networks and of Massachusetts Amherst, a long-
to play such complex games from reinforcement learning called “deep time center of research into reinforce-
scratch and achieve a proficient level reinforcement learning.” ment learning.

12 COM MUNICATIO NS O F TH E ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 news

The clearest contrast is with super- These networks, whose multiple layers
vised learning, the kind used to train learn relevant features at increasingly
image recognition software, in which Despite the buzz higher levels of abstraction, are cur-
the supervision comes in the form around DeepMind, rently the best available way to mea-
of labeled examples (and requires sure similarities between situations,
people to label them). Reinforcement combining Abbeel explains.
learning, on the other hand, “is a way reinforcement The two types of learning—rein-
of not needing labels, or labeling au- forcement learning and deep learning
tomatically by who’s winning or los- learning with through deep neural networks—com-
ing—by the rewards,” explains Uni- neural networks plement each other beautifully, says
versity of Alberta computer scientist Sutton. “Deep learning is the greatest
Rich Sutton, a co-founder of the field is not new. thing since sliced bread, but it quickly
of reinforcement learning and co-au- becomes limited by the data,” he ex-
thor of the standard textbook on the plains. “If we can use reinforcement
subject. In reinforcement learning, learning to automatically generate
the better your moves are, the more data, even if the data is more weakly
rewards you get, “so you can learn to labeled than having humans go in and
play the Go game by playing the moves label everything, there can be much
and winning or losing, and no one has I think is at the core of intelligence,” more of it because we can generate it
to tell you if that was a good move or a says computer scientist Itamar Arel, a automatically, so these two together
bad move because you can figure it out professor of electrical engineering and really fit well.”
for yourself; it led to a win, so it was a computer sciences at the University of Despite the buzz around DeepMind,
good move.” Tennessee and CEO of Osaro, a San combining reinforcement learning
Sutton knows the process is not Francisco-based AI startup. “If some- with neural networks is not new. TD-
as simple as that. Even in the neat, thing good happens now, can I think Gammon, a backgammon-playing pro-
tightly controlled world of a game, back to the last n steps and figure out gram developed by IBM’s Gerald Tes-
deducing which moves lead to a win what I did that led to the positive or auro in 1992, was a neural network that
is a notoriously difficult problem be- negative outcome?” learned to play backgammon through
cause of the delay between an action Just as for human players, figuring reinforcement learning (the TD in the
and its reward, a key feature of rein- out smart moves enables the program name stands for Temporal-Difference
forcement learning. In many games, to repeat that move the next time it learning, still a dominant algorithm in
you receive no feedback at all until the faces the same situation—or to try a reinforcement learning). “Back then,
end of the game, such as a 1 for a win new, possibly better move in hope of computers were 10,000 times slower
or a –1 for a loss. stumbling into an even higher reward. per dollar, which meant you couldn’t
“Typically, you have to go through In extremely small worlds (think of a have very deep networks because
hundreds of actions before your score simple game like Tic-Tac-Toe, also those are harder to train,” says Jürgen
increases,” explains Pieter Abbeel, an known as Noughts and Crosses), the Schmidhuber, a professor of artificial
associate professor at the University same exact situations come up again intelligence at the University of Lu-
of California, Berkeley, who applies and again, so the learning agent can gano in Switzerland who is known for
deep reinforcement learning to robot- store the best action for every possible seminal contributions to both neural
ics. (For a robot, a reward comes for situation in a lookup table. In complex networks and reinforcement learning.
completing a task, such as correctly as- games like chess and Go, however, it is “Deep reinforcement learning is just
sembling two Lego pieces.) “Before you impossible to enumerate all possible a buzzword for traditional reinforce-
understand how the game works, and situations. Even checkers has so much ment learning combined with deeper
are learning through your own trial and branching and depth that the game neural networks,” he says.
error,” Abbeel says, “you just kind of do yields a mind-boggling number of Schmidhuber also notes the tech-
things, and every now and then your different positions. So imagine what nique’s successes, though impressive,
score goes up, and every now and then happens when you move from games have so far been in narrow domains,
it goes down, or doesn’t go up. How do to real-world interactions. in which the current input (such as
you tease apart which subset of things “You’re never going to see the same the board position in Go or the current
that you did contributed to your score situation a second time in the real screen in Atari) tells you everything you
going up, and which subset was just world,” says Abbeel, “so instead of a need to know to guide your next move.
kind of a waste of time?” table, you need something that under- However, this “Markov property” does
This thorny question—known as the stands when situations are similar to not normally hold outside of the world
credit assignment problem—remains situations you’ve seen before.” This is of games. “In the real world, you see
a major challenge in reinforcement where deep learning comes in, because just a tiny fraction of the world through
learning. “Reinforcement learning is understanding similarity—being your sensors,” Schmidhuber points out,
unique in that it’s the only machine able to extract general features from speaking of both robots and humans.
learning field that’s focused on solving many specific examples—is the great As humans, we complement our lim-
the credit assignment problem, which strength of deep neural networks. ited perceptions through selective

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 13
news

memories of past observations; we their own past experiences, but also Even modest amounts of demon-
also draw on decades of experience to from the aggregate experiences of oth- stration, Arel says, “give the agent a
combine existing knowledge and skills er connected devices, and as a result head start to make it practical to apply
to solve new problems. “Our current become increasingly better at taking these ideas to robotics and other do-
reinforcement learners can do this in the right action at the right time. mains where acquiring experience is
principle, but humans still do it much Osaro, Arel’s software startup, also prohibitively expensive.”
better,” he says. uses deep reinforcement learning, but
Researchers continue to push rein- promises to eliminate the costly ini-
forcement learners’ capabilities, and are tial part of the learning curve. For ex- Further Reading
already finding practical applications. ample, a computer learning to play the Mnih, V., et al.
“Part of intelligence is knowing Atari game Pong from scratch starts Human-level control through deep
reinforcement learning. Nature (2015), vol.
what to remember,” says University out completely clueless, and therefore
518, pp. 529–533.
of Michigan reinforcement learning requires tens of thousands of plays to
expert Satinder Singh, who has used become proficient—whereas humans’ Silver, D., et al.
Mastering the game Go with deep neural
the world-building game Minecraft to experience with the physics of balls networks and tree search. Nature (2016),
test how machines can choose which bouncing off walls and paddles makes vol. 529, pp. 484–489.
details in their environment to look Pong intuitive even to children. Tesauro, G.
at, and how they can use those stored “Deep reinforcement learning is a Temporal difference learning and TD-
memories to behave better. promising framework, but applying it Gammon. Communications of the ACM
Singh and two colleagues recently from scratch is a bit problematic for re- (1995), vol. 38, issue 3, pp. 58–68.
co-founded Cogitai, a software com- al-world problems,” Arel says. A factory Sutton, R.S., and Barto, A.G.
pany that aims to use deep reinforce- assembling smartphones, for example, Reinforcement Learning: An Introduction.
ment learning to “build machines requires its robotic manufacturing MIT Press, 1998, https://mitpress.mit.edu/
books/reinforcement-learning
that can learn from experience the way equipment to get up to speed on a new
humans can learn from experience,” design within days, not months. Osa-
Based in San Francisco, Marina Krakovsky is the author
Singh says. For example, devices like ro’s solution is to show the learning of The Middleman Economy: How Brokers, Agents,
thermostats and refrigerators that agent what good performance looks Dealers, and Everyday Matchmakers Create Value and
Profit (Palgrave Macmillan, 2015).
are connected through the Internet of like “so it gets a starting point far better
Things could continually get smarter than cluelessness,” enabling the agent
and smarter by learning not only from to rapidly improve its performance. © 2016 ACM 0001-0782/16/08 $15.00

Milestones

Computer Science Awards, Appointments

NEWEST AMERICAN about the use of randomized cryptography, number theory, Board from 2007 to 2016,
ACADEMY MEMBERS packet markings to perform IP and the theory of algorithms and Schneider served as chair of
INCLUDE SIX COMPUTER traceback, competitive analysis of distributed systems. the organization’s Government
SCIENTISTS multiprocessor cache coherence ˲˲ Scott J. Shenker, University Affairs Committee for seven
Among the 176 new Fellows algorithms, unified algorithms of California, Berkeley. Leader of years, helping to drive CRA’s
recently elected to the American for simultaneously managing all the Initiatives Group and Chief policy agenda, and developing
Academy of Arts and Scientists are levels of the memory hierarchy, Scientist of the International the Leadership in Science Policy
six in the computer science arena: Web proxy servers, and hash Computer Institute, Shenker Institute to educate computing
˲˲ Jeffrey A. Dean, Google. A tables with constant worst-case received the 2002 SIGCOMM for researchers on how science
Google Senior Fellow, Dean is a lookup time. lifetime contribution to the field policy in the U.S. is formulated.
Fellow of ACM, and shared the ˲˲ Tom M. Mitchell, Carnegie of communication networks Schneider led the
ACM-Infosys Foundation Award Mellon University (CMU). “For contributions towards organization’s Committee
for 2012 with Sanjay Ghemawat. Chair of the Machine Learning an understanding of resource on Best Practices for Hiring,
˲˲ Sanjay Ghemawat, Google. Department at CMU and E. sharing on the Internet.” He has Promotion, and Scholarship in
A research scientist who works Fredkin University Professor, been an ACM Fellow since 2003. conducting interviews with more
with MapReduce and other large Mitchell has contributed to than 75 academic and industry
distributed systems, Ghemawat the advancement of machine computing and information
is also the author of the popular learning, artificial intelligence, SCHNEIDER RECEIVES CRA unit heads to understand issues
calendar application iCal, and and cognitive neuroscience. SERVICE AWARD and gain insights from practice.
with Dean, wrote the 2004 paper ˲˲ Tal D. Rabin, IBM T.J. The Computing Research Preliminary recommendations
“MapReduce: Simplified Data Watson Research Center. Head of Association (CRA) has named were vetted with department
Processing on Large Clusters.” the cryptography research group Fred Schneider, Samuel B. Eckert chairs and CRA Deans at the CRA
˲˲ Anna R. Karlin, University at theWatson Research Center, Professor and Chair of Computer Conference at Snowbird in 2014,
of Washington. The Microsoft Rabin’s research focuses on Science at Cornell University, and were published in a CRA Best
Professor of Computer Science the design of efficient, secure recipient of the Service to CRA Practices memo, “Incentivizing
& Engineering at the University encryption algorithms, as well Award for his ongoing work with Quality and Impact: Evaluating
of Washington, Karlin, an as secure distributed algorithms, the organization. Scholarship in Hiring, Tenure,
ACM Fellow since 2012, writes the theoretical foundations of A member of the CRA and Promotion.”

14 COMMUNICATIO NS O F TH E AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 news

Technology | DOI:10.1145/2949684 Gary Anthes

Open Source Software

No Longer Optional
Open development and sharing of software gained widespread
acceptance 15 years ago, and the practice is accelerating.

I
N T H E S P RI N G of 1991, a 21-year-
old Finnish student named
Linus Torvalds sat down to
write code that would ulti-
mately revolutionize the world
of software development. In a Usenet
newsgroup post late that summer, he
told the world about his work: “I’m
doing a (free) operating system (just a
hobby, won’t be big and professional
like gnu) for 386(486) AT clones,” he
wrote. “This has been brewing since
April and is starting to get ready. I’d
like to know what features most people
would want. Any suggestions are wel-
come, but I won’t promise I’ll imple-
ment them :-).”
Indeed, users of his Linux operating
system have wanted a lot of features
over the past quarter-century, and Tor-
valds has not had to add them himself.
Linux today has more than 18 million
lines of source code and some 12,000 the 1970s, AT&T Bell Labs licensed ers asked. “Why would you give away
participating developers. There are tens Unix source code to government and software created at great expense to
of millions of Linux users worldwide, academic researchers pretty much competitors?” developers wanted to
from owners of Android smartphones without restriction. know. William Scherlis, a computer
to corporate data center managers to The modern open source software science professor at Carnegie Mellon
scientists at supercomputer centers. (OSS) movement got its start with Rich- University and director of the univer-
It is a remarkable success story by ard Stallman, a staunch “free software” sity’s Institute for Software Research,
almost any measure, and much of that advocate, who wrote an open source says these objections are no longer
success owes to a model of software de- text editor called Emacs in 1976. In valid, if they ever were.
velopment called “open source.” There 1983, he launched the GNU Project to Scherlis says the view of the open
are slightly different definitions of the develop a free Unix-like operating sys- source movement as a combination of
idea, but essentially open source refers tem and related utilities. At the same anarchy and demagoguery is a myth.
to software that is publicly available as time he also founded the non-profit “It looks like hundreds or thousands
source code and may be freely used, Free Software Foundation to promote of people contributing from around
modified, and redistributed, without wide collaboration in the develop- the world, but generally it’s a very small
charge for the license (but sometimes ment, distribution, and modification core group that has intellectual owner-
with a charge for the service of distrib- of free software, including GNU Project ship of the code base,” he says. “There’s
uting the software). software such as GNU Emacs and the usually a hierarchical structure so that
GCC C compiler. control is maintained, and the major
History The creation and use of OSS grew successful projects, like Apache and
Software offered to the public in open steadily after 1983, but users and de- Eclipse, have elaborate ownership and
source format is not a new idea. Begin- velopers, especially large corpora- governance structures: the Apache
ning in the 1950s, a user group called tions, often have looked at it askance. Foundation, the Eclipse Foundation,
SHARE, working with IBM, published “Who would trust a mission-critical and so on.”
applications and utilities as source application to software written by a Allison Randal, president of the
code for use on IBM mainframes. In bunch of long-haired anarchists?” us- Open Source Initiative, which advo-

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 15
news

cates for OSS and maintains a list of gan four years ago and resulted in a the public domain ... [OSS] isn’t suc-
industry-standard OSS licenses, says development and production tool for cessful in building a mass market and
the open source community essential- Google, but it was not flexible enough making powerful, easy-to-use software
ly declared victory in 2010, by which for others to adapt to their purposes, broadly accessible to consumers.”
time she says the tide of opinion had says Google senior fellow Jeffrey Dean. Yet in 2004, Microsoft dipped its giant
flowed overwhelmingly from propri- “If you wanted to do a more exotic neu- toe into the OSS waters with the release
etary software to OSS. She cites a re- ral network, some of those were hard,” of the open source Windows Installer
cent survey of 1,300 IT professionals he says. TensorFlow was developed XML Toolset (WiX). In 2005, Microsoft
by Black Duck Software that showed from the start to be open sourced and open sourced the F# programming lan-
the percentage of companies running was written to minimize its dependen- guage and, soon after, a number of other
part or all of their operations on OSS cies on other internal Google tools things. Last year, it released the open
had almost doubled between 2010 and libraries. source development framework and
and 2015, from 42% to 78%. The num- Dean says Google traditionally has runtime system .NET Core, a free imple-
ber reporting they contribute to open published the ideas behind its tech- mentation of its .NET Framework, for
source projects rose from 50% in 2014 nologies in journals. By open sourcing Windows, Linux, and Mac OS X.
to 64% last year, she adds. TensorFlow, Google has gone further Microsoft now participates in more
by making it easier for others to try than 2,000 open source projects, says
Why Do It? Google’s ideas and code in their own Anders Hejlsberg, a technical fellow
“It comes down to economic neces- software. That will enable users to try and a lead developer of the open source
sity,” says Randal, who is also a devel- different machine-learning techniques, tools C# and TypeScript. “New proj-
opment manager at Hewlett Packard spawning advances that may help ects today are open source by default,
Enterprise. “If nobody else was using Google in return. “We hope that a whole unless there are good reasons why
open source, you could ignore it, but community will spring up around this, they shouldn’t be,” he says. “That’s a
if others use it, they are getting some- and we will get a wide variety of contrib- complete switch from the proprietary
thing free and you are not, and they utors, from students and hobbyists to mind-set of earlier days.”
have an advantage. You can’t be a start- large companies,” Dean says. Microsoft is collaborating with
up in Silicon Valley and not use it.” For years, Microsoft lagged behind Google on the development of Google’s
There are also reasons why large many other developers in its embrace next version of Angular, the popular
companies like HP increasingly use of OSS. In a speech in 2001, Microsoft Web user-interface framework. The
OSS, Randal says. “They get bogged senior vice president Craig Mundie open source project will combine fea-
down by their massive patent port- said, “The OSS development model tures of Angular with features from
folios. OSS is a good way for them to leads to a strong possibility of un- Microsoft’s TypeScript, a superset of
innovate because they can pool their healthy ‘forking’ of a code base, result- JavaScript. Says Hejlsberg, “Previously
patents.” For example, she says, the ing in the development of multiple it was, ‘Those are our competitors; we
500 companies that participate in the incompatible versions of programs, can’t work with them.’ But now it’s,
OpenStack project for cloud comput- weakened interoperability, product ‘Oh, gosh, they are trying to solve prob-
ing, including AT&T, IBM, and Intel, instability, and hindering businesses lems we’ve already solved, and vice
agree to license their patents to the ability to strategically plan for the fu- versa. We should work together for
neutral, non-profit OpenStack Foun- ture ... It has inherent security risks the benefit of both companies and the
dation and thereby to all OpenStack and can force intellectual property into community at large.’”
users and contributors. “The compa- While altruism toward the exter-
nies have agreed not to attack each nal development community some-
other with patent disputes around Allison Randal, times plays a part, the open sourcing
their collaborative work,” Randal of .NET Core was mostly a financial
says. “It’s a safe space for all of them president of the decision, says Randal of the Open
to work in.” Open Source Source Initiative. “.NET is pretty old,
Last year, Google surprised some and they hit a point where they real-
observers by releasing for general use Initiative, says ized they’d get more value out of re-
the source code for its TensorFlow the open source leasing it as open source, getting a
software, a set of tools for developing lot of eyes on the code, and getting
deep learning applications, including community contributions back.”
neural networks. It is the AI engine essentially declared Carnegie Mellon’s Scherlis says re-
behind various Google apps—such as cent open source projects have shown
Google Photos, which can identify ob- victory in 2010. an increased focus on software assur-
jects in pictures it has never seen be- ance. “With OSS we have a chance to
fore—but the code previously was off do better at providing users with not
limits to external parties wanting to just code, but evidence of quality.” That
develop such apps. might take the form of test cases, per-
Work on a predecessor system for formance evaluations, code analyses,
deep learning, called DistBelief, be- or inspection reports, he notes.

16 COMM UNICATIO NS O F THE ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 news

Downsides
Scherlis cautions not to get swept away
“New projects today
ACM
with open source euphoria; major ef-
forts like Apache may have tight gov-
ernance, but some projects do not. He
are open source by Member
points to the devastating Heartbleed default, unless there News
security bug discovered in the OpenSSL are good reasons why
library in 2014 as an example; the bug
left an estimated 500,000 trusted com- they shouldn’t be. MAKING SOFTWARE SAFER,
RATHER THAN FASTER
puters vulnerable to breaches of cryp- That’s a complete Michael Franz,
a professor in
tographic security. “OpenSSL wasn’t
a well-funded consortium, it was just switch from the computer
science
a small group doing it,” Scherlis says. the proprietary mind- department at
the University
“But it was so good and so essential, ev-
erybody used it.” set of earlier days.” of California,
Irvine, is co-inventor of the trace
Scherlis says users are dreaming compilation technology that
when they think, “Many eyes have cast eventually became the
their gaze upon this code, and so it is JavaScript engine in Mozilla’s
Firefox browser. He has spent
good.” He explains, “It’s possibly true much of his career making
for shallow bugs, but not so much for software go faster.
the deep bugs that vex all projects— Franz says his “original
background” is in programming
the global quality properties of the they want to make sure there is sup-
languages and compilers.
system, architectural flaws, concur- port for the project after the launch. He recalls reading a book on
rency problems, deep security prob- So you have not just coders, you have data structures and algorithms
lems, timing and performance prob- community managers, marketing by Niklaus Wirth, the designer
of Pascal and recipient of
lems, and so on.” teams, and product managers looking the 1984 ACM A.M. Turing
Finally, Scherlis warns OSS is not re- at what is the experience of users com- Award, then writing him a
ally “free.” In reality, most users will pay ing to the project.” letter saying, “this would be
someone to adapt the software to work interesting” and asking “what
can I do to study under you?”
in their data centers and will incur inter- He received a response from
Further Reading
nal support and maintenance costs for the university registrar’s office,
it. If the software is mission critical, the Charny, B. Franz recalls, “saying they
Microsoft Raps Open-Source Approach, had taken the liberty to enroll
company will want to devote staff to the me in their series of entrance
CNET News, May 3, 2001
external open source project to ensure http://www.cnet.com/news/microsoft-raps- examinations, and asked could
its needs are met over time. open-source-approach/ I be there in two weeks.
OSS has become big business since I passed, and that is how
Google I got the opportunity to study
Stallman started the Free Software Interviews with Google’s Angular computer science at ETH
Foundation. The company GitHub has team about their use of Microsoft’s Zurich, the Swiss Federal
become the go-to place for develop- open source TypeScript Institute of Technology.”
https://www.youtube.com/ Today, Franz sees computer
ers and users of open software, from
watch?v=hvYnjJc88OI security as a more immediate
large companies like Apple, Google, problem. As a result, he has
and Microsoft to thousands of start- Kon, F. and Souza, B. been helping to pioneer
The Open-Source Ecosystem, Open Source artificial diversity. “The idea
ups. According to GitHub’s Brandon Initiative, 2012 behind artificial diversity is
Keepers, the company hosts 31 mil- http://flosscc.org/spread-the-word [video] to generate multiple versions
lion open source projects used by 12 Meeker, H. of a program, so an attacker
million developers. doesn’t know which version is
Open (Source) for Business: A Practical
Keepers, GitHub’s head of open running, making it far more
Guide to Open-Source Software Licensing,
difficult to exploit.”
source software, commends Apple for CreateSpace Independent Publishing During the last few years,
the way it released in 2014 its open Platform, April 6, 2015 Franz says he has been focused
http://www.amazon.com/exec/obidos/ on making things safer, rather
source programming language Swift. ASIN/1511617772/flatwave-20 than faster, although not at
“The way they did their launch was one the expense of performance.
Stallman, R.
of the most impressive we’ve seen,” “We invent a security feature,
Free Software, Free Society: Selected
Keepers says. “They invited the com- Essays, 3rd ed., Free Software Foundation, which creates a drag, and then
munity into the process.” we put on our other hat and
Oct. 2015
optimize the drag away again.
That is the wave of the future as de- http://shop.fsf.org/product/free-software-
So in the end, we have a new
velopers take open source more and free-society-3-paperback/ security feature which is almost
more seriously, Keepers predicts. “We performance-neutral.”
Gary Anthes is a technology writer and editor based in —John Delaney
are seeing companies treating open
Arlington, VA.
source launches like product launch-
es. They want to make a big splash, but © 2016 ACM 0001-0782/16/08 $15.00

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 17
news

Society | DOI:10.1145/2949664 Logan Kugler

Smartphone Apps
for Social Good
Mobile apps make it easier, faster, and cheaper to create massive impact
on social causes ranging from world hunger to domestic violence.

T
HE INTERNET IS chock-full of
gripes about Millennials, the
smartphone-obsessed gen-
eration that reached young
adulthood at the turn of the
century. Millenials are entitled, lazy,
self- —and selfie- —absorbed, and un-
interested in the world at large. They
vex and puzzle employers in equal mea-
sure, and they cannot be counted on to
do anything other than, well, whatever
they feel like doing.
Tell that to a new generation of app
makers who are busy building pro-
grams that make it easy and fun to do
massive good around the world. Their
apps feed the hungry, clothe the naked,
and shelter the homeless, all with a tap
of that little screen typically reserved
for Angry Birds or Amazon purchases.
The first wave of smartphone apps—
the Instagrams, Foursquares, and
Snapchats of the world—prided them-
selves on being social. This new genera-
tion of apps prides itself on being so-
cially good, and they are being adopted
most frequently by Millennials.
Apps that do social good range from
ethical marketplaces like Orange Harp, The Lunchbox Fund fosters education by providing nourishing meals to children in rural
which “makes the world more socially areas of South Africa.
conscious and sustainable by provid-
ing people access to amazing products “Smartphone users are ordering (we are only human). The human race
and behind-the-scenes details about meals, cars, making appointments, has always had an altruistic streak; it
how they are made,” to Feedie, which and conducting more and more as- is not exclusive to recent generations.
donates a meal to the non-profit Lunch- pects of their personal and work lives Yet the youth of today have a few ad-
box Fund each time a user shares pic- from their devices,” de Brun says. vantages that help them do more good
tures of his or her own food at partici- “Why wouldn’t they also be able to do- faster, says Anbu Anbalagapandian,
pating restaurants. nate, give back, or effect social change who works for the Orange Harp ethical
Far from wasting their time order- from their phones as well?” mobile marketplace.
ing stuff, broadcasting their breakfast To all the Millennial naysayers out “With advances in technology, it
PHOTO C OURT ESY OF THE LUNCH BOX F UND

plans, or gaming with friends, Millen- there, it might be time to revise your is much easier to create solutions
nials are using apps like these that criticisms: the Millennial generation is and have a bigger impact,” says An-
do social good to change the world, connected, conscientious, and ready to balagapandian. “For example, donat-
because they are conditioned to do combat social ills. ing food from a local restaurant to a
so, says Steve de Brun, co-creator of homeless shelter, or microlending to
MicroHero, a free app that allows us- Charity Meets Cool a small business in remote parts of
ers to earn money for charity by taking Perhaps Millennials like to pat them- the world, have been made incred-
online surveys. selves on the back a little too much ibly easy.”

18 COMM UNICATIO NS O F THE ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 news

Orange Harp does what a de- VolunteerMatch connects aspiring

cade ago might have been fiscally do-gooders with opportunities to con-
or physically impossible: it con- “Information tribute their time to a good cause in
nects consumers with hand-picked spreads much their local area.
fashion producers who use only the
most ethical processes and materi- faster now,” says Global Impact
als. The app wears its rejection of Anbalagapandian. This is not just a movement for U.S.-
unsustainable manufacturing like based hipsters. The Lunchbox Fund,
a badge of honor, broadcasting its Social media can for example, provides daily meals to
work with small businesses that are “create awareness poor children in rural areas of South
good for people and the planet. The Africa. In 2013, South African cleric
company goes so far as to condemn around problems Desmond Tutu signed on as patron
the “modern-day slavery” that defines that affect our of the organization, which primar-
the garment industry. ily solicited donations in his home
That approach seems to garner ac- people and planet.” country.
claim. The Orange Harp app is highly That same year, the Lunchbox
rated in Apple’s App Store, with con- Fund decided to expand its footprint
sumers enthusiastic about knowing in a cost-effective way, so it created the
their dollars are being spent ethically. Feedie app to help it raise more mon-
It was rated by Apple as one of the “best This is not a trend confined to apps ey in other countries without hiring
new apps” in 2015. that funnel money and donations to a huge canvassing force or running a
Orange Harp understands its mil- good causes. global marketing campaign.
lennial audience well: to do good, you SafeNight is an app that connects Here is how it works: Feedie users
have to look good, because if you look victims of abuse to hotel rooms when connect the app to their social net-
good, your message gets attention. shelters are full. Smartphones are the works. They then use the app to share
If your message gets attention, it can ideal solution; rooms are needed in photos of their meals in participating
spread like wildfire. near-real time, and time is of the es- restaurants, and those restaurants
“Information spreads much faster sence in domestic violence situations. make donations to The Lunchbox
now,” says Anbalagapandian. “We can Project Noah is an app nature lovers Fund to feed hungry children.
use social media to create awareness can use to catalog animals and plants At press time, more than 12 mil-
around problems that affect our peo- they encounter; the database is then lion meals had been sponsored for
ple and planet.” used for conversation efforts. children worldwide by Feedie.
SCREEN IMAGES CO URT ESY OF ORA NGEH A RP.COM , SH ARETH EM EAL .O RG, A ND PROJECTNOA H .ORG

Phone screens displaying apps that allow users to give to those in need; from left, Orange Harp, Share the Meal, and Project Noah.

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 19
news

ShareTheMeal is another app that says de Brun, will cause more corporate
does good in a cost-effective way by social responsibility programs to get in
leveraging cross-border engagement. Social good apps the game, and that is when things will
Developed by the United Nations World succeed because start to get really interesting.
Food Program, the app makes it easy When social good apps appeal not
for a user to tap once and donate $0.50, they are a win-win-win just to individuals but entire corpora-
enough to feed a child for an entire day for charitable tions, their impact grows by orders of
in most of the world. Instead of costly magnitude.
outreach, users may download the app organizations, users, That is because the incentives for
from anywhere in the world and donate. and participating doing good and doing well are aligned.
The U.N. claims this initiative’s admin- “Entrepreneurs are inventing business
istrative costs are among the lowest in businesses. models that provide social good and
the non-profit world, with 90% of dona- provide for a profitable, sustainable
tions going directly to operations. business,” de Brun says.
“So many people want to dedicate Other app makers agree. Nick Ma-
time and energy to charities that they rino is director of Social Change at
feel passionate about, but there may nesses that have pressing questions TangoTab, an app that donates a meal
be certain factors preventing them they need answered. The result is a to local food charities each time a user
from doing so, like geographic barri- type of conscientious capitalism that checks in at a local restaurant. “I be-
ers,” says Sophie Barnett, the Lunch- gives businesses a direct incentive to lieve we have seen an overall increase
box Fund’s digital coordinator. “Social support charitable causes. Currently, in businesses working with causes,”
good apps, accessible from anywhere, MicroHero works with over 200 chari- Marino says.
at any time, have made doing good infi- ties, including the World Wildlife Fund Restaurants like Starbucks, Nobu,
nitely easier.” and the American Red Cross. and Maggiano’s have signed up to
Social good apps succeed because This model only works when you work with TangoTab, because the
they are a win-win-win for charitable understand how consumers actually best social good apps leverage con-
organizations, users, and participat- use smartphones; you cannot simply sumer behavior to create real change,
ing businesses. In the case of Feedie, use an app notification to ask for a Marino explains.
restaurants pay $500 as a tax-deduct- donation and call it a day, says Micro- “Apps like TangoTab are making
ible donation in anticipation of 2,000 Hero’s de Brun, adding that apps must it easier for people to make a differ-
photos of their meals being posted. provide an experience just like any ence by doing things they already do
They receive baked-in buzz as photos consumer product. daily. People dine out all the time. We
of their culinary creations are shared “Smartphone operating systems give people the opportunity to impact
by users who feel good when they do and app user interfaces are getting bet- someone in need just by doing what
good, and they garner media atten- ter at serving end users in natural, even they’re already doing.”
tion when Feedie is featured by me- delightful ways,” he says. “If done well,
dia outlets like Mashable, The Huff- social good actions can be very sponta-
Further Reading
ington Post, and Time, marketing neous and efficient from a phone.”
exposure for which many businesses In short, charitable giving cannot Wigglesworth, V.,
(2015) SafeNight app comes to the aid
would gladly pay. Thanks to Feedie’s only become widespread on mobile
of domestic violence victims in North
ingenuity, businesses pay to feed the devices; it can become second nature Texas. The Dallas Morning News. http://
hungry instead. if done right, just like opening Face- www.dallasnews.com/news/domestic-
“We want to make taking a Feedie book or checking Snapchat. There is an violence/20151009-safenight-app-comes-
photo as ubiquitous as posting to Ins- added financial benefit for consumers, to-the-aid-of-domestic-violence-victims-in-
north-texas.ece
tagram and create a sustainable, scal- too: you can claim many types of chari-
able impact,” says Barnett. table donations as tax deductions. Godfrey, M,.
(2013) Feedie App Turns Food Photos
While the apps themselves do not of-
Into Charitable Giving. ABC News. http://
Doing Well While Doing Good fer much help with this (you still must abcnews.go.com/Technology/feedie-
Feedie highlights an important truth claim a charitable donation on your app-turns-food-photos-charitable-giving/
about social good apps of any type: own), they do make it easier to give in story?id=20060750
those that create the biggest impact the first place. Chang, L,.
are the ones that help others do well De Brun believes social good apps (2015) With the ShareTheMeal App, Your
while doing good. That is exhibited in like MicroHero are just getting started. 50-Cent Donation Can Help End World
Hunger. Digital Trends. http://www.
the business model of the MicroHero As user bases grow, social good app
digitaltrends.com/mobile/help-end-world-
survey-taking app. developers will find more fluid ways to hunger-with-the-uns-sharethemeal-app/
Users are asked to complete free connect in-app actions with actual mon-
surveys in MicroHero; each complet- etary impact. Gamification will help:
Logan Kugler is a freelance technology writer based in
ed survey results in a donation to the the more giving feels like play, the more Tampa, FL. He has written for over 60 major publications.
user’s favorite charity by companies engagement we will see from socially
that conduct market research, or busi- conscious users. Widespread adoption, © 2016 ACM 0001-0782/16/08 $15.00

20 COM MUNICATIO NS O F TH E ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 XRDS Seeks Student Volunteers
Are you a student who enjoys staying up to date with the latest tech
innovations, and is looking to make an impact on the ACM community?

Editorial positions are now open for the following positions:

social media editor, feature editor and department editor.

XRDS is a quarterly print magazine for students by students that examines

cutting edge research in computer science, viewpoints on technology’s
impact in the world today, and works to support a strong, positive, and
inclusive community of students interested in computer science. Our X RD

D
goal is to make the magazine accessible to anyone with an interest in
.4
NO
2•
L .2
VO
16
20

computer science and technology. XRDS focuses on interesting work being

ER
MM

R
SU

conducted at different universities, research centers and labs around for

St ude
nt s

X
zine
the word. Our editors represent a team of students with diverse interests s Th
e AC
MM
aga

oad
who are undergrads and graduate students from around the globe. Cr o
s sr

S
G
.OR

For more information and to apply visit:

CM
S .A
X RD

D
.3
NO

http://xrds.acm.org/volunteer.cfm G2
0 16
VO
L .2
2•

R
R IN
SP

nt s
ude
r St

X
e fo
azin
M Mag
e AC
s Th
Association for s sr
oad
Cr o
Computing Machinery

S
G
.OR
CM
S .A
X RD

D
O .2
•N
L .2 2
VO
15
20
TER

R
W IN

nt s
St ude

X
for
zine
aga
MM
e AC
s Th
oad
s sr
Cr o

G
.OR
CM
S .A
X RD

ital ion

X
Digbricat
az
Mag
A CM

Theet
The
ads

Fa
ro
Cr os s

S
rn
Intehings
for n
est atio abric .O RG
anif bric
CM
A M ital Fa F S .A
with
X RD
d
Han

of T
ig g
the D intin ends a
t Pr
.3
for s
O
•N
cts ing Sof n L L .2 1
spe f Th icatio 15
VO
Pro rnet o tion r 0
Fab
G2
nizaes of
R IN
Inte SP
hro
ync eng ss
lob al S e Challwarene nt s
G d th rk A St ude
an etwo for
N zine
ding aga
Buil e AC
MM
s Th
oad
s sr
Cr o
V
viewpoints

DOI:10.1145/2955112 Paul Kocher

Privacy and Security

Computer Security Is Broken:
Can Better Hardware Help Fix It?
Computer security problems have far exceeded
the limits of the human brain. What can we do about it?

I
N 1967, THE Silver Bridge col- ply because we are ignorant as to which Protocols can greatly simplify se-
lapsed into the Ohio River specific elements will fail. curity by removing reliance on com-
during rush hour. Instead of munications channels, but in practice
redundancy the bridge used Security Building Blocks they have proven deceptively tricky. In
high-strength steel. The failure To build strong security systems, we 1996, I co-authored the SSL v3.0 pro-
of a single eyebar was catastrophic.a need reliable building blocks. Crypto- tocol for Netscape, which became the
Today’s computing devices resemble graphic algorithms are arguably the basis for the TLS standard. Despite
the Silver Bridge, but are much more most important building block we have nearly 20 years of extensive analysis,
complicated. They have billions of today. Well-designed algorithms can researchers have identified new issues
lines of code, logic gates, and other provide extraordinary strength against and corner cases related to SSL/TLS
elements that must work perfectly. certain attacks. For example, Diffie- even relatively recently. Still, I believe
Otherwise, adversaries can compro- Hellman, RSA, and triple DES—known we are reaching the point of having
mise the system. The individual failure since the 1970s—continue to provide cryptographically sound protocols.
rates of many of these components are practical security today if sufficiently Although breakthroughs in quantum
small, but aggregate complexity makes large keys are used. computing or other attacks are con-
vulnerability statistically certain. ceivable, I am cautiously optimistic
This is a scaling problem. Security- that current versions of the TLS stan-
critical aspects of our computing plat- To build strong dard (when conservative key sizes and
forms have seen exponential increases configurations are chosen) will resist
in complexity, rapidly overwhelming security systems, cryptanalysis over many decades.
defensive improvements. The futility we need better Unfortunately, my optimism does
of the situation leads to illogical rea- not extend to actual implementations.
soning that structural engineers would building blocks. Most computing devices running SSL/
never accept, such as claiming that ob- TLS are riddled with vulnerabilities that
viously weak systems are “strong” sim- allow adversaries to make an end-run
around the cryptography. For example,
a “The Collapse of the Silver Bridge: NBS Deter- errant pointers in device drivers or bugs
mines Cause,” 2009; https://1.usa.gov/21cRgUV in CPU memory management units can

22 COMM UNICATIO NS O F THE AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 viewpoints

destroy security for all software on a de- be straightforward to secure. The branches—the bits of the secret key.
vice. To make progress, we need another problems I encountered were a lot Upgrading to a digital storage oscil-
building block: simple, high-assurance more interesting and less intuitive loscope enabled far more advanced
hardware for secure computation. than I expected. analysis methods. With my colleagues
I noticed small data-dependent Joshua Jaffe and Benjamin Jun, I devel-
Secure Computation in Hardware correlations in timing measure- oped statistical techniques (Differen-
Consider the problem of digitally ments of devices’ cryptographic op- tial Power Analysis, or DPA) to solve for
signing messages while securing erations. Cryptographic algorithms keys by leveraging tiny correlations in
a private key. Meaningful security are extremely brittle; they are very noisy power consumption or RF mea-
assurances are impossible for soft- difficult to break by analyzing binary surements.c
ware implemented on a typical PC or input and output messages, but fail Side channels weren’t the only is-
smartphone due to reliance on com- if attackers get any other informa- sue. For example, scan chains and oth-
plex and untrustworthy components, tion. The timing variations violated er test modes can be abused by attack-
including the hardware, operating the algorithms’ security model, and ers. Researchers and pay TV pirates
system, and so forth. Alternatively, in practice allowed me to factor RSA independently discovered that glitches
if the computation is moved to iso- keys and break other algorithms.b and other computation errors can be
lated hardware, the private key’s se- I bought the cheapest analog os- devastating for security.d
curity depends only on the logic of cilloscope from Fry’s electronics and Fortunately, practical and effective
IMAGE BY ALICIA KUBISTA /A ND RIJ BORYS ASSOCIAT ES

a comparatively simple hardware placed a resistor in the ground input of solutions have been found and imple-
block (see Figure 1). The amount of a chip doing cryptographic operations. mented to these issues. For example,
security-critical logic is reduced by The scope showed power consumption nearly 10 billion chips are made an-
many orders of magnitude, turning varying with the pattern of branches nually with DPA countermeasures.
an unsolvable security problem into taken by the device’s processor. I could
a reasonably well-bounded one. easily identify the conditions for these c P. Kocher, J. Jaffe, and B. Jun, “Differential
In the 1990s, I started investigat- Power Analysis,” 1999; https://bit.ly/1XLZhSZ
d D. Boneh, R. DeMillo, and R. Lipton,
ing secure hardware, assuming that b P. Kocher, “Timing Attacks on Implementa- “On the Importance of Checking Crypto-
simple mathematical operations like tions of Diffie-Hellman, RSA, DSS, and Other graphic Protocols for Faults,” 1997; https://
encryption and digital signing would Systems,” 1996; https://bit.ly/25S86vt stanford.io/1PPPFnj

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 23
viewpoints

Figure 1. A simple fixed-function secure computation block. Figure 2. Vulnerability risks increase
with the number of potential interactions
between system elements.

Security perimeter

Key Generation

Keypair

Write Once Memory

- Public key

Private key

Message Digital Signing Signature

4 elements 8 elements
6 interactions 28 interactions

Although there is a possibility that un- most all of the (very complexf) proces- orders of magnitude less. Examples
expected new categories of attack may sor in the security perimeter, and do of on-chip security hardware include
be discovered, based on what we know, not even appear to mitigate side chan- Apple’s Secure Enclave, AMD’s Secure
a well-designed chip can be robust nel or glitch attacks. Trusted Execu- Processor, and Rambus’s CryptoMan-
against non-invasive attacks. Strate- tion Environments (TEEs) typically use ager Cores. Depending on the appli-
gies for addressing invasive attacks ARM’s TrustZone CPU mode to try to cation, a security core may offload
have also improved greatly, although isolate an independent “trusted” oper- specific functions like authentication,
still generally assume some degree of ating system, but security dependen- or can be programmable. Over time,
security through obscurity. cies include the CPU(s), the chip’s test/ these secure domains can improve
debug modes, the memory subsystem/ and evolve to take on a growing range
Adding Secure Computation RAM, the TEE operating system, and of security-sensitive operations.
to Legacy Architectures other high-privilege software.
Today’s computing architectures are The approach I find most compel- Limits of Human Comprehension
too entrenched to abandon, yet too ling is to integrate security blocks Security building blocks must be sim-
complex to secure. It is practical, how- onto large multi-function chips. These ple enough for people to comprehend
ever, to add extra hardware where criti- cores can create an intra-chip security their intended security properties.
cal operations can be isolated. Actual perimeter that does not trust the RAM, With remarkable regularity, teams
efforts to do this in practice vary wildly legacy processors, operating system, working on data security dramatically
in cost, programming models, fea- or other logic. In addition to providing overestimate what can be implement-
tures, and level of security assurance. much better security integration than ed safely. I set a requirement when
Early attempts used standalone separate chips, on-die cores cost 1–2 working on the design of SSL v3.0 that
security chips, such as SIM cards in a technically proficient person could
mobile devices, TPMs in PCs, and f J. Rutkowska, “Intel x86 Considered Harm- read and understand the protocol in
conditional access cards in pay TV ful,” 2015; https://bit.ly/1ObbBaA one day. Despite this, multiple review-
systems. These were limited to single- ers and I missed several important
purpose applications that could bear but subtle design problems, some
the cost—typically a dollar or more.
The security chip’s electrical interface
Better hardware of which were not found until many
years later.
was also a security risk, for example foundations can Vulnerability risks grow with the
allowing pay TV pirates to steal video
decryption keys for redistribution.
enable a new number of potential interactions be-
tween elements in the system. If in-
Another strategy is to add security evolutionary process teractions are not constrained, risks
modes to existing designs. Because scale as the square of the number of
the existing processor and other logic that is essential elements (see Figure 2).
are reused, these approaches add al-
most no die area. Unfortunately, this
for the technology Although secure hardware blocks
may appear to be simple, they are
reuse brings significant security risks industry’s future. still challenging to verify. Formal
due to bugs in the shared logic and methods, security proofs, and stat-
separation mechanisms. Intel’s Soft- ic analysis tools can help to some
ware Guard Extensions (SGX)e leave al- extent by augmenting our human
brains. Still, there are gaps between
e M. Hoekstra, “Intel SGX for Dummies,” 2013; these methods and the messiness of
https://intel.ly/1eQpY4P the real world. As a result, these ap-

24 COMM UNICATIO NS O F THE ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 viewpoints

Figure 3. Increased complexity increases risk.

Calendar
Benefits of features
of Events
August 4– 5
Value

APSys ‘16: 7th ACM SIGOPS

Overall value Asia-Pacific Workshop
(benefits – risks) on Systems,
Hong Kong, China,
Sponsored: ACM/SIG,
Contact: Heming Cui,
Email: [email protected]

Complexity August 13–17

KDD ’16: The 22nd ACM
SIGKDD International
Conference on Knowledge
Discovery and Data Mining,
San Francisco, CA,
proaches need to be combined with hidden vulnerabilities. The costs of Co-Sponsored: ACM/SIG,
careful efforts to keep complexity coping with these weaknesses, and the Contact: Mohak Shah,
Email: [email protected].
under control. For example, expand- serious failures that will occur anyway, com
ing a system from 8 to 11 elements can easily overwhelm the benefits.
approximately doubles the number Secure compute building blocks August 18–21
of potential interactions. A tool that do not eliminate the link between ASONAM ‘16: Advances in
Social Networks Analysis
eliminated 50% of defects would be complexity and risk, but can funda- and Mining 2016,
extraordinary, yet this modest in- mentally change the risk calculus. Davis, CA,
crease in complexity could exhaust Critical functions can scale indepen- Contact: Jon Rokne,
Email: [email protected]
its benefits. Nevertheless, these ap- dently from each other and from the
proaches can help us extend our rest of the system. Each security-rel- August 22–26
abilities as we work to create new evant use case is exposed to dramati- SIGCOMM ‘16: ACM SIGCOMM
building blocks. cally less overall complexity and can 2016 Conference,
Salvador, Brazil,
be optimized separately on the value/ Sponsored: ACM/SIG,
Security and the Technology complexity curve. Contact: Jon Crowcroft,
Industry’s Future Although Moore’s Law is slowing, Email: [email protected]
The benefits of feature enhance- transistor costs will continue to fall. If
August 29–Sept 3
ments to existing products have di- hardware budgets for security stay con- SBCCI ‘16: 29th Symposium
minishing returns. The most impor- stant, the number of security blocks on Integrated Circuits
tant capabilities get implemented that can be added to each chip will in- and Systems Design,
first. Doubling the lines of code in a crease exponentially. These blocks can Belo Horizonte, Brazil,
Contact: Davies William de
word processor will not make the pro- be tailored for different use cases. They Lima Monteiro,
gram twice as useful. A smartphone can also be organized with redundancy Email: [email protected]
with two CPUs is only a little better to avoid single points of failure like the
than a phone with one. one that doomed the Silver Bridge. September
From a security perspective, extra Better hardware foundations
September 3–7
features can create risks that scale fast- can enable a new evolutionary proc- ASE ’16 ACM/IEEE International
er than the increase in complexity (see ess that is essential for the technol- Conference on Automated
Figure 3). As a result, the technology in- ogy industry’s future. Problems that Software Engineering,
Singapore,
dustry faces a troubling curve: as com- are unsolvable today due to uncon- Contact: David Lo,
plexity increases, the benefits from strained interconnectedness can be Email: [email protected]
added features are undermined and isolated. Over time, secure domains
ultimately overwhelmed by risk. When can improve and evolve, addressing September 6–9
MobileHCI ‘16: 18th
more advanced products become less a growing range of security-sensitive International Conference on
valuable, innovation stalls. needs. Eventually, claims of security Human-Computer Interaction
Many applications are near or al- may even be based on a realistic un- with Mobile Devices and
ready beyond the point where value be- derstanding of what humans can suc- Services,
Florence, Italy,
gins to decline without new approach- cessfully implement. Sponsored: ACM/SIG,
es to security. Current efforts to build Contact: Fabio Paterno,
the ‘Internet of Things’ or ‘Smart Cit- Paul Kocher ([email protected]) is President and Email: [email protected]
Chief Scientist in the Cryptography Research division of
ies’ using conventional hardware and Rambus in Sunnyvale, CA.
operating systems will produce con-
nected systems that are plagued with Copyright held by author.

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 25
V
viewpoints

DOI:10.1145/2955114 Yasmin B. Kafai

Education
From Computational Thinking
to Computational Participation
in K–12 Education
Seeking to reframe computational thinking as computational participation.

C
OMPUTATIONAL THINKING HAS
become a battle cry for cod-
ing in K–12 education. It is
echoed in statewide efforts to
develop standards, in chang-
es to teacher certification and gradua-
tion requirements, and in new curricu-
lum designs.1 The annual Hour of Code
has introduced millions of kids to cod-
ing inspired by Apple cofounder Steve
Jobs who said, “everyone should learn
how to program a computer because
it teaches you how to think.” Compu-
tational thinking has garnered much
attention but people seldom recognize
that the goal is to bring programming
back into the classroom.
In the 1980s many schools featured
Basic, Logo, or Pascal programming
computer labs. Students typically re-
ceived weekly introductory program-
ming instruction.6 These exercises Students in a Makey Makey workshop conducted by volunteers from Robogals Wellesley.
were often of limited complexity, dis-
connected from classroom work, and Under what circumstances do they do thinking.7 Computational participation
lacking in relevance. They did not de- it, and how?2 Computational think- involves solving problems, designing
liver on promises. By the mid-1990s ing and programming are social, cre- systems, and understanding human
most schools had turned away from ative practices. They offer a context for behavior in the context of computing.
programming. Pre-assembled multi- making applications of significance It allows for participation in digital ac-
media packages burned onto glossy for others, communities in which de- tivities. Many kids use code outside of
PHOTO C OURT ESY OF ROBO GA LS W ELLESLEY

CD-ROMs took over. Toiling over syn- sign sharing and collaboration with school to create and share. Youth-gen-
tax typos and debugging problems others are paramount. Computational erated websites have appeared to make
were no longer classroom activities. thinking should be reframed as com- and share programmable media online.
Computer science is making a putational participation. These sites include video games, inter-
comeback in schools. We should not active art projects, and digital stories.
repeat earlier mistakes, but leverage Computational Participation They are inherently do-it-yourself (DIY),
what we have learned.5 Why are stu- This idea expands on Jeannette Wing’s encouraging youth programming as an
dents interested in programming? original definition of computational effective way to create and share online,

26 COM MUNICATIO NS O F TH E AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 viewpoints

and connect with each other, unlike Broadening computational par-

learned disciplines such as algebra or ticipation gets students into the club-
chemistry. Through individual endeav- How do we facilitate house. The next challenge is to help
or mixed with group feedback and col- broader and deeper them develop fluency that permits
laboration the DIY ethos opens up three them to engage deeply, making their
new pathways for engaging youth. participation in participation meaningful and enrich-
From building code to creating the design of ing. These levels of computational
shareable applications. Programming participation are still rare. To learn
that prizes coding accuracy and effi- the programming to code students must learn the tech-
ciency as signifiers of success is boring. activities, tools, nicalities of programming language
To learn programming for the sake of and common algorithms, and the so-
programming goes nowhere for chil- and practices? cial practices of programming com-
dren unless they can put those skills to munities.
use in a meaningful way. Today children
program to create applications like vid- Conclusion
eo games or interactive stories as part of Computational participation provides
a larger learning community.3 They are new direction for programming in
attracted to the possibility of creating predominantly individualistic view to K–12 education. It moves us beyond
something real and tangible that can greater focus on underlying social and tools and code to community and con-
be shared with others. Programming is cultural dimensions of programming. text. It equips designers, educators,
not an abstract discipline, but a way to We should rethink what and how stu- and researchers to broaden and deep-
“make” and “be” in the digital world. dents learn to become full participants en computational thinking on a larger
From tools to communities. Coding in networked communities. scale than previously. Users of digital
was once a solitary, tool-based activity. technologies for functional, political,
Now it is becoming a shared social prac- Broadening and Deepening and personal purposes need a basic
tice. Participation spurred by open soft- Computational Participation understanding of computing. Students
ware environments and mutual enthusi- It is not possible to addresses all of the must understand interfaces, technolo-
asm shifts attention from programming difficulties of implementing compu- gies, and systems that they encounter
tools to designing and supporting com- tational participation by placing stu- daily. This will empower them and pro-
munities of learners. The past decade dents in groups, having them program vides them with the tools to examine
has brought many admirable introduc- applications, and encouraging them and question design decisions they en-
tory programming languages to make to remix code. Computational par- counter. Computing for communicat-
coding more intuitive and personal. ticipation will present new challenges ing and interacting with others builds
Developers and educators realize that in bringing programming back into relationships. Education activist Paulo
tools alone are not enough. Audiences schools. How do we facilitate broader Freire once said that “reading the word
are needed, and a critical mass of like- and deeper participation in the design is reading the world.” He was right.
minded creators. Scratch, Alice, and of the programming activities, tools, Today, reading code is about reading
similar tools have online communities and practices? the world. It is needed to understand,
of millions of young users. Children can Computational thinking is a social change, and remake the digital world
work and share programs on a single practice. We must broaden access to in which we live.
website. This tacitly highlights the com- communities of programming.4 Chil-
munity of practice that has become a dren are not “digital natives” who References
1. Grover, S. and Pea, R. Computational thinking in
key for learning to code. naturally migrate online. Establishing K–12: A review of the state of the field. Educational
From “from scratch” creation to “re- membership in the programming com- Researcher 42, 2 (2013), 59–69.
2. Kafai, Y.B. and Burke, Q. Connected Code: Why
mixing.” These new, networked com- munity is not easy. Groups with power- Children Need to Learn Programming. MIT Press,
munities focus on remixing. Students ful learning cultures are often exclusive Cambridge, 2014.
3. Kafai, Y.B. and Burke, Q. Constructionist gaming:
once created programs from scratch cultures. Students need strategies to Understanding the benefits of making games for learning.
Educational Psychologist 50, 4 (2015), 313–334.
to demonstrate competency. Now they cope with the vulnerability of sharing 4. Margolis, J. Estrella, E., Goode, G., Holme, J. J. and
pursue seamless integration via remix- one’s work for others to comment on Nao, K. Stuck in the Shallow End: Race, Education, and
Computing. MIT Press, Cambridge, 2008.
ing as the new social norm, in the spirit and remix. 5. Palumbo, D.B. Programming language/problem-
of the open source movement. Sharing In addition, students need a more solving research: A review of relevant issues. Review
of Educational Research 60, 1 (1990), 65–89.
one’s code encourages others to sam- expansive menu of computing activi- 6. Papert, S. Mindstorms: Children, Computers, and
ple creations, adjust them, and add to ties, tools, and materials. Designing Powerful Ideas. Basic Books, New York, 1980.
7. Wing, J.M. Computational thinking. Commun. ACM 49,
them. Such openness heightens poten- authentic applications is an important 3 (Mar. 2006), 33–35.
tial for innovation across the board. step in the right direction, but games,
Young users embrace sampling and stories, and robotics are not the only Yasmin B. Kafai ([email protected]) is a Professor
sharing more freely, challenging the applications for achieving this goal. and Chair of the Teaching, Learning, and Leadership
Division in the Graduate School of Education at the
traditional top-down paradigm. We need different materials to expand University of Pennsylvania.
These three shifts signal a social turn students’ perspectives and perceptions
in K–12 computing. They move from a of computing. Copyright held by author.

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 27
V
viewpoints

DOI:10.1145/2955116 George V. Neville-Neil

Article development led by
queue.acm.org

Kode Vicious
Chilling the
Messenger
Keeping ego out of software-design review.
Dear KV,
I was recently hired as a mid-level Web
developer working on version 2 of a
highly successful but outdated Web
application. It will be implemented
with ASP.Net WebAPI. Our archi-
tect designed a layered architecture,
roughly like Web Service > Data Ser-
vice > Data Access. He noted that data
service should be agnostic to Entity
Framework ORM (object-relational
mapping), and it should use unit-of-
work and repository patterns. I guess
my problem sort of started there.
Our lead developer has created a
solution to implement the architec-
ture, but the implementation does
not apply the unit-of-work and reposi-
tory patterns correctly. Worse, the
code is really difficult to understand
and it does not actually fit the archi-
tecture. So I see a lot of red flags com-
ing up with this implementation. It
took me almost an entire weekend to
work through the code, and there are
still gaps in my understanding.
This week our first sprint starts,
and I feel a responsibility to speak up
and try to address this issue. I know new kid on the block trying to change Dear ~Opinionated,
that I will face a lot of resistance, just the game. I also don’t want to be per- Let me work backward through your
based on the fact that the lead devel- ceived as Mr. Know-It-All, even though letter from the end. You are asking me,
oper wrote that code and understands I might be a little more opinionated Kode Vicious, how to point out prob-
it more than the alternatives. He may than I should be sometimes. lems without offending anyone? Have
IMAGE BY MA RYNA PLESH KUN

not see the issue that I will try to con- My question is, how can I convince you read any of my previous columns?
vey. I need to convince him and the the team that there is a real problem Let’s just start out with the KV ground
rest of the team that the code needs with the implementation without of- rules: it’s only the law and other del-
to be refactored or reworked. I feel fending anyone? eterious side effects that keep me on
apprehensive, because I am like the ~Opinionated the “right” side of violence in some

28 COMMUNICATIO NS O F TH E ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 viewpoints

meetings. I’d like to think a jury of my Returning to the question of of-

peers would acquit me should I eventu- fense, I have found only one legal way
ally cross to the wrong side, but I don’t The one thing to avoid giving offense, and that is al-
want to stake my freedom on that. I will not to do in ways to phrase things as questions.
try my best to give you solutions that do Often called the Socratic method, this
not land you in jail, but I will not guar- a design review can be a good way to get people to ex-
antee them not to offend. is to turn it plain to you, and often to themselves,
Trying to correct someone who what they think they are doing. The So-
has just done a lot of work, even if, into a code review. cratic method can be applied in an an-
ultimately, that work is not the right noyingly pedantic way, but since you’re
work, is a daunting task. The person trying not to give offense, I suggest you
in question no doubt believes that play by a few useful rules. First, do not
he has worked very hard to produce hammer the person with a relentless
something of value to the rest of the lead developer to get away with that, list of questions right off. Remember
team, and walking in and spitting on so you should call for a design review that you are trying to explore the de-
it, literally or metaphorically, prob- where you take the lid off the box and sign space in a collaborative way; this
ably crosses your “offense” line—at poke around at the parts inside. In fact, is not an interrogation. Second, leave
least I think it does. I’m a bit sur- questions 2 and 3 are going to be your spaces for the people you’re working
prised that since this is the first sprint main tools for figuring out what the with to think. A pause doesn’t mean
and there is already so much code software does and whether or not it is they don’t know; in fact, it might be
written, shouldn’t the software have suitable for the task. that they’re trying to adjust their men-
shown up after the sprints established When I have to interview people tal model of the system in a way that
what was needed, who the stakehold- for jobs, I always ask them questions will be beneficial to everyone when the
ers were, and so forth? Or was this a about systems they have worked on review is done. Lastly, try to vary the
piece of previously existing code that while we draw out the block diagram questions you ask and the words you
was being brought in to solve a new on a whiteboard: What are the major use. No one wants to be subjected to a
problem? It probably doesn’t matter, components? How does component A lot of, “And then what happens?”
because the crux of your letter is the talk to component B? What happens Finally, I find that when I’m in a de-
fact that you and your team do not if C fails? I’m trying to transfer their sign review and about to do something
sufficiently understand the software mental images of their software into that might give offense, such as throw-
in question to be comfortable with my own mind, of course without either ing a chair or a whiteboard marker, I
fielding it. going mad or having a nasty flashback. try to do something less obvious. My
In order to become more comfort- Some pieces of software are best left personal style is to take off my glasses,
able with the system, there are two outside your mind, but hopefully that’s put them on the table and speak in a
things to call for: a design review and a not going to be the case with the sys- very calm voice. That usually doesn’t
code review. These are not actually the tem you’re working with. offend, but it does get people’s atten-
same things, and KV has already cov- Remember that every box this per- tion, which leads them to concentrate
ered how to conduct a code review (see son draws can be opened if you think harder on working to understand the
my October 2009 Communications col- you’re not getting sufficient detail. problem we’re all trying to solve.
umn Kode Reviews 101). Let’s talk now Much like the ancient game show, KV
about a design review. “Let’s Make a Deal,” it is always OK for
A software design review is intended you to ask, “What’s behind door num-
Related articles
to answer a basic set of questions: ber 1, Monty?” Of course, you might on queue.acm.org
1. How does the design take inputs find that it’s a goat, but hopefully you
The Code Delusion
and turn them into outputs? find that it’s a working set of compo- Stan Kelly-Bootle
2. What are the major components nents that are understandable to you http://queue.acm.org/detail.cfm?id=1317411
that make up the system? and the team.
Verification of Safety-critical Software
3. How do the components work to- The one thing not to do in a design B. Scott Andersen and George Romanski
gether to achieve the goals set out by review is turn it into a code review. http://queue.acm.org/detail.cfm?id=2024356
the design? You are definitely not interested in Lazarus Code
That all sounds simple, but the devil the internals of any of the algorithms, George Neville-Neil
is in the level of the details. Many soft- at least not yet. The only code you http://queue.acm.org/detail.cfm?id=2773214
ware developers and systems archi- might want to look at are the APIs
tects would prefer that everyone but that glue the components together, George V. Neville-Neil ([email protected]) is the proprietor of
Neville-Neil Consulting and co-chair of the ACM Queue
themselves see the systems they have but even these are best left abstract, editorial board. He works on networking and operating
built as black boxes, where data goes so that the amount of detail does not systems code for fun and profit, teaches courses on
various programming-related subjects, and encourages
in and other data comes out, no ques- overwhelm you. Remember that the your comments, quips, and code snips pertaining to his
tions asked. You clearly do not have the goal is always to get the big picture Communications column.
necessary level of trust with the soft- rather than the fine details, at least in
ware you’re working with to allow the a design review. Copyright held by author.

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 29
V
viewpoints

DOI:10.1145/2955110 Ben Shneiderman

Viewpoint
Teamwork in
Computing Research
Considering the benefits and downsides
of collaborative research.

T
E A M WO RK H AS LON G been a sonalities are fruitfully combined.6 In statistically significantly higher ratings
part of computing research, short, research teams of two to 10 mem- than papers whose authors were either all
but now advanced technolo- bers and larger groups of hundreds of academics or all business practitioners.
gies and widespread profi- researchers, can accomplish much more This added to the evidence that diversity
ciency with collaboration tech- and conduct higher quality work than in teams is a catalyst for high quality.8
nologies are creating new opportunities. they could just two decades ago when the However, teamwork has downsides,
The capacity to share data, computing Internet was a novelty.10 requiring extra coordination among
resources, and research instruments has The growth of research teams was collaborators, learning new disciplines,
been growing steadily, just as predicted well documented in a series of papers by adjusting to fresh research methods,
when Bill Wulf coined the term “collabo- Wuchty, Jones, and Uzzi.5,13,14 They report- and accommodating different person-
ratories” a quarter of a century ago.2,15,16 ed that from the 1950s to 2000 the aver- alities.4 These downsides mean that
Teamwork has become the over- age number of journal paper co-authors those who engage in teamwork will
whelmingly dominant form of research, in science and engineering grew from 1.9 need to learn how to do it effectively, so
so rewarding effective teams, teaching to 3.5. They also showed that the impact as to attain the full benefits.
our students how to collaborate, and sup- as measured by journal citation counts
porting research on what works and what increased as the number of authors grew. Doing Teamwork Right
doesn’t have taken on new importance. Furthermore, the benefit of teamwork The interest in research teams and larger
grew over time. In 1955, team papers at- groups has now accelerated with the pub-
The Case For and tracted 1.7 times as many citations as lication of the National Academies report
Against Teamwork solo-authored papers, but by 2000 the Enhancing the Effectiveness of Team Science.3
In recent years, the tools for locating rel- advantage grew to 2.1 times as many cita- This report adds recent evidence that
evant documents, finding team members tions, suggesting that technologies and teams and larger groups are a growing
with special skills, coordinating sched- teamwork skills had enabled teams to be phenomenon in science and engineer-
ules, and refining reports collaboratively more effective than they were in the past. ing research, where multiple authorship
has grown substantially.7 In addition to A study of the papers for the ACM SIG- has risen to 90% of all papers in 2013.
these technology advances, the willing- KDD 2014 Conference, by program chairs The report makes another useful
ness and fluency with which young re- Jure Leskovec and Wei Wang, added evi- contribution by characterizing seven
searchers appear to use video and audio dence of the benefits of teamwork. The dimensions that challenge today’s re-
conferencing, curated datasets, shared reviewer ratings of the 1,036 submitted search teams (see the accompanying ta-
document editors, task managers, and papers increased steadily for papers with ble). Teams on the left side of the range
other collaboration tools grows steadily. up to five co-authors, then remained are easier to manage, while teams on
Another driving force for teamwork level. Reviewer ratings may be imperfect, the right side of the range are more dif-
and larger group collaborations is what but this bit of evidence seems potent, es- ficult to manage, suggesting that these
I see as the increased ambition of team pecially since this conference had an im- deserve more study.3 The report offers
members and the growing expectations pressively rigorous acceptance rate of ap- suggestions of how to improve team pro-
from research leaders. Teamwork brings proximately 14%. Another outcome was cesses and calls for increased research
more than larger capacity for work; it tied to the ratings for papers. Those pa- on teams and larger groups.
opens new possibilities when different pers whose authors included a mix of aca- Teams and larger groups of academics
disciplines, research methods, and per- demics and business practitioners had and practitioners seem likely to be more

30 COMM UNICATIO NS O F THE AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 viewpoints

effective in choosing meaningful prob- come part of breakthroughs than those A third step, for government agen-
lems, forming successful research plans, who go it alone. cies, would be to increase funding to
and in testing hypotheses in living labo- A near-term impediment to teamwork study computing research teams so as to
ratories at scale. Teaming between ap- is the difficulty that researchers expect to enable leaders to form and manage suc-
plied and basic researchers is likely to be have when facing hiring, tenure, and pro- cessful teams. Teamwork is difficult since
a growing trend, as indicated by a recent motion committees, who are perceived it requires different skills than working
National Science Foundation program as having trouble in assessing individu- alone, but the potential for greater impact
announcement, Algorithms in the Field:11 als who contribute to teams. Even team makes teamwork attractive. A strong re-
“Algorithms in the Field encourages clos- members who have participated in many search agenda would include applied and
er collaboration between two groups of award-winning papers fear they will find basic components to understand which
researchers: (i) theoretical computer sci- it difficult to convince review committees incentives and rewards best amplify suc-
ence researchers, who focus on the de- of their contributions. Being a first author cess within the seven dimensions of the
sign and analysis of provably efficient and helps gain recognition, as does docu- National Academies report.
provably accurate algorithms for various menting the role of each team member in
computational models; and (ii) applied the acknowledgments section. Writing a References
1. ACM 2014 Conference on Knowledge Discovery and
researchers including a combination of single-author paper, when this is warrant- Data Mining (ACM-KDD); www.kdd2014.org
systems and domain experts.” ed, may also help in many disciplines. 2. Cerf, V.G. et al. National Collaboratories: Applying
Information Technologies for Scientific Research.
Teamwork between academics and National Academy Press, Washington, D.C. (1993).
3. Cooke, N.J. and Hilton, M.L., Eds. Enhancing the
practitioners can have strong benefits, Recommendations Effectiveness of Team Science. National Academies
as does multidisciplinary collaboration In light of the growing interest in team- Press, Washington, D.C. (2015); http://www.nap.
edu/19007
within academic communities. A clear work, appointment, promotion, and ten- 4. Cummings, J. and Kiesler, S. Collaborative research
testimonial for joint research bridging ure committees would do well to update across disciplinary and organizational boundaries.
Social Studies of Science 35, 5 (2005), 703–722.
computer science and other disciplines their methods for documenting and as- 5. Jones, B.F., Wuchty, S., and Uzzi, B. Multi-University
comes from David Patterson’s review of sessing teamwork, so as to encourage research teams: Shifting impact, geography, and
stratification in science. Science 322, 5905 (2008),
his 35-plus years running research labs and reward effective team participation 1259–1262; DOI:10.1126/science.1158357
on computer systems: “The psychologi- and leadership. One example to follow 6. Nelson, B. The data on diversity. Commun. ACM 57, 11
(Nov. 2014), 86–95.
cal support of others also increases the is the University of Southern Califor- 7. Olson, J.S. and Olson, G.M. Working Together Apart:
collective courage of a group. Multidisci- nia, which has developed guidelines to Collaboration over the Internet. Morgan & Claypool
Publishers, 2013.
plinary teams, which increasingly involve emphasize a variety of forms of collab- 8. Page, S.E. The Difference: How the Power of Diversity
disciplines outside computer science, orative scholarship and to introduce at- Creates Better Groups, Firms, Schools, and Societies.
Princeton University Press, NJ, 2007.
have greater opportunity if they are will- tribution standards for contributions to 9. Patterson, D. How to build a bad research center.
ing to take chances that individuals and larger projects.12 Commun. ACM 57, 3 (Mar. 2014), 33–36.
10. Spector, A., Norvig, P., and Petrov, S. Google’s hybrid
companies will not.”9 A second step, for computing edu- approach to research, Commun. ACM 55, 7 (July
2012), 34–37.
Patterson concludes with his vision cators, would be to increase teamwork 11. U.S. National Science Foundation Program on
of the growth of multidisciplinary teams: training and experiences, so as to raise Algorithms in the Field (AitF); http://www.nsf.gov/
pubs/2015/nsf15515/nsf15515.htm
“Whereas early computing problems the quality of students’ work. Team 12. University of Southern California, Guidelines for
were more likely to be solved by a single projects in undergraduate and graduate Assigning Authorship and for Attributing Contributions
to Research Products and Creative Works (Sept.
investigator within a single discipline, I courses would train students in using 16, 2011); http://www.usc.edu/academe/acsen/
believe the fraction of computing prob- collaboration tools and nurture their Documents/senate%20news/URC_on_Authorship_
and_Attribution_20110916.pdf
lems requiring multidisciplinary teams communication skills for future profes- 13. Wuchty, S., Jones, B. F., and Uzzi, B., The increasing
will increase.” sional or research jobs. The National dominance of teams in production of knowledge.
Science 316, 5827 (2007a), 1036–1039. DOI:10.1126/
There is always room for solitary re- Academies report makes many recom- science.1136099
searchers who wish to pursue their own mendations that need to be tailored to fit 14. Wuchty, S., Jones, B. F., and Uzzi, B., Why do team-
authored papers get cited more? Response. Science
projects. There are substantial advan- local computing cultures and the seven 317, 5844, (2007b), 1497–1498.
tages to working alone, but those who dimensions on which today’s research 15. Wulf, W.A. The collaboratory opportunity. Science 261,
5123 (1993), 854–855; DOI: 10.1126/science.8346438
learn team skills are more likely to be- teams differ in complexity. 16. Wulf, W.A. The National Collaboratory—A White Paper.
In Towards a National Collaboratory, the unpublished
report of a workshop held at Rockefeller University,
Seven dimensions that challenge today’s research teams. March 17–18, 1989 (Joshua Lederberg and Keith
Uncapher, co-chairs).

Dimension Range
Diversity of team or group membership Homogeneous Heterogeneous Ben Shneiderman ([email protected]) is a Distinguished
University Professor of computer science at the University
Disciplinary integration Unidisciplinary Transdisciplinary of Maryland, a Member of the National Academy of
Engineering, and the author of The New ABCs of Research:
Team or group size Small (2) Mega (1000s)
Achieving Breakthrough Collaborations (Oxford University
Goal alignment across teams Aligned Divergent or Misaligned Press, April 2016).
Permeable team and organizational Stable Fluid
boundaries Thanks to the anonymous reviewers and readers of early
drafts, including Nancy Cooke, Gerhard Fischer, Kara Hall,
Proximity of team or group members Co-located Globally distributed Margaret Hilton, Judy Olson, Scott Page, Dave Patterson,
Task interdependence Low High and Jennifer Preece.

Copyright held by author.

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 31
practice
D OI:1 0.1 1 4 5/29 09 480

 rticle development led by

A
queue.acm.org

ShiViz is a new distributed system

debugging visualization tool.
BY IVAN BESCHASTNIKH, PATTY WANG,
YURIY BRUN, AND MICHAEL D. ERNST

Debugging
Distributed
Systems

DISTRIBUTED SYSTEMS POSE unique challenges for

software developers. Reasoning about concurrent
activities of system nodes and even understanding the
system’s communication topology can be difficult.
A standard approach to gaining insight into system
activity is to analyze system logs. Unfortunately, this can Heterogeneity. A distributed sys-
tem’s nodes may include mobile
be a tedious and complex process. This article looks phones, laptops, server-class ma-
at several key features and debugging challenges that chines, and more. This hardware and
differentiate distributed systems from other kinds of software diversity in node resources
and network connectivity can make a
software. The article presents several promising tools distributed system more robust, but
and ongoing research to help resolve these challenges. this heterogeneity forces developers
to manage compatibility during both
Distributed systems differ from single-machine development and debugging.
programs in ways that are simultaneously positive Concurrency. Simultaneous op-
in providing systems with special capabilities, and eration by multiple nodes leads to
concurrency, which can make a dis-
negative in presenting software-development and tributed system outperform a cen-
operational challenges. tralized system. However, concur-

32 COMMUNICATIO NS O F TH E AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 rency may introduce race conditions consistent. Potential inconsistencies failures of entire data centers.2 Achiev-
and deadlocks, which are notorious- are prevented by distributed algo- ing such fault tolerance, however, re-
ly difficult to diagnose and debug. rithms, such as those that guarantee quires developers to reason through
Additionally, networks introduce a particular flavor of data consisten- complex failure modes. For most dis-
packet delay and loss, exacerbating cy and cache coherence. Developers tributed systems, fault tolerance can-
the issues of understanding and de- may find it difficult, or even impossi- not be an afterthought; the systems
bugging concurrency. ble, to reconstruct the global state of must be designed to deal with failures.
Distributing state. Distributing the system when it is distributed on Such failure resiliency is complex to
system state across multiple nodes many nodes. This complicates bug design and difficult to test.
IMAGE F RO M SH UTT ERSTOCK.CO M

can remove a central point of failure diagnosis and validation.

and improve scalability, but distrib- Partial failures. The distribution Existing Approaches
uted state requires intricate node of state and responsibility allows dis- What follows is an overview of seven
coordination to synchronize state tributed systems to be robust and sur- approaches designed to help software
across nodes—for example, nodes vive a variety of failures. For example, engineers validate and debug distrib-
must ensure their local states are Google’s Spanner system can survive uted systems.

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 33
practice

because it focuses on a specific subset

of the data, but it requires instrument-
Distributed Timestamps ing applications and protocols to prop-
erly forward, without consuming, the
A typical distributed-system log does not contain enough information to regenerate tracing metadata.
the happens-before relation, and this is one reason that distributed-system logs are Log analysis is an even lighter-weight
so hard to interpret. ShiViz relies on logs that have been enhanced by another tool,
ShiVector, to include vector clock timestamps that capture the happens-before relation approach that works with systems that
between events.10 Each node α maintains a vector of logical clocks, one clock for each cannot be modified. It is a common
node in the distributed system, including itself. α’s ith clock is a lower bound on the black-box approach in which a system’s
current logical time at node i. The node α increments the αth component of its vector
clock each time it performs a local action or sends or receives a message. Each message
console logs, debug logs, and other log
contains the sending node’s current vector clock; upon message receipt, the receiving sources are used to understand the sys-
node updates its vector clock to the elementwise maximum of its local and received tem. For example, Xu et al. applied ma-
timestamps. chine learning to logs to detect anoma-
ShiVector is a lightweight instrumentation tool that augments the information
already logged by a distributed system with the partial ordering information encoded lies in Google infrastructure services.17
as vector clocks. ShiVector interposes on communication and logging channels at each Detailed logs from realistic systems
node in the system to add vector clock timestamps to every logged event. contain a great deal of valuable detail,
ShiViz parses ShiVector-augmented logs to determine, for each event: the node
that executed the event; the vector timestamp of the event; and the event’s description.
but they tend to be so large that they are
ShiViz permits a user to customize the parsing of logs using regular expressions, which overwhelming to programmers, who as a
can be used to associate additional information, or fields, with each event. result cannot directly benefit from them.
Visualization. The complexity of dis-
tributed systems has inspired work on
Testing. A test suite exercises a spe- Howard isomorphism; the Coq specifi- visualization of such systems to make
cific set of executions to ensure that they cation is then compiled into an OCaml them more transparent to developers.
behave properly. Most testing of dis- implementation of the distributed sys- For example, Theia displays a visual sig-
tributed systems is done using manu- tem.16 In contrast, IronFleet uses TLA nature that summarizes various aspects
ally written tests, typically introduced and Hoare-logic verification to similarly of a Hadoop execution, such as the exe-
in response to failures and then mini- produce a verified implementation of cution’s resource utilization.3 These sig-
mized.14 Testing is an effective way to de- a distributed system.5 The enormous natures can be used to spot anomalies
tect errors. However, since testing exer- effort needed to use these tools makes and to compare executions. Tools such
cises a limited number of executions, it them most appropriate for new imple- as Theia provide high-level summaries
can never guarantee to reveal all errors. mentations of small, critical cores. Oth- of a system’s behavior. They do not,
Model checking is exhaustive testing, er techniques are needed for existing however, help a developer understand
typically up to a certain bound (number distributed systems. the underlying communication pattern
of messages or steps in an execution). Record and replay captures a single in the system, including the distributed
Symbolic model checking represents execution of the system so that this ordering of messages.
and explores possible executions math- execution can be later replayed or ana-
ematically; explicit-state model check- lyzed. This is especially useful when de- Visualizing Distributed-System
ing is more practical because it actually bugging nondeterministic behaviors. A Executions
runs the program, controlling its execu- record-and-replay tool such as Friday4 As noted earlier, the ability to visualize
tions rather than attempting to abstract or D3S8 captures all nondeterministic distributed-system executions can
it. MoDist performs black-box model events so that an execution can be re- help developers understand and de-
checking, permuting message sequenc- produced exactly. Recording a complex bug their distributed systems. ShiViz
es and changing the execution speed execution, however, may be prohibitive- is such a visualization tool, display-
of a process relative to other processes ly expensive and may change the behav- ing distributed-system executions as
in the system.18 MaceMC is a white-box ior of the underlying system. interactive time-space diagrams that
technique that achieves speedups by Tracing tracks the flow of data explicitly capture distributed ordering
adding programming-language sup- through a system, even across applica- of messages and events in the system.
port for model checking.7 Common tions and protocols such as a database, This diagram reproduces the events
problems of all model-checking tools Web server, domain-name server, load and interactions captured in the ex-
are scalability and environmental mod- balancer, or virtual private network ecution log, making the ordering in-
eling, so they rarely achieve a guarantee. protocol.13 For example, pivot tracing formation explicit through a concise
Theorem proving can, in principle, dynamically instruments Java-based visualization. A developer can expand,
prove a distributed system to be free of systems to collect user-defined metrics collapse, and hide parts of the dia-
defects. Amazon uses TLA+ to verify its at different points in the system and col- gram, as well as search for particular
distributed systems.11 Two recent sys- lates the resulting data to provide an in- interaction patterns. ShiViz is freely
tems can construct a verified distribut- ter-component view of the metrics over available as a browser application; any
ed-system implementation. Verdi uses multiple executions.9 Dapper is a lower- developer can visualize a log, without
the Coq tool, whose expressive type sys- level tracing system used at Google to installing software or sending the log
tem makes type checking equivalent to trace infrastructure services.15 Tracing over the network.
theorem proving, thanks to the Curry- is more efficient than record and replay To provide a rich and accurate visu-

34 COMMUNICATIO NS O F TH E ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 practice

alization of a distributed system’s ex- The colored boxes at the top represent distributed-system executions and
ecution, ShiViz displays the happens- nodes, and the vertical lines below corresponding logs. Figure 2 details
before relation. Given event e at node n, them are the node timelines. Circles some of these operations.
the happens-before relation indicates on each node’s timeline represent
all the events that logically precede e. events executed by that node. Edges Understanding Distributed-System
Other events might have already oc- connect events, representing the re- Executions
curred at other nodes according to corded happens-before relation: an ShiViz helps developers to understand
wall-clock time, but node n cannot tell event that is higher in the graph hap- the relative ordering of events and
whether those other events happened pened before an event positioned the likely chains of causality between
before or after e, and they do not affect lower in the graph that it is connected events, which is important for debug-
the behavior of e. This partial order to via a downward path. ShiViz aug- ging concurrent behavior; to query for
can rule out which events do not cause ments the time-space diagram with certain events and interaction patterns
others, identify concurrent events, operations to help developers explore between hosts; and to identify structur-
and help developers mentally replay
parts of the execution. Figure 1. Time-space diagram of an execution with three nodes.
Figure 1 illustrates an execution of
the two-phase commit protocol with replica 1 tx manager replica 2
one transaction manager and two rep-
tx prepare
licas.1 This time-space diagram is a [0,1,0)
visualization of the underlying hap-
commit
pens-before partial order, showing an [0,1,1)
execution with three nodes. Lines with abort
[1,1,0) r2 commit
arrows denote the partial ordering of [0,2,1)
events, each of which has an associated
r1 abort
vector timestamp in brackets. (See the [1,3,1)
accompanying sidebar on timestamps.)
Figure 2 shows a screenshot of
ShiViz visualizing an execution of a tx abort
[1,4,1)
distributed data-store system called
tx aborted tx aborted
Voldemort.12 In the middle of the [2,4,1) [1,4,2)
screen is the time-space diagram,
with time flowing from top to bottom.

Figure 2. A ShiViz screenshot.

Search the visualization Closed, exiting

ShiViz supports searching the time-space date: 2013-05-24 23:28:01,863
diagram by keywords and by structure.
path: voldemort.store.socket.clientrequest.Clien
Log lines Motifs priority: INFO
host: nio-client1
ShiViz display log lines that correspond to the
Boxes represent nodes in the system; the box Hovering over an event
currently visible time-space diagram to the right.
colors provide a consistent coloring for events displays its details.
Protocol negotiated for Socket[addr=/127.0.0.1,port=64151,localport=64146]: voldemort-native-v1
and log lines associated with a node.
792 collapsed events 792 12
12 collapsed events

Protocol negotiated for Socket[addr=/127.0.0.1,port=64152,localport=64149]: voldemort-native-v1

Hidden processes:
Protocol negotiated for Socket[addr=/127.0.0.1,port=64153,localport=64146]: Each
voldemort-native-v1
circle represents an
event on a node timeline.
Protocol negotiated for Socket[addr=/127.0.0.1,port=64154,localport=64149]: voldemort-native-v1
2 collapsed events 2 The user can click on a node to hide it and its
Local events with no
log lines from the visualization. Hidden nodes
intermediate communication
can be restored with a double click.
279Closed, exiting can be collapsed into a larger
Closed, exiting circle labeled with the number
of collapsed events. Clicking on an event
Closed, exiting displays its details in
a popup and
Protocol negotiated for Socket[addr=/127.0.0.1,port=64161,localport=64156]: voldemort-native-v1 highlights the
date: 2013-05-24 23:2
8:01,863 relevant log line in
path: voldemort.store.s the left panel.
Protocol negotiated for Socket[addr=/127.0.0.1,port=64162,localport=64159]: voldemort-native-v1 ocket.clientreque
Protocol negotiated for Socket[addr=/127.0.0.1,port=64163,localport=64156]: voldemort-native-v1
st.ClientRequest
ExecutorFactory
Protocol negotiated for Socket[addr=/127.0.0.1,port=64164,localport=64159]: voldemort-native-v1 $ClientRequestS
2 collapsed events 2 electorManager
priority: INFO
host: nio-client1
Closed, exiting
Closed, exiting

Protocol negotiated for Socket[addr=/127.0.0.1,port=64171,localport=64166]: voldemort-native-v1

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 35
Protocol negotiated for Socket[addr=/127.0.0.1,port=64172,localport=64169]: voldemort-native-v1
Protocol negotiated for Socket[addr=/127.0.0.1,port=64173,localport=64166]: voldemort-native-v1
 practice

Figure 3. Structured search feature. A user can also compose a cus-

tom pattern consisting of nodes, node
events, and connections between events
Sending representing
SLDeliver(Data a partial order. Figure 3
#structure=[{"host":"a","clock":{"a":1}},{"host":"a","clock":{"a":2,"c":1,"b":1}},{"host":"b","clock":{"b":1,"a":1}},{"host":"c","clock":{"c":
Message(1,Message1)) t
o node1
shows such a custom pattern, depicting
Text Search Structured Search three nodes communicating in a ring:
date: 10/13/2014
Search for a custom structure: draw a graph Search for a pre-defined structure: node 1 communicates only with node
14:37:20.550
structure below (add processes, events, click Select one of the options below to host: node0
and drag to add inter-event edges). find the specified structure.
2; node 2 with node 3; and node 3 with
aMessage(1,Message1)) node 1. Drawing this pattern allows the
+
user to search for all instances of this
age(1,Message1)) to node1 three-node ring communication in the
execution. ShiViz automatically trans-
age(1,Message1)) to node2
sage(1,Message1)) from node0 lates the drawn pattern into a textual
representation (see search bar at the
sage(1,Message1)) from node0 top), and it is possible to edit, copy, and
paste the textual representation direct-
essage(1,Message1) from node0
ly. The structured search feature allows
age(1,Message1)) to node0
users to express custom communica-
essage(1,Message1) from node0 tion patterns between events and to
sage(1,Message1)) from node1
Figure 4. The two-phase commit protocol executions. query an execution for instances of the
age(1,Message1)) to node2
age(1,Message1)) to node0
Searchthe
Search thevisualization
visualization
specified pattern. The presence or ab-
sence of queried subgraphs at particu-
age(1,Message1)) to node1
lar points in an execution can help us-
essage(1,Message1) from node1
orted
sage(1,Message1))
ted from node2
ers detect anomalous behavior, aiding
sage(1,Message1)) from node1
e-send
send
them in their debugging efforts.
age(1,Message1)) to node1
Comparing executions. ShiViz can
e-send
send
e-recvd
recvd help users understand multiple execu-
age(1,Message1)) to node2
tions of a system. When ShiViz parses
e-recvd
recvd
multiple executions, the user can
-recvd
ecvd choose between viewing executions in-
sage(1,Message1))
t from node0

sage(1,Message1)) from node2

tx-commit tx-abort dividually or pairwise.
recvd
sage(1,Message1))
cvd from node0 host: replica2 host: replica2 In the pairwise view, a user can
d-send
send
compare the two executions further
by highlighting their differences.
d-send
send
d-recvd
recvd
When enabled, the nodes are com-
pared by name. For nodes present in
d-recvd
recvd
both executions, ShiViz compares
their events one by one by comparing
the corresponding event descriptions.
al similarities and differences between can be further constrained with field Nodes or events in one execution that
pairs and groups of executions. The identifiers and regular expressions. For do not appear in the other are redrawn
time-space diagram representation sup- example, the query node=alice && as rhombuses.
ports the first goal by visualizing event priority=CRITICAL* will highlight Figure 4 illustrates this pairwise
ordering and communication. The next only events at the alice node with a comparison on a log of the two-phase
section describes two search operations priority field matching the regular ex- commit protocol. The two selected
that support the second goal, and op- pression CRITICAL*. events in the figure explain the differ-
erations over multiple executions that In a structured search, a user que- ence between these two executions:
correspond to the third goal. ries ShiViz for any set of events related the two-phase commit successfully
Keyword search and structured through a particular ordering pattern, commits a transaction in the left exe-
search operations. ShiViz implements and ShiViz highlights the sections of the cution, but aborts a transaction in the
two kinds of search operations: key- diagram (events and their interconnec- right execution.
word and structured. Both types are tions) that match this pattern. ShiViz in- The explicit highlighting of differ-
accessible to the developer through the cludes several predefined patterns: ences provides users with fast detec-
top search bar (see Figure 2). ˲˲ Request-response. A source node tion of anomalous events or points
Keyword search allows a developer to sends a request and the destination where the two executions diverge. The
highlight all events in the diagram that node sends back a response. search features described earlier can
contain a field matching a query. For ˲˲ Broadcast. A node sends a message be applied in the pairwise view to help
example, searching for send will high- to most other nodes in the system. developers detect specific unifying or
light all events in the diagram that have ˲˲ Gather. A node receives a message distinguishing features across traces,
a field whose value is send. The results from most other nodes. allowing them to design and test their

36 COMM UNICATIO NS O F THE ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 practice

systems more effectively. bucket.org/shiviz/). Watch a video dem- 7. Killian, C., Anderson, J. W., Jhala, R., Vahdat, A. Life,
death, and the critical transition: Finding liveness
Clustering executions. To help onstrating key ShiViz features at http:// bugs in systems code. In Proceedings of the 4th
manage many executions, ShiViz sup- bestchai.bitbucket.org/shiviz-demo/. Usenix Conference on Networked Systems Design
and Implementation, (2007); https://www.usenix.org/
ports grouping executions into clus- legacy/event/nsdi07/tech/killian/killian.pdf.
ters. A user can cluster by the num- Acknowledgments
 8. Liu, X., Guo, Z., Wang, X., Chen, F., Lian, X., Tang, J.,
Wu, M., Kaashoek, M. F., Zhang, Z. D3S: Debugging
ber of nodes or by comparison to a We thank Perry Liu and Albert Xing, deployed distributed systems. In Proceedings of
base execution, using as a distance who helped develop ShiViz; Jenny the 5th Usenix Symposium on Networked Systems
Design and Implementation, 2008; 423–437; http://
metric the differencing mechanism Abrahamson, who developed the ini- static.usenix.org/event/nsdi08/tech/full_papers/
liu_xuezheng/liu_xuezheng.pdf.
described earlier. Cluster results are tial ShiVector and ShiViz prototypes; 9. Mace, J., Roelke, R., Fonseca, R. Pivot tracing: Dynamic
presented as distinct groups of listed and Donald Acton and Colin Scott, who causal monitoring for distributed systems. In Proceedings
of the 25th Symposium on Operating Systems Principles,
execution names. helped evaluate ShiViz. This work is (2015); 378–393; http://sigops.org/sosp/sosp15/
Execution clusters aid in the inspec- supported by NSERC USRA, the NSERC current/2015-Monterey/122-mace-online.pdf.
10. Mattern, F. Virtual time and global states of distributed
tion and comparison of multiple ex- Discovery grant, and the National Sci- systems. In Proceedings of the International
ecutions by providing an overview of all ence Foundation under grants CCF- Workshop on Parallel and Distributed Algorithms, 1989;
http://homes.cs.washington.edu/~arvind/cs425/doc/
executions at once. Users can quickly 1453474 and CNS-1513055. This ma- mattern89virtual.pdf
scan through cluster results to see terial is based on research sponsored 11. Newcombe, C., Rath, T., Zhang, F., Munteanu, B., Brooker,
M., Deardeuff, M. How Amazon Web Services uses
how executions are alike or different, by DARPA under agreement number formal methods. Commun. ACM 58, 4 (2015), 66–73;
based on the groups into which they FA8750-12-2-0107. The U.S. govern- http://cacm.acm.org/magazines/2015/4/184701-how-
amazon-web-services-uses-formal-methods/fulltext.
are sorted. Clustering also helps users ment is authorized to reproduce and 12. Project Voldemort; http://www.project-voldemort.com/
pinpoint executions of interest by al- distribute reprints for governmental voldemort/.
13. Sambasivan, R.R., Fonseca, R., Shafer, I., Ganger, G. So,
lowing them to inspect a subset of ex- purposes, notwithstanding any copy- you want to trace your distributed system? Key design
ecutions matching a desired measure. right notices thereon. insights from years of practical experience. Parallel
Data Laboratory, Carnegie Mellon University, 2014;
This subset can be further narrowed http://www.pdl.cmu.edu/PDL-FTP/SelfStar/CMU-
PDL-14-102.pdf.
by performing a keyword search or a 14. Scott, C. et al. Minimize faulty executions of distributed
Related articles
structured search on top of the cluster- systems. In Proceedings of the 13th Usenix Symposium
on queue.acm.org on Networked Design and Implementation (Santa
ing results. Execution names among Clara, CA, Mar. 16–18, 2016) 291–309.
clusters are highlighted if their cor- Advances and Challenges in Log Analysis 15. Sigelman, B. H., Barroso, L. A., Burrows, M., Stephenson,
Adam Oliner, Archana Ganapathi, and Wei Xu P., Plakal, M., Beaver, D., Jaspan, S., Shanbhag, C. Dapper,
responding graphs contain instances http://queue.acm.org/detail.cfm?id=2082137 a large-scale distributed systems tracing infrastructure.
matching the user’s search query. Research at Google, 2010; http://research.google.com/
Leveraging Application Frameworks pubs/pub36356.html.
ShiViz helps developers visualize the Douglas C. Schmidt, Aniruddha Gokhale, 16. Wilcox, J. R., Woos, D., Panchekha, P., Tatlock, Z., Wang,
event order, search for communication and Balachandran Natarajan X., Ernst, M. D., Anderson, T. Verdi: A framework for
implementing and formally verifying distributed systems.
patterns, and identify potential event http://queue.acm.org/detail.cfm?id=1017005 In Proceedings of the 36th SIGPLAN Conference on
causality. This can help developers rea- Postmortem Debugging
Programming Language Design and Implementation,
2015, 357–368; https://homes.cs.washington.
son about the concurrency of events in in Dynamic Environments edu/~ztatlock/pubs/verdi-wilcox-pldi15.pdf.
an execution, distributed system state, David Pacheco 17. Xu, W., Huang, L., Fox, A., Patterson, D., Jordan, M.
Experience mining Google’s production console logs. In
and distributed failure modes, as well http://queue.acm.org/detail.cfm?id=2039361 Proceedings of the Workshop on Managing Systems via
as formulate hypotheses about system Log Analysis and Machine Learning Techniques, 2010;
http://iiis.tsinghua.edu.cn/~weixu/files/slaml10.pdf.
behavior and verify them via execution References 18. Yang, J., et al. MoDist: Transparent model checking of
1. Bernstein, P., Hadzilacos, V., Goodman, N. Distributed unmodified distributed systems. In Proceedings of the
visualizations. Meanwhile, the gener- recovery. Concurrency Control and Recovery in 6th Usenix Symposium on Networked Systems Design
ality of logging makes ShiVector and Database Systems, Chapter 7. Addison-Wesley, 1986; and Implementation, 2009, 213–228; https://www.
http://research.microsoft.com/en-us/people/philbe/ usenix.org/legacy/event/nsdi09/tech/full_papers/yang/
ShiViz broadly applicable to systems chapter7.pdf. yang_html/.
2. Corbett, J. C. et al. Spanner: Google’s globally
deployed on a wide range of devices. distributed database. In Proceedings of the 10th
ShiViz has some limitations. ShiViz Usenix Symposium on Operating Systems Design
Ivan Beschastnikh (http://www.cs.ubc.ca/~bestchai/)
and Implementation, 2012; https://www.usenix.org/
surfaces low-level ordering informa- conference/osdi12/technical-sessions/presentation/
works on improving the design, implementation, and
operation of complex systems. He is an assistant
tion, which makes it a poor choice corbett.
professor in the department of computer science at the
3. Garduno, E., Kavulya, S. P., Tan, J., Gandhi, R.,
for understanding high-level system Narasimhan, P. Theia: Visual signatures for problem
University of British Columbia, where he leads a team
of students on projects that span distributed systems,
behavior. The ShiViz visualization is diagnosis in large Hadoop clusters. In Proceedings of
software engineering, security, and networks, with a
the 26th International Conference on Large Installation
based on logical and not realtime or- System Administration, 2012, 33–42; https://users.
particular focus on program analysis.
dering, and cannot be used to study cer- ece.cmu.edu/~spertet/papers/hadoopvis-lisa12- Patty Wang has explored approaches to helping
cameraready-v3.pdf. developers understand and compare multiple distributed
tain performance characteristics. The 4. Geels, D., Altekar, G., Maniatis, P., Roscoe, T., Stoica, I. executions, focusing on summarizing similarities and
ShiViz tool is implemented as a client- Friday: Global comprehension for distributed replay. In differences across traces.
Proceedings of the 4th Usenix Conference on Networked
side-only browser application, making Systems Design and Implementation, (2007); https:// Yuriy Brun (http://people.cs.umass.edu/~brun/) works on
www.usenix.org/legacy/event/nsdi07/tech/full_papers/ automating system building and creating self-adaptive
it portable and appropriate for ana- systems. He is an assistant professor at the University of
geels/geels.pdf.
lyzing sensitive log data. This design 5. Hawblitzel, C., Howell, J., Kapritsos, M., Lorch, J. R., Massachusetts, Amherst.
choice, however, also limits its scalabil- Parno, B., Roberts, M. L., Setty, S., Zill, B. IronFleet:
Michael D. Ernst (http://homes.cs.washington.edu/~mernst/)
Proving practical distributed systems correct. In
ity. A related and complementary tool researches ways to make software more reliable, more
Proceedings of the 25th Symposium on Operating
secure, and easier to produce. His primary technical interests
Systems Principles; 2015; http://sigops.org/sosp/sosp15/
to ShiViz is Ravel, which can scalably current/2015-Monterey/250-hawblitzel-online.pdf.
are in software engineering, programming languages, type
theory, and security, among others.
visualize parallel execution traces.6 6. Isaacs, K.E. et al. Combing the communication hairball:
Visualizing parallel execution traces using logical time.
ShiViz is an open source tool with an IEEE Transactions on Visualization and Computer Copyright held by authors.
online deployment (http://bestchai.bit- Graphics 20, 12 (Dec 2014), 2349–2358. Publication rights licensed to ACM. $15.00.

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 37
practice
DOI:10.1145/ 2948983
easily with set-oriented operations.
 rticle development led by
A
queue.acm.org
Second, the high-level expression of
the programmer’s intent has empow-
ered huge performance gains.
SQL has a brilliant future as a major figure This article discusses how these
in the pantheon of data representations. features are dependent on SQL cre-
ating a notion of stillness through
BY PAT HELLAND transactions and a notion of a tight
group of tables with schema fixed at

The
the moment of the transaction. These
characteristics are what make SQL dif-
ferent from the increasingly pervasive
distributed systems.
SQL has a brilliant past and a bril-
liant future. That future is not as the
singular and ubiquitous holder of data

Singular
but rather as a major figure in the pan-
theon of data representations. What
the heck happens when data is not
kept in SQL?

SQL: The Miracle of the Age,

of the Ages, and of the Aged

Success
I launched my career in database
implementation when Jimmy Carter
was president. At the time, there were
a couple of well-accepted represen-
tations for data storage: the network
model was expressed in the CODASYL

of SQL
(Conference/Committee on Data Sys-
tems Languages) standard with data
organized in sets having one set owner
(parent) and multiple members (chil-
dren); the hierarchical model ensured
all data was captured in a tree structure
with records having a parent-child-
grandchild relationship. Both of these
models required the programmer to
navigate from record to record.
Then along came these new-fangled
relational things. INGRES (and its lan-
guage QUEL) came from UC Berkeley.
System-R (and its language SQL) came
from IBM Research. Both leveraged re-
lational algebra to support set-oriented
SQL HAS BEEN singularly successful in its impact on the abstractions allowing powerful access
database industry. Nothing has come remotely close to to data.
At first, they were really, really, really
its ubiquity. Its success comes from its high-level use of slow. I remember lively debates with
relational algebra allowing set-oriented operations on database administrators who fervently
IMAGE BY FOC AL PO INT

data shaped as rows, columns, cells, and tables. believed they must be able to know the
cylinder on disk holding their records!
SQL’s impact can be seen in two broad areas. First, They most certainly did not want to
the programmer can accomplish a lot very change from their hierarchical and

38 COM MUNICATIO NS O F TH E AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 39
practice

network databases. As time went on, ing the computation. SQL is supposed
SQL became inexorably faster and to produce consistent results. Those
more powerful. Soon, SQL meant data- consistent results are dependent on in-
base and database meant SQL. put data that appears to be unchanging.
A funny thing happened by the early
2000s, though. People started putting Distributed Transactions and, specifically,
transactional isolation provide the
data in places other than “the data-
base.” The old-time database people
transactions across sense that nothing else is happening in
the world.
(including yours truly) predicted their different SQL The Holy Grail of transaction iso-
demise. Boy, were we wrong!
Of course, for most of us who had
databases are rare lation is serializability. The idea is to
make transactions appear as if they
worked so hard to build transaction- and challenging. happened in a serial order. They don’t
al, relational, and strongly consistent actually have to occur in a serial order;
systems, these new representations of it just has to seem like they do.
data in HTML, XML, JSON, and other In the accompanying figure, the red
formats didn’t fit into our worldview. transaction Ti depends upon changes
The radicals of the 1970s and 1980s be- made by the green transactions (Ta, Tb,
came the fuddy-duddies of the 2000s. A Tc, Td, and Tf). The blue transactions
new schism had emerged. (Tk, Tl, Tm, Tn, and To) depend on the
changes made by Ti. Ti definitely is or-
SQL, Values, and Relational Algebra dered after the green transactions and
Relational databases have tables with before the blue ones. It doesn’t matter
rows and columns. Each column in if any of the yellow transactions (Te,
a row provides a cell that is of a well- Tg, Tj, and Th) occur before or after
known type. Data Definition Language Ti. There are many correct serial or-
(DDL) specifies the tables, rows, and ders. What matters is the concurrency
columns and can be dynamically implemented in the system provides a
changed at any time, transforming the view that is serializable.
shape of the data. Suddenly, the world is still and set
The fundamental principle in the re- orientation can smile on it.
lational model is that all interrelating
is achieved by means of comparisons A Sense of Place
of values, whether these values iden- SQL and its relational data are almost
tify objects in the real world or indicate always kept inside a single system or a
properties of those objects. A pair of few systems close to each other. Each
values may be meaningfully compared, SQL database is almost always con-
however, if and only if these values are tained within a trust boundary and pro-
drawn from a common domain. tected by surrounding application code.
The stuff being compared in a query I don’t know of any systems that al-
must have matching DDL or it doesn’t low untrusted third parties to access
make sense. SQL depends on its DDL their back-end databases. My bank’s
being rigid for the duration of the query. ATM, for example, has never let me di-
There is not really a notion of some rectly access its back-end database with
portion of the SQL data having extensi- Java Database Connectivity (JDBC). So
ble metadata that arrives with the data. far, the bank has constrained me to a
All of the metadata is defined before handful of operations such as deposit,
the query is issued. Extensible data is, withdrawal, or transfer. It’s really an-
by definition, not defined (at least at noying! In fact, I can’t think of any en-
the receiver’s system). terprise databases that allow untrusted
SQL’s strength depends on a well- third parties to “party” on their data-
defined schema. Its set-oriented na- bases. All of them insist on using appli-
ture uses the well-defined schema for cation code to mitigate the foreigners’
the duration of the operations. The access to the system.
data and metadata (schema) must re- Interactions occur across these sys-
main still while SQL does its thing. tems, but they are implemented with
some messages or other data exchange
The Stillness and Isolation that is loosely coupled to the underly-
of Transactions ing databases on each side. The mes-
SQL is set oriented. Bad stuff happens sages hit the application code and not
when the set of data slides around dur- the database.

40 COM MUNICATIO NS O F TH E ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 practice

Each of these databases appears Transaction serializability.

to be an island unto itself. Now, that
island may have a ferry or even a four-
lane bridge connecting it to other
Ti doesn’t know about
islands. Still, you always know the is- Te Tg Tj
these transactions and
land upon which you stand when you they don’t know about Ti
access a database.
Ta Ti

Different Places
Means Different Times Tc Tf Tl Tn
Multiple databases sharing a transac-
tional scope is extremely rare. When
a transaction executes on a database, Tb Td Th Tk Tm To

there is no clear and crisp notion of its

time when compared with the time on these transactions these transactions follow Ti
precede Ti
another system’s database. Distributed
transactions across different SQL data-
bases are rare and challenging. empowers MapReduce, Hadoop, and the a single trust boundary such as a depart-
If you assume two databases do not other big-data computation. By being ment or a company. SQL databases pro-
share a transactional scope, then the immutable, the contents are still and the vide the illusion that they exist at a single
simple act of spreading work across set-oriented computations make sense. point in space.
space (the databases) implies spreading Immutable data can be everywhere at Providing a single point in space and
the work across time (multiple transac- any time. That allows it to be both inside time yields both stillness and isolated lo-
tions). This transition from one database the singularity and outside of it. No big cation. This empowers the value-based
to more than one database is a seminal deal. Immutability truly is one of the uni- comparisons of relational algebra. It
semantic shift. Space and time are in- fying forces of distributed systems. looks just like a singularity.
trinsically tied to each other. Classic centralized databases force The industry has leapt headlong
When you pop from one to many, SQL their data to appear immutable using toward data representations that are
and its relational algebra cannot func- transactions. When distribution im- neither bound to a single point in time
tion without some form of restriction. pedes the use of transactions, you snap- nor to a single point in space with dis-
The most common form is to cast some shot a subset of your data so it can be tributed, heterogeneous, and loosely
of the data into immutable views that cast across the boundaries with predict- coupled systems. Nowadays, far more
can be meaningfully queried over time. able behavior. data is being generated outside the SQL
The system projecting these views won’t environment than within it. This trend
change them. When they don’t change, Escaping the Singularity is accelerating.
you can use them across space. SQL databases are phenomenally pow- Future articles will explore various
Freezing data in time allows its use erful and have enjoyed singular success consequences of escaping the singular-
across spatial boundaries. Typically, in providing access to and control over ity and relaxing the constraints of both
you also project the data to strip out the data. They allow the combination and space and time.
private stuff as you project across trust analysis of data by leveraging relational No, it ain’t your grandmother’s
boundaries. To span spatial boundar- algebra. Relational algebra relates values database anymore.
ies, time must freeze, at least for the contained in the rows and the columns
data being shared. When you freeze of its tables. This has provided incredible
Related articles
data, it’s immutable. power in programming and huge perfor- on queue.acm.org
Immutability: The One Constant mance gains in accessing relational data.
Scalable SQL
of Distributed Systems
 Immutable To do this, relational algebra requires
Michael Rys
data can be immortal and omnipresent. a static set of tables unmolested by con- http://queue.acm.org/detail.cfm?id=1971597
Think of it as the Gideon Bible, which current changes. Both the data and
If You Have Too Much Data, then “Good
seems to be in every hotel room; I sus- the schema for the data must be static Enough” Is Good Enough
pect there will be Bibles there for a long while operations are performed. This is Pat Helland
time. If you want to do a query leveraging achieved with transactional serializabil- http://queue.acm.org/detail.cfm?id=1988603
the Gideon Bible as an input, you will not ity or other slightly weaker isolation poli- All Your Database Are Belong to Us
struggle with challenges of concurrency cies. Serializability provides the illusion Erik Meijer
or isolation. It’s relatively straightfor- that each user of the database is alone at http://queue.acm.org/detail.cfm?id=2338507
ward to cache a copy close to where you a single point in time.
need it, too. In a relational database, it is difficult Pat Helland has been implementing transaction systems,
databases, application platforms, distributed systems,
SQL’s relational operations can be to provide full functionality when dis- fault-tolerant systems, and messaging systems since
applied to immutable data at a massive tributed except, perhaps, across a hand- 1978. He currently works at Salesforce.
scale because the metadata is immu- ful of machines in close proximity. Even Copyright held by author.
table and the data is immutable. This more profoundly, SQL works well within Publication rights licensed to ACM.

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 41
practice
DOI:10.1145/ 2948985
separation of concerns, focusing the
 rticle development led by
A
queue.acm.org
attention of each service upon some
well-defined aspect of the overall
application. These services can be
Microservices aren’t for every company, composed in novel ways with loose
and the journey isn’t easy. coupling between the services, and
they can be deployed independently.
BY TOM KILLALEA Many implementers are drawn by the
allure of being able to make changes

The Hidden
more frequently and with less risk of
negative impact. Robert C. Martin de-
scribed the single responsibility princi-
ple: “Gather together those things that

Dividends of
change for the same reason. Separate
those things that change for differ-
ent reasons.”5 The clear separation of
concerns, minimal coupling across

Microservices
domains of concern, and the potential
for a higher rate of change lead to in-
creased business agility and engineer-
ing velocity.
Martin Fowler argues the adop-
tion of continuous delivery and the
treatment of infrastructure as code
are more important than moving to
microservices, and some implement-
ers adopt these practices on the way
to implementing microservices, with
MICROSERVIC ES ARE AN approach to building positive effects on resilience, agility,
distributed systems in which services are exposed only and productivity. An additional key
benefit of microservices is they can
through hardened APIs; the services themselves have enable owners of different parts of an
a high degree of internal cohesion around a specific overall architecture to make very dif-
ferent decisions with respect to the
and well-bounded context or area of responsibility, hard problems of building large-scale
and the coupling between them is loose. Such services distributed systems in the areas of
are typically simple, yet they can be composed into persistence mechanism choices, con-
sistency, and concurrency. This gives
very rich and elaborate applications. The effort service owners greater autonomy, can
required to adopt a microservices-based approach lead to faster adoption of new tech-
nologies, and can allow them to pur-
is considerable, particularly in cases that involve sue custom approaches that might be
migration from more monolithic architectures. The optimal for only a few or even for just
explicit benefits of microservices are well known and one service.
numerous, however, and can include increased agility, The Dividends
resilience, scalability, and developer productivity. While difficult to implement, a mi-
croservices-based approach can pay
This article identifies some of the hidden dividends dividends to the organization that takes
of microservices that implementers should make a the trouble, though some of the benefits
conscious effort to reap. are not always obvious. What follows is
a description of a few of the less obvious
The most fundamental of the benefits driving the ones that may make the adoption of mi-
momentum behind microservices is the clear croservices worth the effort.

42 COMM UNICATIO NS O F THE ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 Dividend #1: find surprising and even bewildering. coordination, coupling, and problems
Permissionless Innovation It contrasts with approaches where with the granularity or functionality of
Permissionless innovation is about gatekeepers (a euphemism for blockers) service interfaces. Engineers do not
“the ability of others to create new have to be consulted before an integra- seek out meetings if they can avoid
things on top of the communications tion can be considered. them; such meetings could mean
constructs that we create,”1 as put forth To determine whether permission- that a service’s APIs are not all that is
by Jari Arkko, chair of the Internet En- less innovation has been unleashed needed to integrate. An organization
gineering Task Force (IETF). When
IMAGE BY SASH KIN

to the degree possible, a simple test is that has embraced permissionless in-
enabled, it can lead to innovations by to look at the prevalence of meetings novation should have a high rate of ex-
consumers of a set of interfaces that between teams (as distinct from within perimentation and a low rate of cross-
the designers of those interfaces might teams). Cross-team meetings suggest team meetings.

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 43
practice

Dividend #2: one service and another becomes a

Enable Failure set of APIs. The consumer gives up
It should come as no surprise to hear influence over the design of what lies
that in computer science, we still behind those APIs, how that design
don’t know how to build complex sys-
tems that work reliably,6 and the unre- Microservices evolves, and how its data persists, in
return for a set of SLAs (service-level
liability of systems increases with size
and complexity. While opinions dif-
encourage agreements) governing the stability
of the APIs and their runtime charac-
fer as to whether microservices allow the “you build it, teristics. Trust can be replaced with
a reduction in overall complexity, it’s
worth embracing the notion that mi-
you own it” model. a combination of autonomy and ac-
countability.
croservices will typically increase the As stated by Melvin Conway, who
number of failures. Further, failures defined what is now known as Con-
across service boundaries will be more way’s law: “Any organization that de-
difficult to troubleshoot since external signs a system will inevitably produce
call stacks are inherently more fragile a design whose structure is a copy of
than internal ones, and the debugging the organization’s communication
task is limited by poorer tooling and structure.”2
by more challenging ad hoc analysis Microservices can provide an effec-
characteristics. This tweet by @Hon- tive model for evolving organizations
est_Update can sometimes feel un- that scale far beyond the limits of per-
comfortably accurate: “We replaced sonal contact.
our monolith with micro services so
that every outage could be more like a Dividend #4:
murder mystery.”4 You Build It, You Own It
Designing for the inevitability and Microservices encourage the “you
indeed the routineness of failure can build it, you own it” model. Amazon
lead to healthy conversations about CTO Werner Vogels described this
state persistence, resilience, depen- model in a 2006 conversation with
dency management, shared fate, and Jim Gray that appeared in ACM Queue:
graceful degradation. Such conver- “Each service has a team associated
sations should lead to a reduction of with it, and that team is completely re-
the blast radius of any given failure by sponsible for the service—from scop-
leveraging techniques such as cach- ing out the functionality, to architect-
ing, metering, traffic engineering, ing it, to building it, and operating it.
throttling, load shedding, and back- You build it, you run it. This brings
off. In a mature microservices-based developers into contact with the day-
architecture, failure of individual ser- to-day operation of their software. It
vices should be expected, whereas the also brings them into day-to-day con-
cascading failure of all services should tact with the customer. The customer
be impossible. feedback loop is essential for improv-
ing the quality of the service.”3
Dividend #3: In the decade since that conversa-
Disrupt Trust tion, as more software engineers have
In small companies or in small code followed this model and taken on re-
bases, some engineers may have a sponsibility for the operation as well
strong sense of trust in what is being as the development of microservices,
deployed because they look over every they have driven broad adoption of
shoulder and review every commit. a number of practices that enable
As team size and aggregate velocity greater automation and that lower op-
increase, “Dunbar’s number” takes erational overhead. Among these are
effect, leading to such trust becom- continuous deployment, virtualized
ing strained. As defined by British an- or containerized capacity, automated
thropologist Robin Dunbar, this is the elasticity, and a variety of self-healing
maximum number of individuals with techniques.
whom one can maintain social rela-
tionships by personal contact. Dividend #5:
A move to microservices can force Accelerate Deprecations
this expectation of trust to surface and In a monolith, it’s difficult to depre-
be confronted. The boundary between cate anything safely. With microser-

44 COMM UNICATIO NS O F THE AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 practice

vices, it’s easy to get a clear view of a different approaches to the gover- ˲˲ A change in one service has un-
service’s call volume, to stand up dif- nance expectations that it has of dif- expected consequences or requires a
ferent and potentially competing ver- ferent services. This will start with change in other services.
sions of a service, or to build a new ser- a consistent companywide model ˲˲ Services share a persistence store.
vice that shares nothing with the old for data classification and with the ˲˲ You cannot change your service’s
service other than backward compat- classification of the criticality of the persistence tier without anyone car-
ibility with those interfaces that con- integrity of different business pro- ing.
sumers care about the most. cesses. This will typically lead to ˲˲ Engineers need intimate knowl-
In a world of permissionless in- threat modeling for the services that edge of the designs and schemas of
novation, services can and should handle the most important data and other teams’ services.
routinely come and go. It’s worth in- processes, and the implementation ˲˲ You have compliance controls
vesting some effort to make it easier of the controls necessary to serve the that apply uniformly to all services.
to deprecate services that have not company’s security and compliance ˲˲ Your infrastructure isn’t program-
meaningfully caught on. One ap- needs. As microservices proliferate, mable.
proach to doing this is to have a suf- it can be possible to ensure the most ˲˲ You can’t do one-click deploy-
ficiently high degree of competition severe burden of compliance is con- ments and rollbacks.
for resources so that any resource- centrated in a very small number of
constrained team that is responsible services, releasing the remaining ser- Conclusion
for a languishing service is drawn to vices to have a higher rate of innova- Microservices aren’t for every compa-
spending most of their time on other tion, comparatively unburdened by ny, and the journey isn’t easy. At times
services that matter more to custom- such concerns. the discussion about their adoption
ers. As this occurs, responsibility has been effusive, focusing on auton-
for the unsuccessful service should Dividend #8: omy, agility, resilience, and developer
be transferred to the consumer who Test Differently productivity. The benefits don’t end
cares about it the most. This team Engineering teams often view the there, however, and to make the jour-
may rightfully consider themselves to move to microservices as an opportu- ney worthwhile, it’s important to reap
have been left “holding the can,” al- nity to think differently about testing. the additional dividends.
though the deprecation decision also Frequently, they will start thinking
passes into their hands. Other teams about how to test earlier in the de-
Related articles
that wish not to be left holding the can sign phase, before they start to build on queue.acm.org
have an added incentive to migrate or their service. A clearer definition of
A Conversation with Werner Vogels
terminate their dependencies. This ownership and scope can provide an
http://queue.acm.org/detail.cfm?id=1142065
may sound brutal, but it’s an impor- incentive to achieve greater coverage.
tant part of “failing fast.” As stated by Yelp in setting forth its The Verification of a Distributed System
Caitie McCaffrey
service principles, “Your interface http://queue.acm.org/detail.cfm?id=2889274
Dividend #6: is the most vital component to test.
There’s Just No Getting around It: You’re
End Centralized Metadata Your interface tests will tell you what Building a Distributed System
In Amazon’s early years, a small your client actually sees, while your Mark Cavage
number of relational databases were remaining tests will inform you on http://queue.acm.org/detail.cfm?id=2482856
used for all of the company’s criti- how to ensure your clients see those
cal transactional data. In the interest results.”7 References
1. Arkko, J. Permissionless innovation. IETF; https://
of data integrity and performance, The adoption of practices such as www.ietf.org/blog/2013/05/permissionless-
any proposed schema change had to continuous deployment, smoke tests, innovation/.
2. Conway, M.E. How do committees invent? Datamation
be reviewed and approved by the DB and phased deployment can lead to Magazine (1968); http://www.melconway.com/Home/
Cabal, a gatekeeping group of well- tests with higher fidelity and lower Committees_Paper.html.
3. Gray. J. A conversation with Werner Vogels. ACM
meaning enterprise modelers, data- time-to-repair when a problem is dis- Queue 4, 4 (2006); http://queue.acm.org/detail.
cfm?id=1142065.
base administrators, and software covered in production. The effective- 4. Honest Status Page. @honest_update,
engineers. With microservices, con- ness of a set of tests can be measured 2015; https://twitter.com/honest_update/
status/651897353889259520.
sumers should not know or care about less by their rate of problem detection 5. Martin, R.C. The single responsibility principle;
how data persists behind a set of APIs and more by the rate of change that http://blog.8thlight.com/uncle-bob/2014/05/08/
SingleReponsibilityPrinciple.html.
on which they depend, and indeed it they enable. 6. Perera, D. The crypto warrior. Politico; http://www.
should be possible to swap out one politico.com/agenda/story/2015/12/crypto-war-cyber-
security-encryption-000334.
persistence mechanism for another Warning Signs 7. Yelp service principles; https://github.com/Yelp/
without consumers noticing or need- The following indicators are helpful service-principles.
ing to be notified. in determining that the journey to
Tom Killalea was with Amazon for 16 years and now
microservices is incomplete. You are consults and sits on several company boards, including
Dividend #7: probably not doing microservices if: those of Capital One, ORRECO, and MongoDB.
Concentrate The Pain ˲˲ Different services do coordinated
A move to microservices should en- deployments. Copyright held by author.
able an organization to take on very ˲˲ You ship client libraries. Publications rights licensed to ACM.

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 45
contributed articles
DOI:10.1145/ 2858789
improve energy efficiency and mini-
The aim is to improve cities’ management mize carbon-emission levels. Along
with cities’ growth, innovative solu-
of natural and municipal resources and tions are crucial for improving produc-
in turn the quality of life of their citizens. tivity (increasing operational efficien-
cies) and reducing management costs.
BY RIDA KHATOUN AND SHERALI ZEADALLY A smart city is an ultra-modern ur-
ban area that addresses the needs of

Smart
businesses, institutions, and especially
citizens. Here we should differentiate
between a smart city and smart urban-
ism. The objective of these concepts is
the same—the life of citizens. The ar-
chitects of ancient cities did not take
into consideration long-term scalabil-

Cities:
ity—housing accessibility, sustain-
able development, transport systems,
and growth—and there is no scalable
resource management that may be
applied from one decade to another.
Unfortunately, smart urbanism is not
well represented in smart cities’ devel-

Concepts,
opment. Smart urbanism must also
be considered as an aspect of a smart
city, including information-commu-

Architectures,
nication technologies. In recent years,
a significant increase in global energy
consumption and the number of con-

Research
nected devices and other objects has
led government and industrial institu-
tions to deploy the smart city concept.

Opportunities Cities’ demographic, economic, social,

and environmental conditions are the
major reasons for the dramatic in-
crease in pollution, congestion, noise,
crime, terrorist attacks, energy pro-
duction, traffic accidents, and climate
change. Cities today are the major con-
tributors to the climate problem. They
cover less than 2% of the Earth’s surface
yet consume 78% of the world’s energy,
BY 2030, THE world’s population is projected to be 8.5
billion and increase to 9.7 billion by 2050 and 11.2 billion key insights
by 2100. Half of humanity today lives in cities. Many cities ˽˽ Many cities in Asia, Europe, and North
are experiencing exponential growth as people move America are pursuing smart city projects.

from rural areas in search of better jobs and education. ˽˽ A smart city is a complex system,
meaning even a single vulnerability
Consequently, cities’ services and infrastructures are could affect all citizens’ security.
being stretched to their limits in terms of scalability, ˽˽ Future research must address high
environment, and security as they adapt to support this energy consumption, security, privacy,
lack of investment, smart citizens,
population growth. Visionaries and planners are thus and other related challenges to enable
secure, robust, scalable smart city
seeking a sustainable, post-carbon economy20 to development and adoption.

46 COMMUNICATIO NS O F TH E AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 An operator checks the electric power control panel for the smart city project in Kashiwa, Japan, on July 7, 2014.

producing more than 60% of all CO2 ternet, dispatching units of energy as how organizations should deliver and
emissions (http://unhabitat.org/). needed, representing a set of distrib- reap benefits from their services (such
Innovative solutions are imperative uted renewable electricity generators as transport, energy consumption, and
to address cities’ social, economic, and linked and managed through the In- charging tolls); such models must be
environmental effects. Those solutions ternet. The IoE enables accurate, real- designed to support city development.
involve three key objectives: time monitoring and optimization of Note the “smart city” label is not a
Optimized management of energy power flows; marketing slogan. A city is “smart” if
resources. This objective could be re- Decentralized energy production. it provides better efficiency for urban
PHOTO BY YOSH IKA ZU TSUNO/ AF P/GET T Y IM AGES

alized through the Internet of Energy The IoE concept allows consumers to planning through a variety of tech-
(IoE), or smart grid technology. The be energy producers themselves, using nologies. Smart cities are also defined,
IoEa,b connects energy grids to the In- renewable energy sources and com- according to Anthony Townsend in his
bined heat and power units; decen- book Smart Cities (W.W. Norton & Com-
tralization enables smarter demand- pany, 2014), as “places where infor-
a http://www.artemis-ioe.eu/ioe_consortium_ response management of consumers’ mation technology is combined with
area.htm
b http://www.bdi.eu/BDI_english/download_
energy use; and infrastructure, architecture, everyday
content/Marketing/Brochure_Internet_of_ Integrated business models and eco- objects, and our bodies to address
Energy.pdf nomic models. These models describe social, economic, and environmental

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 47
contributed articles

problems.” The European Parliament and new public-transport solutions to sidered before cities are able to reap
proposedc this definition: “A smart city reduce car use; the benefits. Here, we describe some
is a city seeking to address public is- Home energy management. Options of the basic concepts and architectural
sues via information and communica- include timely energy billing, optimal components of smart cities, includ-
tion technology (ICT)-based solutions energy management, saving, perhaps, ing energy management (ISO 50001),
on the basis of a multi-stakeholder, 30%–40% on electricity bills; the Euro- smart homes, vehicular networks,
municipality based partnership.” This pean Commission estimates approxi- smart grids, and quality of life (ISO
is quite broad, encompassing many mately 72% of European electricity con- 37120). We then examine recent smart
fields, while the Japanese definition is sumers will have smart meters by 2020; city projects around the world, identi-
more specific, focusing on energy, in- Educational facilities. More invest- fying some of the challenges and fu-
frastructure, ICT, and lifestyle. From ment is needed to improve educational ture research opportunities. We also
these definitions, we deduce ICT plays opportunities for all, lifelong learning, highlight some of the risks introduced
a pivotal role in developing a city that education through remote learning, through information systems in the ur-
can adapt to the needs of its citizens. and smart devices in classrooms; ban environment.
By leveraging advanced power sys- Tourism. Preserving a city’s natural
tems, networking, and communica- resources promotes the growth of tour- Implementation and Deployment
tion technologies, a smart city aims ism; additionally, smart devices offer di- Designing and deploying smart cities
to enhance the lives of its citizens and rect and localized access to information; needs experts from multiple fields,
optimize territorial, economic, and Citizens’ health. Using new tech- including economics, sociology, en-
environmental resources. Smart cities nologies could improve people’s gineering, ICT, and policy and regula-
promise multiple benefits: health; citizens need full access to tion. Various frameworks describing
Safety and security. This includes high-quality, affordable healthcare, the architecture of smart cities have
surveillance cameras, enhanced emer- and wireless body-area network tech- been proposed by both industry and
gency-response services, and automat- nology—including sensors attached academic sources. One of the most
ed messages for alerting citizens; real- to the body or clothes and implanted widely adapted and adopted models
time information about a city should under the skin—can acquire health is the reference model proposed by
be available; information (such as heartbeat, blood the U.S. National Institute of Stan-
Environment and transportation. sugar, and blood pressure) and trans- dards and Technology. Smart cities
This entails controlled pollution levels, mit it in real time or offline through a are complex systems, often called
smart street lights, congestion rules, smartphone to remote servers acces- “systems of systems,” including peo-
sible by healthcare professionals for ple, infrastructure, and process com-
c http://www.smartcities.at/assets/Publika-
monitoring or treatment. ponents (see Figure 1). Most smart
tionen/Weitere-Publikationen-zum-Thema/ Despite this potential, many ele- cities models consist of six compo-
mappingsmartcities.pdf ments must be understood and con- nents: government, economy, mobil-
ity, environment, living, and people.
Figure 1. A smart city model. The European Parliament Policy De-
partment said in 2014 that 34% of
Internet smart cities in Europe have only one
of Things
such component.
Multiple approaches and methods
have been proposed to evaluate smart
cities from multiple perspectives, in-
Smart
Environment cluding an urban Internet of Things
(IoT) system for smart cities, sus-
Smart Smart tainability, global city performance,
Living Mobility future urban environments, urban
Internet Internet competitiveness, and resilience. But
of People Smart of Services several fundamental architectural
City components must be in place to make
Smart Smart a city smart.
People Economy Essential components. The basic
underpinnings of a smart city include
Smart five components:
Governance
Broadband infrastructure. This infra-
structure is pivotal, offering connectiv-
ity to citizens, institutions, and orga-
Internet nizations. However, today’s Internet
of Data lacks the robustness needed to support
smart cities’ services and data volume.
It includes both wired and wireless

48 COMMUNICATIO NS O F TH E AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 contributed articles

networks. Wireless broadband is im- ies for creating globally interlinked li-
portant for smart cities, especially with brary data, linked data in biomedicine
the explosive growth of mobile applica- for creating orthogonal interoperable
tions and popularity and the connectiv- reference ontologies, and linked gov-
ity of smart devices;
E-services. The concept of “electronic By leveraging ernment data for improving internal
administrative processes.
services” involves using ICT in the pro-
vision of services, including sales, cus-
advanced Sustainable infrastructures. The In-
ternational Electrotechnical Commis-
tomer service, and delivery. The Inter- power systems, sion (IEC) says cities aiming to develop
net is today the most important way to
provide them (such as for tourism, city
networking, and into smart cities should start with three
pillars of sustainability: economic, so-
environment, energy, transport, securi- communication cial, and environmental. One of the
ty, education, and health). A European
Union research initiative (called the in-
technologies, a first steps in addressing sustainability
is to increase resource efficiency in all
novation framework H2020) focuses on smart city aims to domains (such as energy, transport,
developing such e-services; and
Open government data. Open govern- enhance the lives and ICT). An efficient and sustainable
ICT infrastructure is essential for man-
ment data (OGD) means data can be of its citizens and aging urban systems development.
used freely, reused, and redistributed
by anyone. A multinational initiative to optimize territorial, Adepetu et al.1 explained how an ICT
model works and can be used in sus-
promote worldwide adoption of OGD
was launched in 2012 with input from
economic, and tainable city planning. For a sustainable
ICT infrastructure, they defined various
the Microsoft Open Data initiative, Or- environmental green performance indicators for ICT
ganization for Economic Cooperation
and Development, and U.S. Open Data
resources. resource use, application lifecycle, en-
ergy impact, and organizing impact.
Initiative (http://www.data.gov). E-governance. This component fo-
A smart city can be seen as an cuses on a government’s performance
open data generator. Implementation through the electronic medium to
questions include: How can we effi- facilitate an efficient, speedy, trans-
ciently sort and filter the data being parent process for disseminating in-
produced? Who are the legal owners formation to the public and also for
of the data? And what are the restric- performing administration activities.
tions on the data? Navigating OGD An e-government system consists of
can be related to the open data barri- three components: government-to-
ers of task complexity and informa- citizen, government-to-business, and
tion quality. With OGD, there is no ex- government-to-government. E-govern-
planation of the data’s meaning, and ment allows citizens to fulfill their civic
discovering the appropriate data is and social responsibilities through a
difficult. Data is often duplicated, and Web portal. A growing number of gov-
data formats and datasets are likewise ernments around the world are deploy-
often too complex for humans and ing Web 2.0 technologies, an archi-
even machines to handle. In 2015, the tecture referred to as “e-government
Spanish standardization normative 2.0,” linking citizens, businesses, and
UNE178301 was published to help cit- government institutions in a seamless
ies evaluate the maturity of their own network of resources, capabilities, and
open data projects by relying on five information exchange.
characteristics of their data—political, Fundamental technologies. The de-
legal, organizational, technical, and sign and implementation of smart cities
social. OGD will have an enormously also involves a number of technologies:
positive effect on services offered to Ubiquitous computing. Ubiquitous
citizens, thus improving their daily devices include heterogeneous ones
lives. In this context, linked open data that communicate directly through
(LOD) could support complex and in- heterogeneous networks. The UrBan
terdisciplinary data mining analysis.12 Interactions Research Programd at
LOD is complex because data viewed the University of Oulu, Oulu, Finland,
in isolation may be irrelevant but studies urban computing, interac-
when aggregated from various sources tion among urban spaces, humans,
can yield more meaningful results and
fresh insights. LOD is used in such d Open Ubiquitous Oulu; http://www.ubioulu.fi/
applications as linked data in librar- en/home

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 49
contributed articles

information technology, and infor- reliable communications with one

mation.8,18 Ferreira8 described how to another. Several wireless network-
build context-aware applications, col- ing technologies, including radio fre-
lect data, and study human behavior. quency identification (RFID), ZigBee,
To support a smart and ubiquitous
environment, telecommunication in- Smart cities and Bluetooth, have been deployed, al-
though they are limited by the number
frastructures, Lee13 said, should be need citizens to of devices they can support, along with

be continuously
enhanced to provide a better under- their throughput and transmission
standing of networks, services, users, range. New wireless technologies (such
and users’ devices with various access
connections. Lee13 also identified six
connected—in as WiMAX and Long-Term Evolution)
are unsuitable due to their high energy
capabilities and functions of smart public places, consumption. Novel Wi-Fi technol-
ubiquitous networks including con-
text awareness, content awareness,
in public ogy (such as by the IEEE 802.11ah Task
Group) could be an efficient solution
programmability, smart resource man- transportation, for smart city services.11 IEEE 802.11ah
agement, autonomic network manage-
ment, and ubiquity. and at home— aims to help design an energy-efficient
protocol allowing thousands of indoor
Big data. Traditional database man- in order to share and outdoor devices to work in the
agement tools and data processing ap-
plications cannot process such a huge their knowledge same area and a transmission range up
to 1km at default transmission power
amount of information. Data from
multiple sources (such as email mes-
and experience. of 200mW.11
IoT. One of the main IoT goals is to
sages, video, and text) are distributed make the Internet more immersive
in different systems. Copying all of it and pervasive. As a network of highly
from each system to a centralized loca- connected devices, IoT technology
tion for processing is impractical for works for a range of heterogeneous
performance reasons. In addition, the devices (such as sensors, RFID tags,
data is unstructured. Deploying thou- and smartphones). Multiple forms of
sands of sensors and devices in a city communications are possible among
poses significant challenges in man- such “things” and devices. IoTs must
aging, processing, and interpreting be designed to support a smart city’s
the big data they generate. Big data,10 vision in terms of size, capability, and
reflecting such properties as volume, functionality, including noise moni-
variety, and velocity, is a broad term toring, traffic congestion, city energy
for complex quantitative data that re- consumption, smart parking meters
quires advanced tools and techniques and regulations, smart lighting, au-
for analyzing and extracting relevant in- tomation, and the salubrity of pub-
formation. Several challenges must be lic buildings.11 They must exploit the
addressed, including capture, storage, most advanced communication tech-
search, processing, analysis, and visual- nologies, thus supporting added-val-
ization. Also needed is a scalable analyt- ue services for a city’s administration
ics infrastructure to store, manage, and and citizens.
analyze large volumes of unstructured Cloud computing. Cloud computing
data. Smart cities can use multiple enables network access to shared, con-
hardware and software technologies to figurable, reliable computing resourc-
process the big data being produced, es. The cloud is considered a resource
including parallel system architectures environment that is dynamically con-
(such as cluster-based high-perfor- figured to bring together testbeds, ap-
mance systems and cloud platforms), plets, and services in specific instanc-
parallel file systems and parallel input/ es where people’s social interaction
output (such as parallel file systems for would call for such services;
big data storage and NoSQL databases Service-oriented architectures (SOAs).
for big data), programming (such as An SoA is a principle for software
low-level programming models, skel- structuring based on service. A smart
etal parallel programming, and generic city’s development should focus on
parallel programming), data manage- SOA-based design architectures to ad-
ment on multilevel memory, and hier- dress its challenges. A smart city thus
archy task scheduling.15 requires a new IT infrastructure, from
Networking. Networking technolo- both a technical and an organization-
gies enable devices and people to have al perspective.

50 COMMUNICATIO NS O F TH E AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 contributed articles

Table 1. Smart city projects around the world.

Project/location Funding Duration Goals Smart city characteristics Partners

Yokohama Smart Ministry of Economy, 2010–2015 Low-carbon city, hierarchical energy Smart environment, smart Tokyo Institute of Technology,
City Project,a Japan Trade and Industry management systems (EMS), sensitive living Toshiba, Mitsubishi, Hitachi
(METI) photovoltaic (PV) generation
Smart Mobility METI 2010–2015 PV generation, intelligent transportation Smart mobility, smart Nagoya University, Toyota City,
& Energy Life in systems, hierarchical EMS, 61.2% renewable environment Fujitsu, Hitachi, Toyota Motor
Toyota City,b Japan energy, 4,000 next-generation vehicles Corporation, Chubu Electric
Power Co.
Keihanna Eco City METI 2010–2015 Develop community EMS to minimize CO2 Smart environment Kyoto, Kizugawa, Kyotanabe,
Next-Generation emissions, vehicle-to-infrastructure, and Fuji Electric, Kyoto Center for
Energy and Social to-vehicle Climate Actions, Mitsubishi
Systems project,c
Japan
Kitakyushu Smart METI 2010–2015 Participation by citizens and companies Smart mobility, smart Toyota Motor Corporation,
Community in the energy-distribution process, environment IBM Japan, Japan Telecom
Project,d Japan PV generation, establishing charging Information Service
infrastructure, and next-generation traffic Corporation, Mitsubishi Heavy
systems (bicycles and public transport) Industries
CITYKEYS,e H2020 project, 2015–2017 Develop and validate key performance Smart mobility, smart Research organizations: VTT
European Union European Union indicators and data-collection procedures environment, smart living, (Finland), AIT (Austria), TNO
for smart cities, sharing best practices on smart people (The Netherlands); and five
user privacy and other legislative issues partner cities: Rotterdam,
among cities Tampere, Vienna, Zagreb,
Zaragoza
LIVE Singapore National Research 2011–2016 Develop open platform for collecting, Smart living, smart people MIT’s SENSEable City Lab,
project,f Singapore Foundation of elaborating, and distributing real-time data Future Urban Mobility research
Singapore reflecting urban activities: tracking vehicular initiative, Changi Airport Group,
traffic and estimated temperature rise, ComfortDelGro, NEA, PSA, SP
energy consumption, and taxi operations Services, SingTel
SmartSantander,g European Union 2010–2013 Deploy 20,000 sensors in Belgrade, Smart living, smart Telefonica I+D (Spain)
Europe Guildford, Lübeck, and Santander, exploiting environment Universität zu Lübeck
multiple technologies to collect information (Germany), Ericsson (Serbia),
on parking spaces, public transport, and Alcatel-Lucent (Italy),
automatic management of light; currently Alexandra Instituttet A/S
uses 2,000 IEEE 802.15.4 devices (Denmark)
Open Cities project,h European Union 2011–2013 Explore how to implement open and user- Smart governance Fraunhofer Institute FOKUS
Europe driven innovation methodologies in the (Germany), ATOS (Spain),
public sector in European cities. including ESADE Business School
Amsterdam, Barcelona, Berlin, Bologna, (Spain), Berlin Government
Helsinki, Paris, and Rome Senate Department for
Economics, Technology and
Women’s Issues (Germany),
Institut Telecom (France),
NESTA (U.K.)
Vehicle2Grid,i Top consortium 2014–2017 Deliver European Open Data repository Smart mobility, smart Cofely, Alliander, ABB,
The Netherlands on Knowledge environment Mitsubishi Motors Corporation,
and Innovation Amsterdam Smart City,
Switch2SmartGrids Amsterdam University of
Applied Sciences
City Science Corporate — Use batteries in electric cars to store locally Smart mobility, smart 27 scientific research teamsk
Initiative,j MIT/U.S. sponsorship, industrial produced energy environment
funding, National
Science Foundation,
Defense Advanced
Research Projects
Agency, National
Institutes of Health
“Green Vision”l State and federal 2007–2022 Gain scientific understanding of cities: urban Smart mobility, smart Universities, private
initiative, San Jose, funding analytics, governance, mobility networks, environment companies, regional agencies
CA electronic and social networks, and energy
networks
Create clean tech jobs, reducing energy
use by 50%, generating 100% energy from
renewable sources, reusing water, installing
zero-emission lighting, and having 100%
public vehicles run on alternative fuels
a http://www.city.yokohama.lg.jp/ondan/english/yscp/ e http://www.citykeys-project.eu i http://amsterdamsmartcity.com/?lang=en
b http://jscp.nepc.or.jp/article/jscpen/20150528/445244/ f http://senseable.mit.edu/livesingapore/ j http://cities.media.mit.edu/
c http://jscp.nepc.or.jp/en/keihanna/index.shtml g http://www.smartsantander.eu/ k http://www.media.mit.edu/research/groups-projects
d http://www.nedo.go.jp/content/100639530.pdf h http://www.opencities.net/content/project l http://www.sanjoseca.gov/DocumentCenter/View/42557

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 51
contributed articles

Cybersecurity architectures. Smart latency. Critical infrastructure needs tion privacy of vehicles. Adding layers
cities pose challenges to the security protection from attacks that could of security (such as VANETs, SCADA,
and privacy of citizens and govern- cripple or severely damage a city’s abil- and mobile networks) in an indepen-
ment alike. The security issues associ- ity to function, from industrial plants dent way will make the architecture of
ated with the information produced to essential services, including access a smart city very complex. A smart city
in a smart city extend to relationships to electricity, water, and gas. Attackers thus requires a cybersecurity architec-
among those citizens, as well as their exploiting vulnerabilities in industrial ture by design.
personal safety. Some smart cities are control systems (such as the supervi-
already confronted by identity spoof- sory control and data acquisition, or Projects and
ing, data tampering, eavesdropping, SCADA, systems that manage it) can Standardization Efforts
malicious code, and lack of e-services cause significant disruption in service Many cities have piloted their own
availability. Other related challenges delivery. In vehicular ad hoc networks smart city projects; see Table 1 for spe-
include scalability, mobility, deploy- (VANETs), the standard 1609.2-2013 cific smart city developments in Asia,
ment, interoperability (of multiple recommends using pseudonymous Europe, and North America.
technologies), legal, resources, and authentication for protecting the loca- Smart cities incorporate digital ser-

Table 2. Smart city benchmarking tools.

Reference Benchmarking tool Description Type of comparison

Pires et al.19 Local sustainable Calculation of a single percentage synthesizing multiple themes: Quantitative
development environmental sustainable development education, energy, water,
indicators transport, noise, agriculture, tourism, nature conservation, marine and
coastal environment, and biodiversity.
IBM* IBM smarter city A tool to measure a city’s performance, perform benchmarks, and Qualitative, quantitative
assessment tool identify challenges and opportunities for improvement; tool relies on
multiple themes: civic life, economic life, mobility and transport, energy
management, water management, and city services.
Lee et al.14 Framework for Taking various practical perspectives from case studies in San Francisco Qualitative
building smart cities and Seoul Metropolitan City, the framework relies on urban openness,
service innovation, partnership formation, urban proactiveness, smart city
infrastructure integration, and smart city governance.
Desouza et al.6 Resilience An approach to designing, planning, and managing for resilience, Qualitative
framework for cities including evaluation of cultural and process dynamics within cities.
Debnath et al.5 Benchmarking for A composite scoring system to measure the “smartness index” of a city’s Quantitative
smart-transport transportation system; proposed indicators rely on private transport
cities (traffic flow prediction, parking information sharing, paying tolls/parking
charges/enforcement fines, and automated and coordinated traffic signal
control), public transport (detection of passengers, passenger information
management, and detection of passengers), and emergency transport
(with emergency vehicles able to provide a priority signal).
* http://www.ibm.com/smarterplanet/us/en/smarter_cities/solutions/solution/S868511G94528M58.html

Table 3. Related work by various standardization organizations.

Organization Corresponding work related to smart cities Description

International Electro-technical field, power-utility automation, energy Plan and organize standardization activities in area under
Electrotechnical management, distribution management consideration (Systems Evaluation Group)
Commission
International Environment and climate change* Create framework for standards on smart and sustainable
Telecommunication Union cities (ITU-T Study Group 5)
IEEE Smart grid, IoT, intelligent transportation systems, eHealth, and IEEE 2030 covers smart interoperability, including
smart interoperability characteristics, performance, and evaluation criteria; IEEE
1901 covers smart grid networks, including coexistence of
broadband power line systems operating on same power
line; additional standards (IEEE 1609.2) cover intelligent
transportation systems.
European Smart and sustainable cities Establish coordination group for standardization of smart
Telecommunications and sustainable cities.
Standards Institute
European Commission Energy transport and information and communication technology Create European Innovation Partnership on Smart Cities and
Communities and European Smart Cities Ranking project.**
Britsh Standards Definition of standardization strategy Develop a guide for strategies for smart cities and
Institution communities, a smart city data concept model, and
collaborative relationship management.
* http://www.itu.int/en/ITU-T/studygroups/2013-2016/05/Pages/default.aspx
** http://www.smart-cities.eu/?cid=-1&ver=3

52 COMM UNICATIO NS O F THE AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 contributed articles

vices as part of a livable and sustain- can be used to measure a city’s per-
able environment for their citizens. formance against indicators for each
Along with their benefits comes a set smart city system. It identifies oppor-
of new issues regarding, say, open data tunities for improvement by evaluating
and interoperability for policymakers,
companies, and citizens alike. Cities Detecting component effectiveness, taking into
account their degree of modernity,
need performance-evaluation indica-
tors to measure how much they might
behavioral CO2 emissions, and the city’s energy
management. This analysis is based on
possibly improve quality of life and anomalies in daily multiple indicators to measure the cur-
sustainability. Performance evaluation
indicators often lack standardization,
human life is rent situation and the potential for im-
proving a city for the following compo-
consistency, or comparability from city very important nents of civil society: civic life (degree
to city. A series of international stan-
dards is being developed to provide a
for developing of modernity, public safety, education,
and housing); economic life (business
holistic, integrated approach to sus- smart systems. attraction strategy and online services
tainable development and resilience for businesses); mobility and transport
under ISO/TC 268 (sustainable cities (wireless networks and telecommuni-
and communities standard). cations infrastructures); energy man-
ISO 37120 establishes a set of stan- agement (production rate of renew-
dard performance-evaluation indica- able energy, smart metering, and CO2
tors that provide a uniform approach emissions); water management (water
to what is measured and how that quality and smart metering); and city
measurement is to be undertaken. services. Another smart city tool, de-
The International Telecommunica- veloped by Boyd Cohenf of Universidad
tions Union defines various key per- del Desarrollo in Chile, includes the
formance indicators for smart sus- environment, mobility, governance,
tainable cities through the standard economy, people, and living compo-
ISO/TR 37150 for fire and emergency nents (such as health, safety, cultural
response, health, education, safety, level, and happiness).
transportation, energy (the percentage Table 2 outlines the benchmarking
of a city’s population with authorized methods aimed at measuring smart
electrical service), water (the percent- cities from multiple perspectives.
age of a city’s population with a pota- Various organizations and aca-
ble water supply service), social equity, demic institutions have been working
technology and innovation (such as on smart city models. As mentioned
number of Internet connections per earlier, the IEC uses three pillars of
100,000 people), CO2 levels and reduc- sustainability—economic, social, and
tion strategies, and buildings (such environmental—to develop smart cit-
as energy consumption of residential ies. IBM combines instrumentation,
buildings). Fujitsu has also proposed interconnection, and intelligence in
a performance indicator for ICT in its smart cities model. Table 3 outlines
smart cities, using such factors as a some of the efforts being undertaken
city’s environmental impact, the ratio by various organizations.
of renewable energy to total energy
consumed, and a community’s power- Challenges and
outage frequency rate. Research Opportunities
Some type of benchmarking meth- Here, we highlight some of the chal-
od is pertinent to compare smart cities. lenges faced by smart cities while ex-
Various benchmarking methods were ploring research opportunities that
proposed in 2014 for such comparison. need more attention to assist smart
For instance, Pires et al.19 analyzed a city development and adoption.
Portuguese initiative that uses com- Challenges. The following are the
mon indicators to benchmark sustain- most noteworthy challenges to be ad-
able development across 25 Portuguese dressed.
cities and municipalities.e The Smarter Lack of investment. The concept of
City assessment tool developed by IBM smart cities reflects strong potential for
investment and business opportunities.
e Smart Cities Portugal; http://www.in-
teli.pt/uploads/documentos/documen- f http://smartcitiescouncil.com/resources/
to_1400235009_2055.pdf smart-city-index-master-indicators-survey

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 53
contributed articles

Figure 2. Smart city infrastructure investments by industry, 2014–2023. neutrality in public transport by 2025.
The bus system in Copenhagen, Den-
mark, costs €125 million annually. In
North America Europe Asia Pacific
India, the national government’s an-
Latin America Middle East and Africa
$30,000 nual budget for development of 100
smart citiesh is $1.27 billion, adding
$25,000 11.5 million homes annually. In the
European Union, smart city market
projections are expected to exceed $1
$ Millions

$20,000
trillion by the end of 2016. China’s
$15,000
future smart cities allocations exceed
$322 billion for more than 600 cities
nationwide.i All these projects dem-
$10,000
onstrate how substantial is the rate of
investment in smart cities. However,
$5,000
if some of the challenges (such as cy-
bersecurity) are not addressed early,
$–
2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 the ultimate cost of smart cities will
Source: Navigant Research only increase.
High energy consumption. The U.S.
Energy Information Administration
Figure 3. Estimating future energy consumption. estimates approximately 21% of the
world’s electricity generation was from
renewable energy in 2011, with a pro-
History 2010 Projections jected increase to nearly 25% by 2040.
250
The absence of natural resources in the
28%
World Energy Consumption by Fuel

estimation of energy consumption for

27%
200 the rest of the 21st century plays a nega-
Liquids 34% 23%
Coal tive role in smart cities investments
(including biofuels) Share of
Quadrillion BTU

150 World (see Figure 3). The future of energy cost

28%
Natural gas Total and access is uncertain due primarily
15% to their dependence on projected geo-
100 22%
Renewables
political, socioeconomic, and demo-
(excluding biofuels) graphic scenarios.
11% 7%
50 Smart citizens. Social dimensions
Nuclear must also be taken into consideration.
5%
A city’s “smartness” greatly depends
0
1990 1995 2000 2005 2010 2015 2020 2025 2030 2035 2040
on citizens’ participation in smart city
projects, through multiple communi-
International Energy Outlook 2013; http://www.eia.gov/forecasts/archive/ieo13/pdf/0484%282013%29.pdf cation tools (such as a municipality’s
Web portal, social networks, and
smartphone applications). Smart cit-
On the one hand, investment in related cies, major investment required, long- ies need citizens to be continuously
projects has grown in recent years, fi- term delays before reaping profits, and connected—in public places, in pub-
nanced by both governments (includ- limited capacity for public funding. lic transportation, and at home—in
ing municipalities and public research Cost. Many cities are committing order to share their knowledge and
agencies) and private entities (compa- large budgets to get smarter. For in- experience. The objective is effective
nies and citizens). Navigant Research stance, Saudi Arabia is investing U.S.$70 management of natural resources
says investment in smart cities is divid- billion in the King Abdullah Economic and a higher quality of life for citi-
ed into smart government, smart build- City (2005–2020) in collaboration with zens; for example, they can compare
ing, smart transport, and smart utilities. Orange Business Services, Ericsson, their household use of electricity,
By 2020, $13 billion in funding is expect- Siemens, Cisco, and other companies. gas, and water through their smart-
ed to establish smart cities all over the In Dubai, 1,000 government services are phones. Adequately maintaining
world (see Figure 2). Yet according to a expected to be “smart” in a few years. In this social dimension is a challenge,
2014 research report on financing mod- 2015, South Africa began a $7.4 billion though it is a vital aspect of a smart
els for smart cities, Navigant Research smart city projectg to achieve carbon
said this infrastructure faces major fi-
h http://smartcitiescouncil.com/article/india-
nancial hurdles, including the perceived g http://www.africapropertynews.com/south- budgets-smart-infrastructure
high risk of investing in innovative solu- ern-africa/3071-construction-begins-on- i https://eu-smartcities.eu/blog/eib-eip-smart-
tions, uncertainty of energy price poli- south-africa-7-4bn-smart-city.html cities-financing

54 COM MUNICATIO NS O F TH E ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 contributed articles

city’s functionality that, exploited poor or nonexistent security features others have noted, ubiquitous and
correctly, yields dividends for both in connected devices, poor implemen- collaborative urban sensing integrat-
citizens and the city. tation of security features, encryption ed with smart objects can provide an
Privacy. Privacy will play a pivotal (outdated and weak encryption algo- intelligent environment. Otherwise,
role in any smart city strategy. Citi- rithms), lack of computer emergency packet latencies and packet loss are
zens interact with smart city ser- response teams, large and complex inevitably not controllable. One such
vices through their smartphones attack surfaces, patch deployment is- proposal is the Mobile Ad hoc Net-
and computers connected through sues, insecure legacy systems, lack of works (MANET) coordination proto-
heterogeneous networks and sys- cyberattack emergency plans, and de- col to opportunistically exploit MA-
tems. It is thus imperative smart nial of service (DoS). NET nodes as mobile relays for the
cities, founded on the use of ICT, A 2015 workshopj identified several fast collection of urgent data from
be adept at handling important pri- challenges, including vulnerabilities wireless sensor networks without sac-
vacy issues (such as eavesdropping in the transfer of data, physical conse- rificing battery lifetime. Simulation
and confidentiality). Domingo- quences for cyberattacks, collection results show that their cluster forma-
Ferrer 7 divided privacy into three and storage of large amounts of data in tion protocol is reliable and always
dimensions: respondent, user, and the cloud, and exploitation of city data delivers over 98% of packets in street
owner. Martinez-Ballesté et al. 16 by attackers. and square scenarios. Other issues,
proposed the concept of citizens’ Detecting behavioral anomalies including the convergence of IoT and
privacy based on statistical disclo- in daily human life is very important intelligent transportation systems re-
sure control, including methods for developing smart systems. Table 4 quire further investigation.
for safeguarding the confidential- outlines some research anomaly-de- Data management. Data plays a key
ity of information about individu- tection frameworks being proposed to role in a smart city. A huge quantity of
als when releasing their data. Ex- detect behavioral anomalies in human data will be generated by smart cities;
amples of such methods are private daily life in smart-home and smart- understanding, handling, and treating
information retrieval (obtaining grid environments in the context of it will be a challenge. However, mo-
database information belonging smart cities. Multiple challenges in- bile phone data can help achieve sev-
to someone and hiding it), privacy- clude characterization of the behaviors eral smart city objectives. Smartphone
preserving data mining (collabora- of sensor nodes (such as the accuracy data can be used to develop a variety
tion between entities to get results of detection, false positive rate, and of urban applications. For example,
without sharing all the data), loca- low computational cost). transportation analysis through mo-
tion privacy, anonymity and pseud- Research opportunities. Consider bile phone data can be applied for
onyms, privacy in RFID, and privacy these research opportunities. estimating road traffic volume and
in video surveillance. IoT management. The IoT needs transport demands. Real-time infor-
Cyberattacks. As with any infra- an efficient, secure architecture that mation from mobile-phone data about
structure, smart cities are prone to cy- enhances urban data harvesting. As the origins of visitors combined with
berattack, and the current attack sur- taxis’ Global Positioning System data
face for cities is wide open. IOActive j Designed-In Cybersecurity for Smart Cities
could help manage transportation re-
Labs identified several causes of cyber- Workshop, May 2015; http://www.nist.gov/cps/ sources, as in, say, the public’s future
attack: lack of cybersecurity testing, cybersec_smartcities.cfm demand for taxis.

Table 4. Smart home and smart grid intrusion-detection systems.

Approach Attacks Detection method Advantages Disadvantages

Zhu et al.24 Spatial anomaly (sleeping at the wrong place), Dynamic Bayesian network; Accuracy of 99%, low User intervention needed
timing anomaly (sleepwalking at midnight); maximum-likelihood estimation false positive rate
duration anomaly (working on the computer for algorithm; and Laplace smoothing
a long time); sequence anomaly (working on the
computer for a very long time without eating)

Usman et al.23 Transmission errors, node faults, or attacks Fuzzy logic-based cross-layer Accuracy of 98%, low Tested on limited profiles of
rule-base energy consumption, sensor nodes
simplicity

Mitchell et al.17 Attacks performed by a compromized device in Behavior-rule based intrusion High intrusion detection No repair strategies
smart grid detection system rate, false positives less
than 6%

Britsh Standards Definition of standardization strategy Britsh Standards Institution Definition of Develop a guide for
Institution standardization strategy strategies for smart
cities and communities, a
smart city data concept
model, and collaborative
relationship management

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 55
contributed articles

A smart city also needs a large hicles within communication range

amount of data storage, which can be increases. On the other hand, to en-
achieved through, say, an electrically sure vehicle privacy and anonymity,
tunable metasurface, or an array of na- pseudonym change (pseudonymous
no-antennas.21,22 This technology could
affect a range of fields (such as imag- Elliptic curve certificates with removed identifi-
able information are used in PKI)
ing, communication, encryption, and
data storage).9 The response of a given
cryptography strategies (such as fixed time change,
random change, and density-based
smart city to uncertain data is signifi- is considered change) should be designed and test-
cant, leading to the question of how to
measure the robustness of a smart city.
the most trusted ed on a large scale, as in a smart city
environment. Desired security prop-
Smart city assessment framework. solution for erties include lightweight authenti-
Livable cities must be monitored
through a quality-of-living index,
providing cation, security architecture scalabil-
ity, and resilience against malicious
measuring the health, safety, and security on nodes and DoS attacks.
prosperity in the city. An assessment
framework must take into consid- resource- Improving photovoltaic cells. Achiev-
ing a sustainable energy source in a
eration various characteristics, in- constrained smart city must include renewable
cluding smart city strategy and the
interests of all stakeholders (such as devices energy. Solar technology has made
significant strides (such as photo-
performance evaluators, ICT infra-
structures, legal and regulatory poli-
and embedded voltaic cells that convert light energy
into electricity) in the past decade.
cies, services, business models, and systems. Still, more efficient solar-energy-
sustainability). The objectives of such harvesting techniques are needed to
a framework are to compare the char- improve solar cells. The vast major-
acteristics of different smart cities ity of today’s solar cells absorb light
to identify new challenges, quantify through a thin film of cadmium tel-
benefits, and evaluate performance. luride composed of two layers of
VANET security. In smart cities, effi- glass. The benefits of thin-film solar
cient security support is an important cells include low production cost
requirement of VANETs. One consider- and ease of fabrication. New design
ation is how to secure them by design- approaches emerged in 2014 based
ing solutions that reduce the likeli- on nanophotonics, whereby nano-
hood of network attacks or even how to antennas are exploited for guiding
diminish the effect a successful attack and localizing light at the nanoscale.
could have on them. Such designs promise to improve the
Several security challenges per- absorption process in photovoltaic
sist in the realm of authentication devices, thus enabling a considerable
and driver-behavior analysis. A smart reduction in the physical thickness of
city needs lightweight, scalable au- solar-absorber layers and paving the
thentication frameworks that protect way for new solar-cell designs. In this
drivers from internal and external at- context, designing new micro- and
tackers. The IEEE 1609.2 v2 standard nano-antennas for improving light
specifies a set of security services absorption is important, and dimer
(such as certificate authority) for sup- nanostructures, or structures com-
porting vehicular communications. posed of two nanoparticles turn out
However, public key infrastructure- to be good candidates.2
based (PKI-based) solutions to verify Smart city enablers. Technology
vehicle authenticity might not lead advances are helping create a mar-
to a scalable solution. Cross-cer- ket for smart city products and solu-
tification should be defined when tions, but smart cities need efficien-
countries or cities have multiple root cy and sustainability. Angelidou 4
certificate authorities. The authority proposed the conjuncture of four
responsible for misbehavior detec- forces: urban futures, technologies,
tion should be incorporated into the applications, and innovation econo-
PKI system. City governments need my. To develop, smart cities must le-
to investigate innovative fast, low- verage technological advancements
cost message-exchange solutions and development of knowledge and
whose communication overheads innovation networks.4 In addition,
remain constant as the number of ve- to create a smart city, Amaba3 pro-

56 COMM UNICATIO NS O F THE ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 contributed articles

posed integrating multimedia, hu- Conclusion Commun. ACM 57, 7 (July 2014), 86–94.
11. Khorov, E., Lyakhov, A., Krotov, A., and Guschin,
man factors, user-centered system The strong interest by municipal A. A survey on IEEE 802.11ah: An enabling
methodology, and design principles. and local governments worldwide in networking technology for smart cities. Computer
Communications 58, 1 (Mar. 2015), 53–69.
Smart cities can provide solutions to smart cities stems from their ability 12. Lausch, A., Schmidt, A., and Tischendorf, L. Data
many sustainability problems, but to improve their citizens’ quality of mining and linked open data—New perspectives for
data analysis in environmental research. Ecological
their cohesive development requires life. Here, we described some of the Modelling 295, 10 (Jan. 2015), 5–17.
an effective policy to be in place as basic concepts of smart cities, identi- 13. Lee, C., Gyu, M., and Woo, S. Standardization and
challenges of smart ubiquitous networks. IEEE
part of any solution. fying challenges and future research Communications Magazine 51, 10 (Oct. 2013), 102–110.
14. Lee, J., Gong, M., and Mei-Chih Hu, H. Towards
Information system risks. In a smart opportunities to enable large-scale an effective framework for building smart cities:
city, everything is interconnected, deployment of smart cities. Develop- Lessons from Seoul and San Francisco. Technological
Forecasting and Social Change 89 (Nov. 2014), 80–99.
including the public water system, ers, architects, and designers should 15. Ma, Y., Wu, H., Wang, L., Huang, B., Ranjan, R., Zomaya,
traffic control, public transportation, now focus on aspects of IoT manage- A., and Jie, W. Remote sensing big data computing:
Challenges and opportunities. Future Generation
and critical infrastructure. Each one ment, data management, smart city Computer Systems 51 (Oct. 2015), 47–60.
involves its own vulnerabilities. Al- assessment, VANET security, and re- 16. Martinez-Balleste, A., Perez-Martinez, P., and Solanas,
A. The pursuit of citizens’ privacy: A privacy-aware
though a smart city is a complex sys- newable technologies (such as solar smart city is possible. IEEE Communications
tem, its interconnected nature means power). We underscore when design- Magazine 51, 6 (June 2013), 136–141.
17. Mitchell, R. and Chen, I. Behavior-rule-based intrusion
a single vulnerability could greatly ing smart cities, security and privacy detection systems for safety-critical smart grid
affect citizens’ security; for example, remain considerable challenges that applications. IEEE Transactions on Smart Grid 4, 3
(Sept. 2013), 1254–1263.
an attacker might be able to connect demand proactive solutions. We hope 18. Perttunen, M., Riekki, J., Kostakos, V., and Ojala, T.
to the electric power system to gain to see smart city developers, archi- Spatio-temporal patterns link your digital identities.
Computers, Environment and Urban Systems 47
access to the network and alter pub- tects, and designers provide scalable, (Sept. 2014), 58–67.
lic transportation to potentially para- cost-effective solutions to address 19. Pires, S., Fidélis, T., and Ramos, T. Measuring and
comparing local sustainable development through
lyze intelligent transportation sys- them in the future. common indicators: Constraints and achievements in
practice. Cities 39 (Aug. 2014), 1–9.
tems, with thousands of passengers 20. Rifkin, J. The Zero Marginal Cost Society: The Internet
on board at rush hour. The attacker Acknowledgments of Things, The Collaborative Commons, and The
Eclipse of Capitalism. St. Martin’s Press, St. Martin’s
could also launch false alarms and We express our gratitude to Teodora Griffin, New York, 2015.
modify traffic lights and controllers. Sanislav, Nils Walravens, and Lyes 21. Sheldon, M., Van de Groep, J., Brown, A., Polman,
A., and Atwater, H. Plasmoelectric potentials in
Finding workable solutions is criti- Khoukhi for their comments and sug- metal nanostructures. Science 346, 828 (Nov. 2014),
cal; otherwise the public will not trust gestions on early drafts of this article, 828–831.
22. Silva, A., Monticone, F., Castaldi, G., Galdi, V., Alù, A.,
smart city projects or deem them vi- helping improve its content, quality, and Engheta, N. Performing mathematical operations
able. Devices (such as smartphones) and presentation. We would also like with metamaterials. Science 343, 6167 (Jan. 2014),
160–163.
used in the IoT depend on security to thank the reviewers for their valu- 23. Usman, M., Muthukkumarasamy, V., and Wu, X.
features (such as the ability to do able feedback and reviews. Mobile agent-based cross-layer anomaly detection in
smart home sensor networks using fuzzy logic. IEEE
secure email, secure Web browsing, Transactions on Consumer Electronics 61, 2 (May
and other transactions). These devic- 2015), 197–205.
References 24. Zhu, C., Sheng, W., and Liu, M. Wearable sensor-based
es need efficient, secure implementa- 1. Adepetu, A., Arnautovic, E., Svetinovic, D., and de behavioral anomaly detection in smart assisted-living
Weck, L. Complex urban systems ICT infrastructure systems. IEEE Transactions on Automation Science
tions of all these features in a smart modeling: A sustainable city case study. IEEE and Engineering 12, 4 (Oct. 2015), 1225–1234.
city. In this context, elliptic curve Transactions on Systems, Man, and Cybernetics:
Systems 44, 3 (Mar. 2014), 363–374.
cryptography (ECC) is considered 2. Akselrod, G., Argyropoulos, C., Hoang, T., Ciracì, C.,
Fang, C., and Huang, J. Probing the mechanisms Rida Khatoun ([email protected]) is an
the most trusted solution for provid- associate professor at Telecom ParisTech, Paris, France.
of large Purcell enhancement in plasmonic
ing security on resource-constrained nanoantennas. Nature Photonics 8 (2014), 835–840. Sherali Zeadally ([email protected]) is an associate
devices and embedded systems. ECC 3. Amaba, B. Industrial and business systems for smart professor in the College of Communication and
cities. In Proceedings of the First International Workshop Information at the University of Kentucky, Lexington, KY.
uses public key cryptography and is on Emerging Multimedia Applications and Services for
Smart Cities. ACM Press, New York, 2014, 21–22.
based on the algebraic structure of 4. Angelidou, M. Smart cities: A conjuncture of four
elliptic curves over finite fields. ECC forces. Cities 47 (Sept. 2015), 95–106.
5. Debnath, A., Chin, H., Haque, M., and Yue, B. A
advantages include the ability to pro- methodological framework for benchmarking smart
vide the same level of security as other transport cities. Cities 37 (Apr. 2014), 47–56.
6. Desouza, K. and Flanery, T. Designing, planning, and
cryptographic algorithms but with managing resilient cities: A conceptual framework.
smaller keys, low memory require- Cities 35 (Dec. 2013), 89–99.
7. Domingo-Ferrer, J. A three-dimensional conceptual
ments and computational overheads, framework for database privacy. Chapter in Secure
and much faster computations. Data Management, W. Jonker and M. Petkovic, Eds.
Springer, Berlin, Heidelberg, Germany, 2007, 193–202.
The scientific community must 8. Ferreira, D. AWARE: A Mobile Context Instrumentation
address these cybersecurity proj- Middleware to Collaboratively Understand Human
Behavior. Ph.D. dissertation, Faculty of Technology,
ects. Unresolved challenges and op- University of Oulu, Oulu, Finland, 2013; http://jultika.
portunities for participation involve oulu.fi/Record/isbn978-952-62-0190-0
9. Huang, L., Chen, X., Mühlenbernd, H., Zhang, H., Chen,
DoS-attack detection for distribution S., Bai, B., Tan, Q., Jin, G., Cheah, K., Qiu, C., Li, J.,
systems, cryptographic countermea- Zentgraf, T., and Zhang, S. Three-dimensional optical
holography using a plasmonic metasurface. Nature
sures, and authentication in IoT and Communications 4, 2808 (Nov. 2013).
10. Jagadish, H.V., Gehrke, J., Labrinidis, A.,
critical infrastructure, as well as in Papakonstantinou, Y., Patel, J., Ramakrishnan, R.,
key management. and Shahabi, C. Big data and its technical challenges. © 2016 ACM 0001-0782/16/08 $15.00

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 57
contributed articles
DOI:10.1145/ 2964342
sometimes better known outside com-
John H. Holland’s general theories of adaptive puter science than within.
Holland is best known for his inven-
processes apply across biological, cognitive, tion of genetic algorithms (GAs), a fam-
social, and computational systems. ily of search and optimization methods
inspired by biological evolution. Since
BY STEPHANIE FORREST AND MELANIE MITCHELL their invention in the 1960s, GAs have
inspired many related methods and

Adaptive
led to the thriving field of evolutionary
computation, with widespread scien-
tific and commercial applications. Al-
though the mechanisms and applica-

Computation:
tions of GAs are well known, they were
only one offshoot of Holland’s broader
motivation—to develop a general the-
ory of adaptation in complex systems.
Here, we consider this larger frame-

The Multidisciplinary work, sketching the recurring themes

that were central to Holland’s theory

Legacy of
of adaptive systems: discovery and dy-
namics in adaptive search; internal
models and prediction; exploratory

John H. Holland modeling; and universal properties of

complex adaptive systems.

Discovery and Dynamics

in Adaptive Search
Holland’s goal of developing a general
theory of adaptation was spurred by
IN AUGUST 2015, Professor John H. Holland passed away both his early work on computer mod-
els of Hebbian learning25 and his read-
in Ann Arbor, MI, where he had served on the University ing of Ronald Fisher’s classic book, The
of Michigan faculty for more than 50 years. John, as he Genetical Theory of Natural Selection,
which integrated genetics with Dar-
was known universally to his colleagues and students, winian selection.8 As he read further in
leaves behind a long legacy of intellectual achievements. evolutionary biology, economics, game
As a descendant of the cybernetics era, he was theory, and control theory, Holland
recognized that adaptation is central to
influenced by the work of John von Neumann, Norbert
Wiener, W. Ross Ashby, and Alan Turing, all of whom key insights
viewed computation as a broad, interdisciplinary ˽˽ Adaptation is an open-ended dynamic
process involving populations of
enterprise. Holland thus became an early proponent agents operating in perpetually novel
of interdisciplinary approaches to computer science environments, continually changing
their behavior to improve performance
and an active evangelist of what is now called and enhance their chance of survival.
Adaptive systems create, update,
computational thinking, reaching out enthusiastically ˽˽
and use internal models of their
to psychologists, economists, physicists, linguists, environment to make predictions;
successful models create valid
philosophers, and pretty much anyone he came in homomorphisms of their environment.

contact with. As a result, even though he received what ˽˽ Exploratory models of complex adaptive
systems lead to insights about essential
was arguably one of the world’s first computer science mechanisms and principles, a use of
modeling that is different from simply
Ph.D. degrees in 1959,23 his contributions are making accurate predictions.

58 COMM UNICATIO NS O F THE ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 all of these fields; they all concern pop-
ulations of agents that must continual-
ly obtain information from uncertain,
changing environments and use it to
improve performance and enhance the
chance of survival.
Holland also recognized that ad-
aptation must be continual and open
ended. In his view, adaptive systems
never achieve a state of equilibrium or
final “optimum” configuration. This
emphasis on open-ended, non-equi-
librium dynamics was in stark contrast
with the mainstream approach (at the
time) in all these fields—the belief that
solving for stable equilibrium dynam-
ics was the scientific goal. Holland’s
contrary view was that a system in sta-
ble equilibrium is essentially dead.
Underlying Holland’s theory of ad-
aptation are the following core ideas:
Populations, sampling, and implicit
parallelism. Evolution is a form of
search that leverages statistics to di-
rect population dynamics. Initially, the
population is an independent sample
of many individuals (from the space
of all possible individuals) and over
time the sample is increasingly biased
toward the high-fitness regions of the
search space. In addition, the popula-
tion can be viewed as an implicit sam-
ple of the much larger space of traits
exhibited by those individuals. Hol-
land termed this implicit large-scale
sampling of traits “implicit parallel- more complex building blocks. a slightly higher rate than an exponen-
ism.” Evolutionary dynamics biases Exploitation vs. exploration. Success- tial function of the trials allocated to
these samples over time toward high- ful adaptation requires maintaining a the observed worse arm.11,12
fitness regions of the search space. balance between exploitation, in which Further, Holland showed that in
Building blocks and recombination. successful building blocks propagate populations undergoing adaptation,
In a population undergoing adapta- in a population, and exploration, in building blocks are analogous to arms
tion, individuals can be decomposed which existing building blocks are re- on a multi-armed bandit. Evaluating
into building blocks—sets of traits that combined or mutated in new ways. an individual in an environment is
are the evolutionary “atoms” of an indi- Inspired by Bellman3 and others, analogous to pulling selected arms on
vidual’s fitness or performance. (As an Holland formalized the exploitation- a multi-armed bandit, where the arms
example from biology, Holland often vs.-exploration trade-off as an ideal- correspond to each of the building
PHOTO C OURT ESY OF SA NTA FE INSTITU TE

mentioned the Krebs cycle, a core cel- ized “two-armed bandit” problem. blocks making up that individual.
lular metabolic pathway that is highly Given a slot machine with two arms, The question of balancing exploi-
conserved across living systems.) Suc- each of which has an unknown payoff tation and exploration—how to opti-
cessful individuals are discovered in probability, how should you allocate mally allocate trials to different arms
stages, first by finding useful building trials (pulls) between the arms so as to based on their observed payoffs—now
blocks through stochastic sampling, maximize your total payoff? Holland becomes the question of how to sam-
and over time recombining them to argued that the optimal strategy allo- ple optimally in the vast space of pos-
create higher-fitness individuals out of cates trials to the observed best arm at sible building blocks, based on their

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 59
contributed articles

estimated contribution to fitness. learning. In Holland’s view, the key environment to enhance survival. The
Evolution deals in populations of indi- activity of an adaptive agent involves key learning elements of this method,
viduals, of course, not building blocks. building and refining these data-driv- the “bucket-brigade” algorithm, com-
There is no explicit mechanism that en models of the environment. bined with a genetic algorithm, pre-
keeps statistics on how building blocks In his second book, Induction,14 saged many of the ideas in modern
contribute to fitness. Holland’s central Holland and his co-authors proposed reinforcement learning, notably the
idea here is that nearly optimal build- inductive methods by which cogni- temporal-difference methods intro-
ing-block sampling occurs implicitly, tive agents can construct—and profit duced by Sutton and Barto.28
as an emergent property of evolution- from—internal models by combining Holland’s inspiration for classifier
ary population dynamics. environmental inputs and rewards systems came from several different
Holland’s early papers10,11 and his with stored knowledge. In their frame- disciplines, including Hebbian learn-
influential 1975 book Adaptation in work, an internal model defines a set ing, artificial intelligence, evolution-
Natural and Artificial Systems12 devel- of equivalence classes over states of the ary biology, economics, psychology,
oped a general, formal setting in which world, together with a set of transition and control theory. Knowledge rep-
these ideas could be expressed mathe- rules between the equivalence class- resentation in the form of a popula-
matically. It was this formalization that es, all of which are learned over time tion of “if-then” rules was a natural
led to the invention of genetic algo- based on environmental rewards (or choice due to its popularity in AI at
rithms that featured stochastic popula- punishments). The many-to-one map- the time, as well as Holland’s early
tion-based search, as well as crossover ping from states of the world to states work on modeling Hebbian cell as-
between individuals as a critical op- of the model (the equivalence classes) semblies: “In Hebb’s view, a cell as-
eration that allows successful building is called a homomorphism. Models sembly makes a simple statement: If
blocks to be recombined and tested in that form valid homomorphisms with such and such an event occurs, then
new contexts. the part of the world being modeled I will fire for a while at a high rate.”29
However, Holland’s aim was more allow the system to make accurate pre- The if-then rules, when activated,
general than a new class of algorithms. dictions. In Holland’s conception, the compete to post their results on a
He aspired to develop an interdisci- equivalence classes are initially very shared “message list,” serving as the
plinary theory of adaptation, one that general, as with, say, “moving object” system’s short-term memory, again
would inform, say, biology as much as and “stationary object.” Through expe- inspired by Hebb’s work, as well as
computer science.5 The later, success- rience and learning, these classes can by AI blackboard systems of the day.
ful application of genetic algorithms be specialized into more useful and Unlike blackboard systems, however,
to real-world optimization and learn- precise subclasses, as in, say, “insect” new rules are generated automatically
ing tasks was, for Holland, just icing and “nest.” Over time, the adaptive in a trial-and-error fashion, and can
on the cake. His broader view of adap- system builds up a default hierarchy of be selected and recombined by a ge-
tation has inspired many and engen- rules covering general cases and refine- netic algorithm.
dered criticism from others, leading to ments for specific classes. Successful rules are strengthened
spirited intellectual debates and con- At the time of Holland’s work, the over time if their predictions lead to
troversies. Most controversial is the ex- idea of default hierarchies was preva- positive rewards from the environment
tent to which it can be demonstrated, lent in knowledge representation sys- (and weakened otherwise) through a
either empirically or mathematically, tems. Holland made two key contribu- credit-assignment method called the
that the behavior of adaptive systems tions to this literature. The first was his bucket-brigade algorithm, in which
is actually governed by Holland’s pro- emphasis on homomorphisms as a for- rules gaining rewards from the envi-
posed principles. Regardless of one’s mal way to evaluate model validity, an ronment or from other rules, transfer
position on this question, the ideas idea that dates back to W. Ross Ashby’s some of their gains to earlier-firing
are compelling and provide a set of An Introduction to Cybernetics.2 Hol- “stage-setting” rules that set up the
unifying concepts for thinking about land’s student Bernard Ziegler devel- conditions for the eventual reward.
adaptation. oped this idea into a formal theory of Holland credited Arthur Samuel’s pio-
computer modeling and simulation.30 neering work on machine learning ap-
Internal Models and Prediction Even today, these early homomorphic plied to checkers26 as a key inspiration
Internal models are central to Hol- theories of modeling stand as the most for these ideas.
land’s theory of adaptive systems. He elegant approach we know of to char- Holland was primarily interested in
posited that all adaptive systems create acterize how consistent a model is with how the two learning mechanisms—
and use internal models to prosper in its environment and how an intelligent discovery of new rules and apportion-
the face of “perpetual novelty.” agent, human or artificial, can update a ing credit to existing rules—could work
Models can be tacit and learned model to better reflect reality. together to create useful default hierar-
over evolutionary time, as in the case of Holland’s second key contribu- chies of rules. He emphasized that the
bacteria swimming up a chemical gra- tion was describing a computational competition inherent in the learning
dient, or explicit and learned over a sin- mechanism, the “learning classifier and action mechanisms would allow
gle lifespan, as in the case of cognitive system,”13,21 to illustrate how a cogni- the system to adapt to a continually
systems that incorporate experience tive system could iteratively build up a changing environment without los-
into internal representations through detailed and hierarchical model of its ing what it had learned in the past.

60 COMM UNICATIO NS O F THE ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 contributed articles

Holland put it this way: “Competition a simple computational framework

among rules provides the system with in which to explore the dynamics of
a graceful way of handling perpetual Darwinian evolution and whether the
novelty. When a system has strong basic mechanisms of variation, differ-
rules that respond to a particular situa-
tion, it is the equivalent of saying that it Holland is ential reproduction, and heredity are
sufficient to account for the richness
has certain well-validated hypotheses
... New rules do not interfere with the
best known for of the natural world.
Holland’s work focused on explor-
system’s action in well-practiced situ- his invention atory models—those that explore basic
ations but wait gracefully in the wings
as hypotheses about what to do under
of genetic principles and mechanisms, even if
they do not make specific or detailed
novel circumstances.”15 algorithms, predictions.16 Such models can show
Although Holland proposed clas-
sifier systems as an executable theory
a family of generically how certain behaviors
could be produced. Holland pioneered
of inductive processes in cognition, search and a style of modeling that has come to be
other researchers took them further,
developing applications to areas as di- optimization known as “individual-based” or “agent-
based,” in which every component of a
verse as poker playing,27 control of gas methods system is represented explicitly (such
pipeline transmission,9 and modeling
the stock market.24 (See Booker et al.4 inspired by as every trader in a stock market sys-
tem or every cell in an immune system
for more on practical applications of
classifier systems.) Today, other rein-
biological model) and has a dynamic internal
state. In such models, each agent has
forcement learning methods are more evolution. its own behavior rules it can modify
popular for real-world decision and over time, through learning. In order to
control problems, but classifier sys- capture the behavior of systems under
tems can perhaps be viewed as an early spatial constraints, these models are
stage-setting method that foreshad- often defined over spatial structures
owed these later approaches. (such as networks or simple grids).
The exploratory models champi-
Exploratory Modeling oned by Holland were not intended to
Given that Holland believed the abil- provide detailed, domain-specific pre-
ity to learn and manipulate internal dictions. They were meant instead to
models was essential for any adaptive explore general mechanisms of com-
system, it is no surprise that he viewed plex systems and thus provide insights
modeling as essential for scientific in- that might lead to more specific, de-
quiry. tailed models. Such idealized models
Today, we use computational mod- are akin to what philosopher Daniel
els both for prediction—by analyzing Dennett has called “intuition pumps.”6
data via statistical models—and for The emphasis on exploratory mod-
understanding how systems work—by els to build intuitions was an impor-
probing the effects of hypothesized tant theme of Holland’s work, and he
underlying mechanisms. This latter often quoted Sir Arthur Eddington’s re-
use of models for enhancing under- mark on the occasion of the first exper-
standing was dear to Holland’s heart. imental test of Albert Einstein’s theory
In his view, the key to science is to un- of relativity: “The contemplation in
derstand the mechanisms that cause a natural science of a wider domain than
system to behave in a certain way, an the actual leads to a far better under-
aspiration that goes well beyond data- standing of the actual.”7 This view of
fitting methods, which typically focus modeling is not typical. For many sci-
on the aggregate behavior of a system. entists, models are useful only to the
For example, a purely statistical extent they generate accurate predic-
model that describes the boom-and- tions, a perspective that rules out the
bust pattern of the stock market does very kind of exploratory modeling that
not address the underlying mecha- interested Holland the most.
nisms that lead to these cycles through
the collective actions of myriad indi- Universal Properties of
vidual buy/sell decisions. In contrast, Complex Adaptive Systems
the genetic algorithms for which Holland was interested in a broad ar-
Holland is so famous are exploratory ray of adaptive systems, including im-
models of mechanism; they provide mune systems, ecologies, financial

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 61
contributed articles

markets, cities, and the brain. In the prices over time. The model tested for
early 1980s, he teamed up with a small the emergence of three different trad-
group of scientists, primarily physi- ing strategies: fundamental, techni-
cists, with a sprinkling of economists cal, and uninformed. The simulated
and biologists, to discuss what proper-
ties this wide swath of “complex adap- Holland’s view market with adaptive trading agents
was run many times, and the dynam-
tive systems” have in common. The dis-
cussions helped define the intellectual
was that a ics of price and trading volumes were
compared to observed patterns in real
mission of the Santa Fe Institute, the system in stable markets. Holland and his collabora-
first institution dedicated to develop-
ing a science of complexity, as well as
equilibrium tors found that the model’s dynamics
replicated several otherwise puzzling
the other complexity institutes that is essentially features of real-life markets.
followed. Holland brought to these
discussions his lifelong study of ad-
dead. Although the Santa Fe Institute
Stock Market model was highly sim-
aptation and a reminder that serious plified, it was very influential and led
theories about complexity would need to many follow-on projects. It demon-
to look deeper than phenomenological strated clearly the essential role that
descriptions but also account for the adaptation plays in complex systems
“how” and “why” of these systems. and illustrated how Holland’s theories
As the discussions about complex of continual learning in response to in-
adaptive systems matured, a consensus termittent feedback from the environ-
developed about their basic properties. ment could be integrated into domain-
Such systems are composed of many specific settings.
components with nonlinear interac- Echo17,22 was an even more ambi-
tions; are characterized by complex tious exploratory model Holland and
emergent behavior; exhibit higher-or- his collaborators developed during the
der patterns; operate at multiple (and 1990s. Echo formalized Holland’s ide-
often nested) spatial and temporal alization of complex adaptive systems
scales, with some behavior conserved into a runnable computational system
across all scales and other behaviors where agents evolved external markers
changing at different scales; and are (called tags) and internal preferences,
adaptive, with behavioral rules contin- then used them to acquire resources
ually adjusted through evolution and and form higher-level aggregate struc-
learning. Although this list is far from tures (such as trading relationships,
a formal characterization of complex symbiotic groups, trophic cascades,
adaptive systems, most people work- and interdependent organizations).
ing in the field today are interested in Echo agents sometimes discovered
systems that have these properties. mimicry and used it to deceive com-
In the early 1990s, Holland teamed petitors. These complex interacting
up with other Santa Fe Institute re- patterns arose throughout the mod-
searchers, including several econo- el’s execution, which started with a
mists, to tackle the mismatch between single minimal agent. When the runs
the predictions of rational expecta- stabilized, the resulting population
tions theory—the dominant theory in of agents was found to reproduce sev-
economics at the time—and empiri- eral well-known patterns observed in
cally observed stock-market behaviors. nature, most famously the rank-fre-
In brief, most economic theory of the quency distribution of species diversity
day assumed that all participants in an known as the Preston curve in ecology.
economy or financial market are fully In lay terms, Echo evolved populations
rational, acting to maximize their indi- where “most species are rare.”
vidual gain. In real life, however, actors The broad scope of the model, to-
in economies and markets are rarely gether with its ability to produce easily
wholly rational, and financial markets identifiable and well-known patterns
often deviate from rationality, as in, from nature, was appealing to immu-
say, speculative bubbles and crashes. nologists, economists, and evolution-
The Santa Fe Institute Artificial ary biologists alike. Many of the in-
Stock Market project1,24 developed an sights behind the project are described
exploratory model in which rational in Holland’s third book, Hidden Order.16
traders were replaced by adaptive trad- Holland’s later books, Emergence,18
ers—those who learn to forecast stock Signals and Boundaries,19 and Complex-

62 COM MUNICATIO NS O F TH E AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 contributed articles

ity: A Very Short Introduction20 show ant colonies for optimization methods, 9. Goldberg, D.E. Computer-Aided Gas Pipeline Operation
Using Genetic Algorithms and Rule Learning. Ph.D.
how the theories of adaptation Hol- and mechanisms from immunology to Dissertation, University of Michigan, Ann Arbor, MI,
land developed during the earlier part improve computer security. 1983; http://www.worldcat.org/title/computer-aided-
gas-pipeline-operation-using-genetic-algorithms-and-
of his career fit into the larger land- Behind the ideas is the man himself. rule-learning/oclc/70390568
scape of complex systems research. In Everyone who knew John personally 10. Holland, J.H. Outline for a logical theory of adaptive
systems. Journal of the ACM 9, 3 (1962), 297–314.
these works, he especially emphasized remembers the gleam in his eye when 11. Holland, J.H. Genetic algorithms and the optimal
the open-ended nature of complex sys- encountering a new idea; his willing- allocation of trials. SIAM Journal on Computing 2, 2
(1973), 88–105.
tems, where change and adaptation are ness to talk to anyone, no matter how 12. Holland, J.H. Adaptation in Natural and Artificial
Systems: An Introductory Analysis with Applications
continual, systems co-evolve with each famous or obscure; and his incredible to Biology, Control, and Artificial Intelligence.
other, and ecological niches arise and generosity and patience. His person- University of Michigan Press, Ann Arbor, MI, 1975.
13. Holland, J.H. Escaping brittleness: The possibilities
decay spontaneously depending on re- ality and humanity were somehow of general-purpose learning algorithms applied to
source availability and competition. inextricably entangled with his intel- parallel rule-based systems. In Machine Learning:
An Artificial Intelligence Approach, Volume 2, R.S.
Holland’s focus on understanding lectual contributions. Since his death Michalski, J.G. Carbonell, and T.M. Mitchell, Eds.
the mechanisms by which complex in 2015, many of Holland’s former stu- Morgan-Kaufman, San Francisco, CA, 1986, 593–623.
14. Holland, J.H. Induction: Processes of Inference, Learning,
patterns emerge and change, rather dents and colleagues have movingly and Discovery. MIT Press, Cambridge, MA, 1989.
than simply characterizing the pat- described their desire to emulate his 15. Holland, J.H. Genetic algorithms. Scientific American
267 (July 1992), 44–50.
terns themselves (such as describing personal qualities as much as his sci- 16. Holland, J.H. Hidden Order: How Adaptation Builds
chaotic attractors or power laws), re- entific excellence. His ideas, intellectu- Complexity. Perseus Books, New York, 1995.
17. Holland, J.H. Echoing emergence: Objectives, rough
flected his determination to get to the al passion, and personal approach will definitions, and speculations for Echo-class models.
heart of complex adaptive systems. serve as beacons for research in intel- In Complexity: Metaphor, Models, and Reality, G.A.
Cowen, D. Pines, and D. Meltzer, Eds. Perseus Books,
This determination represents the ligent and complex systems for many New York, 1999, 309–342.
best of science. Holland’s willingness years to come. 18. Holland, J.H. Emergence: From Chaos to Order. Oxford
University Press, Oxford, U.K., 2000.
to tackle the most difficult questions, 19. Holland, J.H. Signals and Boundaries: Building
Blocks for Complex Adaptive Systems. MIT Press,
develop his own formalisms, and use Acknowledgments Cambridge, MA, 2012.
mathematics and simulation to pro- We thank R. Axelrod, L. Booker, R. 20. Holland, J.H. Complexity: A Very Short Introduction.
Oxford University Press, Oxford, U.K., 2014.
vide insight sets a high bar for scien- Riolo, K. Winter, and the anonymous 21. Holland, J.H. and Reitman, J.S. Cognitive systems
tists in all disciplines. reviewers for their careful reading of based on adaptive algorithms. ACM SIGART Bulletin
63 (June 1977), 49.
the manuscript and many helpful sug- 22. Hraber, P.T., Jones, T., and Forrest, S. The ecology of
Conclusion gestions. Stephanie Forrest gratefully Echo. Artificial Life 3, 3 (1997), 165–190.
23. London, R.L. Who Earned First Computer Science
John Holland was unusual in his abil- acknowledges the partial support of Ph.D.? blog@cacm (Jan. 15, 2013); http://cacm.acm.
ity to absorb the essence of other dis- NSF (NeTS 1518878, CNS 1444500), org/blogs/blog-cacm/159591-who-earned-first-
computer-science-phd/fulltext
ciplines, articulate grand overarching DARPA (FA8750-15-C-0118), Air Force 24. Palmer, R.G., Arthur, W.B., Holland, J.H., LeBaron, B.,
principles, and then back them up Office of Scientific Research (FA8750- and Tayler, P. Artificial economic life: A simple model
of a stock market. Physica D: Nonlinear Phenomena
with computational mechanisms and 15-2-0075), and the Santa Fe Institute. 75, 1–3 (1994), 264–274.
mathematics. Unlike most research- Melanie Mitchell gratefully acknowl- 25. Rochester, N., Holland, J.H., Haibt, L.H., and Duda, W.
Tests on a cell assembly theory of the action of the
ers, Holland moved seamlessly among edges the partial support of NSF (IIS- brain, using a large digital computer. IRE Transactions
these three modes of thinking, devel- 1423651). Any opinions, findings, and on Information Theory 2, 3 (1956), 80–93.
26. Samuel, A.L. Some studies in machine learning using
oping models that were years ahead of conclusions or recommendations ex- the game of checkers. IBM Journal of Research and
Development 3, 3 (1959), 210–229.
their time. A close reading of his work pressed in this material are those of 27. Smith, S.F. A Learning System Based on Genetic
reveals the antecedents of many ideas the authors and do not necessarily re- Adaptive Algorithms. Ph.D. Dissertation, University of
Pittsburgh, Pittsburgh, PA, 1980.
prevalent in machine learning today flect the views of the National Science 28. Sutton, A.G. and Barto, R.S. Time derivative models
(such as reinforcement learning in Foundation. of Pavlovian reinforcement. In Learning and
Computational Neuroscience: Foundations of Adaptive
non-Markovian environments and Networks, M. Gabriel and J. Moore, Eds. MIT Press,
active learning). His seminal genetic References
Cambridge, MA, 1990, 497–537.
29. Waldrop, M.M. Complexity: The Emerging Science at
algorithm spawned the field of evolu- 1. Arthur, W.B. Holland, J.H., LeBaron, B.D., Palmer,
the Edge of Order and Chaos. Simon and Schuster,
R.G., and Tayler, P. Asset pricing under endogenous
tionary computation, and his insights expectations in an artificial stock market. In The
New York, 1993.
30. Ziegler, B. Theory of Modeling and Simulation. Wiley
and wisdom helped define what are Economy As an Evolving Complex System II, W.B.
Interscience, New York, 1976.
Arthur, S. Durlauf, and D. Lane, Eds. Addison-Wesley,
today referred to as the “sciences of Reading, MA, 1997.
complexity.” 2. Ashby, W.R. An Introduction to Cybernetics. Chapman
Stephanie Forrest ([email protected]) is Distinguished
& Hall, London, 1956.
Holland’s many books and papers 3. Bellman, R.E. Adaptive Control Processes: A Guided Professor of Computer Science at the University of
Tour. Princeton University Press, Princeton, NJ, 1961. New Mexico, Albuquerque, NM, External Professor
have influenced scientists around the at the Santa Fe Institute, Santa Fe, NM, and a Fellow
4. Booker, L.B., Goldberg, D.E., and Holland, J.H.
world and across many disciplines. Classifier systems and genetic algorithms. Artificial of the IEEE; John Holland was her Ph.D. advisor at
Intelligence 40, 1–3 (1989), 235–282. the University of Michigan.
Closer to home, he introduced several
5. Christiansen, F.B. and Feldman, M.W. Algorithms, Melanie Mitchell ([email protected]) is Professor of
generations of students at the Universi- genetics, and populations: The schemata theorem Computer Science at Portland State University and
ty of Michigan to computation in natu- revisited. Complexity 3, 3 (1998), 57–64. External Professor at the Santa Fe Institute, Santa Fe,
6. Dennett, D.C. Elbow Room: The Varieties of Free Will NM; John Holland was co-advisor for her Ph.D. at the
ral systems, an idea that even today re- Worth Wanting. MIT Press, Cambridge, MA, 1984. University of Michigan.
7. Eddington, A. The Nature of the Physical World:
mains somewhat controversial, despite Gifford Lectures, 1927. Cambridge University Press,
successes in genetic algorithms for en- Cambridge, U.K., 1927.
8. Fisher, R.A. The Genetical Theory of Natural Selection:
gineering design, biomimicry for robot- A Complete Variorum Edition. Oxford University Press, Copyright held by the authors.
ics, abstractions of pheromone trails in Oxford, U.K.,1930. Publication rights licensed to ACM. $15.00.

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 63
contributed articles
DOI:10.1145/ 2888391
excellent communication skills,
The skills and knowledge that earn strong business acumen, and strate-
gic thinking.6–9 Although these quali-
promotions are not always enough ties are important, a more compre-
to ensure success in the new position. hensive set of skills is increasingly
important, as organizations grapple
LEON KAPPELMAN, MARY C. JONES, VESS JOHNSON, with the costs of hiring, training, re-
EPHRAIM R. MCLEAN, AND KITTIPONG BOONME tention, and turnover.5,7,12,13,18–20
Though many studies have consid-

Skills for
ered IT skills, most focus on specific
technical skills (such as programming
languages, hardware, and systems anal-
ysis) and are framed from the perspec-
tive of employers, IT degree programs,
or recent IT graduates,18,23 focusing
primarily on skills for new hires.1,2

Success
Limited research has informed our
understanding of the skills needed for
an IT professional who wants to prog-
ress up the ranks of an organization.
There is also little or no information
on the expectations of senior and mid-
level IT managers with regard to their
own skills or of those above and below

at Different Stages of an them in their chains of command. Re-

search has found, however, that under-
standing what abilities are needed to

IT Professional’s Career progress successfully in one’s career is

critical to motivating IT employees.10,22
Management and leadership skills gain
increasing importance as one moves
up the IT hierarchy. However, achiev-
ing the right balance of technical and
managerial skills is difficult, and many
organizations fail to provide employees
SKI L LED INF ORMAT I O N T E C H NO LO G Y(IT) professionals adequate guidance toward achieving
are scarce and costly. IT managers must not only this critical skill mix.3,10,11,16,22
To address these shortcomings, the
ensure they hire the right entry-level capabilities and Society for Information Management
skills but also understand how to acquire, nurture, (SIM) annual IT Trends Study includ-
ed a number of questions in its 2014
retain, and develop an evolving and diverse set of membership questionnaire to provide
employee skills throughout the IT hierarchy. They a snapshot of the relative importance
must also ensure they develop their own skills to of a broad set of skills across three
achieve the career progression they desire.14 Much has key insights
been written about the skills needed for success in ˽˽ The key to progression in an IT
the IT field. The appropriate set of skills for entry-level management career is to hone one’s
technical and functional-area skills early.
new hires is of great interest to scholars, as well as to ˽˽ IT professionals must build their
employers.1,2,4,7,15,24,25 However, less attention has gone people and decision-making skills
as they progress.
toward identifying skills required for the success of ˽˽ Communication skills are critical
mid-level IT managers and CIOs beyond calls for throughout an IT professional’s career.

64 COMMUNICATIO NS O F TH E AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 levels, or stages, of IT careers: CIO or fessionals require to not only succeed tion is difficult because these skills
senior-most IT manager, mid-level IT in their current positions but move are evolving continuously and can be
professional, and newly hired IT em- into higher levels of responsibility, job- or organization-specific.8,15 The
ployee. In particular, it captured the and succeed there, too. balance among technical, manage-
perspectives of CIOs and mid-level IT rial, leadership, and business skills
managers regarding what skills are Expanding IT Skills shifts in response to changing busi-
IMAGE BY QUINK Y

most important for success at each of The task of identifying the skills ness and technology conditions.3 In
the stages. This research continues to needed by IT employees as they rise the 1960s and 1970s, driven by the
provide insight into the skills IT pro- through the ranks of an organiza- predominance of mainframe com-

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 65
contributed articles

puters and long system develop- still viewed primarily as a support ac- greater strategic focus. In the 2000s,
ment cycles, technical skills were tivity responsible for managing the the emergence of social networking,
the most valued, followed closely infrastructure needed for the func- mobile computing, and e-commerce
by managerial skills.4,16 In the 1980s tional groups within the organiza- made it even more important for IT
and 1990s, the widespread use of tion.3,11,15 This brought greater need managers to address organization is-
personal computers and local-area for broader technical skills, along sues.12,17,25 Interpersonal, technical,
networks triggered a shift to a more with greater awareness of business and organizational skills have long
strategic focus.21 However, IT was and technology changes, as well as been important for the success of IT
professionals at all stages of their
Table 1. Respondents’ work tenures. careers, but the relative mix of skills
at each stage is not always clear or
IT Current Organization Current Position straightforward.5,7–9,15,16,25 For exam-
< 5 years 8.9% 44.4% 65.4%
ple, although nontechnical skills are
>=5 to <10 years 5.6% 21.0% 22.4%
often viewed as more important for
>=10 to <15 years 11.0% 15.2% 6.7%
senior-management career success,
>=15 to <20 years 18.3% 9.5% 4.4%
technical skills are still highly valued,
>=20 years 56.2% 9.8% 1.1%
particularly in organizations that of-
fer dual career ladders, allowing em-
ployees to pursue either technical or
managerial career paths.10,16,24
Figure 1. Annual revenue of respondents’ organizations ($U.S.). Understanding this evolution of
skill requirements is important for
30%
several reasons. First, as IT organiza-
tions become more strategic, under-
25% 24.8%
standing issues related to recruiting,
21.3%
20% developing, and retaining skilled
IT employees becomes even more
15%
11.3%
important.5,8,13,15,21 Second, because
11.0%
10% 9.0% 9.6% IT has become more strategic and
5.9% 6.1% business-focused in most organiza-
5%
tions, the skills needed at all levels
0% of IT personnel have evolved and ex-
panded. A good understanding of the
M

0B

0B
–1

–5
10

50

00

–1

10

skills needed at each career stage is

10

00

>1
0–

0–

–5

>5

0–
0–

>5
>1

00

>1

thus important. IT employees must

>5

>1

continue to acquire the technical

skills needed to address advance-
ments in technology but also acquire
Figure 2. Industries represented by respondents. the business, management, and lead-
ership skills necessary to move up.
Financial Services 13.5%
Manufacturing 12.0% Findings from the Field
Health/Medical 10.2% We collected the data for this study
Education 7.1%
as part of the larger SIM IT Trends
IT Services/Consulting
Study.12,13,17 We developed a question-
6.1%
naire through a review of the literature,
Retail/Wholesale 5.3%
previous SIM Trends studies, and a
Business Professional Services 5.0%
multi-round Delphi method.9,12,13,17,23,25
Government 4.7%
The Delphi panel, a characteristic of
IT Hardware/Software 4.4%
these SIM studies since their incep-
Energy 3.5% tion in the late 1970s, consisted of aca-
Not-For-Profit 3.2% demic researchers and SIM-member
Medical Technology 2.4% IT practitioners. After each Delphi re-
Consumer Goods 2.4% view, including pilot testing, the ques-
Real Estate 2.3% tionnaire was modified. The final on-
Transportation/Distribution 2.2% line questionnaire was distributed by
Other (all < 2% each) 15.7% emailing a personal link to 4,612 SIM
0% 2% 4% 6% 8% 10% 12% 14% 16% 18% members in the spring of 2014. A total
of 1,002 completed the questionnaire,
a 21.4% response rate.

66 COMMUNICATIO NS O F TH E AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 contributed articles

We received responses from 312 Table 2. CIO perceptions of essential success skills at three stages of an IT career (n = 312).
CIOs, 384 mid-level IT managers, and
306 practitioners who either did not
answer the skills questions or self- IT Middle
CIO % Selecting Management % Selecting New IT Hire % Selecting
identified as “others,” or consultants,
vendors, academics, retired, or in tran- Providing 34.29% Collaboration 33.65% Technical 47.44%
leadership with others knowledge
sition. “CIO” represented the highest-
People 29.49% Problem 19.87% Problem 39.42%
ranking IT person in an organization, management solving solving
regardless of title. The term “mid-level Strategic 23.72% Technical 19.87% Collaboration 38.46%
IT manager/professional” was used planning knowledge with others
for respondents in IT management Decision 23.40% People 17.63% Functional area 22.12%
positions below CIO. Everyone in the making management knowledge
sample was an IT manager since SIM is Communication 20.83% Functional area 16.99% Communication 18.27%
(oral) knowledge (oral)
a professional society for IT managers.
Collaboration 20.19% Communication 16.99% Honesty/ 15.38%
Table 1 reports the distribution of the
with others (oral) credibility
respondents’ tenure. For distribution
Emotional 16.03% Business 16.67% User relationship 8.65%
by organizational revenue, see Figure intelligence analysis management
1, and by industry type, see Figure 2. Honesty/ 15.38% Project 14.10% Business 8.65%
Participants were presented with a credibility management analysis
list of 36 skills and asked to identify the Business 11.86% Decision 11.54% Communication 8.65%
three most important for the success analysis making (written)
of new IT hires, mid-level IT managers, Change 11.22% Honesty/ 11.22% Emotional 7.69%
management credibility intelligence
and themselves in their current posi-
tions. Table 2 reports the top 10 rank-
ings and percentage of CIOs selecting
each success skill for each career stage. Table 3. Mid-level IT manager perceptions of skills* (non-CIOs; n = 384).*
“Providing leadership” was select-
ed by 34.3% of CIOs as one of the top
three skills for success in their jobs
IT Middle Management Skills New IT Hire Skills
and was highest ranked. Not surpris-
Skills % Selecting Skills % Selecting
ingly, the next most selected CIO skills
Collaboration with others 34.4% Collaboration with others 41.7%
were directly related to leadership and
big-picture thinking: “people manage- Functional area knowledge 22.1% Technical knowledge 38.5%

ment,” “strategic planning,” and “de- Problem solving 20.6% Problem solving 32.0%

cision making.” Two of the skills CIOs People management 20.1% Communication (oral) 22.1%

perceived as most important to their Technical knowledge 17.7% Functional area knowledge 18.0%

jobs were also skills they perceived as Communication (oral) 16.9% Honesty 17.2%

highly important to both mid-level IT Emotional intelligence 14.3% Business analysis 12.2%

managers and new IT hires: “oral com- Communication (written) 12.5% Emotional intelligence 10.7%

munication” and “collaboration.” Honesty 10.2% Communication (written) 10.7%

CIOs indicated that many of the Managing expectations 9.9% Programming 9.4%

most important skills for mid-level IT * Only the top 10 skills are included.

professional success are also important

for new IT hires; for example, “prob-
lem solving,” “technical knowledge,” lar to the ones most important for the ther one, two, or three or more levels
and “functional area knowledge” were success of new IT hires, as in Table 3. away from their CIOs. Perceptions of
all top picks by CIOs for these levels, al- However, they chose “collaboration mid-level IT managers about the set
beit with different rankings and selec- with others,” “technical knowledge,” of skills necessary for their job suc-
tion frequencies. This suggests CIOs “problem solving,” “oral communica- cess were fairly consistent, regardless
perceive the critical skills for new hires tion,” and “people management” less of their position within the mid-man-
must be honed for them to move up the frequently for themselves than for new agement ranks; however, the relative
ranks. Surprisingly, managerial skills hires. Consistent with CIOs, they did importance of each skill in terms of
like “decision making,” “providing not see leadership skills as particularly rank and percent selecting a skill were
leadership,” and “planning” were not important for mid-level career success. often quite different. All three levels
among those most frequently chosen A picture thus emerged of mid-level IT indicated “collaboration with others,”
by responding CIOs as critical for suc- managers as having greater manage- “functional area knowledge,” “techni-
cess at mid-level. ment responsibilities but not leader- cal knowledge,” and “problem solv-
Mid-level IT managers also largely ship responsibilities. ing” as the top-ranked skills. Manag-
perceived the skills that are most criti- Table 4 reports the perceptions of ers who reported being closer to their
cal to their own job success to be simi- mid-level IT managers who were ei- CIOs seemed to attach a higher relative

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 67
contributed articles

Figure 3. Perception of top skills for mid-level IT managers by level of manager. ment” as being as critical as the two
higher levels did.
Figure 3 outlines the most impor-
1 level from CIO n=159 2 levels from CIO n=106 3 levels from CIO n=40 tant personal success skills at different
35%
reporting distances from the CIO, us-
30% ing the same data as Table 4 but includ-
ing only those skills selected by at least
25%
15% of the respondents. The eight skills
20% in Figure 3 are also in the top six of at
least one level in Table 4. Note how the
15%
relative importance of “emotional intel-
10% ligence,” “problem solving,” and “func-
tional area knowledge” increases as one
5% moves up the IT hierarchy, while the im-
0% portance of “oral communications” and
“decision making” decreases.
(o tion

en al

le rea

en e

so blem

le cal

ak n
ot ion

em pl

m cisio
lig n
rs

l)

ce

ng

ing
ow ni
ag eo
el tio

ow l a
dg

dg
th at

ra

It appears that as IT managers

ica
he

lvi

kn ech
o
an P
wi bor

int mo

kn ona

De
Pr
un

T
move up the career ladder and oc-
lla

E
m

ti
nc
m
Co

Fu
Co

cupy positions closer to their CIOs,

the set of skills they perceive as criti-
cal to their personal success remains
Table 4. Mid-level IS manager perceptions of own skills* by management level.** fairly stable, even as the relative im-
portance of individual skills can shift
significantly. One possible explana-
1 level from CIO 2 levels from CIO 3 or more levels tion for this apparent contradiction
(n = 159) % Selecting (n = 106) % Selecting from CIO (n = 40) % Selecting is that as IT professionals gain more
Collaboration with 32.7% Collaboration with 34.7% Collaboration with 25.6% experience with a skill, they become
others others others
less concerned about it, even though
Functional area 27.7% People 23.6% Communication 23.1%
at each career stage, they are more
knowledge management (oral)
focused on acquiring the skills they
Problem solving 25.2% Communication 21.5% Functional area 20.5%
(oral) knowledge may not have needed in their prior
Technical 20.1% Functional area 18.8% Problem solving 17.9%
positions (such as “functional area
knowledge knowledge knowledge,” “problem solving,” and
Emotional 16.4% Technical 18.8% Technical 17.9% “emotional intelligence”). For exam-
intelligence knowledge knowledge ple, “functional area knowledge,” as
People 16.4% Problem 16.0% Decision making 15.4% selected by 27.7% of the respondents
management solving one level from the CIO, was their
Communication 14.5% Communication 13.9% Communication 12.8% second most selected success skill,
(oral) (written) (written)
whereas lower-level managers did not
Business analysis 10.7% Emotional 13.2% Honesty/credibility 12.8%
rank it nearly as high. Third-ranked
intelligence
“problem solving” exhibited similar
Honesty/credibility 10.7% Marketing/sales 12.5% Marketing/sales 12.8%
differences between those one level
Communication 10.1% Project 11.8% People 12.8% removed and the others. Higher-level
(written) integration/ management IT managers may be more account-
program able to the business and thus must
management
understand it better and more effec-
* Only the top 10 skills are included. tively solve its problems.
** 79 respondents did not provide number of levels away from CIO.

Limitations of the Study

One limitation is the data was self-
importance, as indicated by the higher tant. Conversely, the former attached reports of respondents’ personal per-
percentage of respondents selecting less importance to both oral and writ- ceptions. Data could thus have been
an item, to “functional area knowl- ten “communication” skills than those affected by respondents’ experience
edge” and “problem solving” than at lower levels. Lower-level managers and bias, including the industries and
those at lower levels. Furthermore, reported “decision making” was a top organization cultures they served. Re-
one-level-away managers perceived skill, whereas far fewer of the higher- spondents reported what they believe
“emotional intelligence” as one of the level managers rated it of critical im- contributed to their success, but we
more important skills for their success, portance to their personal success. have no independent evidence that
whereas managers three or more levels Managers at a level farthest from their these skills are the reason for that
away perceived it as much less impor- CIOs did not perceive “people manage- success. The generalizability of these

68 COMMUNICATIO NS O F TH E AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 contributed articles

findings may be limited because all Implications and Lessons Learned ample, “technical knowledge,” “prob-
respondents were members of one A picture emerges of the variety of lem solving,” and “collaboration”
professional association, SIM. Because skills IT managers deem necessary were the top skills for new IT hires
SIM is an organization for IT profes- for success at various stages of an IT yet were relatively less important for
sionals who have chosen a managerial career, providing a broader, more dy- mid-level managers even though still
career path, rather than a technical ca- namic view of skills for IT career suc- highly ranked and significantly less
reer path, findings might not be entire- cess than the typical in-depth look important for CIOs, while “people
ly applicable to those on a more tech- at specific skills required for a given management,” “strategic planning,”
nical track. On the other hand, a plus career stage or the skill shortages at a and “decision making” were of little
for generalizability is the significant particular moment in time. The study importance to the success of new
degree of variation in the organization also helps improve our understanding hires, somewhat important for mid-
size and industries represented in the of the progression of skills needed as level managers, but were among the
sample. However, since smaller organi- an IT professional’s career advances most important skills reported by re-
zations tend to have flatter hierarchies, from individual performer to manager spondents for CIO success. There is
size-related effects could be an issue of individual performers to leader. thus advance and decline in the rela-
for the mid-level perceptions in Table This progression is reflected in Fig- tive importance of various skills as an
3, Table 4, and Figure 3. Moreover, be- ure 4, illustrating the evolution of IT IT professional’s career progresses.
cause we gathered only frequencies of professional skill requirements as a However, Figure 4 also makes clear
responses, it was difficult to know with career progresses and using the top that throughout one’s entire career,
confidence the relative importance five success skills most frequently se- “collaboration” and “oral communi-
among the skills respondents selected; lected by CIOs across the three career cations” skills remain important.
for example, if 20% of the respondents stages in Table 2. Figure 4 depicts These findings, and recognition of
chose skill X and 10% chose skill Z, this how CIOs’ perceptions of essential the different skills needed at differ-
does not necessarily mean skill X is skills change for those IT profession- ent career stages, represent an impor-
twice as important as skill Z. als at different career stages. For ex- tant contribution to our understand-

Figure 4. CIO perceptions of the top five skills across three levels of IT careers.

CIO IT Middle Management New IT Hires

Providing leadership
50%

45%
Functional area
40% People management/relationships
knowledge
35%

30%

25%

20%

15%

Technical knowledge 10% Strategic planning

5%

0%

Problem solving Decision making

Collaboration with Communication (oral)

others/teamwork

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 69
contributed articles

ing of IT skills and careers; they also All this highlights the importance N. The 2014 SIM IT Key Issues and Trends Study.
MIS Quarterly Executive 13, 4 (Dec. 2014), 237–263.
have implications for organizations, of continuous, lifelong learning to the 13. Kappelman, L., McLean, E., Luftman, J., and Johnson,
as well as individuals. On the one success of IT professionals. In addi- V. IT key issues, investments, and practices of
organizations and IT executives: Results and
hand, such understanding can help tion to the formal academic programs observations from the 2013 SIM IT Trend Study. MIS
organizations improve their IT hiring discussed here, mentoring by a more Quarterly Executive 12, 4 (Dec. 2013), 227–240.
14. Lee, C.K. and Wingreen, S.C. Transferability of
practices and invest in designing and senior manager in the organization knowledge, skills, and abilities along IT career
implementing appropriate training, (but not necessarily one’s boss) can paths: An agency theory perspective. Journal of
Organizational Computing and Electronic Commerce
education, retention, and career-ad- be very helpful toward career advance- 20, 1 (Feb. 2010), 23–44.
15. Lee, D.M.S., Trauth, E.M., and Farwell, D. Critical skills
vancement programs. On the other, ment. If not formally provided by an and knowledge requirements of IS professionals: A
they provide a framework whereby IT employer, individuals should seek joint academic/industry investigation. MIS Quarterly
(Special Issue on IS Curricula and Pedagogy) 19, 3
employees can develop and advance out such mentors informally through (Sept. 1995), 313–340.
their own careers, acquiring the skills professional associations like ACM 16. Litecky, C.R., Arnett, K.P., and Prabhakar, B. The
paradox of soft skills versus technical skills in IS
needed for success in their current and personal networks. Similarly, ex- hiring. Journal of Computer Information Systems 45,
positions and prepare for their next ternal career coaches can be helpful, 1 (Sept. 2004), 69–76.
17. Luftman, J., Kempaiah, R., and Nash, E. Key issues
career stage. particularly at critical decision points for IT executives 2005. MIS Quarterly Executive 5, 2
In the first stage, new hires are ex- in one’s career. (June 2006), 27–45.
18. Overby, S. CIOs struggle with the great talent hunt.
pected to have the technical knowl- CIO (May 1, 2013), 32–44.
edge and problem-solving skills Conclusion 19. Prabhakar, B., Litecky, C.R., and Arnett, K. IT skills in a
tough job market. Commun. ACM 48, 10 (Oct. 2005),
needed to perform the job. These This research study, which was based 91–94.
skills would come from their college on SIM member data, provides in- 20. Schwarzkopf, A.B., Mejias, R.J., Jasperson, J.S.,
Saunders, C.S., and Gruenwald, H. Effective practices
preparation in computer science or sights into the diverse and dynamic for IT skills staffing. Commun. ACM 47, 1 (Jan. 2004),
information systems, technical cer- nature of skill requirements at differ- 83–88.
21. Sethi, V. and King, W.R. Development of measures to
tifications (such as Cisco and Micro- ent stages of an IT career and levels of assess the extent to which an information technology
application provides competitive advantage.
soft), or previous employment, intern- responsibility from the perspective of Management Science 40, 12 (Dec. 1994), 1601–1627.
ships, and work-study programs. At most senior and mid-level IT manag- 22. Smits, S.J., McLean E.R., and Tanner, J.R. Managing
high-achieving information systems professionals.
this stage, IT employees function as ers. Organizations can use them to en- Journal of Management Information Systems 9, 4
individual performers or members hance their IT workforce practices and (1993), 103–120.
23. Todd, P.A., McKeen, J.D., and Gallupe, R.B. The
of a team. They also begin to gain the IT professionals to achieve their per- evolution of IS job skills: A content analysis of IS job
functional knowledge and business sonal career objectives and help others advertisements from 1970 to 1990. MIS Quarterly 19,
1 (Mar. 1995), 1–27.
understanding needed to be a more do so, too. 24. Wilkerson, J. An alumni assessment of MIS related
effective performer. job skill importance and skill gaps. Journal of
Information Systems Education 23, 1 (2012), 85–99.
At mid-level, IT professionals le- References 25. Zwieg, P., Kaiser, K.M., Beath, C.M., Bullen, C.,
1. Aasheim, C.L., Li, L., and Williams, S. Knowledge
verage their technical experience to and skill requirements for entry-level information
Gallagher, K.P., Goles, T., Howland, J., Simon, J.C.,
Abbot, P. Abraham, T., Carmel, E., Evaristo, R. Hawk,
be managers of individual perform- technology workers: A comparison of industry and S., Lacity, M., Gallivan, M., Kelly, S., Mooney, J.G.,
academia. Journal of Information Systems Education Ranganathan, C., Rottman, J.W., Ryan, T., and Wion,
ers, heading teams, IT projects, or 20, 3 (Summer 2009), 349–356. R. The information technology workforce: Trends and
programs. Here “decision making,” 2. Aasheim, C.L., Shropshire, J., Li, L., and Kadlee, C. implications 2005–2008. MIS Quarterly Executive 5, 2
Knowledge and skill requirements for entry-level IT (June 2006), 47–54.
“business knowledge,” and “people workers: A longitudinal study. Journal of Information
management” skills become more Systems Education 23, 2 (Spring 2012), 193–204.
3. Agarwal, R. and Ferratt, T. Enduring practices for Leon Kappelman ([email protected]) is a
important than they were previous- managing IT professionals. Commun. ACM 45, 9 professor in the Department of Information Technology
ly. Obtaining an MBA or a master’s (Sept. 2002), 73–79. & Decision Sciences in the College of Business at the
4. Benamati, J.H., Ozdemir, Z.D., and Smith, H.J. Aligning University of North Texas, Denton, TX.
degree in IS, or participating in per- undergraduate IS curricula with industry needs.
sonal- or management-development Commun. ACM 53, 3 (Mar. 2010), 152–156. Mary C. Jones ([email protected]) is department
5. Byrd, T.A. and Turner, D.E. An exploratory analysis chair and a professor in the Department of Information
programs can be valuable career en- of the value of the skills of IT personnel: Their Technology & Decision Sciences in the College of Business
relationship to IS infrastructure and competitive at the University of North Texas, Denton, TX.
hancers at this stage, enabling op- advantage. Decision Sciences 32, 1 (Mar. 2001), 21–54.
portunities for greater management 6. Clark, C.E., Cavanaugh, N.C., Brown, C.V., and Vess Johnson ([email protected]) is an assistant
Sambamurthy, V. Building change-readiness professor and MIS coordinator at the H-E-B School of
responsibilities. capabilities in the IS organization: Insights from the Business at the University of the Incarnate Work, San
Upon achieving executive leader- Bell Atlantic experience. MIS Quarterly 21, 4 (Dec. Antonio, TX.
1997), 425–454.
ship responsibilities, as in, say, a pro- 7. Gallagher, K.P., Kaiser, K.M., Simon, J.C., Beath, C.M.,
Ephraim R. McLean ([email protected]) is a Regents’
professor and George E. Smith Eminent Scholar’s chair
motion to CIO, “providing leadership,” and Goles, T. The requisite variety of skills for IT in Computer Information Systems Department in the
professionals. Commun. ACM 53, 6 (Virtual Extension, J. Mack Robinson College of Business at Georgia State
along with “strategic planning” and June 2010), 144–148. University, Atlanta, GA.
“decision making,” become key ingre- 8. Harris, J. Preparing to be the chief information officer.
Journal of Leadership, Accountability and Ethics 8, 5 Kittipong Boonme ([email protected]) is an assistant
dients for success. It is here that knowl- (Dec. 2011), 56–62. professor in the School of Management at Texas Woman’s
edge of the business must be linked to 9. Hawk, S., Kaiser, K.M., Goles, T., Bullen, C.V., Simon, University, Denton TX.
J.C., Beath, C.M., Gallagher, K.P., and Frampton, K.
knowledge of the business’s custom- The information technology workforce: A comparison
ers, suppliers, and indeed the industry of critical skills of clients and service providers.
Information Systems Management 29, 1 (2012), 2–12.
itself. Here, senior management and 10. Hsu, M.K., Jiang, J.J., Klein, G., and Tang, Z. Perceived
executive leadership programs (such career incentives and intent to leave. Information and
Management 40, 5 (May 2003), 361–369.
as at Harvard, MIT, Stanford, and SIM’s 11. Igbaria, M., Greenhaus, J.H., and Parasuraman, S.
Career orientations of MIS employees: An empirical
Regional Leadership Forum) can help analysis. MIS Quarterly 15, 2 (June 1991), 151–169.
provide this broader perspective. 12. Kappelman, L., McLean, E., Johnson, V., and Gerhart, © 2016 ACM 0001-0782/16/08 $15.00

70 COMMUNICATIO NS O F TH E ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 ACM Books M MORGAN & CLAYPOOL
&C P U B L I S H E R S
Publish your next book in the
ACM Digital Library
ACM Books is a new series of advanced level books for the computer science community,
published by ACM in collaboration with Morgan & Claypool Publishers.
I’m pleased that ACM Books is directed by a volunteer organization headed by a
dynamic, informed, energetic, visionary Editor-in-Chief (Tamer Özsu), working
closely with a forward-looking publisher (Morgan and Claypool).
—Richard Snodgrass, University of Arizona

books.acm.org ACM Books

◆ will include books from across the entire
spectrum of computer science subject
matter and will appeal to computing
practitioners, researchers, educators, and
students.
◆ will publish graduate level texts; research
monographs/overviews of established
and emerging fields; practitioner-level
professional books; and books devoted to
the history and social impact of computing.
◆ will be quickly and attractively published
as ebooks and print volumes at affordable
prices, and widely distributed in both print
and digital formats through booksellers
and to libraries and individual ACM
members via the ACM Digital Library
platform.
◆ is led by EIC M. Tamer Özsu, University of
Waterloo, and a distinguished editorial
board representing most areas of CS.

Proposals and inquiries welcome! Association for

Contact: M. Tamer Özsu, Editor in Chief
Computing Machinery
[email protected] Advancing Computing as a Science & Profession
review articles
DOI:10.1145/ 2957324

Algorithmic advances take advantage of the

structure of massive biological data landscape.
BY BONNIE BERGER, NOAH M. DANIELS, AND Y. WILLIAM YU

Computational
Biology in
the 21st Century:
Scaling with
Compressive
Algorithms

COMPUTATIONAL BIOLOGISTS ANSWER biological and

biomedical questions by using computation in support
of—or in place of—laboratory procedures, hoping to key insights
obtain more accurate answers at a greatly reduced ˽˽ There is a lot of commonality in
cost. The past two decades have seen unprecedented sequences and other biological data—
even more redundancy than in a text file
technological progress with regard to generating of the English language.
biological data; next-generation sequencing, mass ˽˽ This means we can take advantage of
spectrometry, microarrays, cryo-electron microscopy, compression algorithms that exploit
that commonality and represent many
and other high-throughput approaches have led to an sequences by only a few bits.

explosion of data. However, this explosion is a mixed ˽˽ Of course, we are dealing with a massive
amount of data so that compression
blessing. On the one hand, the scale and scope of data becomes important for efficiency.
should allow new insights into genetic and infectious ˽˽ We highlight recent research that
diseases, cancer, basic biology, and even human capitalizes on structural properties
of biological data—low metric entropy
migration patterns. On the other hand, researchers are and fractal dimension—to allow us
to design algorithms that run in sublinear
generating datasets so massive that it has become time and space.

72 COMM UNICATIO NS O F THE ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 difficult to analyze them to discover is now known as next-generation se- kit) to the Google cloud (https://cloud.
patterns that give clues to the underly- quencing. The material costs to se- google.com/genomics/gatk). Amazon
ing biological processes. quence a genome have plummeted Web Services are also commonly used
Certainly, computers are getting in the past decade, to the point where for computational biology research and
faster and more economical; the a whole human genome can be se- enterprise (for example, DNAnexus).31
amount of processing available per quenced for less than US$1,000. As a However, while cloud computing frees
dollar of computer hardware is more or result, the amount of genomic data researchers from maintaining their
less doubling every year or two; a simi- available to researchers is increasing own datacenters and provides cost-
lar claim can be made about storage by a factor of 10 every year. saving benefits when computing re-
ILLUSTRATION BY PETER CROW TH ER ASSO CIATES

capacity (Figure 1). This growth in data poses significant sources are not needed continuously,
In 2002, when the first human ge- challenges for researchers.25 Currently, it is no panacea. First and foremost,
nome was sequenced, the growth in many biological “omics” applications the computer systems that make up
computing power was still match- require us to store, access, and analyze those cloud datacenters are themselves
ing the growth rate of genomic data. large libraries of data. One approach to bound by improvements in semicon-
However, the sequencing technology solving these challenges is to embrace ductor technology and Moore’s Law.
used for the Human Genome Project— cloud computing. Google, Inc. and the Thus, cloud computing does not truly
Sanger sequencing—was supplanted Broad Institute have collaborated to address the problem posed by the faster-
around 2004, with the advent of what bring the GATK (Genome Analysis Tool- than-Moore’s-Law exponential growth

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 73
review articles

Figure 1. (a) Moore’s and (b) Kryder’s laws contrasted with genomic sequence data. tion, and interaction of DNA, RNA, and
proteins. Much of this data is amena-
  Genomic Data     Computing Power
ble to standard Big Data analysis meth-
109 109 ods; however, in this article we focus
108 108
on examples of biological data that ex-
hibit additional exploitable structure

Genomic Data, KiloBase-

10 7
107 for creating scalable algorithms.
Computing Power,

pairs per day

Sequence data, either nucleotide
TeraFLOPS

106 106
sequences (using a four-letter alpha-
105 105
bet representing the four DNA or RNA
104 104 bases) or protein sequences (using a
103 103 20-letter alphabet representing the 20
standard amino acids) are obtained in
102 102
several ways. For both protein and RNA
10 10 sequence data, mass spectrometry,
2002 2004 2006 2008 2010 2012 2014
Year
which can determine protein sequence
(a) and interactions and RNA-seq, which
can determine RNA sequence and abun-
109 109 dance allow scientists to also infer the
expression of the gene to which it might
108 108

Genomic Data, KiloBase-

translate play central roles. However,
107 107
Storage Capacity,

with the advent of next-generation se-

pairs per day

quencing (NGS) technologies, the great-
Gigabytes

106 106
est volume of sequence data available is
105
105
that of DNA. To better understand the
104 104 structure of NGS sequence data, we will
103 103 expand on NGS methodologies.
At the dawn of the genomic era,
102 102
Sanger sequencing was the most widely
10
2002 2004 2006 2008 2010 2012 2014
10 used method for reading a genome.
Year More recently, however, NGS approach-
(b) es, beginning with Illumina’s “sequenc-
ing by synthesis,” have enabled vastly
greater throughput due to massive par-
in omics data. Moreover, in the face of rithmic advances for dealing with the allelism, low cost, and simple sample
disease outbreaks such as the 2014 Ebo- growth in biological data by explicitly preparation. Illumina sequencing and
la virus epidemic in West Africa, analysis taking advantage of its unique struc- other NGS approaches such as SOLiD,
resources are needed at often-remote ture; algorithms for gaining novel bio- Ion Torrent, and 454 pyrosequencing do
field sites. While it is now possible to logical insights are not its focus. not read a single DNA molecule end-to-
bring sequencing equipment and limit- end as one could read through a bound
ed computing resources to remote sites, Types of Biological Data book. Instead, in shotgun sequencing,
Internet connectivity is still highly con- In the central dogma of molecular bi- DNA molecules are chopped into many
strained; accessing cloud resources for ology, DNA is transcribed into RNA, small fragments; from these fragments
analytics may not be possible. which is translated by the ribosome we generate reads from one or both ends
Computer scientists routinely ex- into polypeptide chains, sequences of (Figure 2a). These reads must be put to-
ploit the structure of various data in amino acids, which singly or in com- gether in the correct order to piece to-
order to reduce time or space complex- plexes are known as proteins. Proteins gether an entire genome. Current reads
ity. In computational biology, this ap- fold into sophisticated, low-energy typically range from 50 to 200 bases
proach has implicitly served research- structures, which function as cellular long, though longer reads are available
ers well. Now-classical approaches machines; the DNA sequence deter- with some technologies (for example,
such as principal component analysis mines the amino acid sequence, which PacBio). Because no sequencing tech-
(PCA) reduce the dimensionality of in turn determines the folded structure nology is completely infallible, sequenc-
data in order to simplify analysis and of a protein. This structure ultimately ing machines also provide a quality score
uncover salient features.3 As another determines a protein’s function within (or measure of the confidence in the
example, clever indexing techniques the cell. Certain kinds of RNA also func- DNA base called) associated with each
such as the Burrows-Wheeler Trans- tion as cellular machines. Methods position. Thus, an NGS read is a string
form (BWT) take advantage of aspects have been developed to gather biologi- of DNA letters, coupled with a string of
of sequence structure3 to speed up cal data from every level of this process, ASCII characters that encode the quality
computation and save storage. This resulting in a massive influx of data on of the base call. A sequencing run will
article focuses on cutting-edge algo- sequence, abundance, structure, func- produce many overlapping reads.

74 COM MUNICATIO NS O F TH E AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 review articles

While measuring abundance to gen- in addition to random walks for global into contiguous sequences. The as-
erate gene expression data (for more in- multiple network alignment. Other sembly problem is analogous to the
formation, see the Source Material that tools solve other biological problems, problem of reconstructing a book with
accompanies this article in the ACM such as MONGOOSE,10 which analyzes all its pages torn out. De novo assem-
Digital Library) lends itself to cluster metabolic networks. However, given its bly is beyond the scope of this article,
analysis and probabilistic approaches, breadth, biological network science is but is possible because the sequence
the high dimensionality and noise in beyond the scope of this article. is covered by many overlapping reads;3
the data present significant challeng- for this task, the de Bruijn graph data
es. Principal Component Analysis has Challenges with Biological Data structure is commonly used.6 Often,
shown promise in reducing the dimen- Given DNA or RNA reads from NGS however, a reference genome (or in the
sionality of gene expression data. Such technologies, the first task is to as- case of RNA, transcriptome) is available
data and its challenges have been the semble those fragments of sequence for the organism being sequenced; the
focus of other articles,3 and thus will be
only lightly touched upon here. Figure 2. The next-generation sequencing (NGS) pipeline.
As mentioned earlier, function fol-
lows form, so in addition to sequence
cut many times
and expression, structure plays an im- at random
portant role in biological data science. (Shotgun)
However, we are not interested in only
RNA and protein structures; small chem-
ical compounds represent an additional
source of relevant structural data, as
they often interact with their larger RNA Read ∼100 bases (bp)
and protein brethren. Physical struc- from one or both ends
tures of molecules can be determined ∼100 bp ∼100 bp
by X-ray crystallography, NMR, electron
(a) 
‘Shotgun’ sequencing breaks DNA molecules into many short fragments, which are read from
microscopy, and other techniques. Once one or both ends in the form of reads, and relies on high coverage to produce a statistically likely
determined, there are a variety of ways representation of a whole genome.
of representing these structures, from
labeled graphs of molecular bonds to
summaries of protein domains. These
representations can then be stored in
databases such as Pub-Chem or the Pro- A A G C C T A C C A C

T T C G G A T G G T G
tein Data Bank, and are often searched
through, for example, for potential small
molecule agonists for protein targets.
Importantly, as we will expand upon
later, interesting biomolecules tend to 1
be sparse and non-randomly distributed SNP
2
in many representational spaces, which
can be used for accelerating the afore-
mentioned searches.
When examining more complex
A A G C T T A C C A C
phenomena than single proteins or
T T C G A A T G G T G
compounds, we often look to synthe-
size things together into a systems-
level understanding of biology. To that
end, we frequently use networks to rep-
resent biological data, such as the ge- (b) 
Single-nucleotide polymorphisms, or SNPs, are the simplest type of genomic
netic and physical interactions among variant, and form the bulk of ‘variant-calling’ analysis.
proteins, as well as those in metabolic
pathways.3 While standard network
science tools have been employed in Raw Reads Mapped Reads Variant Calls
these analyses—for example, several 102……A 452……A
146……C 713……C
approaches make use of diffusion or Bowtie2 GATK or
278……G 843……G
or BWA Samtools
random walks to explore the topology to reference 343……T 901……T
of networks9,11—they are often paired (c) 
The NGS downstream analysis pipeline. Shotgun reads are mapped to a reference genome with tools
with more specific biological data, as such as BWA, Bowtie, or CORA. The resulting genomic sequence is analyzed for variants with tools
seen in IsoRank32 and IsoRankN’s21 such as GATK or Samtools. This allows relationships between genes and diseases to be uncovered.
use of conserved biological function

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 75
review articles

establishment of a human reference fly, respectively. These genomes are

genome was indeed the purpose of the enabling cross-species inference, for
Human Genome Project. example about genes and regulatory re-
When a reference sequence is avail- gions, and thus insights into function
able, NGS reads can be mapped onto
this reference (Figure 2c). Continuing When examining and evolution.3 Again, the sheer enor-
mity of sequencing data is problematic
the book analogy, it is much easier to re-
construct a book with all its pages torn
more complex for storage, access, and analysis.
Given a sequenced genome, the
out when one has another (perhaps im- phenomena than next natural questions ask what genes
perfect) copy of that book to match pag-
es to. Mapping allows the differences
single proteins (genomic regions that code for pro-
teins) are present, what structure each
between the newly sequenced genome or compounds, resulting protein takes, and what bio-
and the reference to be analyzed; these
differences, or variants, may include
we often look to logical function it performs. Identify-
ing likely genes is a well-studied prob-
single-nucleotide polymorphisms synthesize things lem3 beyond the scope of this article.
(SNPs, which are the genetic analogue
to bit-flips, see Figure 2b), insertions or together into a However, determining evolutionary
relationships, structure, and function
deletions, or larger-scale changes in the systems-level is at the heart of current research in
genome. Determining the differences
between an individual genome and a understanding of computational biology. Since some
organisms (known as model organ-
reference is known as variant calling.
While reference-based read mapping is
biology. To that isms) are better studied than others,
and evolution is known to conserve
a fundamentally simpler problem than end, we often sequence, structure, and function, a
de novo assembly, it is still computa-
tionally complex, as gigabytes or tera-
use networks powerful approach to determine these
attributes is to search for similar se-
bytes of reads must each be mapped to represent quences about which more is known.
onto the reference genome, which can
range from millions (for bacteria) to biological data. This so-called homology search entails
searching for approximate matches
billions (for mammals) of base pairs. in databases of known gene or pro-
As an example, the ICGC-TCGA Pan tein sequences. The homology search
Cancer Analysis of Whole Genomes problem was believed to be solved pre-
(PCAWG)36 brings together more than viously; Basic Local Alignment Search
500 top cancer researchers from about Tool (BLAST)3 has been the standard
80 institutions in a coordinated man- tool for performing homology (similar-
ner with the goal of mapping the entire ity) search on databases of nucleotide
mutational landscape of 37 common and protein sequences. BLAST takes a
cancer types. Currently, each sample “seed-and-extend” approach; it looks
requires seven hours to download even for small, k-mer matches that might
on an institutional connection. Im- lead to longer matches, and greedily
portantly, researchers do not trust the extends them, ultimately producing a
provided mapping, and thus they redo sequence alignment between a query
mappings. The time spent on mapping and each potential database hit. How-
is about 50% of the overall time spent ever, BLAST’s running time scales lin-
on the sequence analysis pipeline. As early with the size of the database be-
read mapping is typically the most cost- ing searched, which is problematic as
ly step in NGS analysis pipelines (for sequence databases continue to grow
example, GATK), any improvement to at a faster rate than Moore’s Law.
existing mappers will immediately ac- On a potentially even larger scale
celerate sequence analysis studies on is the growth of metagenomic data.
large read datasets. Metagenomics is the study of the many
Driven by the plummeting costs of genomes (bacterial, fungal, and even
next-generation sequencing, the 1000 viral) that make up a particular envi-
Genomes Project1 is pursuing a broad ronment. Such an environment could
catalog of human variation; instead of be soil from a particular region (which
producing a single reference genome can lead to the discovery of new antibi-
for a species, many complete genomes otics14), or it could be the human gut,
are catalogued. Likewise, WormBase whose microbiome has been linked to
and FlyBase are cataloguing many dif- human-health concerns including Au-
ferent species and strains of the Cae- tism Spectrum Disorder,23 Crohn’s Dis-
norhabditis worm and Drosophila fruit ease, and obesity.

76 COMM UNICATIO NS O F THE AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 review articles

Metagenomics fundamentally asks

what organisms are present, and, in
the case of a microbiome such as the
gut, what metabolic functions it can
Definitions
accomplish as a whole. One way of ad- Chemogenomics: Computational study of drugs and their targets based on chemical
dressing this problem is to attempt to structure and function.
map NGS reads from a metagenomic Metagenomics: Study of the many genomes that make up a particular environment.
sample onto a set of reference ge-
nomes that are expected to be present. Shotgun sequencing: Modern genomic sequencing, which chops DNA into many
short pieces
This is exactly the read-mapping prob-
lem discussed early, but with many Homology search: Determining the function, structure, or identity of a gene sequence by
reference genomes, compounding the locating similar sequences within an annotated database.
computational requirements. A sec- Transcriptome: Transcribed RNA from a genome, which results in protein production.
ond way is to perform homology search
BLAST: Standard biological sequence similarity search tool.
on a protein sequence database; exact
or nearly exact matches imply the pres-
ence of a species, while more distant
hits may still give clues to function. For deed, these growing datasets “threaten string and associated quality scores,
this task, BLASTX2 is commonly used to make the arising problems compu- the latter of which generally uses more
to translate nucleotide reads into their tationally infeasible.”3 space when compressed. By taking ad-
possible protein sequences, and search vantage of biological structure, both
for them in a protein database. The dif- State-of-the-Art Approaches parts of NGS reads can be better com-
ficulty is the datasets required to shine to Meet These Challenges pressed. Unlike some other approach-
any light on these questions, namely Techniques for reference-based read es to compressing quality scores in the
from “shotgun” metagenomics, are mapping typically rely on algorithmic ap- literature,4,26 Quartz39 takes advantage
gigantic and vastly more complex than proaches such as the Burrows-Wheeler of the fact that midsize l-mers can in
standard genomic datasets. The mas- transform (BWT), which provides efficient many cases almost uniquely identify
sive data results in major identification string compression through a reversible locations in the genome, bounding
challenges for certain bacterial, as well transformation, while the FM-index data the likelihood that a quality score is
as viral, species, and genera.19 structure is a compressed substring index, informative and allowing for lossy
The computational study of drugs based on the BWT, which provides effi- compression of uninformative scores.
and their targets based on chemical cient storage as well as fast search.3 BWA Because Quartz’s lossy compression
structure and function is known as (Burrows-Wheeler Aligner) uses the BWT, injects information from the distribu-
chemogenomics.5 In the fields of drug while the Bowtie2 mapper further relies on tion of l-mers in the target genome, it
discovery and drug repurposing, the the FM-index for efficient mapping of NGS demonstrates not only improved com-
prediction of biologically active com- reads.3 The Genome Multitool (GEM) pression over competing approaches,
pounds is an important task. Compu- mapper24 also uses an FM-index coupled but slightly improves the accuracy of
tational high-throughput screening with dynamic programming in a com- downstream variant-calling.39 Simi-
eliminates many compounds from la- pressed representation of the reference larly, for the sequence component of
borious wet-lab consideration, but even genome, in order to prune the search the read, Mince27 takes advantage of se-
computational screening can be time space when mapping reads to a reference quence redundancy by grouping simi-
consuming. genome. Masai33 and mrsFAST15 use an lar reads (those that share a common
Chemogenomics typically relies “approximate seed” approach to index short—15bp—substring) together into
on comparing chemical graph struc- the space of possible matches, likewise buckets, allowing that common sub-
tures to identify similar molecules and pruning the search space; however, the string to be removed and treated as
binding sites. Furthermore, compar- bulk of its runtime is spent on the extend the bucket label, so that each read in
ing chemical graph structures typi- phase. State-of-the-art mapper mrsFAST- the compressed representation com-
cally involves computing the maximal Ultra achieves improvements in efficien- prises only its unique differences from
common subgraph (MCS), an NP-hard cy based on machine architecture rather the bucket label. This approach al-
problem. However, there are an in- than leveraging redundancy in the data it- lows a general-purpose compressor to
creasing number of such chemical self with near-perfect sensitivity, but only achieve better compression. SCALCE3
compounds to search; the NCBI’s Pub- for the case where there are no insertions also relies on a “boosting” scheme,
Chem database has grown from 31 mil- and deletions (indels).16 Even with these reordering reads in such a way that a
lion compounds in January 2011 to 68 approaches, read mapping remains a sig- general-purpose compressor achieves
million in July 2015. nificant bottleneck in genomic research.3 improved compression.
The continued ability to store, Compressing reads for storage is Recent advances in metagenomic
search, and analyze these growing da- necessary should researchers wish to search tools have relied on two improve-
tasets hinges on clever algorithms that apply more advanced mapping tools or ments over BLASTX: indexing and al-
take advantage of the structure of, and other analysis in the future.4 As stated phabet reduction. RapSearch240 relies
redundancy present in, the data. In- earlier, NGS reads consist of a sequence on alphabet reduction and a collision-

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 77
review articles

Figure 3. Cartoon depiction of points in an arbitrary high-dimensional space, as might arise computation is performed on one hu-
from genomes generated by mutation and selection during the course of evolution. man genome, and a researcher wishes
to perform the same computation on
Although high dimensional locally, at the global scale of covering spheres, the data cloud looks
nearly 1-dimensional, which enables entropy scaling of similarity search. Clusters cover the data
another human genome, most of the
points but do not cover unoccupied regions of space. The green triangle represents a query, with two work has already been done.22 When
concentric search radii (red circles) around it. Thanks to low fractal dimension, the large circle does dealing with redundant data, cluster-
not contain vastly more points than the small circle. ing comes to mind. While cluster-based
search is well studied,20 conventional
wisdom holds that it provides a constant
factor speed-up over exhaustive search.
Beyond redundancy, however, an-
other attribute of large biological da-
tasets stands out. Far fewer biological
sequences exist than could be enumer-
ated, but even more so, those that exist
tend to be highly similar to many oth-
ers. Thanks to evolution, only those
genes that exhibit useful biological
function survive, and most random
sequences of amino acids would not
be expected to form stable structures.
Since two human genomes differ on
average by only 0.1%, a collection of
1,000 human genomes contains less
than twice the unique information of
a single genome.22 Thus, not only does
biological data exhibit redundancy, it
also tends not to inhabit anywhere near
the entire feasible space (Figure 3). It
seems that physical laws—in this case,
evolution—constrain the data to a par-
ticular subspace of the Cartesian space.
One key insight related to redun-
dancy is that such datasets exhibit low
metric entropy.38 That is, for a given
free hash table. The alphabet reduction, Another recent and novel approach cluster radius rc and a database D, the
as it is reversible, can be thought of as to exploiting the structure of gene number k of clusters needed to cover
a form of lossless compression; a 20-let- expression space is Parti (Pareto task D is bounded by Nrc (D), the metric en-
ter amino acid alphabet is mapped onto inference),17 which describes a set of tropy, which is relatively small com-
a smaller alphabet, with offsets stored data as a polytope, and infers the spe- pared to |D|, the number of entries in
to recover the original sequence in the cific tasks represented by vertices of the database (Figure 3). In contrast,
full alphabet. The hash table provides that polytope from the features most if the points were uniformly distrib-
an efficient index of the database to highly enriched at those vertices. uted about the Cartesian space, Nrc (D)
be searched. DIAMOND7 also relies on The most widely used chemogenom- would be larger.
alphabet reduction, but uses “shaped ics search is the Small Molecule Sub- A second key insight is the biologi-
seeds”—essentially, k-mers of length graph Detector (SMSD),29 which applies cal datasets have low fractal dimen-
15–24 with wildcards at 9–12 specific one of several MCS algorithms based on sion.38 That is, within some range of
positions—instead of simple k-mer the size and complexity of the graphs in radii r1 and r2 about an arbitrary point
seeds to index the database. DIAMOND question. Notably, large chemical com- in the database D, the fractal dimen-
demonstrates search performance pound databases, such as PubCHEM, sion d is d = (log(n 2/n1)
(log (r2/r1) , where n1 and n2
three to four orders of magnitude faster cannot be searched on a laptop com- are the number of points within r1 and
than BLASTX, but still linear in the size puter with current tools such as SMSD. r2 respectively (Figure 3).
of the database being searched. Cluster-based search, as exempli-
Recent work on gene expression Structure of Biological Data fied by “compressive omics”—the use
has explored additional ways to exploit Fortunately, biological data has unique of compression to accelerate analy-
the high-dimensional structure of the structure, which we later take advantage sis—can perform approximate search
data. SPARCLE (SPArse ReCovery of to perform search that scales sublin- within a radius r of a query q on a da-
of Linear combinations of Expres- early in the size of the database.38 The tabase D with fractal dimension d and
sion)28 brings ideas from compressed first critical observation is that much metric entropy k at the scale rc in time
sensing8 to gene expression analysis. biological data is highly redundant; if a proportional to

78 COMM UNICATIO NS O F THE AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 review articles

output size subset of the original database. This the recently released MICA38 dem-
approach provides orders-of-magni- onstrates the compressive-acceler-
metric entropy
tude runtime improvements to BLAST ation approach of caBLAST22 and
scaling factor nucleotide 22 and protein 12 search; caBLASTP12 is largely orthogonal to
these runtime improvements increase alphabet-reduction and indexing ap-
where BD(q, r) refers to the set of points as databases grow. proaches. MICA applies the compres-
in D contained within a ball of radius r The CORA read mapper37 applies a sive-acceleration framework to the
about a point q. mid-size l-mer based read-compression state-of-the-art DIAMOND,7 using it
Given this formalization, the ratio approach with a compressive indexing for its “coarse search” phase and a
(|D|)
k
provides an estimate of the speed- of the reference genome (referred to as user’s choice of DIAMOND or BLASTX
up factor for the coarse search compo- a homology table). CORA, like caBLAST for its “fine search” phase; MICA dem-
nent compared to a full linear search. (compressively accelerated BLAST)22 and onstrates nearly order-of-magnitude
The time complexity of the fine search caBLASTP,12 accelerates existing tools run-time gains over the highly opti-
is exponential in the fractal dimension (in this case, read mappers including mized DIAMOND, comparable to that
d, which can be estimated globally by BWA or Bowtie2) by allowing them to op- of caBLASTP over BLASTP.
sampling the local fractal dimension erate in a compressed space, and relies Compressive genomics22 has been
over a dataset. The accompanying table on a coarse and a fine phase. In contrast, generalized and adapted to non-
provides the fractal dimension d sam- short seed-clustering schemes, such sequence spaces as well, and coined
pled at typical query radii, as well as as those used in Masai33 and MrsFAST,3 “compressive omics.” One such ex-
the ratio (|D|) , for nucleotide sequence, conceptually differ from CORA in that ample is chemogenomics. Applying a
k
protein sequence, protein structure, those schemes aim to accelerate only compressive acceleration approach,
and chemical compound databases. the seed-to-reference matching step. Ammolite38 accelerates SMSD search
Biological datasets exhibit redun- Thus, there is a subsequent seed-exten- by an average of 150x on the PubChem
dancy, and are constrained to subspaces sion step, which is substantially more database. Another example is esFrag-
by physical laws; that is, the vast major- costly and still needs to be performed Bag,38 which clusters proteins based
ity of enumerable sequences and struc- for each read and mapping individually, on the cosine distance or Euclidean
tures do not exist because they are not even when seeds are clustered. Through distance of their bag-of-words vectors,
advantageous (or at least, have not been its l-mer based read compression further accelerating FragBag’s running
selected for by evolution). This combi- model, CORA is able to accelerate and time by an average of 10x.
nation results in low fractal dimension achieve asymptotically sublinear scaling The compressive omics approach
and low metric entropy relative to the for both the seed-matching and seed- can, in some cases, come at the cost
size of the dataset, which suggests that extension steps within coarse-mapping, of accuracy. However, these cases are
“compressive omics” will provide the which comprises the major bulk of the well defined. Compressive omics never
ability for computation to scale sublin- read-mapping computation. Tradition- results in false positives (with respect
early with massively growing data. ally, k-mers refer to short substrings of to the naïve search technique being
fixed length (often, but not necessar- accelerated), because the fine search
The Age of Compressive Algorithms ily, a power of two) used as “seeds” for phase applies the same comparison to
We are entering the age of compressive longer sequence matches. CORA uses the candidates as the naïve approach.
algorithms, which make use of this much longer k-mers (for example, 33–64 Furthermore, when the distance func-
completely different paradigm for the nucleotides long), and links each one to tion used for comparisons is a metric—
structure of biological data. Seeking to its neighbors within a small Hamming more specifically, when it obeys the
take advantage of the redundancy in- or Levenshtein distance. The term l-mer triangle inequality—false negatives will
herent in genomic sequence data, Loh, distinguishes these substrings from typ- also never occur. Yet, in practice, non-
Baym and Berger22 introduced com- ically short k-mers. metric distance functions are used,
pressive genomics, an approach that re- In the area of metagenomic search, such as E-values in BLAST or cosine
lies on compressing data in such a way
that the desired computation (such as Metric-entropy ratio (ratio of clusters to entries in database) and fractal dimension at
typical search radii for four datasets.
BLAST search) can be performed in the
compressed representation. Compres- Metric-entropy ratio gives an estimate of the acceleration of coarse search with respect to
sive genomics is based on the concept naïve search, and as long as fractal dimension is low, coarse search should dominate total
of compressive acceleration, which re- search time. NCBI’s non-redundant ‘NR’ protein and ‘NT’ nucleotide sequence databases are
from June 2015. Protein Data Bank (PDB) is from July 2015. PubChem is from October 2013.
lies on a two-stage search, referred
to as coarse and fine search. Coarse
search is performed only on the coarse, Dataset Metric-entropy ratio Fractal dimension

or representative, subsequences that Nucleotide sequences (NCBI NT) 7:1 1.5

represent unique data. Any represen- Protein sequences (NCBI NR) 5:1 1.6
tative sequence within some threshold Protein structure (PDB) 10:1 2.5
of the query is then expanded into all Chemical structure (PubChem) 11:1 0.2
similar sequences it represents; the
fine search is over this (typically small)

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 79
review articles

distance in esFragBag, and thus false techniques, but the data derives from Information Storage and Retrieval 7, 5 (1971) 217–240.
21. Liao, C.-S., Lu, K., Baym, M., Singh, R. and Berger, B.
negatives can occur. Fortunately, these astoundingly complex processes that IsoRankN: Spectral methods for global alignment of
error rates are low, and recall better themselves are driven by evolution. It is multiple protein networks. Bioinformatics 12 (2009),
i253–i258.
than 90% has been demonstrated.12,22,38 through the development of algorithms 22. Loh, P.-R., Baym, M., and Berger, B. Compressive
that leverage the structure of biological genomics. Nature Biotechnology 30, 7 (2012), 627–630.
23. MacFabe, D.F. Short-chain fatty acid fermentation
Conclusion data that we can make sense of biology products of the gut microbiome: Implications in
The explosion of biological data, largely in light of evolution. autism spectrum disorders. Microbial Ecology in
Health and Disease 23 (2012).
due to technological advances such as 24. Marco-Sola, S., Sammeth, M., Guigó, R. and Ribeca,
P. The gem mapper: Fast, accurate and versatile
next-generation sequencing, presents Acknowledgments alignment by filtration. Nature Methods 9, 12 (2012),
us with challenges as well as opportu- This work is supported by the Nation- 1185–1188.
25. Marx, V. Biology: The big challenges of big data. Nature
nities. The promise of unlocking the al Institutes of Health, under grant 498, 7453 (2013), 255–260.
secrets of diseases such as cancer, obe- GM108348. Y.W.Y. is also supported by 26. Ochoa, I., Asnani, H., Bharadia, D., Chowdhury, M.,
Weissman, T. and Yona, G. QualComp: A new lossy
sity, Alzheimer’s, autism spectrum dis- a Hertz Fellowship. compressor for quality scores based on rate distortion
order, and many others, as well as bet- theory. BMC bioinformatics 14, 1 (2013), 187.
27. Patro, R. and Kingsford, C. Data-dependent bucketing
ter understanding the basic science of References improves reference-free compression of sequencing
1. 1000 Genomes Project Consortium et al. An
biology, relies on researchers’ ability to integrated map of genetic variation from 1,092 human
reads. Bioinformatics (2015).
28. Prat, Y., Fromer, M., Linial, N. and Linial, M. Recovering
analyze the growing flood of genomic, genomes. Nature 491, 7422 (2012), 56–65. key biological constituents through sparse
2. Altschul, S.F., Gish, W., Miller, W., Myers, E.W. and
metagenomic, structural, and interac- Lipman, D.J. Basic local alignment search tool.
representation of gene expression. Bioinformatics 5
(2011), 655–661.
tome data. Journal of Molecular Biology 215, 3 (1990), 403–410. 29. Rahman, S.A., Bashton, M., Holliday, G.L., Schrader, R.
3. Berger, B., Peng, J. and Singh, M. Computational and Thornton, J.M. Small molecule subgraph detector
The approach of compressive accel- solutions for omics data. Nature Reviews Genetics 14, (SMSD) toolkit. J. Cheminformatics 1, 1 (2009), 1–13.
eration,22 and its demonstrated abil- 5 (2013), 333–346. 30. Rubinfeld, R. and Shapira, A. Sublinear time
4. Bonfield, J.K. and Mahoney, M.V. Compression of algorithms. SIAM J. Discrete Mathematics 25, 4
ity to scale with the metric entropy of FASTQ and SAM format sequencing data. PLoS ONE 8, (2011), 1562–1588.
the data,38 while providing orthogonal 3 (2013), e59190. 31. Schatz, M.C., Langmead, B. and Salzberg, S.L.
5. Bredel, M. and Jacoby, E. Chemogenomics: An Cloud computing and the DNA data race. Nature
benefits to many other useful index- emerging strategy for rapid target and drug discovery. Biotechnology 28, 7 (2010), 691–693.
ing techniques, is an important tool Nature Reviews Genetics 5, 4 (2004), 262–275. 32. Singh, R., Xu, J. and Berger, B. Global alignment of
6. Bruijn, D.N. A combinatorial problem. In Proceedings multiple protein interaction networks with application
for coping with the deluge of data. The of the Koninklijke Nederlandse Akademie van to functional orthology detection. In Proceedings of
extension of this compressive accelera- Wetenschappen, Series A 49, 7 (1946), 758. the National Academy of Sciences 105, 35 (2008),
7. Buchfink, B., Xie, C., and Huson, D.H. Fast and sensitive 12763–12768.
tion approach to metagenomics, NGS protein alignment using DIAMOND. Nature Methods 33. Siragusa, E., Weese, D. and Reinert, K. Fast and
12, 1 (2015), 59–60.
read mapping,37 and chemogenomics 8. Candes, E.J. and Tao, T. Decoding by linear
accurate read mapping with approximate seeds and
multiple backtracking. Nucleic Acids Research 41, 7
suggests its flexibility. Likewise, com- programming. IEEE Transactions on Information (2013), e78.
Theory 51, 12 (2005), 4203–4215.
pressive storage for these applications 9. Cao, M., Zhang, H., Park, J., Daniels, N.M., Crovella,
34. Stephens, Z.D. et al. Big data: Astronomical or
genomical? PLoS Biol. 13, 7 (2015), e1002195.
can be shown to scale with the informa- M.E., Cowen, L.J. and Hescott, B. Going the distance for 35. Uhlmann, J.K. Satisfying general proximity/similarity
protein function prediction: A new distance metric for
tion-theoretic entropy of the dataset.38 protein interaction networks. PLoS ONE 8, 10 (2013).
queries with metric trees. Information Processing
Letters 40, 4 (1991), 175–179.
The field of computational biology 10. Chindelevitch, L., Trigg, J., Regev, A. and Berger, B. 36. Weinstein, J.N. et al. The cancer genome atlas pan-
An exact arithmetic toolbox for a consistent and cancer analysis project. Nature Genetics 45, 10 (2013),
must continue to innovate, but also to reproducible structural analysis of metabolic network 1113–1120.
incorporate the best ideas from other models. Nature Communications 5, (2014). 37. Yorukoglu, D., Yu, Y.W., Peng, J. and Berger, B.
11. Cho, H., Berger, B., and Peng, J. Diffusion component Compressive mapping for next-generation sequencing
areas of computer science. For example, analysis: Unraveling functional topology in biological Nature Biotechnology 4 (2016), 374–376.
the compressive acceleration approach networks. Research in Computational Molecular 38. Yu, Y.W., Daniels, N., Danko, D.C. and Berger, B.
Biology. Springer, 2015, 62–64. Entropy-scaling search of massive biological data. Cell
bears similarity to a metric ball tree, 12. Daniels, N.M., Gallant, A., Peng, J., Cowen, L.J., Baym, Systems 1, 2 (2015), 130–140.
first described in the database com- M. and Berger, M. Compressive genomics for protein 39. Yu, Y.W., Yorukoglu, D., Peng, J. and Berger, B. Quality
databases. Bioinformatics 29 (2013), i283–i290. score compression improves genotyping accuracy.
munity over 20 years ago;35 however, the 13. Dobzhansky, T. Nothing in biology makes sense except Nature Biotechnology 33, 3 (2015), 240–243.
latter does not allow one to analyze per- in the light of evolution (1973). 40. Zhao, Y., Tang, H. and Ye, Y. RAPSearch2: A fast and
14. Forsberg, K.J., Reyes, A., Wang, B., Selleck, E.M., memory-efficient protein similarity search tool for
formance guarantees in terms of metric Sommer, M.O. and Dantas, G. The shared antibiotic next-generation sequencing data. Bioinformatics 28, 1
resistome of soil bacteria and human pathogens.
entropy and fractal dimension. Other Science 337, 6098 (2012), 1107–1111.
(2012), 125–126.
ideas from image processing, compu- 15. Hach, F., Hormozdiari, F., Alkan, C., Hormozdiari, F.,
Birol, I., Eichler, E.E. and Sahinalp, S.C. mrsFAST: A Bonnie Berger ([email protected]) is a professor in CSAIL
tational geometry,18 sublinear-time al- cache-oblivious algorithm for short-read mapping. and the Department of Mathematics and EECS at
gorithms,30 and other areas outside of Nature Methods 7, 8 (2010), 576–577. Massachusetts Institute of Technology, Cambridge, MA.
16. Hach, F., Sarra, I. Hormozdiari, F., Alkan, C., Eichler,
biology are likely to bear fruit. It is also E.E. and Sahinalp, S.C. mrsFAST-Ultra: a compact, Noah M. Daniels ([email protected]) is a postdoctoral
likely that algorithmic ideas developed SNP-aware mapper for high-performance sequencing associate in CSAIL and Department of Mathematics,
applications. Nucleic Acids Research (2014), gku370. Massachusetts Institute of Technology, Cambridge, MA.
within computational biology will be- 17. Hart, Y., Sheftel, H., Hausser, J., Szekely, P., Ben- Y. William Yu ([email protected]) is a graduate student in
come useful in other fields experienc- Moshe, N.B., Korem, Y., Tendler, A., Mayo, A.E. and CSAIL and Department of Mathematics, Massachusetts
Alon, U. Inferring biological tasks using Pareto Institute of Technology, Cambridge, MA.
ing a data deluge, such as astronomy or analysis of high-dimensional data. Nature Methods 12,
social networks.34 3 (2015), 233–235. Copyright held by authors.
18. Indyk, P. and Motwani, R. Approximate nearest
Biological data science is unique for neighbors: Towards removing the curse of
two primary reasons: biology itself— dimensionality. In Proceedings of the 13th Annual
ACM Symposium on Theory of Computing. ACM, 1998,
even molecular biology—predates the 604–613.
19. Janda, J.M. and Abbott, S.L. 16S rRNA gene Watch the authors discuss
information age, and “nothing in biol- sequencing for bacterial identification in the diagnostic their work in this exclusive
ogy makes sense except in light of evo- laboratory: pluses, perils, and pitfalls. J. Clinical Communications video.
Microbiology 45, 9 (2007), 2761–2764. http://cacm.acm.org/videos/
lution.”13 Not only have biologists de- 20. Jardine, N. and van Rijsbergen, C.J. The use of computational-biology-in-the-
veloped a diverse array of experimental hierarchic clustering in information retrieval. 21st-century

80 COMM UNICATIO NS O F THE ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 research highlights
P. 82 P. 83
Technical
Perspective Verifying Quantitative
Toward Reliable Reliability for Programs
Programming for
Unreliable Hardware that Execute on
By Todd Millstein Unreliable Hardware
By Michael Carbin, Sasa Misailovic, and Martin C. Rinard

P. 92 P. 93
Technical
Perspective Ur/Web: A Simple Model
Why Didn’t for Programming the Web
I Think of That? By Adam Chlipala
By Philip Wadler

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 81
research highlights
DOI:10.1145/ 2 9 6 1 8 9 0

Technical Perspective
To view the accompanying paper,
visit doi.acm.org/10.1145/2958738 rh

Toward Reliable Programming

for Unreliable Hardware
By Todd Millstein

“ I T ’ S N O T A bug; it’s a feature!” Though The computing industry and re- provides specific probabilities of soft
this sentence is often meant as a joke, search community have developed errors for different operations (for
sometimes a bug really is a feature— many tools and techniques for find- example, reading from memory, per-
when the benefits of tolerating the ing bugs and validating properties of forming an addition). Therefore the
bug outweigh its negative impact on programs. However, for the most part approach is oblivious to the particular
applications. those approaches do not help to an- details of the hardware architecture
Designers of emerging hardware ar- swer the question here. The issue in and the causes of its soft errors.
chitectures are taking this point of view this setting is not whether a bug ex- These choices not only make the
in order to increase energy efficiency, ists, but how likely the bug is to occur approach more general; they also en-
which is a critical concern across the and how it will affect the application’s able the authors to recast the prob-
computing landscape, from tiny em- behavior. Further, the bug is not in the lem in a manner that is surprisingly
bedded devices to enormous datacen- application but rather in the underly- amenable to traditional program veri-
ters. Techniques such as a low-voltage ing hardware platform. Finally, it’s fication techniques. Their analysis
mode for data-processing components not even clear how to specify a desired validates reliability specifications by
and a low refresh rate for memory com- quality-of-service level; traditional determining the probability that each
ponents can significantly decrease program logics based on a binary no- variable’s computation incurs no soft
energy consumption. But they also tion of truth and falsehood are not up errors, since that is a lower bound on
increase the likelihood of soft errors, to the task. the variable’s probability of being reli-
which are transient hardware faults The following paper by Carbin et able. By abstracting away the specific
that can cause an erroneous value to be al. addresses these challenges in the reliability probabilities of function
computed or retrieved from memory. context of an important subproblem. inputs as well as of individual op-
Ultimately, whether these tech- The authors introduce the notion of a erations, the problem essentially be-
niques should be considered bugs or quantitative reliability specification for a comes one of counting the number of
features rests on the ability of software variable, which specifies a minimal ac- operations that can incur soft errors
systems, and their developers, to tol- ceptable probability that the variable’s and that can affect a variable’s value,
erate the increase in soft errors. For- computed value will be correct despite a task that is well suited to automated
tunately, a large class of applications the potential for soft errors. For exam- program analysis.
known as approximate computations ple, a developer may desire a particular This work is part of an exciting
is naturally error-tolerant. A book rec- variable’s value to be correct 99% of the stream of recent research that adapts
ommendation system approximates time. The authors introduce a language and extends traditional program veri-
an unknown “ideal” recommendation for providing such specifications as well fication techniques to reason about
function, for example, by clustering us- as an automated code analysis to verify probabilistic properties, which are
ers with similar tastes. With enough us- them. Separately, the authors and other abundant in modern software sys-
ers and data about these users, sporad- researchers have tackled complemen- tems. I am hopeful this research agen-
ic errors in the clustering computation tary problems, such as how to bound da will lead to general ways of build-
are unlikely to cause noticeably worse the maximum effect that soft errors can ing robust systems out of potentially
recommendations. Similarly, an audio have on a variable’s value. unreliable parts, where the notion of
encoder can likely tolerate sporadic The power of the authors’ approach unreliability is broadly construed—
errors that introduce additional noise comes from its generality. Despite my not only soft errors, but also faulty
without affecting the user experience. example here, reliability specifications sensor and other environmental in-
Even so, no application can toler- are relative rather than absolute. For puts, untrusted libraries, and approx-
ate an unbounded number of errors. example, the reliability specification imate computations themselves. The
At some point the book recommenda- for a function’s return value is defined more tools we have to reason about
tions will be random and the music in terms of the reliability probabili- unreliability, the more bugs we can
will be unlistenable. How can the im- ties of the function’s arguments and turn into features.
plementers of these applications gain so must hold for all possible values of
assurance that the quality of service those probabilities. Further, the ap- Todd Millstein is a professor of computer science at
UCLA, Los Angeles, CA.
will be acceptable despite the potential proach is parameterized by a separate
for soft errors? hardware reliability specification that Copyright held by author.

82 COMMUNICATIO NS O F TH E ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 DOI:10.1145/ 2 9 5 8 73 8

Verifying Quantitative Reliability

for Programs that Execute on
Unreliable Hardware
By Michael Carbin, Sasa Misailovic, and Martin C. Rinard

Abstract checker that verifies either the exact correctness4, 14 or the

Emerging high-performance architectures are anticipated approximate acceptability1 of the results that the computa-
to contain unreliable components that may exhibit soft tion produces. If the checker does detect an error, it can
errors, which silently corrupt the results of computations. re-execute the computation to obtain an acceptable result.
Full detection and masking of soft errors is challenging, For both approximate and checkable computations, oper-
expensive, and, for some applications, unnecessary. For ating without (or with at most selectively applied) mecha-
example, approximate computing applications (such as nisms that detect and mask errors can produce (1) fast and
multimedia processing, machine learning, and big data energy efficient execution that (2) delivers acceptably accurate
analytics) can often naturally tolerate soft errors. results often enough to satisfy the needs of their users.
We present Rely, a programming language that enables
developers to reason about the quantitative reliability of an 1.1. Background
application—namely, the probability that it produces the Approximate computations have emerged as a major com-
correct result when executed on unreliable hardware. Rely ponent of many computing environments. Motivated in
allows developers to specify the reliability requirements for part by the observation that approximate computations
each value that a function produces. can often acceptably tolerate occasional computation and/
We present a static quantitative reliability analysis that or data errors,7, 20, 25 researchers have developed a range of
verifies quantitative requirements on the reliability of an new mechanisms that forgo exact correctness to optimize
application, enabling a developer to perform sound and other objectives. Typical goals include maximizing program
verified reliability engineering. The analysis takes a Rely pro- performance subject to an accuracy constraint and altering
gram with a reliability specification and a hardware speci- program execution to recover from otherwise fatal errors.26
fication that characterizes the reliability of the underlying Software Techniques: Most software techniques deploy
hardware components and verifies that the program satisfies unsound transformations—transformations that change the
its reliability specification when executed on the underlying semantics of an original exact program. Proposed mecha-
unreliable hardware platform. We demonstrate the applica- nisms include skipping tasks,16, 25 loop perforation (skipping
tion of quantitative reliability analysis on six computations iterations of time-consuming loops),20, 29 sampling reduction
implemented in Rely. inputs,30 multiple selectable implementations of a given
component or components,2, 3, 12, 30 dynamic knobs (configu-
ration parameters that can be changed as the program
1. INTRODUCTION executes)12 and synchronization elimination (forgoing syn-
Reliability is a major concern in the design of computer sys- chronization not required to produce an acceptably accurate
tems. The current goal of delivering systems with negligible result).16, 18 The results show that aggressive techniques such
error rates restricts the available design space and imposes as loop perforation can deliver up to a fourfold performance
significant engineering costs. And as other goals such as energy improvement with acceptable changes in the quality of the
efficiency, circuit scaling, and new features and functional- results that the application delivers.
ity continue to grow in importance, maintaining even current Hardware Techniques: The computer architecture community
error rates will become increasingly difficult. has begun to investigate new designs that improve per-
In response to this situation, researchers have developed formance by breaking the traditional fully reliable digital
numerous techniques for detecting and masking errors in abstraction that computer hardware has traditionally sought
both hardware10 and software.9, 23, 24 Because these techniques to provide. The goal is to reduce the cost of implement-
typically come at the price of increased execution time, ing a reliable abstraction on top of physical materials and
increased energy consumption, or both, they can substan- manufacturing methods that are inherently unreliable. For
tially hinder or even cripple overall system performance.
Many computations, however, can easily tolerate occasional
errors. An approximate computation (including many multi- The original version of this paper appeared in Proceedings
media, financial, machine learning, and big data analytics of the 28th ACM SIGPLAN Conference on Object-Oriented
applications) can often acceptably tolerate occasional errors Programming, Systems, Languages, and Applications
in its execution and/or the data that it manipulates.7, 20, 25 (Indianapolis, IN, Oct. 2013).
A checkable computation can be augmented with an efficient

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 83
research highlights

example, researchers are investigating designs that incor- accuracy property might state that the transformed program
porate aggressive device and voltage scaling techniques must produce a result that differs by at most a specified
to provide low-power ALUs and memories. A key aspect of percentage from the result that a corresponding original
these components is that they forgo traditional correctness program produces.19, 30 Alternatively, a potential accuracy
checks and instead expose timing errors and bitflips with property for our example program might require the min to
some non-negligible probability.9, 11, 13, 15, 21, 22, 27 be within the smallest N/2 elements a[0]–a[N–1]. Such
an accuracy property might be satisfied by, for example, a
1.2. Reasoning about approximate programs loop perforation transformation that skips N/2–1 of the
Approximate computing violates the traditional contract that loop iterations.
the programming system must preserve the standard semantics In this article we focus on reliability properties for
of the program. It therefore invalidates standard paradigms approximate computations executing on unreliable hard-
and motivates new, more general, approaches to reasoning ware platforms. In other research, we have developed
about program behavior, correctness, and acceptability. techniques for reasoning about integrity properties5, 6
One key aspect of approximate applications is that they typi- and both worst-case and probabilistic accuracy proper-
cally contain critical regions (which must execute without error) ties.5, 19, 30 We have also extended the research presented
and approximate regions (which can execute acceptably even in in this article to include combinations of reliability and
the presence of occasional errors).7, 25 Existing systems, tools, accuracy properties.17
and type systems have focused on helping developers iden-
tify, separate, and reason about the binary distinction between 1.3. Verifying reliability (contributions)
critical and approximate regions.7, 11, 15, 25, 27 However, in practice, To meet the challenge of reasoning about reliability, we
no computation can tolerate an unbounded accumulation of present a programming language, Rely, and an associated
errors—to execute acceptably, executions of even approximate program analysis that computes the quantitative reliability
regions must satisfy some minimal requirements. of the computation—that is, the probability with which the
Approximate computing therefore raises a number of fun- computation produces a correct result when parts of the
damental new research questions. For example, what is the computation execute on unreliable hardware with soft errors
probability that an approximate program will produce the (independent errors that occur nondeterministically with
same result as a corresponding original exact program? How some probability). Specifically, given a hardware specification
much do the results differ from those produced by the origi- and a Rely program, the analysis computes, for each value
nal program? And is the resulting program safe and secure? that the computation produces, a conservative probability
Because traditional correctness properties do not pro- that the value is computed correctly despite the possibility of
vide an appropriate conceptual framework for addressing soft errors.
these kinds of questions, we instead work with acceptability Rely supports and is specifically designed to enable parti-
properties—the minimal requirements that a program must tioning a program into critical regions (which must execute
satisfy for acceptable use in its designated context. We iden- without error) and approximate regions (which can execute
tify three kinds of acceptability properties and use the fol- acceptably even in the presence of occasional errors).7, 25
lowing program (which computes the minimum element In contrast to previous approaches, which support only
min in an N-element array) to illustrate these properties: a binary distinction between critical and approximate
regions, quantitative reliability can provide precise static
int min = INT_MAX ;
probabilistic acceptability guarantees for computations
for (int i = 0; i < N; ++i)
that execute on unreliable hardware platforms. This article
if (a[i] < min) min = a[i];
specifically presents the following contributions:
Integrity Properties: Integrity properties are properties that Quantitative Reliability Specifications: We present quan-
the computation must satisfy to produce a successful result. titative reliability specifications, which characterize the
Examples include computation-independent properties (no probability that a program executed on unreliable hardware
out of bounds accesses, null dereferences, divide by zero produces the correct result, as a constructive method for
errors, or other actions that would crash the computation) developing applications. Quantitative reliability specifica-
and computation-dependent properties (e.g., the computa- tions enable developers who build applications for unreli-
tion must return a result within a given range). One integ- able hardware architectures to perform sound and verified
rity property for our example program is that accesses to the reliability engineering.
array a must always be within bounds. Language: We present Rely, a language that enables devel-
Reliability Properties: Reliability properties characterize the opers to specify reliability requirements for programs that
probability that the produced result is correct. Reliability prop- allocate data in unreliable memory regions and use unreli-
erties are often appropriate for approximate computations able arithmetic/logical operations.
executing on unreliable hardware platforms that exhibit occa- Quantitative Reliability Analysis: We present a program
sional nondeterministic errors. A potential reliability property analysis that verifies that the dynamic semantics of a Rely
for our example program is that min must be the minimum program satisfies its quantitative reliability specifications.
element in a[0]–a[N–1] with probability at least 95%. For each function in the program, the analysis computes a
Accuracy Properties: Accuracy properties characterize symbolic reliability precondition that characterizes the set
how accurate the produced result must be. For example, an of valid specifications for the function. The analysis then

84 COMMUNICATIO NS O F TH E ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

verifies that the developer-provided specifications are valid the results of search_ref to encode cblock as a function
according to the reliability precondition. of the identified block.
Case Studies: We have used the Rely implementation to This is an approximate computation that can trade cor-
develop unreliable versions of six building block compu- rectness for more efficient execution by approximating the
tations for media processing, machine learning, and data search to find a block. If search_ref returns a block that
analytics applications. These case studies illustrate how to is not the most similar, then the encoder may require more
use quantitative reliability to develop and reason about both bits to encode cblock, potentially decreasing the video’s
approximate and checkable computations in a principled way. peak signal-to-noise ratio or increasing the video’s encoded
size. However, previous studies on soft error injection9 and
2. EXAMPLE more aggressive transformations like loop perforation20, 29
Rely is an imperative language for computations over inte- have demonstrated that the quality of x264’s final result is
gers, floats (not presented), and multidimensional arrays. only slightly affected by perturbations of this computation.
To illustrate how a developer can use Rely, Figure 1 presents
a Rely-based implementation of a pixel block search algo- 2.1. Reliability specifications
rithm derived from that in the x264 video encoder.a The function declaration on Line 6 specifies the types
The function search_ref searches a region (pblocks) of and reliabilities of search_ref’s parameters and return
a previously encoded video frame to find the block of pixels value. The parameters of the function are pblocks(3), a
that is most similar to a given block of pixels (cblock) in three-dimensional array of pixels, and cblock(2), a two-
the current frame. The motion estimation algorithm uses dimensional array of pixels. In addition to the standard
signature, the function declaration contains reliability
a
  x264 (http://www.videolan.org/x264.html). specifications for each result that the function produces.
Rely’s reliability specifications express the reliability of
Figure 1. Rely code for motion estimation computation. a function’s results—when executed on an unreliable hard-
1 # define nblocks 20
ware platform—as a function of the reliabilities of its inputs.
2 # define height 16 A reliability specification has the form r ⋅ R(X), where r is a
3 # define width 16 real number between 0 and 1 and X is a set of variables. For
4 example, the specification for the reliability of search_
5 int <0.99 * R ( pblocks , cblock ) > ref’s result is int<0.99*R(pblocks,cblock)>. This
6 search_ref ( specification states that the return value is an integer with
7 int < R ( pblocks ) > pblocks (3) in urel , a reliability that is at least 99% of the joint reliability of the
8 int < R ( cblock ) > cblock (2) in urel ) parameters pblocks and cblock (denoted by R(pblocks,
9 { cblock)). The joint reliability of a set of parameters is the
10 int minssd = INT_MAX ,
probability that they all have the correct value when passed
11 minblock = -1 in urel ;
in from the caller. This specification holds for all possible
12 int ssd , t , t1 , t2 in urel ;
13 int i = 0 , j , k ; values of the joint reliability of pblocks and cblock. For
14 instance, if the contents of the arrays pblocks and cblock
15 repeat nblocks { are fully reliable (correct with probability one), then the
16 ssd = 0; return value is correct with probability 0.99.
17 j = 0; In Rely, arrays are passed by reference and the execution
18 repeat height { of a function can, as a side effect, modify an array’s contents.
19 k = 0; The reliability specification of an array therefore allows a
i20 repeat width { developer to constrain the reliability degradation of its con-
21 t1 = pblocks [i ,j , k ];
tents. Here pblocks has an output reliability specification
22 t2 = cblock [j , k ];
of R(pblocks) (and similarly for cblock), meaning that
23 t = t1 -. t2 ;
24 ssd = ssd +. t *. t ; all of pblock’s elements are at least as reliable when the
25 k = k + 1; function exits as they were on entry to the function.
26 } Joint reliabilities serve as an abstraction of a function’s
27 j = j + 1; input distribution, which enables Rely’s analysis to be both
28 } modular and oblivious to the exact shape of the distribu-
29 tions. This is important because (1) such exact shapes can be
30 if ( ssd <. minssd ) { difficult for developers to identify and specify and (2) known
31 minssd = ssd ; tractable classes of probability distributions are not closed
32 minblock = i ;
under many operations found in standard programming
33 }
languages, which can complicate attempts to develop com-
34
35 i = i + 1; positional analyses that work with such exact shapes.19, 28
36 }
37 return minblock ; 2.2. Unreliable computation
38 } Rely targets hardware architectures that expose both reli-
able operations (which always execute correctly) and more

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 85
research highlights

energy-efficient unreliable operations (which execute cor- additional checking logic, enabling the unit to execute
rectly with only some probability). Specifically, Rely supports more efficiently but also allowing for soft errors that may
reasoning about reads and writes of unreliable memory occur due to, for example, power variations within the
regions and unreliable arithmetic/logical operations. ALU’s combinatorial circuits or particle strikes.
Memory Region Specification: Each parameter declaration To prevent the execution from taking control flow
specifies the memory region in which the data of the param- edges that are not in the program’s static control flow
eter is allocated. Memory regions correspond to the physical graph, the control unit of the CPU reliably fetches,
partitioning of memory at the hardware level into regions of decodes, and schedules instructions (as is supported by
varying reliability. Here pblocks and cblock are allocated existing unreliable processor architectures11, 27). In addi-
in an unreliable memory region named urel. tion, given a virtual address in the application, the control
Lines 10–13 declare the local variables of the function. unit correctly computes a physical address and operates
By default, variables in Rely are allocated in a fully reliable only on that address.
memory region. However, a developer can also optionally Memory: Rely supports machines with memories that
specify a memory region for each local variable. For exam- consist of an arbitrary number of memory partitions (each
ple, the variables declared on Lines 10–12 reside in urel. potentially of different reliability), but for simplicity Figure 2
Unreliable Operations: The operations on Lines 23, 24, partitions memory into two regions: reliable and unreliable.
and 30 are unreliable arithmetic/logical operations. In Unreliable memories can, for example, use decreased DRAM
Rely, every arithmetic/logical operation has an unreliable refresh rates to reduce power consumption at the expense of
counterpart that is denoted by suffixing a period after the increased soft error rates.15, 27
operation symbol. For example, “−.” denotes unreliable
subtraction and “<.” denotes unreliable comparison. 2.4. Hardware reliability specification
Using these operations, search_ref’s implementa- Rely’s analysis works with a hardware reliability specifica-
tion approximately computes the index (minblock) of the tion that specifies the reliability of arithmetic/logical and
most similar block, that is, the block with the minimum memory operations. Figure 3 presents a hardware reli-
distance from cblock. The repeat statement on line 15, ability specification that is inspired by results from the
iterates a constant nblock number of times, enumerating existing computer architecture literature.10, 15 Each entry
over all previously encoded blocks. For each encoded block, specifies the reliability—the probability of a correct exe-
the repeat statements on lines 18 and 20 iterate over the cution—of arithmetic operations (e.g., +.) and memory
height * width pixels of the block and compute read/write operations.
the sum of the squared differences (ssd) between each For ALU operations, the presented reliability specifi-
pixel value and the corresponding pixel value in the cur- cation uses the reliability of an unreliable multiplication
rent block cblock. Finally, the computation on lines 30 operation from Ref.10, Figure 9. For memory operations, the
through 33 selects the block that is—approximately—the specification uses the probability of a bit flip in a memory
most similar to cblock. cell from Ref.15, Figure 4 with extrapolation to the prob-
ability of a bit flip within a 32-bit word. Note that a memory
2.3. Hardware semantics region specification includes two reliabilities: the reliability
Figure 2 illustrates the conceptual machine model behind of a read (rd) and the reliability of a write (wr).
Rely’s reliable and unreliable operations; the model con-
sists of a CPU and a memory.
CPU: The CPU consists of (1) a register file, (2) arithmetic Figure 3. Hardware reliability specification.
logical units that perform operations on data in registers,
and (3) a control unit that manages the program’s execution. reliability spec {
The arithmetic-logical unit can execute reliably or unre- operator (+.) = 1 - 10^-7;
liably. Figure 2 presents physically separate reliable and operator (-.) = 1 - 10^-7;
unreliable functional units, but this distinction can be operator (*.) = 1 - 10^-7;
operator (<.) = 1 - 10^-7;
achieved through other mechanisms, such as dual-volt-
memory rel {rd = 1, wr = 1};
age architectures.11 Unreliable functional units may omit memory urel {rd = 1 - 10^-7, wr = 1};
}
Figure 2. Machine model. Orange boxes represent unreliable
components.

Exact Approximate
Figure 4. Rely analysis overview.
Registers CPU Cache Memory

Rely
ALU
Program Precondition Precondition Verified
Hardware Generator Checker Yes/No
Specification

86 COMMUNICATIO NS O F TH E ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

2.5. Reliability analysis Rely’s analysis conservatively approximates the reliabil-
Given a Rely program, Rely’s reliability analysis verifies that ity of a computation by only considering the first scenario.
the each function in the program satisfies its reliability This design point simplifies the reasoning to the task of
specification when executed on unreliable hardware. Figure 4 computing the probability that a result is reliably computed
presents an overview of Rely’s analysis. The analysis con- as opposed to reasoning about a computation’s input distri-
sists of two components: the precondition generator and the bution and the probabilities of all executions that produce
precondition checker. the correct result. As a consequence, the analysis requires
Precondition Generator: Given a Rely program and a hard- as input only a hardware reliability specification that gives
ware reliability specification, the precondition generator the probability with which each arithmetic/logical opera-
generates a symbolic reliability precondition for each func- tion and memory operation executes correctly. The analysis
tion. A reliability precondition is a set of constraints that is therefore oblivious to a computation’s input distribution
is sufficient to ensure that a function satisfies its reliability and does not require a full model of how soft errors affect
specification when executed on the underlying unreliable its result.
hardware platform. The reliability precondition is a con- Precondition generator. For each function, Rely’s analy-
junction of predicates of the form Aout ≤ r ⋅ R (X), where Aout sis generates a reliability precondition that conservatively
is a placeholder for a developer-provided reliability specifi- bounds the set of valid specifications for the function. The
cation for an output named out, r is a real number between analysis produces this precondition by starting at the end of
0 and 1, and the term R (X) is the joint reliability of a set of the function from a postcondition that must be true when
parameters X. the function returns and then working backward to produce
Conceptually, each predicate specifies that the reliability a precondition such that if the precondition holds before
given in the specification (given by Aout) should be less than execution of the function, then the postcondition holds at
or equal to the reliability of a path that the program may take the end of the function.
to compute the result (given by r ⋅ R(X) ). The analysis com- Postcondition: The postcondition for a function is the con-
putes the reliability of a path from the probability that all straint that the reliability of each array argument exceeds
operations along the path execute reliably. that given in its specification. For search_ref, the post-
The specification is valid if the probabilities for all paths condition Q0 is
to computing a result exceed that of the result’s specifica-
tion. To avoid the inherent intractability of considering
all possible paths, Rely uses a simplification procedure to
reduce the precondition to one that characterizes the least which specifies that the reliability of the arrays pblocks
reliable path(s) through the function. and cblock—R(pblocks) and R(cblock)—should be at
Precondition Checker: Rely verifies that the function’s least that specified by the developer—Apblocks and Acblock.
specifications are consistent with its reliability precondi- Precondition Generation: The analysis of the body of the
tion. Because reliability specifications are also of the form search_ref function starts at the return statement.
r ⋅R(X), the final precondition is a conjunction of predicates Given the postcondition Q0, the analysis creates a new pre-
of the form r1 ⋅R(X1) ≤ r2 ⋅R(X2), where r1 ⋅R(X1) is a reliability condition Q1 by conjoining to Q0 a predicate that states that
specification and r2 ⋅R(X2) is a path reliability. If these predi- the reliability of the return value (r0 ⋅R(minblock) ) is at
cates are valid, then the reliability of each computed output least that of its specification (Aret):
is greater than that given by its specification.
The validity problem for these predicates has a sound
mapping to the conjunction of two simple constraint valid-
ity problems: inequalities between real numbers (r1 ≤ r2) and The reliability of the return value comes from the design prin-
set inclusion constraints over finite sets (X2 ⊆ X1). Checking ciple for reliability approximation. Specifically, this reliability
the validity of a reliability precondition is therefore decid- is the probability of correctly reading minblock from unreli-
able and efficiently checkable. able memory—which is r0 = 1 − 10−7 according to the hardware
Design: As a key design point, the analysis generates reliability specification—multiplied by R(minblock), the
preconditions according to a conservative approximation probability that the preceding computation correctly com-
of the semantics of the function. Specifically, it character- puted and stored minblock.
izes the reliability of a function’s result according to the Loops: The statement that precedes the return state-
probability that the function computes that result fully ment is the repeat statement on Line 15. A key difficulty
reliably. with reasoning about the reliability of variables modified
To illustrate the intuition behind this design point, con- within a loop is that if a variable is updated unreliably and
sider the evaluation of an integer expression e. The reliabil- has a loop-carried dependence then its reliability mono-
ity of e is the probability that it evaluates to the same value n tonically decreases as a function of the number of loop
in an unreliable evaluation as in the fully reliable evaluation. iterations. Because the reliability of such variables can,
There are two ways that an unreliable evaluation can return in principle, decrease arbitrarily in an unbounded loop,
n: (1) the unreliable evaluation of e encounters no faults and Rely provides both an unbounded loop statement (with an
(2) the unreliable evaluation possibly encounters faults, but associated analysis) and an alternative bounded loop state-
still returns n by chance. ment that lets a developer specify a compile-time bound

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 87
research highlights

on the maximum number of its iterations that therefore Step 3: In the final step, the analysis leaves the scope of
bounds the reliability degradation of modified variables. the conditional and conjoins the two preconditions for its
The loop on Line 15 iterates nblocks times and therefore branches after transforming them to include the direct
decreases the reliability of any modified variables nblocks dependence of the control flow variable on the reliability of
times. Because the reliability degradation is bounded, Rely’s the if statement’s condition expression.
analysis uses unrolling to reason about the effects of a The reliability of the if statement’s expression is greater
bounded loop. than or equal to the product of (1) the reliability of the <. oper-
Conditionals: The analysis of the body of the loop on Line ator (r0), (2) the reliability of reading both ssd and minssd
15 encounters the if statement on Line 30.b This if statement from unreliable memory (r 20), and (3) the reliability of the
uses an unreliable comparison operation on ssd and computation that produced ssd and minssd (R(ssd,
minssd, both of which reside in unreliable memory. The minssd) ). The analysis therefore transforms each predicate
reliability of minblock when modified on Line 32 therefore that contains the variable 30, by multiplying the right-hand
also depends on the reliability of this expression because side of the inequality with r 30 and replacing the variable 30
faults may force the execution down a different path. with ssd and minssd.
Figure 5 presents a Hoare logic style presentation of the This produces the precondition Q2:
analysis of the conditional statement. The analysis works in
three steps; the preconditions generated by each step are
numbered with the corresponding step.
Step 1: To capture the implicit dependence of a variable
on an unreliable condition, Rely’s analysis first uses latent Simplification: After unrolling a single iteration of the loop
control flow variables to make these dependencies explicit. that begins at Line 15, the analysis produces
A control flow variable is a unique program variable (one for R(pblocks, cblock, i, ssd, minssd) as the precondition for
each statement) that records whether the conditional evalu- a single iteration of the loop’s body. The constant 2564 rep-
ated to true or false. We denote the control flow variable for resents the number of unreliable operations within a single
the if statement on Line 30 by 30. loop iteration.
To make the control flow dependence explicit, the analy- Note that there is one less predicate in this precondition
sis adds the control flow variable to all joint reliability terms than in Q 2. As the analysis works backwards through the
in Q1 that contain variables modified within the body of the program, it uses a simplification technique that identifies
if conditional (minssd and minblock). that a predicate Aret ≤ r1 ⋅R(X1) subsumes another predicate
Step 2: The analysis next recursively analyzes both the A ret ≤ r 2 ⋅ R(X 2). Specifically, the analysis identifies that
“then” and “else” branches of the conditional, produc- r 1 ≤ r2 and X2 ⊆ X1, which together mean that the sec-
ing one precondition for each branch. As in a standard ond predicate is a weaker constraint on A ret than the first
precondition generator (e.g., weakest-preconditions) and can therefore be removed. This follows from the fact
the assignment of i to minblock in the “then” branch that the joint reliability of a set of variables is less than
replaces minblock with i in the precondition. Because or equal to the joint reliability of any subset of the vari-
reads from i and writes to minblock are reliable (accord- ables—regardless of the distribution of their values.
ing to the specification) the analysis does not introduce This simplification is how Rely’s analysis achieves scal-
any new r0 factors. ability when there are multiple paths in the program; specifi-
cally a simplified precondition characterizes the least reliable
path(s) through the program.
b
  This happens after encountering the increment of i on Line 35, which
Final Precondition: When the analysis reaches the begin-
does not modify the current precondition because it does not reference i. ning of the function after fully unrolling the loop on Line 15, it
has a precondition that bounds the set of valid specifications
as a function of the reliability of the parameters of the func-
Figure 5. if statement analysis in the last loop iteration.
tion. For search_ref, the analysis generates the precondition
(3) {Q0 ∧ Aret ≤ r 04 · R(i, ssd, minssd)
∧ Aret ≤ r 04 · R(minblock, ssd, minssd)}
if (ssd <. minssd) {
(2) {Q0 ∧ Aret ≤ r0 · R(i, 30)}
minssd = ssd;
{Q0 ∧ Aret ≤ r0 · R(i, 30)}
Precondition checker. The final precondition is a con-
minblock = i;
{Q0 ∧ Aret ≤ r0 · R(minblock, 30)}
junction of predicates of the form A out ≤ r ⋅R(X), where
} else { A out is a placeholder for the reliability specification of an
(2) {Q0 ∧ Aret ≤ r0 · R(minblock, 30)} output. Because reliability specifications are all of the
skip; form r ⋅R(X), each predicate in the final precondition
{Q0 ∧ Aret ≤ r0 · R(minblock, 30)} (where each Aout is replaced with its specification) is of
} the form form r1 ⋅R(X1) ≤ r 2 ⋅R(X 2), where r 1 ⋅R(X 1) is a
(1) {Q0 ∧ Aret ≤ r0 · R(minblock, 30)} reliability specification and r 2 ⋅R(X2) is computed by the
analysis. Similar to the analysis’s simplifier (see Precon-

88 COM MUNICATIO NS O F TH E AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

dition checker section), the precondition checker verifies Quantitative reliability enables a developer to model the
the validity of each predicate by checking that (1) r1 is performance of this checked implementation of the compu-
less than r 2 and (2) X2 ⊆ X1. tation. We will use Tpass to denote the expected time required
For search_ref, the analysis computes the following to compute the correct value of the computation and per-
predicates: form the check and Tfail to denote the expected time required
to compute an incorrect result, perform the check, and then
rerun the reliable version of the computation (that produces
the correct result).
If r denotes the reliability of the computation, then the
expected execution time of the checked computation as a
whole is T′ = r ⋅ Tpass + (1 − r) ⋅ Tfail. This time can be compared
with the time to always perform a reliable version of the
computation. Therefore, this reasoning allows a developer
Because these predicates are valid according to the check- to find the reliability r that meets the developer’s perfor-
ing procedure, search_ref satisfies its reliability specifi- mance improvement goal and can be analogously applied
cation when executed on the specified unreliable hardware. for alternative resource usage measures, such as energy con-
sumption and throughput.
3. CASE STUDIES Approximate Computations: For computations that are
We have used Rely to build unreliable versions of six build- inherently approximate, we can perform reliability profiling
ing block computations for media processing, machine to relate the errors in the approximate computational ker-
learning, and data analytics applications. These case stud- nels to the full application’s errors.
ies illustrate how quantitative reliability enables a developer To estimate the error of the computation, a developer
to use principled reasoning to relax the semantics of both can provide a sensitivity testing procedure, that specifies how
approximate computations and checkable computations. the noise can be injected in the application. For instance, to
Benchmarks: We analyze the following six computations: estimate the error of the function search_ref from Figure 1,
a profiler can modify the program to produce the correct
• newton: This computation searches for a root of a uni- minimum distance block with probability r and produce
variate function using Newton’s Method. the maximum distance block with probability 1 − r. This
• bisect: This computation searches for a root of a uni- modification provides a conservative estimate of the
variate function using the Bisection Method. bound on search_ref’s accuracy loss given the reliabil-
• coord: This computation calculates the Cartesian coor- ity r (when the computation’s inputs are reliable) and the
dinates from the polar coordinates passed as the input. assumption that a fault causes search_ref to return the
• search_ref: This computation performs a simple worst-case result.
motion estimation. We presented this computation in The profiler can then run the application on represen-
Section 2. tative inputs, for different values of r. The profiler then
• mat_vec: This computation multiplies a matrix and a compares the outputs of the original and modified pro-
vector and stores the result in another vector. gram by computing a developer-provided application
• hadamard: This computation takes as input two blocks level quality-loss-metric. The profiler estimates the rela-
of 4 × 4 pixels and computes the sum of differences tionship between computation-level error, controlled by
between the pixels in the frequency domain. r, and application-level quality loss. Based on this esti-
mate, the developer can select an appropriate value of r.
3.1. Deriving reliability specification In our example, if the developer is willing to accept 1%
A developer’s choice of reliability specifications is typi- loss in the video’s peak-signal-to-noise ratio (the quality-
cally influenced by the perceived effect that the unreliable loss metric for the video encoder), then this procedure
execution of the computation may have on the accuracy of can help the developer select r to be 0.98.
the full program’s result and its execution time and energy
consumption. We present two strategies for how developers
can use Rely to reason about the trade-offs between accuracy
and performance that are available for checkable computa- Benchmark analysis summary.
tions and approximate computations.
Checkable Computations: Checkable computations can Predicates
be augmented with an efficient checker that dynamically Benchmark Type LOC Time (ms) N S
verifies the correctness of the computation’s result. If the
newton Checkable 21 8 82 1
checker detects an error, then it re-executes the computa- bisect Checkable 30 7 16,356 2
tion or executes an alternative reliable implementation. coord Checkable 36 19 20 1
For instance, a Newton’s method computation searches for search_ref Approximate 37 348 36,205 3
value of input x for which a function f(x) is 0. Once this com- matvec Approximate 32 110 1061 4
hadamard Approximate 87 18 3 3
putation finds a zero of the function, x0, it is typically much
less expensive to compute f(x0) and check if it equals 0.

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 89
research highlights

3.2. Analysis summary desirable to reason about the accuracy of the result that the
The table here presents Rely’s analysis results on the bench- computation produces. Dynamic techniques observe the
mark computations. For each benchmark, the table presents accuracy impact of program transformations, for exam-
the type of the computation (checkable or approximate), its ple, Refs., 2, 3, 16, 20, 25, 29 or injected soft errors, for example,
length in lines of code (LOC), the execution time of the anal- Refs. 9, 15, 27 Researchers have developed static techniques
ysis, and the number of inequality predicates in the final that use probabilistic reasoning to characterize the accu-
precondition produced by the precondition generator both racy impact of various sources of uncertainty.8, 19, 30 And of
without and with our simplification strategy. course, the accuracy impact of the floating point approxi-
Analysis Time: The analysis times for all benchmarks are mation to real arithmetic has been extensively studied in
under one second when executed on an Intel Xeon E5520 numerical analysis.
machine with 16 GB of main memory. More recently, we developed the Chisel optimization
Number of Predicates: We used Rely with the hardware reli- system to automate the placement of approximate opera-
ability specification from Figure 3 to generate a reliability tions and data.17 Chisel extends the Rely reliability specifi-
precondition for each benchmark. The second to last column cations (that capture acceptable frequency of errors) with
(labeled N) presents the number of predicates in the precon- absolute error specifications (that also capture accept-
dition when using a naïve strategy that does not include our able magnitude of errors). Chisel formulates an integer
simplification procedure. The rightmost column (labeled S) optimization problem to automatically navigate the trad-
presents the number of predicates in each precondition eoff space and generate an approximate computation that
when Rely employs our simplification procedure. provides maximum energy savings (for the given model of
When Rely uses simplification, the size of each precondi- approximate hardware) while satisfying the developer’s
tion is small (all consisting of less than five predicates). The reliability and absolute error specifications.
difference in size between the naïvely generated precondi- Fault Tolerance and Resilience: Researchers have devel-
tions and those generated via simplification demonstrates oped various software, hardware, or mixed approaches for
that simplification reduces the size of preconditions by detection and recovery from specific types of soft errors
multiple orders of magnitude. Simplification achieves these that guarantee a reliable program execution, for example,
results by identifying that many of the additional predicates Refs.9, 23, 24 For example, Reis et al.24 present a compiler
introduced by the reasoning required for conditionals can that replicates a computation to detect and recover from
be removed. These additional predicates are often sub- single event upsets. These techniques are complemen-
sumed by another predicate. tary to Rely in that each can provide implementations of
operations that need to be reliable, as either specified by
4. RELATED WORK the developer or as required by Rely, to preserve memory
In this section, we present an overview of the other work that safety and control flow integrity.
intersects with Rely and its contributions to modeling and
analysis of approximate computations, and computation 5. CONCLUSION
fault tolerance. Driven by hardware technology trends, future computa-
Integrity: Almost all approximate computations have tional platforms are projected to contain unreliable hard-
critical regions that must execute without error for the ware components. To safely exploit the benefits (such as
computation as a whole to execute acceptably. Dynamic reduced energy consumption) that such unreliable compo-
criticality analyses automatically change different nents may provide, developers need to understand the effect
regions of the computation or internal data structures, that these components may have on the overall reliability of
and observe how the change affects the program’s out- the approximate computations that execute on them.
put, for example, Refs.7, 20, 25 In addition, specification- We present a language, Rely, for exploiting unreliable
based static criticality analyses let the developer identify hardware and an associated analysis that provides probabi-
and separate critical and approximate program regions, listic reliability guarantees for Rely computations executing
for example, Refs.15, 27 Carbin et al.5 present a verification on unreliable hardware. By enabling developers to bet-
system for relaxed approximate programs based on a rela- ter understand the probabilities with which this hardware
tional Hoare logic. The system enables rigorous reason- enables approximate computations to produce correct
ing about the integrity and worst-case accuracy properties results, these guarantees can help developers safely exploit
of a program’s approximate regions. the benefits that unreliable hardware platforms offer.
In contrast to the prior static analyses that focus on the
binary distinction between reliable and approximate com- Acknowledgments
putations, Rely allows a developer to specify and verify that We thank Deokhwan Kim, Hank Hoffmann, Vladimir
even approximate computations produce the correct result Kiriansky, Stelios Sidiroglou, and Rishabh Singh for their
most of the time. Overall, this additional information can insightful comments.
help developers better understand the effects of deploying This research was supported in part by the National
their computations on unreliable hardware and exploit the Science Foundation (Grants CCF-0905244, CCF-1036241,
benefits that unreliable hardware offers. CCF-1138967, CCF-1138967, and IIS-0835652), the United
Accuracy: In addition to reasoning about how often a States Department of Energy (Grant DE-SC0008923), and
computation may produce a correct result, it may also be DARPA (Grants FA8650-11-C-7192, FA8750-12-2-0110).

90 COMMUNICATIO NS O F TH E AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

References partitioning. In ASPLOS (2011).
1. Achour, S., Rinard, M. Approximate 16. Meng, J., Chakradhar, S.,
checkers for approximate Raghunathan, A. Best-effort parallel
computations in topaz. In OOPSLA execution framework for recognition
(2015). and mining applications. In IPDPS
2. Ansel, J., Wong, Y., Chan, C., (2009).
Olszewski, M., Edelman, A., 17. Misailovic, S., Carbin, M., Achour, S.,
Amarasinghe, S. Language and Qi, Z., Rinard, M. Chisel: Reliability-
compiler support for auto-tuning and accuracy-aware optimization of
variable-accuracy algorithms. In CGO approximate computational kernels.
(2011). In OOPSLA (2014).
3. Baek, W., Chilimbi, T.M. Green: A 18. Misailovic, S., Kim, D., Rinard, M.
framework for supporting energy- Parallelizing sequential programs
conscious programming using with statistical accuracy tests. ACM
controlled approximation. In PLDI TECS Special Iss. Prob. Embedded
(2010). Comput. (2013).
4. Blum, M., Kanna, S. Designing 19. Misailovic, S., Roy, D., Rinard, M.
programs that check their work. In Probabilistically accurate program
STOC (1989). transformations. In SAS (2011).
5. Carbin, M., Kim, D., Misailovic, S., 20. Misailovic, S., Sidiroglou, S.,
Rinard, M. Proving acceptability Hoffmann, H., Rinard, M. Quality of
properties of relaxed nondeterministic service profiling. In ICSE (2010).
approximate programs. In PLDI 21. Narayanan, S., Sartori, J., Kumar, R.,
(2012). Jones, D. Scalable stochastic
6. Carbin, M., Kim, D., Misailovic, S., processors. In DATE (2010).
Rinard, M. Verified integrity 22. Palem, K. Energy aware computing
properties for safe approximate through probabilistic switching: A
program transformations. In PEPM study of limits. IEEE Trans. Comput.
(2013). (2005).
7. Carbin, M., Rinard, M. Automatically 23. Perry, F., Mackey, L., Reis, G., Ligatti, J.,
identifying critical input regions and
code in applications. In ISSTA (2010).
August, D., Walker, D. Fault-tolerant
typed assembly language. In PLDI ACM Books.
In-depth.
8. Chaudhuri, S., Gulwani, S., (2007).
Lublinerman, R., Navidpour, S. Proving 24. Reis, G., Chang, J., Vachharajani, N.,
programs robust. In FSE (2011). Rangan, R., August, D. Swift: Software
9. de Kruijf, M., Nomura, S., implemented fault tolerance. In CGO

Innovative.
Sankaralingam, K. Relax: An (2005).
architectural framework for software 25. Rinard, M. Probabilistic accuracy
recovery of hardware faults. In ISCA bounds for fault-tolerant
(2010). computations that discard tasks. In

Insightful.
10. Ernst, D., Kim, N.S., Das, S., Pant, S., ICS (2006).
Rao, R., Pham, T., Ziesler, C., Blaauw, D., 26. Rinard, M., Cadar, C., Dumitran, D.,
Austin, T., Flautner, K., Mudge, T. Roy, D., Leu, T., Beebee, W. Jr.
Razor: A low-power pipeline based on Enhancing server availability and
circuit-level timing speculation. security through failure-oblivious
In MICRO (2003). computing. In OSDI (2004).
11. Esmaeilzadeh, H., Sampson, A.,
Ceze, L., Burger, D. Architecture
27. Sampson, A., Dietl, W., Fortuna, E.,
Gnanapragasam, D., Ceze, L., The VR Book: Human-Centered
Design for Virtual Reality
support for disciplined approximate Grossman, D. EnerJ: Approximate
programming. In ASPLOS (2012). data types for safe and general
12. Hoffman, H., Sidiroglou, S., Carbin, M., low-power computation. In PLDI
Misailovic, S., Agarwal, A., Rinard, M.
Dynamic knobs for responsive
(2011).
28. Sankaranarayanan, S., Chakarov, A., By Jason Jerald, PhD
power-aware computing. In ASPLOS Gulwani, S. Static analysis for
(2011). probabilistic programs: Inferring Good VR design requires strong communication between
13. Leem, L., Cho, H., Bau, J., Jacobson, Q., whole program properties from
Mitra, S. Ersa: Error resilient system finitely many paths. In PLDI
human and machine, indicating what interactions are
architecture for probabilistic (2013). possible, what is currently occurring, and what is about to
applications. In DATE (2010). 29. Sidiroglou, S., Misailovic, S.,
14. Leveson, N., Cha, S., Knight, J.C., Hoffmann, H., Rinard, M. Managing occur. A human-centered design principle, like lean
Shimeall, T. The use of self checks performance vs. accuracy trade-offs methods, is to avoid completely defining the problem at
and voting in software error detection: with loop perforation. In FSE (2011).
An empirical study. In IEEE TSE 30. Zhu, Z., Misailovic, S., Kelner, J., the start and to iterate upon repeated approximations and
(1990).
15. Liu, S., Pattabiraman, K., Moscibroda, T.,
Rinard, M. Randomized accuracy-
aware program transformations for
modifications through rapid tests of ideas with real users.
Zorn, B. Flikker: Saving dram efficient approximate computations. Thus, The VR Book is intended as a foundation for anyone
refresh-power through critical data In POPL (2012).
and everyone involved in creating VR experiences
including: designers, managers, programmers, artists,
Michael Carbin, Sasa Misailovic, and
Martin C. Rinard, Computer Science psychologists, engineers, students, educators, and user
and Artificial Intelligence Laboratory, experience professionals.
Massachusetts Institute of Technology,
Cambridge, MA. Available in hardcover, paperback and eBook. 
DOI: 10.1145/2792790

For more info please visit

http://books.acm.org
M M
&C &C
Association for Morgan & Claypool
Computing Machinery Publishers

Copyright held by authors.

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 91
research highlights
DOI:10.1145/ 2 9 6 1 8 9 2

Technical Perspective
To view the accompanying paper,
visit doi.acm.org/10.1145/2958736 rh

Why Didn’t I Think of That?

By Philip Wadler

ON C E I N A while, an idea will strike Advanced as these systems were, a Web application has been treated
you with great force, and you say “Why even as simple a matter as enter- as a global variable, accessible to all.
didn’t I think of that?” The history of ing a date on a form could be com- Chlipala suggests a better approach:
programming the Web is a sequence plex. It might be input as a single allow each module to declare locally
of innovations in abstraction, each of string from a form that needed to be a portion of the database relevant to
which might make you utter the afore- parsed, or three drop-down menus its needs, and hide that portion from
mentioned phrase. for day, month, and year that need to the other modules. He also introduc-
The Web is supported by an array be assembled, or through a calendar es primitives to support concurrency
of interlocked standards, including widget in JavaScript. It was not until and transaction, with a more elegant
HTTP, HTML, CSS, CGI, and Java- 2006 that I saw the iData system of design than found in most other Web
Script. On top of these have been built a Plasmeijer and Achten,6 which sug- languages. Finally, he suggests a novel
series of abstractions, each increasing gested Web systems should abstract form of functional reactive program-
the ease with which a Web application away from such detail, introduc- ming that incorporates imperative ac-
can be designed and implemented. ing model-view abstraction to Web tions. How the latter compares with
One of the earliest of these ab- forms, encapsulating how data was the more declarative form of func-
stractions appeared at the end of the input separately from how it was to tional reactive programming found
last millennium, when Atkins, Ball, be processed. An obvious idea—but in languages such as Elm remains
Bruns, and Cox1 devised MAWL, the only in retrospect. Cooper, Lindley, to be seen. Chlipala has tried these
Mother of All Web Languages. MAWL Wadler, and Yallop3 reworked this techniques in practice, and an intrigu-
introduced to the Web world the now- aspect of iData into formlets. Just as ing list of his early customers may be
common idea of inversion of control, inversion of control was easier to ab- found in the research version of this
where a sequence of requests from sorb once it was related to the known paper, which appeared in POPL 2015.
users invoking programs that gener- notion of continuations, so formlets Modularizing database access is a
ate Web pages is instead viewed as a benefited from fitting into the known simple idea of enormous power, and I
single program generating a sequence notion of applicatives, as introduced expect it will be coming to a Web pro-
of pages to which users respond. My by McBride and Patterson.5 The the- gramming language near you soon.
first attempts to come to grips with ory aided practice: developers wrote Why didn’t I think of that?
inversion of control hurt my brain, formlet libraries for F#, Haskell, Ja-
but within a few years it acquired firm vaScript, and Racket, and incorporat- References
1. Atkins, D.L., Ball, T., Bruns, G. and Cox, K. Mawl: A
foundations in theory, relating it to ed formlet support into frameworks domain-specific language for form-based services.
well-understood notions of continua- including Happstack, Tupil, Web- IEEE Trans. Software Engineering 25, 3 (1999),
334–346.
tions and continuation-passing style, Sharper, and Yesod. 2. Cooper, E., Lindley, S., Wadler, P. and Yallop, J. Links:
Web programming without tiers. Formal Methods for
thanks to the efforts of Queinnec7 and The following paper presents the Components and Objects. Springer, 2007, 266–296.
the PLT Scheme (now Racket) team of next step. Until now, the database in 3. Cooper, E., Lindley, S., Wadler, P. and Yallop, J. The
essence of form abstraction. In Proceedings of the
Graunke, Findler, Krishnamurthi, Van Asian Symposium on Programming Languages and
Der Hoeven, and Felleisen.4 Systems. Springer, 2008, 205–220.
Web programming was complex Until now, 4. Graunke, P., Krishnamurthi, S., Van Der Hoeven, S. and
Felleisen, M. Programming the Web with high-level
because it involved a plethora of pro- programming languages. In Proceedings of the
grams written in different languages the database in European Symposium on Programming. Springer,
2001, 122–136.
running on different platforms. Typi- a Web application 5. McBride, C. and Paterson, R. Applicative programming
with effects. J. Functional Programming 18, 1 (2008),
cally, a three-tier system consisted of
JavaScript on the client, Java (or some has been treated 1–13.
6. Plasmeijer, R. and Achten, P. idata for the World Wide

as a global variable,
Web—Programming interconnected Web forms. In
other language) on the server, and SQL Proceedings of the International Symposium on
on the database. The idea of generat- Functional and Logic Programming. Springer, 2006,

ing all three tiers from a single source accessible to all. 242–258.
7. Queinnec, C. The influence of browsers on evaluators
was christened “programming without Chlipala suggests or, continuations to program Web servers. ACM
SIGPLAN Notices 35 (2000), 23–33.
tiers” by Cooper, Lindley, Wadler, and
Yallop.2 Many systems independently a better approach. Phil Wadler ([email protected]) is Professor of
appeared generating two or three Theoretical Computer Science in the Laboratory for
Foundations of Computer Science in the School of
tiers from a single source, including Informatics at the University of Edinburgh, Scotland.
Google’s AWT and Microsoft’s LINQ,
and research-oriented systems includ-
ing Ocsygen, Opa, and Hop. Copyright held by author.

92 COMM UNICATIO NS O F THE ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 DOI:10.1145/ 2 9 5 8 73 6

Ur/Web: A Simple Model for

Programming the Web
By Adam Chlipala

Abstract Such established systems provide substantial benefits to

The World Wide Web has evolved gradually from a document Web programmers, but there is more we could ask for. This
delivery platform to an architecture for distributed program- article focuses on a language design that advances the state
ming. This largely unplanned evolution is apparent in the set of the art by addressing two key desiderata. First, we bring
of interconnected languages and protocols that any Web encapsulation to rich Web applications, supporting program
application must manage. This paper presents Ur/Web, a modules that treat key pieces of Web applications as private
domain-specific, statically typed functional programming state. Second, we expose a simple concurrency model to pro-
language with a much simpler model for programming grammers, while supporting the kinds of nontrivial commu-
modern Web applications. Ur/Web’s model is unified, where nication between clients and servers that today’s applications
programs in a single programming language are compiled to take advantage of. Most Web programmers seem unaware of
other “Web standards” languages as needed; supports novel either property as something that might be worth asking for,
kinds of encapsulation of Web-specific state; and exposes so part of our mission here is to evangelize for them.
simple concurrency, where programmers can reason about We present the Ur/Web programming language, an exten-
distributed, multithreaded applications via a mix of transac- sion of the Ur language,5 a statically typed functional lan-
tions and cooperative preemption. We give a tutorial intro- guage inspired by dependent type theory. Open-source
duction to the main features of Ur/Web. implementations of Ur/Web have been available since 2006,
and several production Web applications use the language,
including at least one profitable commercial site.
1. INTRODUCTION Ur/Web reduces the nest of Web standards to a simple pro-
The World Wide Web is a very popular platform today for gramming model, coming close to retaining just the essence
programming certain kinds of distributed applications with of the Web as an application platform, from the standpoints
graphical user interfaces (GUIs). Today’s complex ecosystem of security and performance. We have a single distributed
of “Web standards” was not planned monolithically. Rather, system, with one server under the programmer’s control and
it evolved gradually, from the starting point of the Web as a many clients that are not. The server and clients communicate
delivery system for static documents. The result is not sur- only through various strongly typed communication chan-
prising: there are many pain points in implementing rich nels, and every such interaction occurs as part of a transac-
functionality on top of the particular languages that brows- tion that appears to execute atomically, with no interference
ers and servers speak. At a minimum, today’s rich applica- from other actions taking place at the same time. The server
tions must generate HTML, for document structure; CSS, for has access to persistent state in an SQL database, which is
document formatting; JavaScript, a scripting language for also accessed only through channels with strong types spe-
client-side interactivity; and messages of HTTP, a protocol cific to the data schema. Clients maintain their GUIs though
for sending all of the above and more, to and from browsers. a novel variant of functional-reactive programming.
Most recent, popular applications also rely on languages like The next section expands on these points with a tutorial
JSON for serializing complex datatypes for network commu- introduction to Ur/Web. We highlight the impact on the lan-
nication, and on languages or APIs like SQL for storing per- guage design of our goals to support encapsulation and simple
sistent, structured data on servers. Code fragments in these concurrency. Afterward, we compare with other research proj-
different languages are often embedded within each other in ects and widely used frameworks.
complex ways, and the popular Web development tools pro- The open-source implementation of Ur/Web is available at:
vide little help in catching inconsistencies.
http://www.impredicative.com/ur/.
These complaints are not new, nor are language-based solu-
tions. The Links project4, 8 pioneered the “tierless programming”
approach, combining all the pieces of dynamic Web applica- 2. A TUTORIAL INTRODUCTION TO UR/WEB
tions within one statically typed functional programming lan- We will introduce the key features of Ur/Web through a
guage. Similar benefits are attained in more recent mainstream series of refinements of one example, a multiuser chat appli-
designs, such as Google’s Web Toolkita and Closureb systems, cation. Visitors to the site choose from a selection of chat
for adding compilation on top of Web-standard languages; and
Microsoft’s LINQ,12 for type-safe querying (to SQL databases
The original version of this paper was published in the
and more) within general-purpose languages.
Proceedings of the 42nd ACM SIGPLAN-SIGACT Sympo-
sium on Principles of Programming. ACM, New York, NY,
a
 http://www.gwtproject.org/.
2015, 153–165.
b
 https://developers.google.com/closure/.

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 93
research highlights

rooms, each of which maintains a log of messages. Any visi- Figure 1. A simple chat-room application.
tor to a chat room may append any line of text to the log, and
table room : { Id : int, Title : string }
there should be some way for other users to stay up-to-date table message : { Room : int, When : time,
on log additions. We start with a simple implementation, in Text : string }
the style of 20th century Web applications, before it became
fun chat id =
common to do significant client-side scripting. We evolve let
toward a version with instant updating upon all message fun say r =
dml (INSERT INTO message (Room, When, Text)
additions, where a chat room runs within a single HTML VALUES ({[id]}, CURRENT_TIMESTAMP, {[r.Text]}));
page updated incrementally by client-side code. Along the chat id
in
way, we highlight our running themes of encapsulation and title <− oneRowE1 (SELECT (room.Title) FROM room
simple concurrency. WHERE room.Id = {[id]});
log <− queryX1 (SELECT message.Text FROM message
The examples from this section are written to be under- WHERE message.Room = {[id]}
standable to readers with different levels of familiarity with ORDER BY message.When)
statically typed functional languages. Though the code should (fn r => <xml>{[r.Text]}<br/> </xml>);
return <xml><body>
be understandable to all at a high level, some remarks (safe to <h1>Chat Room: {[title]}</h1>
skip) may require more familiarity.
<form>
Add message: <textbox{#Text}/>
2.1. HTML and SQL <submit value="Add" action={say}/>
</form>
Mainstream modern Web applications manipulate code in
many different languages and protocols. Ur/Web hides most <hr/>
of them within a unified programming model, but we decided {log}
to expose two languages explicitly: HTML, for describing the </body> </xml>
end
structure of Web pages as trees, and SQL, for accessing a per-
sistent relational database on the server. In contrast to main- fun main () =
stream practice, Ur/Web represents code fragments in these rooms <− queryX1 (SELECT * FROM room
ORDER BY room.Title)
languages as first-class, strongly typed values. (fn r => <xml> <li><a link={chat r.Id}>
Figure 1 gives our first chat-room implementation, rely- {[r.Title]}</a> </li> </xml>);
return <xml> <body>
ing on embedding of HTML and SQL code. While, in general, <h1>List of Rooms</h1>
Ur/Web programs contain code that runs on both server and
{rooms}
clients, all code from this figure runs on the server, where </body> </xml>
we are able to enforce that it is run exactly as written in the
source code.
The first two lines show declarations of SQL tables, which
can be thought of as mutable global variables of type “mul- sense that they take other functions as arguments, and we
tiset of records.” Table room’s records contain integer IDs often write those function arguments anonymously using the
and string titles, while table message’s records contain syntax fn x => e, which defines a function that, when called,
integer room IDs, timestamps, and string messages. The returns the value of expression e where parameter variable x
former table represents the set of available chat rooms, is replaced with the actual argument value. We adopt a typo-
while the latter represents the set of all (timestamped) mes- graphic convention for documenting each library function
sages sent to all rooms. briefly, starting with queryX1, used in main:
We direct the reader’s attention now to the declaration
queryX1 Run an SQL query that returns columns from a
of the main function, near the end of Figure 1. Here we see
single table (leading to the 1 in the identifier), calling
Ur/Web’s syntax extensions for embedded SQL and HTML
an argument function on every result row. Since just
code. Such notation is desugared into calls to constructors
a single table is involved, the input to the argument
of abstract syntax tree types. The main definition demon-
function is a record with one field per column returned
strates two notations for “antiquoting,” or inserting Ur code
by the query. The argument function should return
within a quoted code fragment. The notation {e} asks to eval-
XML fragments (leading to the X in the identifier), and
uate expression e to produce a subfragment to be inserted
all such fragments are concatenated together, in order,
at that point, and notation {[e]} adds a further stage of for-
to form the result of queryX1.
matting e as a literal of the embedded language (using type
classes17 as in Haskell’s show). Note that we are not exposing Ur/Web follows functional languages like Haskell in enforc-
syntax trees to the programmer as strings, so neither anti- ing purity, where expressions may not cause side effects.
quoting form presents any danger of code injection attacks, We allow imperative effects on an “opt-in” basis, with types
where we accidentally interpret user input as code. delineating boundaries between effectful and pure code,
What exactly does the main definition do? First, we run following Haskell’s technique of monadic IO.14 For instance,
an SQL query to list all chat rooms. In our tutorial examples, the main function here inhabits a distinguished monad
we will call a variety of functions from Ur/Web’s standard for input-output. Thus, we use the <- notation to run an
library, especially various higher-order functions for using effectful computation and bind its result to a variable, and
SQL query results. Such functions are higher-order in the we call the return function to lift pure values into trivial

94 COMM UNICATIO NS O F THE AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

computations. Readers unfamiliar with the Haskell style for example, into classes implementing data structures.
may generally read <- as simple variable assignment and The database tables here are effectively data structures, so
return in its usual meaning from C-like languages. why not try to encapsulate them as well?
The remaining interesting aspect of main is in its use of The answer is that, as far as we are aware, no prior language
an HTML <a> tag to generate a hyperlink. Instead of denot- designs allow it! As we wrote above, the general model is that
ing a link via a URL as in standard HTML, we use a link the SQL database is a preexisting resource, and any part of the
attribute that accepts a suspended Ur/Web remote function application may create an interface to any part of the database.
call. In this case, we call chat, which is defined earlier. The We analogize such a scheme to an object-­oriented language
Ur/Web implementation handles proper marshalling of argu- where all class fields are public; it forecloses on some very use-
ments in suspended calls. ful styles of modular reasoning. It is important that modules be
Now let us examine the implementation of the chat able to create their own private database tables, without requir-
function, providing a page for viewing the current message log ing any changes to other source code, application configuration
of a chat room. First, there is a nested definition of a function files, etc., for the same reason that we do not want client code
say, which will be called to append a message to the log. of a dictionary class to change, when the dictionary switches to
being implemented with hash tables instead of search trees.
dml  Run a piece of SQL code for its side effect of mutating
Figure 2 shows a refactoring of our application code, to
the database. The function name refers to SQL’s data
present the chat-room table as a mutable abstract data type.
manipulation language.
We use Ur/Web’s module system, which is in the ML tradition.11
This particular invocation of dml inserts a new row into the We have modules that implement signatures, which may
message table with the current timestamp, after which we impose information hiding by not exposing some members
trigger the logic of the main chat page to generate output. or by making some types abstract. Figure 2 defines a module
Note that say, like all remotely callable functions, appears Room encapsulating all database access.
to execute atomically, so the programmer need not worry The signature of Room appears bracketed between key-
about interleavings between concurrent operations by dif- words sig and end. We expose an abstract type id of chat-
ferent clients. room identifiers. Ur/Web code in other program modules
The main body of chat runs appropriate queries to will not be able to take advantage of the fact that id is really
retrieve the room name and the full, sorted message log. int, and thus cannot fabricate new IDs out of thin air. The
signature exposes two methods: rooms, to list the IDs and
oneRowE1  Run an SQL query that should return just one
titles of all chat rooms; and chat, exactly the remotely call-
result row containing just a single column ( justifying
able function we wrote before, but typed in terms of the
the 1) that is computed using an arbitrary SQL expression
abstract type id. Each method’s type uses the transaction
( justifying the E). That one result value becomes the
monad, which is like Haskell’s IO monad, but with support
result of the oneRowE1 call.
for executing all side effects atomically in a remote call.
We antiquote the query results into the returned page in an The implementation of Room is mostly just a copying-
unsurprising way. The only new feature involves HTML forms. and-pasting of the bulk of the code from Figure 1. We only
In general, we tag each input widget with a record field name, need to add a simple implementation of the rooms method.
and then the submit button of the form includes, in its action
queryL1 Return as a list (justifying the L) the results
attribute, an Ur/Web function that should be called upon sub-
of a query that only returns columns of one table
mission, on a record built by combining the values of all the input
(justifying the 1).
widgets. We will not say any more about HTML forms, which to
some extent represent a legacy aspect of HTML that has been
superseded by client-side scripting. Old-style forms need to Figure 2. A modular factorization of Figure 1.
use a rigid language (HTML) for describing how to combine
structure Room : sig
the values of different widgets into one request to send to the type id
server, while these days it is more common to use a Turing- val rooms : transaction (list {Id : id,
Title : string})
complete language (JavaScript) for the same task. val chat : id −> transaction page
Compiling an application to run on the real Web plat- end = struct
(* ...copies of old definitions of room, message,
form requires exposing remotely callable functions (like and chat... *)
main, chat, and say) via URLs. Ur/Web automatically gen-
val rooms = queryL1 (SELECT * FROM room
erates pleasing URL schemes by serializing the function-call ORDER BY room.Title)
expressions that appear in places like link attributes. For end
instance, the link to chat in the declaration of main is fun main () =
compiled to a URL/chat/NN, where NN is a textual represen- rooms <− Room.rooms;
tation of the room ID. return <xml> <body>
<h1>List of Rooms</h1>
Adding more encapsulation. The application in Figure 1
is rather monolithic. The database state is exposed without {List.mapX (fn r =>
<xml> <li><a link={Room.chat r.Id}>
restrictions to all parts of the application. We would not {[r.Title]}</a> </li> </xml>) rooms}
tolerate such a lack of encapsulation in a large traditional </body> </xml>
application. Chunks of functionality should be modularized,

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 95
research highlights

List.mapX  Apply an XML-producing function to each element source : ∀α. transaction (source α)

of a list, then concatenate together the resulting XML get  :  ∀α. source α → transaction α
fragments to compute the result of mapX. set  :  ∀α. source α → α → transaction {}
s_m  :  monad signal
The code for main changes so that it calls methods of Room, signal  :  ∀α. source α → signal α
instead of inlining database access.
This sort of separation of a data model is often imple- That is, data sources have operations for allocating them
mented as part of the “model-view-controller” pattern. To and reading or writing their values. All such operations live
our knowledge, that pattern had not previously been com- inside the transaction monad for imperative side effects.
bined with guaranteed encapsulation of the associated data- Signals, or time-varying values, happen to form a monad
base tables. It also seems to be novel to apply ML-style type with appropriate operations (e.g., support return and the
abstraction to database results, as in our use of an id type <- operator), as indicated by the presence of a first-class
here. We hope this example has helped convey one basic dictionary s_m witnessing their monadhood. One more key
take-away message: giving first-class status to key pieces of operation with signals is producing them from sources, via
Web applications makes it easy to apply standard language- the value-level signal function, which turns a source into
based encapsulation mechanisms. a stream that documents changes to the source’s contents.
Figure 3 demonstrates these constructs in a module imple-
2.2. Client-side GUI scripting menting a GUI widget for append-only logs. The module sig-
We will develop two more variations of the chat-room appli- nature declares an abstract type t of logs. We have methods
cation. Our modifications will be confined to the implemen- create, to allocate a new log; append, to add a new string to
tation of the Room module. Its signature is already sufficient the end of a log; and render, to produce the HTML represent-
to enable our experiments, and we will keep the same main ing a log. The type of render may be deceptive in its simplic-
function code for the rest of the tutorial. ity; Ur/Web HTML values (as in the xbody type of HTML that
Our first extension takes advantage of client-side scripting to fits in a document body) actually are all implicitly parameter-
make applications more responsive, without the need to load ized in the dataflow style, and they are equipped to rerender
a completely fresh page after every user action. Mainstream themselves after changes to the data sources they depend on.
Web applications are scripted with JavaScript, but, as in Links
and similar languages, Ur/Web scripting is done in the lan- Figure 3. Append-only log module for GUIs.
guage itself, which is compiled to JavaScript as needed. structure Log : sig
Reactive GUIs. Ur/Web GUI programming follows the type t
val create : transaction t
functional-reactive style. That is, to a large extent, the vis- val append : t −> string −> transaction {}
ible page is described as a transformation over streams val render : t −> xbody
end = struct
(sequences of values over time). User inputs like keypresses datatype log =
are modeled as primitive streams, which together should Nil
| Cons of string * source log
be transformed into the stream of page contents that the
user sees. Languages like Flapjax13 and Elm9 adopt the type t = {Head : source log,
Tail : source (source log)}
stream metaphor literally. Ur/Web follows a less pure style,
where we retain the event callbacks of imperative program- val create =
ming. These callbacks modify data sources, which are a s <− source Nil;
s’ <− source s;
special kind of mutable reference cells. The only primi- return {Head = s, Tail = s’}
tive streams are effectively the sequences of values that
fun append t text =
data sources take on, where new entries are pushed into s <− source Nil;
the streams mostly via imperative code in callbacks. Both oldTail <− get t.Tail;
set oldTail (Cons (text, s));
flavors of the functional-reactive style provide superior set t.Tail s;
modularity compared to the standard Web model, which
log <− get t.Head;
involves imperative mutation of the document tree, treat- case log of
ed as a public global variable. Nil => set t.Head (Cons (text, s))
| _ => return ()
As a basic orientation to the concepts of sources and
streams in Ur/Web, here is their type signature. We rely on fun render_aux log =
two abstract parameterized types: source α is a data source case log of
Nil => <xml> </xml>
that can store values of type α, and signal α is a time-varying | Cons (text, rest) => <xml>
value that, at any particular time, has some value of type α. {[text]}<br/>
<dyn signal={log <− signal rest;
As types and values occupy different namespaces, we often return (render_aux log)}/>
reuse an identifier (e.g., source) to stand for both a type and </xml>
the run-time operation for allocating one of its instances, fun render t = <xml>
much as happens with classes and their constructors in Java. <dyn signal={log <− signal t.Head;
return (render_aux log)}/>
We write ∀α. T for a type that is polymorphic in some arbitrary </xml>
type parameter α, much as we would write a method proto- end
type like <a> T f(. . .) in Java to bind a for use in T.

96 COMM UNICATIO NS O F THE AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 The workhorse data structure of logs is an algebraic browser GUIs with JavaScript, mistakes in one code module
datatype log. Algebraic datatypes are the classic tool for may wreck subtrees that other modules believe they control.
structured data in statically typed functional programming, For instance, subtrees are often looked up by string ID, cre-
and they behave similarly to tagged unions in some other lan- ating the possibility for two different libraries to choose the
guages (or Scala’s case classes). The definition of log gives same ID unwittingly for different subtrees. With the Ur/Web
an exhaustive list of the constructors for logs (Nil and Cons) model, the author of module Log may think of it as owning
with the types of arguments that they take, and later we use particular subtrees of the HTML document as private state.
case expressions to deconstruct such values, giving differ- Standard module encapsulation protects the underlying
ent code to evaluate depending on which constructor built data sources from direct modification by other modules,
a value. Our definition of log looks almost like a standard and rendered logs only have dataflow dependencies on the
definition of lists of strings. The difference is that the tail of values of those sources.
a nonempty log has type source log, rather than just log. Remote procedure calls. The GUI widget for displaying
We effectively have a type of lists that supports imperative the chat log is only one half of the story if we are to write an
replacement of list tails, but not replacement of heads. application that runs within a single page. We also need a
The type t of logs is a record of two fields. Field Head is a way for this application to contact the server, to trigger
modifiable reference to the current log state, and Tail is a state modifications and receive updated information. Ur/
“pointer to a pointer,” telling us which source cell we should Web’s first solution to that problem is remote procedure calls
overwrite next to append to the list. Methods create and (RPCs), allowing client code to run particular function calls
append involve a bit of intricacy to update these fields prop- as if they were executing on the server, with access to shared
erly, but we will not dwell on the details. We only mention database state. Client code only needs to wrap such calls to
that the point of this complexity is to avoid rerendering the remotely callable functions within the rpc keyword, and
whole log each time an entry is appended; instead, only the Ur/Web implementation takes care of all network com-
a constant amount of work is done per append, to modify munication and marshalling. Every RPC appears to execute
the document tree at the end of the log. That sort of pat- atomically, just as for other kinds of remote calls.
tern is difficult to implement with pure functional-reactive Figure 4 reimplements the Room module to take advantage
programming. of RPCs and the Log widget.
The most interesting method definition is for render.
List.foldl  As in ML, step through a list, applying a function
Our prior examples only showed building HTML fragments
f to each element, so that, given an initial accumulator
with no dependencies on data sources. We create dependen-
a and a list [x1, . . . , xn], the result is f (xn, . . . , f (x1, a) . . .).
cies via a pseudotag called <dyn>. The signal attribute
of this tag accepts a signal, a time-varying value telling us List.app  Apply an effectful function to every element of a
what content should be displayed at this point on the page list, in order.
at different times. Crucially, the signal monad rules out The code actually contains few new complexities. Our basic
imperative side effects, instead capturing pure dataflow pro- strategy is for each client to maintain the timestamp of the
gramming. Since it is a monad, we have access to the usual most recent chat message it has received. The textbox for
monad operations <- and return, in addition to the signal user input is associated with a freshly allocated source
function for lifting sources into signals. string, via the <ctextbox> pseudotag (“c” is for “client-
Let us first examine the definition of render_aux, a side scripting”). Whenever the user modifies the text shown
recursive helper function for render. The type of render_ in this box, the associated source is automatically mutated
aux is log -> xbody, displaying a log as HTML. Empty logs to contain the latest text. When the user clicks a button to
are displayed as empty HTML fragments, and nonempty logs send a message, we run the callback code in the button’s
are rendered with their textual heads followed by recursive onclick attribute, on the client, whereas the code for this
renderings of their tails. (Following functional-programming example outside of on* attributes runs on the server. This
tradition, we write “head” and “tail” respectively for the first code makes an RPC, telling the server both the new message
element of a list and the remainder of the list minus that text and the last timestamp that the client knows about.
element.) However, the recursive call to render_aux is not The server sends back a list of all chat messages newer than
direct. Instead it appears inside a <dyn> pseudotag. We indi- that timestamp, and client code iterates over that list, add-
cate that this subpage depends on the current value of the tail ing each message to the log; and then updates the last-seen
(a data source), giving the computation to translate from the timestamp accordingly, taking advantage of the fact that the
tail’s value to HTML. Now it is easy to define render, mostly RPC result list will never be empty, as it always contains at
just duplicating the last part of render_aux. least the message that this client just sent. An onload event
An important property of this module definition is that handler in the body tag initialized the log in the first place,
a rendered log automatically updates in the browser after appending each entry returned by an initial database query.
every call to append, even though we have not coded any Note how seamless the use of the Log module is. We allo-
explicit coupling between these methods. The Ur/Web run- cate a new log, drop its rendering into the right part of the
time system takes care of the details, once we express GUIs page, and periodically append to it. Pure functional-reactive
via parameterized dataflow. programming would require some acrobatics to interleave
Client code may use logs without knowing implemen- the event streams generated as input to the log system, from
tation details. In the standard model for programming the two syntactically distinct calls to Log.append.

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 97
research highlights

Figure 4. A client-code-heavy chat-room application.

asynchronously receive messages from channels for which
they have handles, conceptually dequeuing from local queues,
structure Room : sig
type id blocking when queues are empty. Any remote call may trig-
val rooms : transaction (list {Id : id, ger any number of sends to any number of channels. All sends
Title : string})
val chat : id −> transaction page
in a single remote call appear to take place atomically.
end = struct The API for channels is straightforward:
table room : { Id : int, Title : string }
table message : { Room : int, When : time, channel  :  ∀α. transaction (channel α)
Text : string }
val rooms = queryL1 (SELECT * FROM room recv : ∀α. channel α → transaction α
ORDER BY room.Title) send  :  ∀α. channel α → α → transaction {}
(* New code w.r.t. Figure 2 starts here. *) Figure 5 gives another reimplementation of Room, this
fun chat id = time using channels to keep clients synchronized at all times,
let modulo small amounts of lag. We retain the same room
fun say text lastSeen =
dml (INSERT INTO message (Room, When, Text) and message tables as before, but we also add a new table
VALUES ({[id]}, CURRENT_TIMESTAMP, {[text]})); subscriber, tracking which clients are listening for notifi-
queryL1 (SELECT message.Text, message.When
FROM message
cations about which rooms. (Thanks to Ur/Web’s approach
WHERE message.Room = {[id]} to encapsulation of database tables, we need not change any
AND message.When > {[lastSeen]} other source or configuration files just because we add a new
ORDER BY message.When DESC)
private table.) Every row of subscriber has a room ID Room
val maxTimestamp = and a channel Chan that is able to receive strings.
List.foldl (fn r acc => max r.When acc) minTime
in Now the chat method begins by allocating a fresh chan-
title <− oneRowE1 (SELECT (room.Title) FROM room nel with the channel operation, which we immediately insert
WHERE room.Id = {[id]});
initial <− queryL1 (SELECT message.Text, into subscriber. Compared to Figure 4, we drop the client-
message.When side timestamp tracking. Instead, the server will use chan-
FROM message
WHERE message.Room = {[id]} nels to notify all clients in a room, each time a new message is
ORDER BY message.When DESC); posted there. In particular, see the tweaked definition of say.
text <− source "";
log <− Log.create; queryI1  Run an SQL query returning columns from just
lastSeen <− source (maxTimestamp initial);
a single table ( justifying the 1), applying a function
return <xml><body onload={ to each result in order, solely for its imperative side
List.app (fn r => Log.append log r.Text) initial}> effects ( justifying the I).
<h1>Chat Room: {[title]}</h1>

Add message: <ctextbox source={text}/> We loop over all channels associated with the current room,
<button value="Add" onclick={fn _ => sending the new message to each one.
txt <− get text;
set text ""; There is one last change from Figure 4. The onload attri-
lastSn <− get lastSeen; bute of our <body> tag still contains code to run immediately
newMsgs <− rpc (say txt lastSn);
set lastSeen (maxTimestamp newMsgs); after the page is loaded. This time, before we initialize the Log
List.app (fn r => Log.append log r.Text) structure, we also create a new thread with the spawn primi-
newMsgs}/> tive. That thread loops forever, blocking to receive messages
<hr/>
{Log.render log} from the freshly created channel and add them to the log.
</body> </xml> Threads follow a simple cooperative semantics, where
end
end the programming model says that, at any moment in time,
at most one thread is running across all clients of the appli-
cation. Execution only switches to another thread when the
2.3. Message passing from server to client current one terminates or executes a blocking operation,
Web browsers make it natural for clients to contact servers via among which we have RPCs and channel recv. Of course,
HTTP requests, but the other communication direction may the Ur/Web implementation will run many threads at once,
also be useful. One example is our chat application, where only with an arbitrary number on the server and one JavaScript
the server knows when a client has posted a new message, and thread per client, but the implementation ensures that no
we would like the server to notify all other clients in the same behaviors occur that could not also be simulated with the
chat room. Ur/Web presents an abstraction where servers are simpler one-thread-at-a-time model.
able to send typed messages directly to clients, and the Ur/Web This simple approach has pleasant consequences for pro-
compiler and runtime system implement this abstraction gram modularity. The example of Figure 5 only shows a single
once and for all on top of standard protocols and APIs. program module taking advantage of channels. It is possible
The messaging abstraction is influenced by concurrent for channels to be used freely throughout a program, and the
programming languages like Erlang1 and Concurrent ML.15 Ur/Web implementation takes care of routing messages to
Communication happens over unidirectional channels. clients, while maintaining the simple thread semantics.
Every channel has an associated client and a type. The server Figure 5 contains no explicit deallocation of clients that
may send any value of that type to the channel, which con- have stopped participating. The Ur/Web implementation
ceptually adds the message to a queue on the client. Clients detects client departure using a heartbeating mechanism.

98 COM MUNICATIO NS O F TH E ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

Figure 5. Final chat-room application.
A variety of research programming languages and librar-
ies were under development in the early 2000s, in that
structure Room : sig
type id interesting transitional period where the Web had become
val rooms : transaction (list {Id : id, mainstream but the highly interactive “AJAX” style of Gmail
Title : string})
val chat : id −> transaction page and so on had not yet become common. The PLT Scheme
end = struct Web Server10 provides completely first-class support for
table room : { Id : int, Title : string }
table message : { Room : int, When : time,
URLs as first-class functions (more specifically, continua-
Text : string } tions), making it very easy to construct many useful abstrac-
val rooms = queryL1 (SELECT * FROM room tions. The Links8 language pioneered strong static checking
ORDER BY room.Title)
of multiple-tier Web applications, where the code for all tiers
(* New code w.r.t. Figure 2 starts here. *) is collected in a single language. Hop16 is another unified
table subscriber : { Room : int, Web programming language, but is dynamically typed and
Chan : channel string } based on Scheme. Ocsigen2, 3 is an OCaml-based platform
fun chat id = for building dynamic Web sites in a unified language, with
let static typing that rules out many potential programming
fun say text =
dml (INSERT INTO message (Room, When, Text) mistakes. The Opa languagec is another statically typed uni-
VALUES ({[id]}, CURRENT_TIMESTAMP, {[text]})); fied language for database-backed Web applications.
queryI1 (SELECT subscriber.Chan FROM subscriber
WHERE subscriber.Room = {[id]})
In broad strokes, how does Ur/Web compare to these oth-
(fn r => send r.Chan text) ers from the languages research community? We believe the
in key comparison points relate to those features of Ur/Web
chan <− channel;
dml (INSERT INTO subscriber (Room, Chan) that we have stressed throughout this article: encapsulation
VALUES ({[id]}, {[chan]})); and concurrency. No other languages allow enforced encap-
title <− oneRowE1 (SELECT (room.Title) FROM room sulation of database state inside of modules, and the lan-
WHERE room.Id = {[id]}); guages listed above all support client-side GUIs only through
initial <− queryL1 (SELECT message.Text,
message.When mutation of a global document tree, with no enforced encap-
FROM message sulation of client-side state pieces. Their semantics for con-
WHERE message.Room = {[id]}
ORDER BY message.When DESC); currency are substantially more complicated than Ur/Web’s
transactions.
text <− source "";
log <− Log.create;
Several other languages and frameworks support
­functional-reactive programming for client-side Web GUIs,
return <xml> <body onload={ including Flapjax,13 which is available in one flavor as a
let
fun listener () = JavaScript library; and Elm,9 a new programming language.
text <− recv chan; These libraries implement the original, “pure” version of func-
Log.append log text;
listener () tional-reactive programming, where key parts of programs
in are written as pure functions that transform input streams
spawn (listener ());
List.app (fn r => Log.append log r.Text) initial into streams of visible GUI content. Such a style is elegant in
end}> many cases, but it does not seem compatible with the modular-
<h1>Chat Room: {[title]}</h1>
ity patterns we demonstrated in Section 2.2, where it is natu-
Add message: <ctextbox source={text}/> ral to spread input sources to a single stream across different
<button value="Add" onclick={fn _ => parts of a program. Ur/Web supports that kind of modularity
txt <− get text;
set text ""; by adopting a hybrid model, with imperative event callbacks
rpc (say txt)}/> that trigger recomputation of pure code.
<hr/> As far as we are aware, Ur/Web was the first Web program-
ming tool to support impure functional-reactive program-
{Log.render log}
</body> </xml> ming, but the idea of reactive GUI programming in JavaScript
end is now mainstream, and too many frameworks exist to detail
end
here.
One popular JavaScript framework is Meteor,d distin­
guished by its support for a particular reactive programming
When a client departs, the runtime system atomically deletes style. It integrates well with mainstream Web development
from the database all references to that client’s channels, provid- tools and libraries, which is a nontrivial advantage for
ing a kind of modularity similar to what garbage collection most programmers. Its standard database support is
provides for heap-allocated objects. for MongoDB, with no transactional abstraction or other
way of taming simultaneous complex state updates. Like
3. RELATED WORK Opa, Meteor allows modules to encapsulate named data-
The space of Web-development tools is a busy one, both in base elements, but an exception is thrown if two modules
the research world and in the mainstream, so we will not
have space to take a nearly complete tour of it; we provide a  http://opalang.org/.
c

longer comparison elsewhere.7  http://www.meteor.com/.

d

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T HE ACM 99
research highlights

have chosen the same string name for their elements; mod- Acknowledgments
ule authors must coordinate on how to divide a global This work has been supported in part by National Science
namespace. Meteor supports automatic publishing of server-­ Foundation grant CCF-1217501. The author thanks Christian
side database changes into client-side caches, and then from J. Bell, Benjamin Delaware, Xavier Leroy, Clément Pit–
those caches into rendered pages. In addition to automatic Claudel, Benjamin Sherman, and Peng Wang for their feed-
updating of pages based on state changes, Meteor provides back on drafts.
a standard DOM-based API for walking document struc-
ture and making changes imperatively, though it is not very References
1. Armstrong, J. Erlang – A survey of the ACM SIGPLAN Conference
idiomatic. Meteor’s machinery for reactive page updating language and its industrial applications. on Programming Language Design
involves a more complex API than Ur/Web’s. Its central con- In Proceedings of the Symposium and Implementation, PLDI ’13
on Industrial Applications of Prolog (New York, NY, USA, 2013).
cept is of imperative functions that need to be rerun when (INAP96) (1996), 16–18. ACM, 411–422.
any of their dependencies change, whereas Ur/Web describes 2. Balat, V. Ocsigen: Typing Web 10. Krishnamurthi, S., Hopkins, P.W.,
interaction with Objective Caml. McCarthy, J., Graunke, P.T., Pettyjohn, G.,
reactive computations in terms of pure code within the sig- In Proceedings of the 2006 Workshop Felleisen, M. Implementation and
on ML, ML ’06 (New York, NY, USA, use of the PLT Scheme Web Server.
nal monad, such that it is easy to rerun only part of a com- 2006). ACM, 84–94. Higher Order Symbol. Comput. 20, 4
putation, when not all of its dependencies have changed. 3. Balat, V., Vouillon, J., Yakobowski, (2007), 431–460.
B. Experience report: Ocsigen, a 11. MacQueen, D. Modules for standard
Forcing purity on these computations helps avoid the con- Web programming framework. ML. In Proceedings of the 1984 ACM
fusing consequences of genuine side effects being repeated In Proceedings of the 14th ACM Symposium on LISP and Functional
SIGPLAN International Conference Programming, LFP ’84 (New York, NY,
on each change to dependencies. The five lines of code near on Functional Programming, ICFP ’09 USA, 1984). ACM, 198–207.
the start of Section 2.2, together with the <dyn> pseudotag, (New York, NY, USA, 2009). ACM, 12. Meijer, E., Beckman, B., Bierman, G.
311–316. LINQ: Reconciling objects, relations
give the complete interface for reactive programming in 4. Cheney, J., Lindley, S., Wadler, P. A and XML in the .NET framework.
Ur/Web, in contrast with tens of pages of documentation practical theory of language-integrated In Proceedings of the 2006 ACM
query. In Proceedings of the 18th ACM SIGMOD International Conference on
(of dynamically typed functions) for Meteor. SIGPLAN International Conference on Management of Data, SIGMOD ’06
Other popular JavaScript frameworks include Angular.js,e Functional Programming, ICFP ’13 (New York, NY, USA, 2006). ACM,
(New York, NY, USA, 2013). ACM, 706–706.
Backbone,f Ractive,g and React.h A commonality among these 403–416. 13. Meyerovich, L.A., Guha, A., Baskin, J.,
libraries seems to be heavyweight approaches to the basic 5. Chlipala, A. Ur: Statically-typed Cooper, G.H., Greenberg, M.,
metaprogramming with type-level Bromfield, A., Krishnamurthi, S.
structure of reactive GUIs, with built-in mandatory concepts record computation. In Proceedings Flapjax: A programming language for
of models, views, controllers, templates, components, etc. of the 31st ACM SIGPLAN Conference Ajax applications. In Proceedings of
on Programming Language Design the 24th ACM SIGPLAN Conference
In contrast, Ur/Web has its 5-line API of sources and signals. and Implementation, PLDI ’10 on Object Oriented Programming
(New York, NY, USA, 2010). ACM, Systems Languages and Applications,
These mainstream JavaScript frameworks tend to force ele- 122–133. OOPSLA ’09 (New York, NY, USA,
ments of reactive state to be enumerated explicitly as fields of 6. Chlipala, A. An optimizing compiler 2009). ACM, 1–20.
for a purely functional web-application 14. Peyton Jones, S.L., Wadler, P.
some distinguished object, instead of allowing data sources language. In Proceedings of the Imperative functional
to be allocated dynamically throughout the modules of a pro- 20th ACM SIGPLAN International programming. In Proceedings of
Conference on Functional the 20th ACM SIGPLAN-SIGACT
gram and kept as private state of those modules. Programming, ICFP 2015 (New York, Symposium on Principles of
NY, USA, 2015). ACM, 10–21. Programming Languages, POPL ’93
7. Chlipala, A. Ur/Web: A simple (New York, NY, USA, 1993). ACM,
4. CONCLUSION model for programming the Web. 71–84.
We have presented the design of Ur/Web, a programming In Proceedings of the 42nd Annual 15. Reppy, J.H. Concurrent Programming
ACM SIGPLAN-SIGACT Symposium in ML. Cambridge University Press,
language for Web applications, focusing on a few language- on Principles of Programming New York, NY, USA, 1999.
design ideas that apply broadly to a class of distributed Languages, POPL ’15 (New York, NY, 16. Serrano, M., Gallesio, E., Loitsch, F.
USA, 2015). ACM, 153–165. Hop, a language for programming the
applications. Our main mission is to promote two desiderata 8. Cooper, E., Lindley, S., Wadler, P., Web 2.0. In Proceedings of the First
that programmers should be asking for in their Web frame- Yallop, J. Links: Web programming Dynamic Languages Symposium, DLS
without tiers. In Proceedings of the ’06 (New York, NY, USA, 2006). ACM.
works, but which seem almost absent from mainstream 5th International Conference on 17. Wadler, P., Blott, S. How to make
discussion: stronger and domain-specific modes of encapsu- Formal Methods for Components and ad-hoc polymorphism less ad hoc.
Objects, FMCO’06 (Berlin, Heidelberg, In Proceedings of the 16th ACM
lation and simple concurrency models based on transactions. 2007). Springer-Verlag, 266–296. SIGPLAN-SIGACT Symposium
9. Czaplicki, E., Chong, S. Asynchronous on Principles of Programming
Ur/Web is used in production today for a number of appli- functional reactive programming for Languages, POPL ’89 (New York,
cations, including at least onei with thousands of paying GUIs. In Proceedings of the 34th NY, USA, 1989). ACM, 60–76.
customers. We list more examples elsewhere.7 We have also
Adam Chlipala ([email protected]),
written elsewhere about Ur/Web’s whole-program optimizing MIT CSAIL, Cambridge, MA.
compiler,6 which has placed favorably in a third-party Web-
framework benchmarking initiative,j for instance achieving
Copyright held by author.
the second-best throughput (out of about 150 participating Publication rights licensed to ACM. $15.00
frameworks) of about 300,000 requests per second on the test
closest to a full Web app.

e
 https://angularjs.org/.
f
 http://backbonejs.org/.
g
 http://www.ractivejs.org/.
h
 http://facebook.github.io/react/.
Watch the author discuss his work
i
 http://www.bazqux.com/. in this exclusive Communications video.
j
 http://www.techempower.com/benchmarks/. http://cacm.acm.org/videos/ur-web

100 CO MM UNICATIO NS O F T H E ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 CAREERS
Lecturer or Senior Lecturer
Electrical and Computer Engineering
The Department of Electrical and Computer Engineering
(http://www.ece.iastate.edu/) at Iowa State University invites
applications for the position of Lecturer or Senior Lecturer at
part or full–time. Lecturers serve the department’s education
mission through instruction, laboratory development, and
curriculum innovation. This position is available in the area of
software engineering.
Successful candidates will have experience that demonstrates
ability, potential, and commitment to undergraduate education.
Swarthmore College
All faculty members are expected to interact collegially and Computer/Electrical Engineering Faculty (All Ranks)
maintain the highest standards of integrity and ethical behavior. The
Department of Electrical and Computer Engineering (College of Swarthmore College invites applications for a tenure-track or tenured po-
Engineering) and the Department of Computer Science (College of sition at any rank in the area of Computer/Electrical Engineering, to start
Liberal Arts and Sciences) jointly administer the Software during the Fall semester of 2017. A doctorate in Computer or Electrical En-
Engineering Program with a Director overseeing the program. gineering or a related field is required. The appointee will pursue a research
All interested, qualified persons are encouraged to apply program that encourages involvement by undergraduate students. Strong
early and must apply for this position by visiting interests in undergraduate teaching, supervising senior design projects,
http://www.iastatejobs.com:80/postings/19005 and complete the and student mentoring are also required. Teaching responsibilities include
Employment Application for vacancy #600084. Please be prepared courses in computer hardware such as computer architecture and digital
to enter or attach the following: Resume/Curriculum Vitae, letter logic, and electives in the appointee’s area of specialization. For the full de-
of application/cover letter, contact information for three references. tails on the position and application instructions, visit https://academicjob-
If you have questions regarding this application process, sonline.org/ajo/jobs/7247.
please email [email protected] or call 515-294-4800 or Swarthmore College has a strong institutional commitment to excel-
Toll Free: 1-877-477-7485. lence through diversity in its educational program and employment prac-
tices and actively seeks and welcomes applications from candidates with
Iowa State University is an Equal Opportunity/Affirmative Action Employer. exceptional qualifications, particularly those with demonstrable commit-
ments to a more inclusive society and world.

A personal walk down the

computer industry road.
BY AN EYEWITNESS.
Smarter Than Their Machines: Oral Histories
of the Pioneers of Interactive Computing is
based on oral histories archived at the Charles
Babbage Institute, University of Minnesota.
These oral histories contain important messages
for our leaders of today, at all levels, including
that government, industry, and academia can
accomplish great things when working together in
an effective way.

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T H E ACM 101

CAREERS

Dean: College of Computing Sciences

New Jersey Institute of Technology (NJIT) seeks applications and
nominations from the academic and corporate sectors for the position
of Dean of the Ying Wu College of Computing Sciences (CCS).
The College, established in 2001, is comprised of the Department of
Computer Science, the Department of Information Systems, and the
Information Technology Program. The College enrolls approximately
2385 students, including 1390 undergraduates, 925 master students,
and 70 doctoral students; these students, representing about 21 percent
of NJIT’s student body, are taught by 34 tenured and tenure-track
faculty and 20 full-time, non-tenure track faculty. Undergraduate degree
programs in Computer Science, Information Systems, and Information
Technology are ABET accredited. CCS’s current research strengths
include, but are not limited to, Cyber Security and Networking, Data
Analytics, Cyber-Human Systems, and Game Design. Based on the 2015
Shanghai Rankings, TheBestSchools.org released its top 100 Computer
Science programs in the world, with NJIT’s program ranked 47 in the
United States and 100 globally. The Princeton Review chose NJIT as one
of the top 50 undergraduate schools for Game Design in 2016.
Responsibilities: The Dean serves as the chief executive officer of the
College with primary responsibility for enhancing its national leadership
in computing research and education. The Dean is a senior academic
officer who reports to the Provost and works closely with the President,
the deans of the other five colleges and senior officers to advance the
university’s mission. Specific responsibilities include strategic planning,
corporate outreach, fundraising leadership to attract resources
necessary to sustain and enhance the College, program evaluation and
development, and recruitment of new faculty. The Dean manages the
college’s finances and budget and leads CCS’s marketing and visibility
initiatives. The Dean is also expected to foster interdisciplinary education
and research programs as a priority of the University’s 2020 Vision
Strategic Plan.
Qualifications: Candidates must possess an earned doctorate and a
distinguished record of teaching, research, publication, funding, and
service that merits appointment as a full professor with tenure in CCS.
We seek an individual who can span disciplinary boundaries to build
alliances and partnerships for CCS not only with other colleges, but
also with private sector organizations and government agencies. The
successful candidate will be a dynamic leader with a demonstrated
ability to promote successful research, service, teaching and learning
outcomes and offer innovative solutions to the challenges facing higher
education today and into the future.
Application: To apply, please visit https://njit.jobs and search for posting
# 603260.
Deadline for applications to be submitted in order to guarantee search
committee’s full consideration is August 20, 2016. Please address any
questions regarding this search to [email protected] or [email protected].
To build a diverse workforce, NJIT encourages applications from individuals with disabilities, minorities,
veterans and women. EEO employer.

NEW JERSEY INSTITUTE OF TECHNOLOGY • UNIVERSITY HEIGHTS, NEWARK, NJ 07102-1982

102 COMM UNICATIO NS O F T H E ACM | AU GU ST 201 6 | VO L . 5 9 | NO. 8

 last byte

[ C ONTI N U E D FRO M P. 104] fingers, shelter, oblivious to his own carelessness ventions keeps quiet about it. And why ev-
but it’s just the frame and the forks and ... but the offense is trivial compared to the ery tax inspector who goes in finds the ac-
the mudguards. The saddles look weird tax evasion, and I doubt he knows anything counts add up. Or if they don’t, they like
before they’re fully grown, on the trunks about how the company pulls it off. the people here too much to tell on them.
like cankers, but that’s all they are. Just as I won’t.
Growths, like the seats we’re sitting on. Anyway, Jess. Oh, hi. Just telling him The funny thing is, I should be feeling
Don’t get up. It’ll only go out of shape. about you, but I’m sure you can ... ah, outraged, but I’m not. I’m laughing at the
There’s a skill to the job, you know. be off with you! ingenuity and effrontery of it all. I look at
Say you see a growth that’s going wild, That woman will be the death of the guy, grinning stupidly. There’s some-
or a stray sapling from another plan- me some day. Likes her fun. Loves her thing I want to tell him. It’s just on the tip
tation, and you have to prune it before work. But you should have seen her of my tongue. But I can’t.
it spreads. OK, I’ll put the knife away. I when she came here two years ago.
don’t want you to feel uncomfortable. Health and Safety inspector. Hard And our bar seats have the same
Settle in. Take it easy. hat and high heels and a clipboard. effect on anyone who sits on them—
I know, I know. The lab boys—and Wouldn’t touch the beer, insisted on good feelings.
girls of course—will tell you it’s all fruit juice. None of ours, either. She Gut feelings, you might say. Because
predictable, like a chemical factory. took a bottle from her own handbag that’s where they come from—your in-
But biology’s not like that, even when and sipped from it. testinal flora tweaked by the spores to
it’s synthetic. I’m not mystical about Sit yourself down, I said, and got a pump out mood-modifying molecules
it. It’s just mutation and natural selec- beer for myself and started talking to to your bloodstream.
tion. We have a joke—that we’re for her, just like I’m talking to you. After a Doesn’t mean they’re not real feelings.
intelligent design, and against evo- while she began to come round to my You’ll like it here.
lution. Intelligent design is what the way of seeing things, just like you are.
company does, and evolution is what And I did, for several days. The feel-
it pays us to prevent. So that’s what became of the young ings were real all right. I loved the place.
But you can’t. Not completely. lady from Environment ... I find my- I looked around and considered what
Time for another. No, not at all, my self enjoying the sound of the forester’s job to apply for, and kept phoning in
treat. You’re our guest here. And have a voice, and somehow that lazy enjoy- glowing reports to the office. Meanwhile,
shot of spirit on the side; yes, we do our ment is more important than the dis- the polycarbonate strands under my
own distilling. Careful though, you’re covery. Must be the vague benign glow skin kept reporting back what was really
probably not used to it. from the drink. The drink! Have I been going on. Then, the next morning, I woke
Just a sip, that’s it. Oh! There’s a slipped something? to the sound of helicopters.
napkin. A gulp of beer afterward, that’s The Revenue knew what the wire had
the trick. Gesundheit! Here, have anoth- Nah, don’t look at your pint like reported, but back at the office they got
er napkin. that, or even your shot. It’s good beer nothing out of me. Geraldine was very
Where were we? Oh yes. This tax and good grain spirit with a touch of understanding, and put me on sick leave
business you’re on about. Well, the flavoring, that’s all. It’s not what’s until the artificial loyalty wore off.
company takes care of all that. We get bringing you round. And it’s not what’s Now it has, I can tell the story. But
our bank statements on our phones. been making you sneeze. one question still bothers me: What
Take a look. Yes, the balance does It’s the spores. stopped me, for those days of synthetic
mount up. Not much we need to Told you, the seat’s made from the love for the company, from telling them
spend money on here. Every so often same stuff as the bike saddles. Just an- about the wire?
some government department sends other mutant growth. But it’s not just Only now, when the wire has disin-
in someone young and keen like your- the shape that’s mutated. tegrated, do I realize one obvious an-
self who thinks they can make a big The spores waft out whenever you swer—the wire itself. The Revenue has
deal of some little thing and make a shift your weight. You can’t help but its own biochemical tricks to ensure loy-
name for themselves. But they soon inhale them. The people who designed alty and secrecy. And it isn’t telling any-
come round, every one of them. the bikes wanted people to feel confi- one about them.
Take Jess over there. Lovely girl. dent riding them, so they did a bit of When I ask Geraldine if I’m right, she
No, she’s not smoking. Good grief, tinkering with the spores. Put a bit looks vague.
do you think we’re crazy? It’s some of genetic code in to work on the old ‘It’s just on the tip of my tongue,’ she
kind of steam, you just roll up the nervous system. Give feelings of confi- says. ‘It’ll come back to me.’
leaf real tight like, and it heats up in dence and rightness and wellbeing.
the center. Some experimental thing Ken MacLeod ([email protected]) is the
author of 15 novels, from The Star Fraction (Orbit Books,
that blew in, no doubt. Like I was say- So that’s why LifeCycles bikes sell so London, 1995) to The Corporation Wars: Dissidence (Orbit
ing, evolution. well, why their customers are so loyal. Books, London, 2016). He blogs at The Early Days of a
Better Nation (http://kenmacleod.blogspot.com) and
And their employees, too ... and why ev- tweets as @amendlocke.
Got him right there, admitting a breach of eryone who finds out about this massive,
the GM regulations. My cheerful host waves brazen violation of the GM regulations
a hand around the crowded recreation and all the relevant international con- © 2016 ACM 0001-0782/16/08 $15.00

AU G U ST 2 0 1 6 | VO L. 59 | N O. 8 | C OM M U N IC AT ION S OF T H E ACM 103

last byte

From the intersection of computational science and technological speculation,

with boundaries limited only by our ability to imagine what could be.

DOI:10.1145/2962577 Ken MacLeod

Future Tense
Gut Feelings
Even a little genetic engineering can
render us too comfortable for our own good.

I ’ M A T A X I N S P E C T O R . I don’t expect to
be liked.
‘They’re up to something in there,’
said Geraldine Myles, her finger-tap cast-
ing a black shadow on the map projec-
tion. ‘I can feel it.’
‘We can all feel it, chief,’ I said. ‘It’s
getting the evidence that’s the problem.’
The LifeCycles forest covered most of
Fife. Its export record didn’t square with
its revenue. The product’s popularity was
as inarguable as it was unaccountable.
Every inspector we’d sent in had returned
glowing reports. The young lady from
Environment was so impressed she’d
chucked in her job and joined it. Drones?
The forest found a way to swat them. The
tiny wreckage was always returned, with
a bland apology and a note on commer-
cial secrecy.
‘Evidence? That’s where you come in.’
Myles shot me an evil smile. ‘Or rather,
that’s where you’re going in.’

Talk in private? Sure, happy to do that. is conventional polished hardwood, but Sit yourself down and let me get you a
We’ve got nothing to hide. Everything’s seamless in a way that makes me sus- pint. No, no … it’s nothing, it’s a local
open and above board, even if it’s a bit pect it’s GM, too. A couple dozen people brew, you can see the kegs right there.
dark and gloomy looking. But what’s are here, at the end of the working day. Yes, it’s all covered in the forest bylaws;
private these days? The trees don’t talk, Folks come and go through gaps in the you can look it up.
but the walls listen; that’s what we say hedge. Talk is careless when loud. I Cheers! Good stuff, eh?
around here. can’t hear what it’s like when it’s quiet. You were saying? Oh yes! The trees.
But the wire can. Well, I can see how you might get that
IMAGE BY AND RIJ BORYS ASSOCIAT ES/SHUT TERSTOCK

Walls? I’m confused for a moment, until It’s not the walls he should be worry- impression. A lot of folks do, the first
I realize this friendly foreman is refer- ing about. time. Oppressive and sinister, they
ring to the densely interwoven geneti- We call the transmitter injected across tell me. It’s dark beneath the trees—
cally modified hedge that surrounds my collarbones ‘the wire,’ but that’s just but the leaves are designed to catch as
and covers this place deep in the for- a skeuomorph. It’s a new device. It’ll be much sunlight as possible.
est. It’s one of the LifeCycles recreation about a fortnight before it disintegrates. And the branches … nothing but bi-
spots, modeled on an old-fashioned Subcutaneous, organic, undetectable ... cycle frames, thousands of them. It looks
pub. The lighting is bioluminescent and now, with a carefully casual shrug of sinister only when you let daft ideas into
tubes. The floor is like pine needles, the my shoulders … your head, about a crooked arm, maybe,
furnishings cork. The bar at the center On. with clawed [C O NTINUED O N P. 103]

104 COMM UNICATIO NS O F T H E AC M | AU GU ST 201 6 | VO L . 5 9 | NO. 8