liskov ACM interview

WEBVTT
Kind: captions
Language: en

00:00:05.509 --> 00:00:10.340
Hello, I’m Tom Van Vleck, and I have the
honor today to interview Professor Barbara

00:00:10.340 --> 00:00:20.670
Liskov, the 2008 ACM Turing Award winner.
Today is April 20th, 2016.

00:00:20.670 --> 00:00:29.880
To start with, why don’t you tell us a little
bit about your upbringing, where you lived,

00:00:29.880 --> 00:00:34.660
and how you got into the business?

00:00:34.660 --> 00:00:45.729
I grew up in San Francisco. I was actually
born in Los Angeles, so I’m a native Californian.

00:00:45.729 --> 00:00:54.920
When I was growing up, it was definitely not
considered the thing to do for a young girl

00:00:54.920 --> 00:01:01.679
to be interested in math and science. In fact,
in those days, the message that you got was

00:01:01.679 --> 00:01:10.790
that you were supposed to get married and
have children and not have a job. Nevertheless,

00:01:10.790 --> 00:01:15.690
I was always encouraged by my parents to take
academics seriously. My mother was a college

00:01:15.690 --> 00:01:20.900
grad as well as my father, so it was expected
that I would go to college, which in those

00:01:20.900 --> 00:01:25.920
times was not that common. Maybe 20% of the
high school class would go on to college and

00:01:25.920 --> 00:01:37.170
the rest would not. I was always very interested
in math and science, so I took all the courses

00:01:37.170 --> 00:01:42.500
that were offered at my high school, which
wasn’t a tremendous number compared to what

00:01:42.500 --> 00:01:48.390
is available today. The most advanced course
that was offered was a pre-calculus course,

00:01:48.390 --> 00:01:52.250
which I took in my senior year.

00:01:52.250 --> 00:01:57.000
There weren’t many girls in these classes.
I don’t really remember how many there were.

00:01:57.000 --> 00:02:07.370
I might have been the only one. But that didn’t
seem to matter much. But I did feel from the

00:02:07.370 --> 00:02:16.360
students around me that this was not something
I should be doing, so I kept a low profile.

00:02:16.360 --> 00:02:21.389
I think that I was probably encouraged by
the math teacher that I had in my senior year,

00:02:21.389 --> 00:02:25.400
though I don’t remember anything specific.
But I certainly don’t remember picking up

00:02:25.400 --> 00:02:30.580
anything negative.

00:02:30.580 --> 00:02:36.569
I definitely was encouraged by my parents
to do well in academics, although not anything

00:02:36.569 --> 00:02:41.779
specifically having to do with math and science.
On the other hand, there were also no negative

00:02:41.779 --> 00:02:50.939
signs. I think that probably what was particularly
important was my father, who had very high

00:02:50.939 --> 00:02:59.310
academic aspirations, and my mother who did
never said anything negative about what I

00:02:59.310 --> 00:03:06.110
was doing. I think that sometimes mothers
can have a lot of impact on young girls, and

00:03:06.110 --> 00:03:10.480
if they show signs of disapproving of the
path you’re taking, that could be a big

00:03:10.480 --> 00:03:13.290
push in the opposite direction.

00:03:13.290 --> 00:03:18.510
My father insisted I take Latin because he
said it would serve me in good stead, which

00:03:18.510 --> 00:03:25.889
it has over the years, but he also insisted
that I take typing. The rationale there was

00:03:25.889 --> 00:03:31.909
that if, heaven help me, I ever had to support
myself because I didn’t get married or something

00:03:31.909 --> 00:03:38.540
happened to my husband, then I could get a
job as a secretary. A secretary or a teacher

00:03:38.540 --> 00:03:46.769
were sort of the acceptable professions for
a woman who had to work.

00:03:46.769 --> 00:03:54.160
In those days, if you went to high school
in California and you had I think a B+ average,

00:03:54.160 --> 00:04:00.209
then you were guaranteed a slot at the University
of California. The question was which of the

00:04:00.209 --> 00:04:06.400
campuses would you end up going to. The top
campus was UC Berkeley, and I had a very high

00:04:06.400 --> 00:04:14.879
average, so I got into UC Berkeley. I went
there for college. And I started off thinking

00:04:14.879 --> 00:04:20.669
I was going to major in physics. I think this
was the aspiration of many students because

00:04:20.669 --> 00:04:25.530
physics was considered to be the hardest major.
But I pretty quickly discovered that I didn’t

00:04:25.530 --> 00:04:29.760
have a lot of aptitude for physics and I liked
math a lot better, so I switched to a math

00:04:29.760 --> 00:04:38.200
major and a physics minor. I didn’t know
anything about computers. I don’t remember

00:04:38.200 --> 00:04:41.980
any computers as an undergraduate. They were
there. I mean I’ve talked to people after

00:04:41.980 --> 00:04:47.150
the fact and I know that some of the men who
were there at that time had discovered them.

00:04:47.150 --> 00:04:52.650
They were probably in the School of Engineering.
And Berkeley has a separate admissions process

00:04:52.650 --> 00:04:57.070
for that. I did not apply to engineering.
It never crossed my mind to do something like

00:04:57.070 --> 00:04:59.850
that.

00:04:59.850 --> 00:05:09.410
So I majored in math in the College of Letters
& Science. Again, looking back at these classes,

00:05:09.410 --> 00:05:17.150
if there was another woman in the class, that
would be it, and often I was the only one.

00:05:17.150 --> 00:05:25.200
And I would say that at Berkeley, I definitely
got push-back. You know, I was not the one

00:05:25.200 --> 00:05:31.160
called on in class, I was not the one that
was invited to do a research project with

00:05:31.160 --> 00:05:36.710
somebody. I was usually the top or one of
the top two in the class, but it didn’t

00:05:36.710 --> 00:05:44.970
really make any difference. On the other hand,
I never encountered anything overt. Or if

00:05:44.970 --> 00:05:52.180
I did, I didn’t notice it, because I have
a tendency to not pay too much attention to

00:05:52.180 --> 00:05:58.220
negative signals, which I think has stood
me in very good stead.

00:05:58.220 --> 00:06:04.040
So I majored in math, I minored in physics,
and when I finished at Berkeley, I thought

00:06:04.040 --> 00:06:12.050
about going to graduate school and I actually
applied to both UC Berkeley and to Princeton.

00:06:12.050 --> 00:06:16.561
I got into Berkeley. From Princeton I received
a postcard saying that they didn’t admit

00:06:16.561 --> 00:06:26.330
women to their graduate program. This is 1961,
so it was before the Ivy League men’s schools

00:06:26.330 --> 00:06:30.180
had meshed with the women’s schools, and
women were not allowed into these schools.

00:06:30.180 --> 00:06:37.300
But I was very surprised. I had no idea this
applied to the graduate school as well and

00:06:37.300 --> 00:06:38.820
the undergraduates

00:06:38.820 --> 00:06:44.970
But I decided that I wasn’t ready to go
on to graduate school because I didn’t feel

00:06:44.970 --> 00:06:55.460
like I was ready to work that intensely on
my studies. So I decided instead to take a

00:06:55.460 --> 00:07:01.020
break. And I wasn’t really thinking of it
as a break. I was just thinking I wasn’t

00:07:01.020 --> 00:07:04.150
ready to go to school. I wasn’t thinking,
“Well, in a couple of years, I’ll go to

00:07:04.150 --> 00:07:09.980
school.” I just thought this wasn’t what
I wanted to do right now.

00:07:09.980 --> 00:07:14.910
My father came from the Boston area. Actually
he grew up in Portland, Maine and then went

00:07:14.910 --> 00:07:19.280
to Harvard and his family moved to Boston,
so I had relatives in the Boston area and

00:07:19.280 --> 00:07:23.340
I thought it would be nice to go to Boston
for a while and see what it’s like. I had

00:07:23.340 --> 00:07:27.320
a friend from high school who’d gone to
Stanford who was interested in doing this

00:07:27.320 --> 00:07:35.090
too. She was a biology major. So we decided
to go to Boston together.

00:07:35.090 --> 00:07:42.410
We went to Boston in the summer of 1961. I
didn’t have a job lined up. I decided I

00:07:42.410 --> 00:07:46.590
would just go and then I would look around
to see what I could find. I got to Boston

00:07:46.590 --> 00:07:56.710
probably in August and sent out résumés
to various places. I wasn’t able to get

00:07:56.710 --> 00:08:03.830
an interesting job as a mathematician but
I was offered a job as a programmer at the

00:08:03.830 --> 00:08:13.460
Mitre Corporation, and so I took that. That
was my first intimation that there was such

00:08:13.460 --> 00:08:20.100
a thing as computers. And at that time, since
there were no computer science programs and

00:08:20.100 --> 00:08:26.520
nobody coming out of college who knew anything,
or they were very rare, they would take anybody

00:08:26.520 --> 00:08:30.330
they thought might have an aptitude for programming.

00:08:30.330 --> 00:08:39.930
I got a job at Mitre and on my first day at
work, they handed me a FORTRAN manual and

00:08:39.930 --> 00:08:43.419
they gave me a problem. They said, “Write
a program to do" something. I forget what

00:08:43.419 --> 00:08:55.060
the “something” was. I discovered that
I really enjoyed this. So I’m totally self-taught

00:08:55.060 --> 00:09:00.990
as far as programming is concerned. I had
to do this by myself. Nobody was training

00:09:00.990 --> 00:09:05.750
me. If I had a question, I could go ask somebody,
but basically I was doing it all on my own.

00:09:05.750 --> 00:09:13.900
I discovered I really liked it. I was really
good at it. I had an aptitude for it. So that

00:09:13.900 --> 00:09:20.670
was a great door that opened for me, to find
something that I could do really well and

00:09:20.670 --> 00:09:21.910
that I really enjoyed.

00:09:21.910 --> 00:09:25.320
Were there other women at Mitre working with
you at the time?

00:09:25.320 --> 00:09:30.500
There definitely were other women there. There
were a large percentage of women, because,

00:09:30.500 --> 00:09:36.840
as I said, they were taking them if they thought
they could do it and had the ability to think

00:09:36.840 --> 00:09:40.770
logically. You didn’t even have to be a
math major, though math would be a good background

00:09:40.770 --> 00:09:48.790
for this. But it had to do with being able
to think logically and be organized. Yeah,

00:09:48.790 --> 00:09:55.990
so I definitely remember women who were working
there.

00:09:55.990 --> 00:10:01.920
They had different levels of employees. I
was just a “programmer” but there was

00:10:01.920 --> 00:10:09.940
a higher level known as “tech staff.”
While I was there, they hired a man and a

00:10:09.940 --> 00:10:15.390
woman, and both had master’s degrees. The
woman was hired as a programmer and the man

00:10:15.390 --> 00:10:20.730
was hired as a tech staff. I noticed this
and thought “Hmm, that doesn’t really

00:10:20.730 --> 00:10:26.120
look quite right to me.” Although in retrospect,
the man had a degree from MIT and the woman

00:10:26.120 --> 00:10:30.110
had it from someplace else, so there could
have been a rationale. But that was how things

00:10:30.110 --> 00:10:36.279
were in those days. In fact, to get that job,
I had to tell them that I was looking for

00:10:36.279 --> 00:10:40.750
permanent career employment. That was the
way you had to approach these jobs, because

00:10:40.750 --> 00:10:46.980
they were worried about women coming and them
leaving, and they would have lost their money

00:10:46.980 --> 00:10:48.210
or something.

00:10:48.210 --> 00:10:55.200
I worked at Mitre for a year and I was living
in Cambridge. I saw an ad for a position at

00:10:55.200 --> 00:11:00.970
Harvard working on the language translation
project and I thought it would just be nice

00:11:00.970 --> 00:11:06.990
not to have to commute, so I applied for that
job. I got that job at a pretty good raise

00:11:06.990 --> 00:11:12.870
in salary. I knew nothing about how you might
negotiate for a higher salary by getting a

00:11:12.870 --> 00:11:18.840
competing offer. Mitre offered to counter
that. They offered to give me a tech staff

00:11:18.840 --> 00:11:22.620
position. But of course it wasn’t why I
was doing it. I just thought it might be fun

00:11:22.620 --> 00:11:27.470
to do something different for a year. So I
went to work at Harvard on the language translation

00:11:27.470 --> 00:11:30.770
project.

00:11:30.770 --> 00:11:36.190
That was a good move as it turned out. The
project used a huge program that was written

00:11:36.190 --> 00:11:43.960
in assembler - it was probably for the IBM
7094. I think in both places it was a 7094.

00:11:43.960 --> 00:11:50.150
That gave me an opportunity to really understand
how the machine worked, and since I was maintaining

00:11:50.150 --> 00:11:55.660
a very large program, it taught me a lot about
program structure. It was a pretty good program

00:11:55.660 --> 00:12:03.200
as these programs go, and fairly well modularized,
although I knew nothing about modularity in

00:12:03.200 --> 00:12:09.730
those days. But it was non-reentrant code,
so when you would call a procedure, they might

00:12:09.730 --> 00:12:13.620
modify an instruction in the procedure they
were calling so that when it got to the end

00:12:13.620 --> 00:12:20.370
it would go back to the caller without having
to have a stack where you branch through something.

00:12:20.370 --> 00:12:25.740
Of course that was a very error-prone way
of doing things. So that was a good lesson

00:12:25.740 --> 00:12:27.910
for me, to see that.

00:12:27.910 --> 00:12:30.050
So this was led by Tony Oettinger?

00:12:30.050 --> 00:12:38.370
Tony Oettinger and Susumu Kuno was a postdoc.
Yes. But I was just a programmer, so I wasn’t

00:12:38.370 --> 00:12:43.360
doing research. They’d find an error in
the program and they’d just say, “Track

00:12:43.360 --> 00:12:48.710
this down and fix it.” That was my job.

00:12:48.710 --> 00:12:55.230
But it was good training. I worry about our
current students who may not ever really understand

00:12:55.230 --> 00:12:59.790
how machines work. Although of course machines
are a lot more complicated now than they were

00:12:59.790 --> 00:13:04.980
then, since in those days they weren’t doing
speculative execution, they didn’t have

00:13:04.980 --> 00:13:11.360
multiple processors, all that stuff you have
to worry about today. But nevertheless, understanding

00:13:11.360 --> 00:13:16.210
when you’re using a higher-level language
what the compiler is producing under the covers

00:13:16.210 --> 00:13:20.800
is really very helpful to understanding what’s
going on.

00:13:20.800 --> 00:13:26.120
I worked at that job and partway through the
year I decided to apply to graduate school

00:13:26.120 --> 00:13:31.970
because it just seemed like it was time. I
was learning a tremendous amount, but as I

00:13:31.970 --> 00:13:37.490
said, I was pretty much self-taught. I thought,
“Well, I probably could learn a lot more

00:13:37.490 --> 00:13:45.140
if I went to graduate school. I’d learn
faster.” I applied to Harvard and Stanford.

00:13:45.140 --> 00:13:50.420
It never occurred to me to apply to MIT. And
I went to Stanford because I wanted to get

00:13:50.420 --> 00:13:55.780
back to the Bay Area. I’d been in Boston
for a couple years and my family was in San

00:13:55.780 --> 00:14:03.460
Francisco, so in 1963 I went to Stanford.
They didn’t have a computer science major

00:14:03.460 --> 00:14:11.860
then. They had a program. It was between,
I guess, math and EE. It was some sort of

00:14:11.860 --> 00:14:15.100
joint thing.

00:14:15.100 --> 00:14:21.050
I went there without any financial support.
I didn’t even know there was financial support.

00:14:21.050 --> 00:14:23.980
I wasn’t really worried about it anyway
because I’d been saving all my money so

00:14:23.980 --> 00:14:32.360
I had a lot of savings. But my recollection
is that on the day I arrived I met John McCarthy

00:14:32.360 --> 00:14:36.640
. I walked up the steps with him, and I asked
him whether he could support me and he said

00:14:36.640 --> 00:14:42.310
yes. It’s highly unlikely that this is what
actually happened, so I always think this

00:14:42.310 --> 00:14:48.149
is an example of how memory is not all that
reliable. I think, in retrospect, they probably

00:14:48.149 --> 00:14:52.700
expected me to be in AI because I had been
doing this work on the language translation

00:14:52.700 --> 00:14:56.310
project even though I knew nothing about AI
at the time.

00:14:56.310 --> 00:15:01.740
They probably already thought I was going
to be working with McCarthy. That’s my guess

00:15:01.740 --> 00:15:09.300
now. It was a very small faculty. I think
besides John, there were only Forsythe and

00:15:09.300 --> 00:15:16.490
Gene Golub. There was a big project in numerical
analysis. And Niklaus Wirth came, but he wasn’t

00:15:16.490 --> 00:15:20.180
there yet. So it was pretty small faculty.
I don’t think there were all that many options

00:15:20.180 --> 00:15:24.850
about what you would be working on. There
weren’t many of us in my class either. I

00:15:24.850 --> 00:15:33.550
think five maybe. I’m not sure. Raj Reddy
was in my class.

00:15:33.550 --> 00:15:41.459
So I moved back to Stanford in the fall of
1963 and started working with John and taking

00:15:41.459 --> 00:15:45.660
classes. It was a good thing to do.

00:15:45.660 --> 00:15:47.710
What kind of classes were they?

00:15:47.710 --> 00:15:53.160
Whatever they offered. So I took a lot of
classes with Dana Scott . He was at Stanford

00:15:53.160 --> 00:16:00.890
at the time and he was teaching classes in
logic. I remember a class in compilers. I

00:16:00.890 --> 00:16:07.990
remember that we had to write some kind of
little compiler-like thing. I don’t really

00:16:07.990 --> 00:16:13.180
remember what it was, but we used to take
over the machine at night. It was a B5500

00:16:13.180 --> 00:16:21.450
I think. That way we could get fast turnaround,
because it was still the days of batch processing,

00:16:21.450 --> 00:16:26.209
and if you couldn’t get hold of the machine,
then you would have to submit your program

00:16:26.209 --> 00:16:30.839
and wait a day or so before you could get
your results.

00:16:30.839 --> 00:16:37.920
Clearly interactive programming is a big improvement
over batch processing, but one advantage of

00:16:37.920 --> 00:16:42.690
batch processing is that you have to think
through your experiment very carefully before

00:16:42.690 --> 00:16:46.810
you submit it, otherwise you’re just wasting
a whole day of time. Another advantage of

00:16:46.810 --> 00:16:52.019
batch processing is that you have to learn
how to multiplex your time, because you can’t

00:16:52.019 --> 00:16:57.630
just sit there waiting. [laughs] I think both
of those were actually very valuable skills

00:16:57.630 --> 00:17:02.910
that served me in good stead as time went
by.

00:17:02.910 --> 00:17:08.910
I don’t know what else I took. There was
certainly no course in operating systems.

00:17:08.910 --> 00:17:12.780
I refused to take the course in numerical
analysis because I really didn’t like that

00:17:12.780 --> 00:17:22.530
stuff. So I don’t know - I took whatever,
what people were taking, whatever it was they

00:17:22.530 --> 00:17:31.660
offered. I remember Jerry Feldman showed up
maybe my third year. Probably Niklaus Wirth

00:17:31.660 --> 00:17:41.730
was teaching the compiler course. That might
have been my second year. It’s hard to remember.

00:17:41.730 --> 00:17:44.820
Meanwhile I was working with John [McCarthy]
and I was reading whatever papers were available

00:17:44.820 --> 00:17:50.890
and so forth. And I figured out, probably
in my second year, that I would really rather

00:17:50.890 --> 00:17:57.201
be in systems. I think I liked that compiler
course and I liked that way of thinking. But

00:17:57.201 --> 00:18:06.540
I decided to stick in AI and try to get my
PhD out of the way as expeditiously as possible.

00:18:06.540 --> 00:18:15.860
I was very interested in what was then machine
learning. I was really interested in trying

00:18:15.860 --> 00:18:22.230
to make machines do planning and stuff like
that, but it was a very hard problem.

00:18:22.230 --> 00:18:28.450
As you know, that’s an area of AI that’s
changed hugely since those days. Then it was

00:18:28.450 --> 00:18:33.880
this idea that the program would think like
a person and you would try to mimic the way

00:18:33.880 --> 00:18:39.030
people thought about things. In fact, that
was kind of what was going on in my PhD thesis

00:18:39.030 --> 00:18:44.299
– the Program to Play Chess Endgames. There
I was thinking about what were the strategies

00:18:44.299 --> 00:18:49.510
I would use as a person playing that game,
and then I built those strategies into my

00:18:49.510 --> 00:18:54.980
program. But it was limited what you could
accomplish with that way of thinking about

00:18:54.980 --> 00:18:58.910
machine learning. Now that we’ve switched
to the modern techniques, they seem to make

00:18:58.910 --> 00:19:01.410
a lot more progress.

00:19:01.410 --> 00:19:13.410
Anyway, I did my PhD working with John McCarthy.
And when I was in my final year, I started

00:19:13.410 --> 00:19:21.750
looking around for a job, but nobody gave
me any guidance. John was not a person who

00:19:21.750 --> 00:19:28.590
would have done that anyway and I didn’t
really understand any sort of application

00:19:28.590 --> 00:19:38.200
process. So I didn’t apply to any schools.
I sort of waited for people to come to me,

00:19:38.200 --> 00:19:42.640
which in a way was what was going on with
others - I mean Raj Reddy and so forth, because

00:19:42.640 --> 00:19:47.650
it was the old boys’ network in full play
at that time.

00:19:47.650 --> 00:19:53.400
So what I had offers to do… I must have
applied to somewhere, because I don’t think

00:19:53.400 --> 00:19:59.100
these just came out of the blue, but I had
an offer at Hayward State – that was because

00:19:59.100 --> 00:20:03.850
Harry Huskey who was running the department
there knew me. I had an offer at SRI – that

00:20:03.850 --> 00:20:08.470
was because… I can’t remember his name
right now, but the person running SRI labs

00:20:08.470 --> 00:20:16.100
knew me. Then I had an offer from Mitre where
they knew me, right? [laughs] And I knew that

00:20:16.100 --> 00:20:20.010
the job at Hayward State would be a very bad
idea, because it was a heavy teaching load

00:20:20.010 --> 00:20:24.260
with very little research, and that didn’t
seem like a good idea. And I wanted to move

00:20:24.260 --> 00:20:29.720
back to the Boston area. I actually came and
applied to MIT, and I think they would have

00:20:29.720 --> 00:20:37.090
offered me a job as a tech staff probably.
Not a research associate. I’m not sure exactly.

00:20:37.090 --> 00:20:39.260
I decided that probably wasn’t a good idea.

00:20:39.260 --> 00:20:46.410
So I decided to go to Mitre. That was a good
idea because I was also changing fields from

00:20:46.410 --> 00:20:50.679
AI to systems, and I didn’t know too much
about systems. I think I’d had that one

00:20:50.679 --> 00:20:58.290
course in compilers plus my background in
computer architecture such as it was. So I

00:20:58.290 --> 00:21:04.560
had a lot to learn. And so this is now the
fall of 1968. I moved to the Boston area.

00:21:04.560 --> 00:21:09.820
By then I had met my husband. We weren’t
married yet, but that seemed like a good thing

00:21:09.820 --> 00:21:18.420
to continue with, and so I moved back to the
Boston area and took the job at Mitre.

00:21:18.420 --> 00:21:29.429
I started at Mitre in September of 1968, and
the first project they handed me was a microprogramming

00:21:29.429 --> 00:21:36.000
project. In those days, microprogramming was
considered to be an interesting research direction.

00:21:36.000 --> 00:21:42.600
The idea was that they would provide you with
a read-only memory and a very simple, small

00:21:42.600 --> 00:21:50.440
instruction set, and then you could implement
a more grandiose instruction set using the

00:21:50.440 --> 00:22:02.840
read-only memory and this very small instruction
set. I had read the paper on the THE operating

00:22:02.840 --> 00:22:08.690
system and I was very intrigued with the notion
of semaphores and I was interested in parallel

00:22:08.690 --> 00:22:16.000
computing, so I decided to put the project
in that direction. I mean, why do a project

00:22:16.000 --> 00:22:19.250
like that if you’re just going to implement
a standard instruction set? So I sort of moved

00:22:19.250 --> 00:22:21.430
it in that direction.

00:22:21.430 --> 00:22:27.690
I actually had a chance to meet [Edsger W.]
Dijkstra. He came to Mitre. Maybe it was the

00:22:27.690 --> 00:22:32.550
spring of ’69. I’m not really sure. I
met with him and we talked about semaphores,

00:22:32.550 --> 00:22:43.340
and I decided to implement them in the hardware.
I had put into the hardware, using the microprogram,

00:22:43.340 --> 00:22:47.150
sort of a basis for parallel programming.
It was a single processor, but this was a

00:22:47.150 --> 00:22:52.870
way of time-sharing. When that part of the
project was finished, then the next part of

00:22:52.870 --> 00:23:00.150
the project was to use it for something. I
built a little multiprogramming system on

00:23:00.150 --> 00:23:06.419
top of this hardware, taking advantage of
what semaphores gave me and some of the other

00:23:06.419 --> 00:23:10.830
stuff that I’ve really forgotten about,
how you control the interrupt system and stuff

00:23:10.830 --> 00:23:11.830
like that.

00:23:11.830 --> 00:23:13.530
So this was the Interdata 3…

00:23:13.530 --> 00:23:16.090
This would be Interdata 3. Or maybe it was
the 4.

00:23:16.090 --> 00:23:21.549
Yeah. I think it was… Was it Interdata 3
or 4? I’ve forgotten. I could look in my…

00:23:21.549 --> 00:23:23.559
you know. But anyway, it was…

00:23:23.559 --> 00:23:26.620
They were similar.

00:23:26.620 --> 00:23:33.751
Yeah. I probably finished the first part of
that thing in the first year, and then in

00:23:33.751 --> 00:23:39.500
the second part of the project, which maybe
started in the fall of 1969, by then I was

00:23:39.500 --> 00:23:46.190
working with one other person, somebody named
Bob Curtis who was a tech staff at Mitre.

00:23:46.190 --> 00:23:52.020
Actually I don’t remember that Bob was involved.
I’m not sure exactly when we started working

00:23:52.020 --> 00:23:57.320
together. Anyway, he was definitely involved
in the early work on the Venus operating system.

00:23:57.320 --> 00:24:02.240
[chuckles] The little computer I developed
was called “Venus” and then we developed

00:24:02.240 --> 00:24:11.559
the Venus operating system. I had also a couple
of people working as programmers. I did most

00:24:11.559 --> 00:24:20.270
of the design and we figured out how to implement
this thing. It was an interesting little system.

00:24:20.270 --> 00:24:23.970
It’s been a long time, I really haven’t
thought about it much since then, but it got

00:24:23.970 --> 00:24:29.820
me into operating systems and I learned about
what was going on, the kinds of abstractions

00:24:29.820 --> 00:24:38.810
that were being used in operating systems.
Semaphores turned out to be handy. That was

00:24:38.810 --> 00:24:44.510
probably the second year at Mitre – ’69
maybe into the fall of 1970.

00:24:44.510 --> 00:24:51.789
When that project was finished, Mitre asked
me to look at programming methodology. That

00:24:51.789 --> 00:24:57.620
was a successful project. I’m not sure exactly
what these dates are. I actually have some

00:24:57.620 --> 00:25:05.760
of the tech reports, so I can go back and
figure this out.

00:25:05.760 --> 00:25:13.150
So that got me into programming methodology.
Mitre, as you know, works for the government,

00:25:13.150 --> 00:25:18.980
and the government puts out request for proposals,
and I wasn’t in a position yet where I was

00:25:18.980 --> 00:25:25.179
the person who would be answering those proposals.
I was somebody that they were using as a person

00:25:25.179 --> 00:25:30.669
they could put in charge of a project once
they’d brought it in. When I arrived this

00:25:30.669 --> 00:25:35.390
Interdata 3 project was there waiting for
me to work on, and then after that was done,

00:25:35.390 --> 00:25:44.470
they’d already bid on the “software crisis”
request for proposals. And I was finishing

00:25:44.470 --> 00:25:49.930
up this project, so they asked me to take
that on.

00:25:49.930 --> 00:25:57.522
That was a marvelous opportunity for me because
it opened up a whole new area I didn’t know

00:25:57.522 --> 00:26:03.640
anything about. I started reading the literature,
which was not vast, but there definitely was

00:26:03.640 --> 00:26:12.570
some. The players were the sort of usual players
if you think about… I mean there was Tony

00:26:12.570 --> 00:26:22.179
Hoare , Niklaus Wirth , Dijkstra , and other
people that you would recognize from those

00:26:22.179 --> 00:26:26.110
days. I guess most of the conferences were
in Europe now that I think about it.

00:26:26.110 --> 00:26:32.000
Did you go to the NATO program methodology
meeting or whatever it was, the famous one?

00:26:32.000 --> 00:26:42.160
I did not, no. I didn’t go to many meetings
at this time. Later I was in Working Group

00:26:42.160 --> 00:26:51.810
2.3, 2.5, the methodology working group. But
I never found that kind of format useful for

00:26:51.810 --> 00:27:00.100
me. I tend to be more “I work by myself.”
But I read proceedings from these meetings

00:27:00.100 --> 00:27:10.799
and learned about what was going on, and started
thinking about methodology. As I say in my

00:27:10.799 --> 00:27:16.090
Turing talks, as I was looking at various
people – Dave Parnas of course was another

00:27:16.090 --> 00:27:22.360
big player – and I read all the papers I
could get my hands on and thought about their

00:27:22.360 --> 00:27:29.740
proposals for methodology. At some point during
this process, I realized that I had invented

00:27:29.740 --> 00:27:35.530
a methodology of my own while working on the
Venus system, not because I was thinking about

00:27:35.530 --> 00:27:40.410
it but just because I wanted a way of organizing
that software that gave us a sensible way

00:27:40.410 --> 00:27:44.020
of approaching the software development process.

00:27:44.020 --> 00:27:50.600
The idea that I had in Venus was that… I
mean to understand the background at this

00:27:50.600 --> 00:27:55.530
time, you have to understand that there was
that ALGOL school of programming which had

00:27:55.530 --> 00:28:01.540
a good idea and a bad idea. The good idea
was that you had blocks, and inner block had

00:28:01.540 --> 00:28:06.480
private data and the outer block couldn’t
access it. The bad idea was you had blocks

00:28:06.480 --> 00:28:10.490
[laughs] and the inner block could freely
access all the stuff in the outer block, and

00:28:10.490 --> 00:28:17.370
so there was a natural tendency to communicate
through global variables. That was not such

00:28:17.370 --> 00:28:22.451
a great idea. Some of Parnas’ papers talked
a bit about why that was a bad idea, although

00:28:22.451 --> 00:28:27.780
I would not say that in general it was understood
that this was a bad idea.

00:28:27.780 --> 00:28:32.810
At any rate, somehow I understood this wasn’t
a great idea, and I think it has to do with

00:28:32.810 --> 00:28:36.230
the fact that if you have lots of people working
on different pieces of the system and they

00:28:36.230 --> 00:28:39.409
all can freely communicate through this set
of global variables, you’re going to have

00:28:39.409 --> 00:28:44.760
a big mess on your hands. And maybe I saw
a mess like that in the Harvard stuff. I’m

00:28:44.760 --> 00:28:49.650
really not sure where it came from. But I
decided we were not going to have shared global

00:28:49.650 --> 00:28:55.169
variables in developing the Venus system.
Instead we were just going to break up the

00:28:55.169 --> 00:29:02.299
global variable space into what I called “partitions,”
and each partition would be in the charge

00:29:02.299 --> 00:29:07.910
of a particular program module, and that module
would be the only place you could access that

00:29:07.910 --> 00:29:13.970
data. Since other parts of the program had
to use it, that module would provide procedures

00:29:13.970 --> 00:29:19.251
that that other parts of the program could
call. That’s the methodology we used and

00:29:19.251 --> 00:29:21.490
it worked out extremely well.

00:29:21.490 --> 00:29:24.780
Another thing that was going on in Venus,
which I usually don’t talk about in my Turing

00:29:24.780 --> 00:29:31.230
talk, is that we were also thinking of the
question of “How do you organize a parallel

00:29:31.230 --> 00:29:37.710
program like an operating system? And how
in particular do you control the devices,

00:29:37.710 --> 00:29:43.549
the shared resources? How do you communicate
among the threads that are doing the concurrent

00:29:43.549 --> 00:29:50.900
processing?” And I was kind of using abstract
data types already. I was thinking in terms

00:29:50.900 --> 00:29:57.919
of the way you do it is the thread makes use
of the shared resource, which is actually

00:29:57.919 --> 00:30:03.200
an object with a bunch of operations, and
you call that object and it has some hidden

00:30:03.200 --> 00:30:08.240
resources which it uses to sort of… it’s
being shared by all the threads and that’s

00:30:08.240 --> 00:30:10.850
how the control actually happens.

00:30:10.850 --> 00:30:16.210
Although I didn’t pull that out in the first
paper I wrote on programming methodology.

00:30:16.210 --> 00:30:23.140
I wasn’t even really thinking about it until
the SOSP History Day where I gave a talk about

00:30:23.140 --> 00:30:30.390
the history of program structure in operating
systems and I looked at the THE system again,

00:30:30.390 --> 00:30:37.890
I looked at the Venus system, and then there
was that Schroeder and Nelson, or Nelson and

00:30:37.890 --> 00:30:45.440
Birrell - the paper about the two ways of
organizing a parallel program, one where you

00:30:45.440 --> 00:30:51.159
have queues and one where you send messages.
I was looking at some of those methodology

00:30:51.159 --> 00:30:56.720
papers and I realized that Venus was actually
one of the ones in the mix there and that

00:30:56.720 --> 00:31:02.289
there were two structures – one of the shared
resources where threads just call operations

00:31:02.289 --> 00:31:06.400
and everything is taken care of under the
covers, and this other structure which is

00:31:06.400 --> 00:31:12.300
you provide a… it’s sort of a CSP-like
structure where you have your thread and it’s

00:31:12.300 --> 00:31:19.620
got a bunch of methods that are being called
remotely. It’s a different model of computation.

00:31:19.620 --> 00:31:24.159
So Venus had both those things. It was on
the shared resource, you just call its operations.

00:31:24.159 --> 00:31:29.060
It kind of follows naturally from this idea
of partitions and just calling operations.

00:31:29.060 --> 00:31:36.500
Okay. So I was thinking about methodology
and I realized I had a methodology, so I wrote

00:31:36.500 --> 00:31:41.880
a paper on it and that went into the Fall
Joint I think it was in 19-… I think it

00:31:41.880 --> 00:31:47.941
was probably published in ’71 or ’72.
But meanwhile I also had written [a] paper

00:31:47.941 --> 00:32:02.090
on Venus, and I submitted that to SOSP. It
was the third SOSP. And it was accepted.

00:32:02.090 --> 00:32:07.909
By the way, that was the first writing experience
I ever had where I had somebody reading my

00:32:07.909 --> 00:32:14.440
paper and giving me criticism about it. Because
John [McCarthy] didn’t do that. I had never

00:32:14.440 --> 00:32:18.659
had that experience. I never had an advisor
as a graduate student who was working with

00:32:18.659 --> 00:32:22.520
me, telling me, “Oh, this doesn’t make
sense. Reorganize that,” and so forth. It

00:32:22.520 --> 00:32:28.620
was very useful. That was my boss, Judy Clapp.
She’d been a tech staff at Mitre even earlier

00:32:28.620 --> 00:32:34.500
than me, and has very interesting stories
to tell. She was serving that role and it

00:32:34.500 --> 00:32:36.190
was very valuable.

00:32:36.190 --> 00:32:42.710
Anyway, the paper on Venus was accepted. SOSP
as you know is the top systems conference.

00:32:42.710 --> 00:32:47.070
It was even in those days, even though it
was only the third one, because it was the

00:32:47.070 --> 00:32:54.370
only act in town. Jerry Saltzer was the…
I was one of the prize papers. They’ve always

00:32:54.370 --> 00:33:01.370
had this tradition of the top few papers,
the award papers, and they go into… they

00:33:01.370 --> 00:33:04.559
used to go into the Communications. Now they
go into TOCS.

00:33:04.559 --> 00:33:12.261
So Jerry was the chair of my session, and
Corby was there, Professor Corbató . And

00:33:12.261 --> 00:33:17.539
I’m not sure who else was there from MIT.
Probably other people from the Multics group.

00:33:17.539 --> 00:33:27.020
And after my talk I was invited to apply to
MIT. So I think I talked to Jerry. He encouraged

00:33:27.020 --> 00:33:34.610
me to apply, so I did. I also applied to Berkeley,
and I could have probably gone to Berkeley,

00:33:34.610 --> 00:33:39.409
but my husband was not willing to move. We
were married by then and he worked for Raytheon

00:33:39.409 --> 00:33:43.140
and it didn’t look like it was easy for
him. Certainly not in the Berkeley area. He

00:33:43.140 --> 00:33:49.330
might have been able to do something down
in the peninsula. So I moved to MIT in the

00:33:49.330 --> 00:34:02.970
fall of 1972. And at the same time, Mike Schroeder
was hired, so they hired two people in systems.

00:34:02.970 --> 00:34:16.020
I think it was Title IX that sort of opened
up things for women. My understanding of what

00:34:16.020 --> 00:34:22.619
happened was the landscape had changed. All
of a sudden there was more pressure on universities

00:34:22.619 --> 00:34:27.830
to hire women. I don’t think all universities
were paying much attention to this, but MIT

00:34:27.830 --> 00:34:32.530
was paying attention. I think it was coming
from Jerry Wiesner, who was the president

00:34:32.530 --> 00:34:37.849
of MIT, because this kind of stuff has to
come from the top. Jerry was actually interested

00:34:37.849 --> 00:34:42.859
in increasing the number of women. The head
of the EE department – it wasn’t EECS

00:34:42.859 --> 00:34:48.450
yet, it was just EE – was Louis Smullin,
and I think Louis was interested in doing

00:34:48.450 --> 00:34:52.440
this. Then Bob Fano was the head of computer
science, and Bob was definitely interested

00:34:52.440 --> 00:35:00.619
in doing this. They were looking for a woman
and there I was. So it was a mutually beneficial

00:35:00.619 --> 00:35:07.740
exchange. As soon as I got the offer, I knew
I was going to leave Mitre. It was just something

00:35:07.740 --> 00:35:12.200
I guess I’d always thought would be fun
to do, and I decided I was going to do it.

00:35:12.200 --> 00:35:18.990
So I got to MIT. There were only 10 women
on the faculty out of a faculty of a thousand.

00:35:18.990 --> 00:35:23.460
As you know, since you went to MIT, the number
of women in the undergraduate population was

00:35:23.460 --> 00:35:31.950
very, very small. My husband is class of 1960
and there were 16 women in his class. I mean

00:35:31.950 --> 00:35:38.900
so small, it’s really, you know… MIT always
admitted women, but they never had very many,

00:35:38.900 --> 00:35:42.800
partly because they had no housing for them
and so they didn’t know what to do with

00:35:42.800 --> 00:35:51.030
them. That changed when… I forget the name
of the woman who gave money for a dormitory

00:35:51.030 --> 00:35:56.660
for women , and as soon as they had more space,
they started to let more women in. That was

00:35:56.660 --> 00:36:00.560
in the ’70s or maybe the late ’60s. I’m
not sure exactly when.

00:36:00.560 --> 00:36:01.560
’60s.

00:36:01.560 --> 00:36:13.720
It was the ’60s? Yeah. So I went to MIT
in the fall of 1972 and that was a wonderful

00:36:13.720 --> 00:36:21.450
move for me. The glory of working as a university
professor is that you get to do whatever you

00:36:21.450 --> 00:36:27.521
want, right? You go to a place like MIT, you
have certain responsibilities. MIT is very

00:36:27.521 --> 00:36:34.890
focused on teaching and quality teaching,
and everybody teaches two courses a year,

00:36:34.890 --> 00:36:40.310
and that takes time and you got to pay attention
to that. But as far as research is concerned,

00:36:40.310 --> 00:36:42.940
you figure out what you’re researching on.

00:36:42.940 --> 00:36:46.750
Of course there’s a downside to this too.
First of all, you better have the ideas. You

00:36:46.750 --> 00:36:50.140
have to figure out what you’re going to
do. You can do it, but you have to figure

00:36:50.140 --> 00:36:53.580
out what it is and then you have to raise
money. But raising money was pretty easy in

00:36:53.580 --> 00:36:59.560
those days because those were the days when
DARPA was supporting computer science research

00:36:59.560 --> 00:37:05.480
and it was mostly putting its money into a
few institutions. I don’t remember whether

00:37:05.480 --> 00:37:11.470
it was Project MAC still or Lab for Computer
Science, but we used to submit one proposal

00:37:11.470 --> 00:37:16.930
for the whole lab and I just had to write
a couple of pages in that proposal to get

00:37:16.930 --> 00:37:23.420
money. I also wrote NSF proposals just to
have sort of another source of money and to

00:37:23.420 --> 00:37:29.089
practice how to do that. But compared to the
situation today, it was a lot easier to fund

00:37:29.089 --> 00:37:31.010
your research then.

00:37:31.010 --> 00:37:42.460
So I came to MIT. The first course I taught
was what is currently 6.004. So it’s a computer

00:37:42.460 --> 00:37:49.421
architecture course. This was a weird assignment
for me because I had no EE background, and

00:37:49.421 --> 00:37:53.890
I was actually in an EE department. It wasn’t
EECS yet. I don’t remember when it became

00:37:53.890 --> 00:38:03.850
EECS. Probably a few a years later. That was
a bit of a scramble. Jack Dennis had a graduate

00:38:03.850 --> 00:38:09.830
student, Clem Leung, who was also a TA for
the class, and he helped me. You know, I was

00:38:09.830 --> 00:38:15.200
keeping sort of one week ahead of the students,
learning stuff about circuits and so forth,

00:38:15.200 --> 00:38:20.270
which really I had no background in. And I
definitely had students who were not happy

00:38:20.270 --> 00:38:25.990
to see me. I didn’t feel that I got discrimination
from the faculty, but I did feel that the

00:38:25.990 --> 00:38:31.130
students… there was a few students in the
class that were… they’d try to trip me

00:38:31.130 --> 00:38:36.740
up. They’d try to ask me a question I couldn’t
answer. Of course I was at a kind of vulnerable

00:38:36.740 --> 00:38:42.580
position, teaching a course in an area I didn’t
know. So that was a little bit of a baptism

00:38:42.580 --> 00:38:49.150
by fire, but I learned how to… I was one
week ahead of them, and I learned how to say,

00:38:49.150 --> 00:38:54.580
“I’ll talk about that at another time.”
[laughs] Meanwhile I started getting the research…

00:38:54.580 --> 00:39:02.050
Oh, the other problem was I was in Project
MAC or LCS, and they decided I was an AI person

00:39:02.050 --> 00:39:08.150
and they put me on the AI floor. I think they
wanted me to work in AI. But meanwhile I was

00:39:08.150 --> 00:39:15.270
working programming methodology. Jack Dennis
in the spring of 1963 helped me move my office

00:39:15.270 --> 00:39:21.770
back down to the systems floor, which was
a much more congenial place, and that helped

00:39:21.770 --> 00:39:26.089
a lot. So Jack was very helpful.

00:39:26.089 --> 00:39:32.040
So meanwhile in research, I’m sitting there
thinking about programming methodology, and

00:39:32.040 --> 00:39:39.950
I was really interested in programming methodology.
I thought it was a very important field. And

00:39:39.950 --> 00:39:47.490
what I had noticed was that although the papers
were very compelling when you read them and

00:39:47.490 --> 00:39:51.380
they always had an example and you would follow
the example and you’d say, “Oh yes, that’s

00:39:51.380 --> 00:39:55.240
very convincing. This is the right way to
do things”… And I’m thinking specifically

00:39:55.240 --> 00:40:01.340
about Parnas’ papers because his were about
how to structure programming. If you think

00:40:01.340 --> 00:40:05.710
about the papers at the time, there were papers
on “Here’s how you design software.”

00:40:05.710 --> 00:40:11.450
So Niklaus Wirth wrote about top-down programming
and Dijkstra had that wonderful letter to

00:40:11.450 --> 00:40:16.500
the Communications of the ACM on “Go To
Statement Considered Harmful,” and really

00:40:16.500 --> 00:40:21.849
the gist of that paper, if you think behind
the scenes of that paper, it was really about

00:40:21.849 --> 00:40:27.010
Dijkstra’s message, which was “We should
be reasoning about the correctness of code.”

00:40:27.010 --> 00:40:32.040
The goto was bad because it made it harder
to do that reasoning, but the idea that programming

00:40:32.040 --> 00:40:38.530
is an intellectually difficult problem and
that we should approach it in a kind of mathematical

00:40:38.530 --> 00:40:44.980
way, that was early days and that was a pretty
significant step forward to see that way of

00:40:44.980 --> 00:40:46.220
thinking about things.

00:40:46.220 --> 00:40:52.820
But Dave Parnas was writing about modularity,
and he was saying, “Here is how we should

00:40:52.820 --> 00:40:57.829
think about modules.” He actually said,
“Programs are built of modules, but I don’t

00:40:57.829 --> 00:41:04.140
know what they are.” And that was kind of
the state of the art at the time. But he had

00:41:04.140 --> 00:41:08.230
the idea of specifications. He was saying,
“Whatever they are, we better describe their

00:41:08.230 --> 00:41:14.030
connections completely.” So he meant “Whatever
their interface is, we better have a complete

00:41:14.030 --> 00:41:15.030
description.”

00:41:15.030 --> 00:41:21.080
I used to feel kind of jealous of the electrical
engineers because I thought, “At least they

00:41:21.080 --> 00:41:26.800
have these components and they connect them
by wires, and that forces you to really focus

00:41:26.800 --> 00:41:32.310
on what those wires are.” Whereas software
was so plastic that people used to design

00:41:32.310 --> 00:41:36.160
without thinking much about those wires, and
so then they would end up with this huge mess

00:41:36.160 --> 00:41:42.130
of interconnections between the pieces of
the program, and that was a big problem. That

00:41:42.130 --> 00:41:46.000
was a problem I was looking at in Venus when
I said, “We’re going to have partitions,”

00:41:46.000 --> 00:41:50.750
but it was just a problem in general. Global
variables were a big problem. Just the ability

00:41:50.750 --> 00:41:54.650
that there was nothing forcing you to do things
in any particular way, so you could do whatever

00:41:54.650 --> 00:41:56.660
you wanted.

00:41:56.660 --> 00:42:01.470
So anyway, I was thinking about this. I was
thinking about the fact that even though I

00:42:01.470 --> 00:42:04.920
would read Parnas’ paper and I was convinced
that people would read my paper and have the

00:42:04.920 --> 00:42:09.700
same reaction, you would say, “Yes, that’s
a great idea,” but when you start to think

00:42:09.700 --> 00:42:14.930
about “How do I apply it to my own stuff?”
everything fell apart, you just had no idea

00:42:14.930 --> 00:42:16.160
how to apply it.

00:42:16.160 --> 00:42:23.930
I was trying to think about “What can we
do to make things better?” and at some point,

00:42:23.930 --> 00:42:33.070
and I really don’t know when, but probably
winter of 1963-64… I mean…

00:42:33.070 --> 00:42:34.390
’73.

00:42:34.390 --> 00:42:41.820
…’72-73, [laughs] I got the idea of data
abstraction. And it was this marvelous idea.

00:42:41.820 --> 00:42:47.089
It came out of nowhere. But once I got it,
I could see that this was really going to

00:42:47.089 --> 00:42:52.950
work because programmers already knew about
abstract data types. I mean even if they weren’t

00:42:52.950 --> 00:42:57.630
thinking about them, because they knew when
they used an array in their Fortran program

00:42:57.630 --> 00:43:02.170
that this not something the hardware had,
this was something that you used through a

00:43:02.170 --> 00:43:07.241
set of operations and under the covers there
was an implementation going on. Certainly

00:43:07.241 --> 00:43:12.940
you knew this in spades if you were using
Lisp, which was what I wrote my thesis in,

00:43:12.940 --> 00:43:16.150
because there you used lists and it was clear
there was an implementation underneath and

00:43:16.150 --> 00:43:17.960
that they were abstract.

00:43:17.960 --> 00:43:22.390
So I felt programmers could understand the
notion of data abstraction. They already understood

00:43:22.390 --> 00:43:28.000
about procedure abstraction, and the data
abstraction was more powerful because a procedure…

00:43:28.000 --> 00:43:32.330
Oh, by the way, they were sometimes implementing
a data abstraction with a procedure abstraction

00:43:32.330 --> 00:43:36.810
by having a whole bunch of extra arguments
that controlled the different things the procedure

00:43:36.810 --> 00:43:41.430
was going to do, but that was a mess also.
So I felt this was something that programmers

00:43:41.430 --> 00:43:45.900
would feel an affinity to and something they
could understand.

00:43:45.900 --> 00:43:50.450
And I think another thing that was important
about it was… So it was a bigger module,

00:43:50.450 --> 00:43:54.050
it fit an idea of modularity – you needed
something bigger than a procedure in order

00:43:54.050 --> 00:43:59.400
to really make progress – and it was also
an abstraction. And that was important too

00:43:59.400 --> 00:44:06.430
because when you design, you need to think
abstractly, and having a thing that matches

00:44:06.430 --> 00:44:11.119
the abstract thought, that helps you with
your design. So being able to think in terms

00:44:11.119 --> 00:44:15.600
of “What data abstraction do I want for
this place? What procedure abstraction do

00:44:15.600 --> 00:44:23.730
I want for there?” this is a design approach.
So it was also useful from that perspective.

00:44:23.730 --> 00:44:29.450
I was lucky enough to have this wonderful
moment in which I had this idea, and as soon

00:44:29.450 --> 00:44:37.250
as I had that idea, I knew that it was going
to go somewhere. So I started working on that

00:44:37.250 --> 00:44:47.070
idea. And I started working jointly with Steve
Zilles. And this was definitely in the spring

00:44:47.070 --> 00:44:50.810
of 1973.

00:44:50.810 --> 00:44:57.230
Steve was a graduate student at MIT and he
is an employee of IBM. IBM was in the same

00:44:57.230 --> 00:45:05.440
Tech Square building that the lab was in.
He was older. He was in his early thirties,

00:45:05.440 --> 00:45:08.830
so he’d been working for IBM for a while
and then he went back to school, and he was

00:45:08.830 --> 00:45:13.381
only I think going to school part-time because
he was still working for IBM. And he had had

00:45:13.381 --> 00:45:20.250
some similar ideas, so Steve and I started
to work together. I think Jack Dennis organized

00:45:20.250 --> 00:45:27.690
a little workshop in the spring of 1963, and
maybe that’s how I got connected to Steve.

00:45:27.690 --> 00:45:33.210
I think Tony Hoare was there, but I could
be confused about this. I haven’t tried

00:45:33.210 --> 00:45:39.280
to figure it out. But Jack was interested
in these ideas and he was encouraging me to

00:45:39.280 --> 00:45:42.690
work on them.

00:45:42.690 --> 00:45:47.000
Steve and I started working on this. And having
an idea and figuring out what this idea is

00:45:47.000 --> 00:45:51.190
all about are two different things, so it
was just “Here’s a direction to go in.”

00:45:51.190 --> 00:45:57.500
So we started trying to flesh it out, and
we knew that we probably were going to work

00:45:57.500 --> 00:46:04.609
on programming language as a result because
you need to express an idea like that in a

00:46:04.609 --> 00:46:11.930
programming language so that people have within
their grasp the necessary linguistic features

00:46:11.930 --> 00:46:17.230
to make it all sort of hang together. We were
interested in “What would a programming

00:46:17.230 --> 00:46:23.119
language be like? How could you have type
checking that would encompass this notion

00:46:23.119 --> 00:46:29.650
of data abstraction?” And just the whole
thing was a big mystery, but we started working

00:46:29.650 --> 00:46:30.900
on this.

00:46:30.900 --> 00:46:38.550
Of course we read papers, and now I was moving
into programming languages from a background

00:46:38.550 --> 00:46:43.880
where I knew Lisp and Fortran, and of course
I’d done reading on other stuff. Steve coming

00:46:43.880 --> 00:46:49.390
from IBM, which was the big player in programming
at the time – they had Fortran, they had

00:46:49.390 --> 00:46:56.490
PL/I, they had COBOL – so we covered a wide
range of programming languages between the

00:46:56.490 --> 00:47:02.869
two of us and we read a bunch of papers. The
one that I found the most… Well, we read

00:47:02.869 --> 00:47:10.200
the paper on Simula 67, and that didn’t
quite have data abstraction in it even though

00:47:10.200 --> 00:47:16.170
it was about classes and subclasses, and you
could see how they could be data abstraction.

00:47:16.170 --> 00:47:22.970
It had no encapsulation, which is a very critical
component if you want modularity, and they

00:47:22.970 --> 00:47:29.310
were mostly interested in inheritance, which
we saw as a red herring, so we ignored that.

00:47:29.310 --> 00:47:34.240
Jim Morris had a wonderful paper on “Protection
in programming languages” I think it was

00:47:34.240 --> 00:47:41.400
called, where he was talking about modularity
and what are the rules that you have to follow

00:47:41.400 --> 00:47:48.000
in order to get the benefits of modularity.
So the benefits of modularity are local reasoning…

00:47:48.000 --> 00:47:56.920
That’s the most important. And Jim said,
“Well, a module has some state inside it

00:47:56.920 --> 00:48:01.990
and then a bunch of code. The first rule is
that the code on the outside of the module

00:48:01.990 --> 00:48:07.670
can’t modify that state. And this is clearly
essential, because if the code on the outside

00:48:07.670 --> 00:48:11.780
could modify that state, then I’d never
be able to reason about the correctness of

00:48:11.780 --> 00:48:18.750
that module because all the code in the program
would be suspect.” But then he said, “But

00:48:18.750 --> 00:48:23.180
in addition you want modifiability, which
means that if I don’t like the way that

00:48:23.180 --> 00:48:28.800
module’s implemented, I’d like to be able
to replace it with another piece of code implemented

00:48:28.800 --> 00:48:34.290
in a different way. And so to get modifiability,
the code on the outside shouldn’t even look

00:48:34.290 --> 00:48:40.540
at the state. It should only interact through
this abstract interface.”

00:48:40.540 --> 00:48:46.820
So those are in fact the two key pieces of
modularity, although in those days and actually

00:48:46.820 --> 00:48:52.230
even today, another very important component
about modularity is that it’s a management

00:48:52.230 --> 00:48:57.240
tool, because it allows you to break up your
program into separate pieces. If they follow

00:48:57.240 --> 00:49:01.200
these rules, then people can work on these
pieces independently. In those days, people

00:49:01.200 --> 00:49:06.080
didn’t know what modules were, and there
were papers being written that would say things

00:49:06.080 --> 00:49:10.510
like “A module must not be more than a thousand
lines of code.” I mean people really did

00:49:10.510 --> 00:49:15.500
not understand the notion of abstraction,
the notion of encapsulation. They mostly only

00:49:15.500 --> 00:49:20.609
understood that they needed a way of controlling
the program development process so that people

00:49:20.609 --> 00:49:23.480
could be working on separate things.

00:49:23.480 --> 00:49:30.200
Anyway, Jim laid out those two principles,
and Tony Hoare at the same time was writing

00:49:30.200 --> 00:49:36.569
papers about… He already had the notion
of abstracting from a representation to an

00:49:36.569 --> 00:49:42.510
abstract data type even though sort of they
were existing types rather than… So this

00:49:42.510 --> 00:49:48.990
idea was coming up in very many different
places.

00:49:48.990 --> 00:49:52.730
But Jim had no idea how to implement this.
So then after you say, “Well, these are

00:49:52.730 --> 00:49:57.970
the rules,” the question is “Well, can
I enforce those? In particular, can I build

00:49:57.970 --> 00:50:03.599
them into the programming language so that
the compiler can ensure that you get encapsulation?”

00:50:03.599 --> 00:50:07.500
So that was what Steve and I were struggling
with. How would you implement this? How would

00:50:07.500 --> 00:50:13.900
you make it work? Jim had a proposal which
was basically to use encryption. He talked

00:50:13.900 --> 00:50:20.910
about “seal” and “unseal.” And that
would work. The idea is the module has a key.

00:50:20.910 --> 00:50:27.470
It encrypts an object when it comes out, it
decrypts when it comes in. If somebody’s

00:50:27.470 --> 00:50:33.010
been mucking around with it, you can tell.
That certainly works, but it’s not practical.

00:50:33.010 --> 00:50:36.619
So we were looking for a… You know, “I
don’t want to do it that way. I want something

00:50:36.619 --> 00:50:37.770
efficient.”

00:50:37.770 --> 00:50:47.191
And by the summer of 1973, we had figured
out that it was possible to do this with a

00:50:47.191 --> 00:50:53.650
compiler by having a notion of a linguistic
structure that implemented a data abstraction

00:50:53.650 --> 00:50:59.440
and the compiler would just ensure the abstraction
barrier, and the code on the outside would

00:50:59.440 --> 00:51:04.220
only be able to call the operations. It was
nevertheless just a sketch. I mean we didn’t

00:51:04.220 --> 00:51:09.650
have a language. We just had a proposal for
a language. And in that paper, we talked about

00:51:09.650 --> 00:51:18.040
some issues we didn’t know how to handle.
In particular, generics and polymorphism.

00:51:18.040 --> 00:51:24.900
Polymorphism was neglected for years. I think
it’s relatively easy, when you’re just

00:51:24.900 --> 00:51:30.200
doing procedures, to ignore the fact that
“I don’t want a sort routine that works

00:51:30.200 --> 00:51:35.369
on an array of integers. I want a sort routine
that works in general.” But given the limited

00:51:35.369 --> 00:51:39.359
range of data types that existed at the time,
you can kind of see why people weren’t thinking

00:51:39.359 --> 00:51:45.470
about that. As soon as you go for data abstraction,
you can see that you need some mechanism to

00:51:45.470 --> 00:51:53.599
allow you to define a data abstraction like
a list or a set or a map or something that

00:51:53.599 --> 00:51:57.410
you just define it once and you don’t have
to keep re-implementing it every time you

00:51:57.410 --> 00:52:02.260
have another type of element. And clearly
there was polymorphism in the implementation

00:52:02.260 --> 00:52:09.460
of the built-in types. So arrays could have
floats or ints if you were working in Fortran.

00:52:09.460 --> 00:52:14.480
So it was there. It just wasn’t sort of
pulled out as a mechanism that programmers

00:52:14.480 --> 00:52:18.470
could get their hands on, and we could see
that was going to be an important component

00:52:18.470 --> 00:52:19.680
of it.

00:52:19.680 --> 00:52:28.210
We wrote this paper on abstract data types
and it was a big hit. I mean we submitted

00:52:28.210 --> 00:52:33.740
it to the Conference on Very High Level Languages
– which I don’t know when it stopped,

00:52:33.740 --> 00:52:44.260
it didn’t exist for very many years – and
it resonated with a lot of people. We finished

00:52:44.260 --> 00:52:49.180
this paper in the summer of 1973.

00:52:49.180 --> 00:52:56.920
Then in the fall of 1973, I started working
on what came to be called CLU. So here was

00:52:56.920 --> 00:53:01.350
this proposal for a programming language with
just a few hints of what might be in it and

00:53:01.350 --> 00:53:05.250
some statements about “It’d be nice if
it had polymorphism. It’d be nice if it

00:53:05.250 --> 00:53:09.760
had exception handling.” Exception handling
was also… people were trying to figure out

00:53:09.760 --> 00:53:14.099
what that meant in those days. That was another
area in programming languages that people

00:53:14.099 --> 00:53:20.700
were thinking about but had no real idea of
what should be done. So the next step was

00:53:20.700 --> 00:53:30.220
to sort of really get down to brass tacks
and figure out what all this stuff was.

00:53:30.220 --> 00:53:36.890
In the fall of 1973, I picked up three graduate
students – Russ Atkinson, Larry Snyder…

00:53:36.890 --> 00:53:47.260
or Alan Snyder, and Craig Schaffert – and
they along with me became the designers of

00:53:47.260 --> 00:53:51.880
CLU. We used to have a weekly group meeting
where we would all get together and we’d

00:53:51.880 --> 00:53:57.130
be working on some particular topic like “What
should the exception mechanism be like?”

00:53:57.130 --> 00:54:01.150
or whatever was the topic of the week. We
wrote design notes. In those days, you didn’t

00:54:01.150 --> 00:54:08.370
write them online. You wrote them. My assistant,
Ann Rubin, would type them up. We had a very

00:54:08.370 --> 00:54:13.339
rigorous design process, and we had a group
meeting that was attended by quite a few more

00:54:13.339 --> 00:54:20.530
people than just us. So Steve was coming,
Jack Dennis used to come. Other people. Students

00:54:20.530 --> 00:54:25.971
of Jack’s. So we had a pretty big group
and we would just hammer out… Everything

00:54:25.971 --> 00:54:31.780
we looked at we’d try to look at from all
possible directions and figure out “Of these

00:54:31.780 --> 00:54:35.650
two approaches, what’s the benefits? What
are the disadvantages?”

00:54:35.650 --> 00:54:42.599
We had a very rational design process, and
that’s how we got CLU together. And the

00:54:42.599 --> 00:54:52.109
students implemented, and we implemented as
we went. We started off with a compiler written

00:54:52.109 --> 00:54:58.770
in a language called MDL – M-D-L – which
was a Lisp variant, and a very small subset

00:54:58.770 --> 00:55:05.430
of CLU, and then we bootstrapped. You know,
we used that to implement to CLU. And of course

00:55:05.430 --> 00:55:12.000
CLU itself was a big test case for the methodology,
because a compiler’s a pretty big program,

00:55:12.000 --> 00:55:16.750
and so if you can build a compiler, especially
when you’re working in sequential programming,

00:55:16.750 --> 00:55:21.440
that’s a good test case. So it was very
useful for us to be implementing our own compiler

00:55:21.440 --> 00:55:25.660
since it was forcing us to make sure that
the linguistic mechanisms we were providing

00:55:25.660 --> 00:55:28.510
were powerful enough for the compiler.

00:55:28.510 --> 00:55:39.740
So we’re implementing CLU, we’re designing
CLU. We’d figured out… We call these things

00:55:39.740 --> 00:55:44.300
“clusters.” I think the word “cluster”
was even used in that paper with Steve. We

00:55:44.300 --> 00:55:48.400
couldn’t think of a good name. Eventually
we just used CLU, C-L-U, the first three letters

00:55:48.400 --> 00:56:01.109
of “cluster.” And I guess that… I’m
not going to talk about the actual features

00:56:01.109 --> 00:56:07.800
of CLU, but I do want to talk about it in
more general terms.

00:56:07.800 --> 00:56:15.510
CLU was way ahead of its time. It wasn’t
just that it had data abstraction and nobody

00:56:15.510 --> 00:56:18.619
else had this. The only other project that
was going on at the time that was looking

00:56:18.619 --> 00:56:22.950
at data abstraction was Bill Wulf and Mary
Shaw were working on a language called Alphard

00:56:22.950 --> 00:56:27.329
at CMU. So they were also looking at data
abstraction. A big difference between them

00:56:27.329 --> 00:56:36.030
and us was that I came from Lisp, I believed
in the heap. They were very much in the ALGOL

00:56:36.030 --> 00:56:41.829
world or the… There were a lot of arguments
in those days about “Pointers are bad.”

00:56:41.829 --> 00:56:47.040
So they wanted everything to be on the stack.
Of course you can avoid garbage collection,

00:56:47.040 --> 00:56:51.780
but it made everything much more complicated
for them. So I think it slowed them down.

00:56:51.780 --> 00:56:55.680
Whereas I was coming from the Lisp camp. I
believed in garbage collection, I believed

00:56:55.680 --> 00:57:00.080
in the heap. I didn’t think pointers were
bad provided you could get your type checking

00:57:00.080 --> 00:57:07.540
sorted out. I was however very in favor of
strong type checking, and as I say in my talk,

00:57:07.540 --> 00:57:11.000
this is partly a reaction to Lisp, because
I found it so annoying that they didn’t

00:57:11.000 --> 00:57:17.240
do static checking and you can save an awful
lot of time in the program development process

00:57:17.240 --> 00:57:22.510
if you have a good compiler doing static analysis.

00:57:22.510 --> 00:57:27.270
Lisp had another thing that influenced me
a lot, which was separate compilation. That

00:57:27.270 --> 00:57:32.079
was also very important. Right from day one,
CLU was always separately compiled. In fact,

00:57:32.079 --> 00:57:39.951
our idea was you would put into the program
library a description of the interface of

00:57:39.951 --> 00:57:44.570
a module first, and then you could compile
code that used the module even though the

00:57:44.570 --> 00:57:51.230
module wasn’t implemented yet. And if you
wanted to, you could provide a sort of simpleminded

00:57:51.230 --> 00:57:55.430
simulation of the implementation as your first
implementation if you wanted to go further.

00:57:55.430 --> 00:57:59.890
So we were carrying this notion of separate
compilation, - we were pushing it as far as

00:57:59.890 --> 00:58:02.610
we thought we could.

00:58:02.610 --> 00:58:10.350
CLU had data abstraction. We knew we needed
polymorphism. And polymorphism was a challenge

00:58:10.350 --> 00:58:19.640
for us because of the fact that when you write
a data type or a procedure that’s parameterized

00:58:19.640 --> 00:58:27.190
by some arbitrary type T, sometimes not every
arbitrary type is a legitimate parameter.

00:58:27.190 --> 00:58:32.859
So if you’re talking about a sorted set
of T, then you have to have some way of comparing

00:58:32.859 --> 00:58:39.380
the T elements. And not every type has an
ordering on it. And we didn’t know how to…

00:58:39.380 --> 00:58:42.890
And we wanted to capture this statically.
We didn’t want this to be some sort of dynamic

00:58:42.890 --> 00:58:46.859
thing where we discovered at runtime, “Oh,
the operation we need is missing.” We wanted

00:58:46.859 --> 00:58:51.550
to ensure at compile time that there was such
an operation.

00:58:51.550 --> 00:58:56.170
Finally we invented what we called “where
clauses,” where we would simply list the

00:58:56.170 --> 00:59:00.619
set of operations with their signatures that
the type was required to have, and then the

00:59:00.619 --> 00:59:06.640
compiler could check when it was compiling
a use that the parameter type being provided

00:59:06.640 --> 00:59:12.650
had the operations that were required. Of
course we captured only syntax, not semantics.

00:59:12.650 --> 00:59:19.290
You know, we said, “It has to have an operation
named less than…” With two Ts returning

00:59:19.290 --> 00:59:23.340
a Boolean, we didn’t say it was an ordering
relation. So that would have been part of

00:59:23.340 --> 00:59:27.891
its specification. You would have had to reason
about this outside. But that’s about as

00:59:27.891 --> 00:59:33.742
far as you can go with a compiler, because
a compiler doesn’t reason. You know, it

00:59:33.742 --> 00:59:40.089
can do simple parts of the reasoning but not
the full reasoning.

00:59:40.089 --> 00:59:47.320
Interestingly there’s something called type
classes in Haskell and these are strongly

00:59:47.320 --> 00:59:53.720
related to where clauses. They are pulling
the requirements for a polymorphic module,

00:59:53.720 --> 00:59:59.500
saying, “Here’s a set of operations, here
are their signatures,” and then you can

00:59:59.500 --> 01:00:04.460
put a specification with it. But CLU had these
in there as where clauses. So that was our

01:00:04.460 --> 01:00:07.960
solution for polymorphism.

01:00:07.960 --> 01:00:14.080
We had an exception handling mechanism. We
thought exceptions are very important, because

01:00:14.080 --> 01:00:20.280
from programming methodology point of view,
you would like the specifications of your

01:00:20.280 --> 01:00:26.349
operations to be complete if possible. Not
partial but complete. So covering the entire

01:00:26.349 --> 01:00:32.450
range of possible inputs. Since if you ever
have “anything but true” as the precondition

01:00:32.450 --> 01:00:37.260
for your call, there’s a potential source
of errors there because somebody using your

01:00:37.260 --> 01:00:44.950
module forgets, whereas if it’s covering
all the bases, then you can be certain that

01:00:44.950 --> 01:00:51.500
those errors are not possible. But when you
try to make a procedure total, then you have

01:00:51.500 --> 01:00:59.420
this problem that you can’t return the same
way over the entire space of inputs. So you

01:00:59.420 --> 01:01:05.390
need some way, we thought, of bringing this
to the attention of the caller.

01:01:05.390 --> 01:01:12.220
The way that people manage this problem today
and even then when they don’t have an exception

01:01:12.220 --> 01:01:19.300
mechanism or they think it’s too expensive
to use it, is they play a game. So they’ll

01:01:19.300 --> 01:01:25.530
say, “Well, you return a value and a special
piece of this value tells you what’s going

01:01:25.530 --> 01:01:34.680
on.” Like “I return a pointer to an object,
but if the pointer is null, this means something.”

01:01:34.680 --> 01:01:37.710
And the problem is that’s very error prone.
“I’ll return an integer if the integer

01:01:37.710 --> 01:01:42.940
is negative.” This has a special meaning
but people forget to test. In some sense,

01:01:42.940 --> 01:01:49.280
it’s the same as having a partial spec.
It’s slightly better, but it’s also very

01:01:49.280 --> 01:01:54.760
error prone. So we wanted a mechanism that
told the user, really push those results into

01:01:54.760 --> 01:01:56.340
another part of your program.

01:01:56.340 --> 01:02:03.440
This all seems so commonplace today because
this is how Java’s mechanism works, but

01:02:03.440 --> 01:02:11.340
in those days, it didn’t exist. So we invented
that stuff. And we worried about a lot of

01:02:11.340 --> 01:02:16.109
the problems with exception handling. One
of the problems with checked exceptions in

01:02:16.109 --> 01:02:21.109
Java is that people don’t like to have to
write the code to handle exceptions that aren’t

01:02:21.109 --> 01:02:26.560
going to happen in their program. “I just
checked that my index is in bounds, so why

01:02:26.560 --> 01:02:33.420
do I have to write a catch clause when I call
the lookup? Because I know it’s not going

01:02:33.420 --> 01:02:38.000
to happen.” So we handled that by turning
those into a special failure exception.

01:02:38.000 --> 01:02:41.471
So CLU had an exception mechanism. That was
another large part of our design, working

01:02:41.471 --> 01:02:44.079
out all the details of how that would work.

01:02:44.079 --> 01:02:50.390
And then the third part of our design was
iterators. That was one we didn’t foresee

01:02:50.390 --> 01:02:55.740
going into the project. The other two, I think
they were in that original paper, but iterators

01:02:55.740 --> 01:03:08.680
was not something on my map. But we had come
to realize we needed an iteration mechanism

01:03:08.680 --> 01:03:13.799
because many data abstractions are collections,
like sets and maps and stuff like that, and

01:03:13.799 --> 01:03:17.460
when you collect, it’s usually because you
want to do something with the collection,

01:03:17.460 --> 01:03:23.339
which is often iterating over it. Although
you can figure out ways of doing iterations

01:03:23.339 --> 01:03:30.220
in the absence of a mechanism, it seemed more
elegant to have a mechanism. And as I have

01:03:30.220 --> 01:03:34.849
told the story many times, we went to Carnegie
Mellon, we visited with Bill Wulf and Mary

01:03:34.849 --> 01:03:39.770
Shaw and their group. They told us about something
called generators, which actually was coming

01:03:39.770 --> 01:03:46.130
out of AI ideas. So we listened to this and
generators were kind of like what iterators

01:03:46.130 --> 01:03:51.960
are in Java today. They were objects with
a bunch of operations to get the iteration

01:03:51.960 --> 01:03:53.310
started and so forth.

01:03:53.310 --> 01:03:58.130
So we could see this was a nice solution,
but we thought it was kind of inelegant and

01:03:58.130 --> 01:04:03.450
overkill. And so on the plane going back to
Boston, my student Russ Atkinson invented

01:04:03.450 --> 01:04:09.079
iterators, and iterators are tailored for
use with a for loop. You call the iterator

01:04:09.079 --> 01:04:17.109
to start the loop. Every time it’s got a
new value to provide you, it uses a special

01:04:17.109 --> 01:04:21.790
return instruction called yield. We then run
the loop body. At the end of the loop body,

01:04:21.790 --> 01:04:26.380
we return back into the iterator exactly where
it yielded so it just continues in its control

01:04:26.380 --> 01:04:30.849
flow. When it has nothing more to yield, it
returns, and that terminates the loop.

01:04:30.849 --> 01:04:39.650
It’s a limited form of coroutine, because
you don’t have the ability to sort of keep

01:04:39.650 --> 01:04:45.680
them running, multiple of them or so forth.
For example, you can’t run over two trees

01:04:45.680 --> 01:04:52.650
and check for the same fringe using iterators.
They have to be nested. But we decided – and

01:04:52.650 --> 01:04:57.470
this is kind of the 90% rule for programming
language design – most of the time, this

01:04:57.470 --> 01:05:01.990
somewhat limited use of iterators was what
you wanted. So rather than have a more complicated

01:05:01.990 --> 01:05:07.200
mechanism that got you further but wasn’t
as convenient to use in the normal case, we

01:05:07.200 --> 01:05:11.089
would go for the simpler mechanism. And it
was nice too because it had a very efficient

01:05:11.089 --> 01:05:17.309
implementation where we simply passed the
loop body as sort of a hidden routine to the

01:05:17.309 --> 01:05:21.609
iterator, which called every time it yielded.
So very straightforward.

01:05:21.609 --> 01:05:30.180
So that was CLU. And by 1978, we had a compiler
that was working well, we had a language,

01:05:30.180 --> 01:05:34.600
we had a reference manual, we had users. It
was being used at over 200 sites at one point.

01:05:34.600 --> 01:05:37.579
It was being used for building big software.

01:05:37.579 --> 01:05:47.440
I should say that it was important to design
a language for several reasons. One was people

01:05:47.440 --> 01:05:50.849
have to write programs in the language for
you to understand whether you have the right

01:05:50.849 --> 01:05:55.690
mechanisms in place. Our users, if they didn’t
like something, they would complain and we

01:05:55.690 --> 01:06:00.170
would think about whether our mechanisms were
powerful enough.

01:06:00.170 --> 01:06:05.109
Another is performance matters. So you need
to think about “How expensive is it?”

01:06:05.109 --> 01:06:12.260
For example, our exception mechanism, it only
cost about twice as much to signal an exception

01:06:12.260 --> 01:06:18.230
as it did to do a normal return. If exception
mechanisms are expensive, which is unfortunately

01:06:18.230 --> 01:06:23.210
the way things are in modern languages, people
don’t want to use them. Even though they

01:06:23.210 --> 01:06:27.200
might be wrong. I mean it may be that the
exception case doesn’t happen very often,

01:06:27.200 --> 01:06:31.510
and so if you look at the overall performance
of the program, the cost of the exception

01:06:31.510 --> 01:06:35.790
doesn’t matter very much, maybe. But we
felt it was important to have an efficient

01:06:35.790 --> 01:06:40.980
exception mechanism so that that barrier to
use would not exist.

01:06:40.980 --> 01:06:47.549
Then you want a mathematical definition. You
want a real mathematical object that people

01:06:47.549 --> 01:06:51.441
can understand the meaning of. So that was
another reason why it was important to do

01:06:51.441 --> 01:06:56.971
programming languages. Then we wanted a language
because people think in terms of… Programmers

01:06:56.971 --> 01:07:02.240
think in terms of programming languages, so
seeing those features just sets the stage

01:07:02.240 --> 01:07:04.490
for figuring out what to do.

01:07:04.490 --> 01:07:09.079
And by the way, once the features exist, now
you can start to simulate them in other languages

01:07:09.079 --> 01:07:14.020
and people will still see it’s a data abstraction.
So for many years 6.001, our introductory

01:07:14.020 --> 01:07:17.670
course that Gerry Sussman developed, they
were teaching data abstraction, but they were

01:07:17.670 --> 01:07:24.720
using basically a record of pointers to (provide)
the methods of the data type. And after data

01:07:24.720 --> 01:07:30.130
abstraction exists, you can kind of see that’s
the way to go. So that’s fine.

01:07:30.130 --> 01:07:38.990
That’s really the story of CLU. And it got
to be 1977 or 1978 and CLU was pretty much

01:07:38.990 --> 01:07:50.770
finished, and I started to think about what
to do next. At that time, I had already started

01:07:50.770 --> 01:07:53.640
teaching 6.170.

01:07:53.640 --> 01:07:56.650
Which is what?

01:07:56.650 --> 01:08:04.950
6.170 for many years was the second programming
course in our curriculum. And I was asked

01:08:04.950 --> 01:08:10.020
to develop this course by Corby and other
people in the department who thought we needed

01:08:10.020 --> 01:08:14.910
such a course. So our students would start
with 6.001, which was taught in Lisp, or Scheme

01:08:14.910 --> 01:08:23.319
actually, and they learned how to build little
programs. And the idea in 6.170 was “Okay.

01:08:23.319 --> 01:08:25.940
Now how do you build good, big programs?”

01:08:25.940 --> 01:08:29.559
So I developed this course. It was all based
on… It was about programming methodology,

01:08:29.559 --> 01:08:35.810
how do you do design, how do you use data
abstraction, how do you do modular design.

01:08:35.810 --> 01:08:43.349
It was really in line with my interests, and
I taught it for about – let me think, ’77

01:08:43.349 --> 01:08:50.500
– probably 20-25 years, something like that.
I to this day still get people telling me

01:08:50.500 --> 01:08:55.739
how important it was for them, what an impact
it had on their career, because it really

01:08:55.739 --> 01:09:03.109
did teach the students how to think about
modular design and how to organize a big project.

01:09:03.109 --> 01:09:08.209
And we still teach it. It’s just morphed
into another course, which… It was too much

01:09:08.209 --> 01:09:12.179
work for the students. This is an MIT problem
in general – courses are too much work for

01:09:12.179 --> 01:09:17.889
the students. So they sort of tried to divide
it. I’m not sure this has been terribly

01:09:17.889 --> 01:09:23.150
successful. I have a feeling these courses
tend to… more and more material accretes

01:09:23.150 --> 01:09:25.730
in the course as you go by.

01:09:25.730 --> 01:09:33.929
Anyway, so I was thinking about what to do
next. I could have continued working on programming

01:09:33.929 --> 01:09:40.069
language stuff, but I didn’t feel like I
had any great ideas. I didn’t see another

01:09:40.069 --> 01:09:45.309
abstraction mechanism. I didn’t see a way
where I would be able to make a big impact.

01:09:45.309 --> 01:09:49.519
I mean CLU, this work had made a huge impact,
so I’m sort of looking for impact like that.

01:09:49.519 --> 01:09:54.949
And iterators were really important too. But
parallel computing, I didn’t have any great

01:09:54.949 --> 01:10:01.469
ideas about what to do about that. So I thought,
“Well, no.” [laughs]

01:10:01.469 --> 01:10:09.900
I also thought about commercialization, but
I decided that… In these days maybe you

01:10:09.900 --> 01:10:16.679
can commercialize by putting stuff out on
the web and people will start to pick it up

01:10:16.679 --> 01:10:22.270
and maybe there will be users who contribute
to the implementation and so forth. I think

01:10:22.270 --> 01:10:25.360
it’s still an awful lot of work. I think
the people who put it out there end up spending

01:10:25.360 --> 01:10:30.969
most of their time focused on that. So it’s
not really research. It’s much more development.

01:10:30.969 --> 01:10:37.389
So that didn’t seem like a very good direction
to go in.

01:10:37.389 --> 01:10:43.289
I was looking around thinking about what to
do, and I started to think about the ARPANET.

01:10:43.289 --> 01:10:51.429
And I really don’t know, I don’t remember
what it was that caused me to see this problem

01:10:51.429 --> 01:10:56.249
lurking in the ARPANET. It wasn’t a problem
that I invented. Bob Kahn had been writing

01:10:56.249 --> 01:11:03.780
papers about the ARPANET. So in those days
people did email, people did FTP, people did

01:11:03.780 --> 01:11:08.459
remote login. That was kind of what you did
on the Internet, and I was using email already.

01:11:08.459 --> 01:11:13.440
I mean people have told me email didn’t
exist so early, but it existed in the ’70s

01:11:13.440 --> 01:11:21.280
because I was using it. But there was a dream
of writing distributed programs where they

01:11:21.280 --> 01:11:24.809
would have components running on different
computers and they would communicate by sending

01:11:24.809 --> 01:11:32.419
messages, and nobody knew how to do that.
So I thought, “Ah, this is a great problem,”

01:11:32.419 --> 01:11:35.179
and so I jumped into distributed computing.

01:11:35.179 --> 01:11:40.219
This was in the late ’70s. I just switched
directions. I didn’t switch totally because

01:11:40.219 --> 01:11:46.190
I was still working on 6.170. I had been thinking
about “How do you reason about the correctness

01:11:46.190 --> 01:11:52.280
of abstract data types? How do you write specifications
for abstract data types?” A lot of this

01:11:52.280 --> 01:11:58.139
was being taught to the students in my course.
I was also…

01:11:58.139 --> 01:12:08.619
If I could, I’m going to pause you for a
moment.

01:12:08.619 --> 01:12:14.110
[Recording was paused for everyone to take
a break]

01:12:14.110 --> 01:12:15.739
Okay. So where were…? [laughs]

01:12:15.739 --> 01:12:19.610
[A lot of it was being tied to your students…]

01:12:19.610 --> 01:12:25.000
In 6.170, yeah. And I was working with John
Guttag. I forget when John came to MIT. He

01:12:25.000 --> 01:12:30.650
had done his thesis on specifications of abstract
data types. Steve Zilles had done a similar…

01:12:30.650 --> 01:12:36.481
didn’t quite finish his thesis, but a similar
kind of research. So John and I were working

01:12:36.481 --> 01:12:41.949
together. We started working together on 6.170.
We wrote a book. I was still interested in

01:12:41.949 --> 01:12:45.530
the programming methodology stuff. Not so
much the programming language stuff, but the

01:12:45.530 --> 01:12:53.519
programming methodology stuff. But I jumped
into research in distributed computing, and

01:12:53.519 --> 01:13:07.570
I really stayed in that area after that, with
a few diversions into other stuff, and had

01:13:07.570 --> 01:13:09.999
a good time.

01:13:09.999 --> 01:13:15.739
I thought it was ironic in a way that I decided
to not look at concurrency when I was working

01:13:15.739 --> 01:13:21.090
on CLU on the grounds that I had enough on
my plate and that would have just been a huge

01:13:21.090 --> 01:13:28.139
distraction. When I got into distributed computing,
of course concurrency came right back, so

01:13:28.139 --> 01:13:32.639
I’m thinking about concurrency again since
clearly you have all these computers and they’re

01:13:32.639 --> 01:13:40.939
all working in parallel and so forth. In a
way, distributed computing is a great place

01:13:40.939 --> 01:13:44.880
to think in terms of abstract data types because
you want to have different objects running

01:13:44.880 --> 01:13:48.260
on different machines, they’re going to
communicate.

01:13:48.260 --> 01:13:52.409
One of the things I was thinking about in
the early days of the first project, which

01:13:52.409 --> 01:13:57.690
was the Argus project to develop a language
to implement these distributed programs, was

01:13:57.690 --> 01:14:04.340
“What is the communication mechanism?”
I ended up strongly on the side of remote

01:14:04.340 --> 01:14:12.159
procedure call. You know, that on my remote
machine I have an object, it provides operations,

01:14:12.159 --> 01:14:20.110
and over here I call those operations. And
then under the cover, stuff is passing. Argus

01:14:20.110 --> 01:14:24.650
was one language system, so we would have
been able to… If you’re running on one

01:14:24.650 --> 01:14:28.119
machine and you have one language, you can
do a much more efficient remote procedure

01:14:28.119 --> 01:14:33.230
call than you can do if you worry about heterogeneous
machines, different programming languages,

01:14:33.230 --> 01:14:35.039
and so forth.

01:14:35.039 --> 01:14:43.059
Anyway, I started working in distributed computing
and that was a long haul. In the ’80s and

01:14:43.059 --> 01:14:52.019
the ’90s I had some great students. I’m
not sure what to talk about there. It’s…

01:14:52.019 --> 01:15:02.000
Well, let’s see. Who influenced you? Were
you… How about Lampson ? Was he a… his

01:15:02.000 --> 01:15:04.719
stuff at Xerox? Or…

01:15:04.719 --> 01:15:12.719
Well, so I was definitely at this point going
to operating system conferences. Certainly

01:15:12.719 --> 01:15:22.550
I… Another course I taught at MIT was 6.033,
the systems course. I taught that many times.

01:15:22.550 --> 01:15:29.440
And so Multics and various operating systems,
all that stuff.

01:15:29.440 --> 01:15:34.769
I wouldn’t say… You know, it’s hard
to answer. I wouldn’t say that Butler’s

01:15:34.769 --> 01:15:46.360
work particularly influenced me. There was
a group in the ’70s of DARPA contractors

01:15:46.360 --> 01:15:52.900
who got together a couple times a year to
talk about programming languages and programming

01:15:52.900 --> 01:15:57.979
methodology. So Butler was in that group,
Bill Wulf and Mary Shaw were in that group,

01:15:57.979 --> 01:16:05.939
I was in that group, Jim Horning, the Euclid
developers. So there, I used to go that meeting

01:16:05.939 --> 01:16:12.070
every six months or so, and there was a lot
of exchange of ideas. You look at a language

01:16:12.070 --> 01:16:19.760
like Euclid and you can see data abstraction,
specifications, all that stuff was going on.

01:16:19.760 --> 01:16:24.340
But when I moved into… No, the thing that
influenced me was transactions.

01:16:24.340 --> 01:16:25.340
Right.

01:16:25.340 --> 01:16:27.679
Yeah, that’s right.

01:16:27.679 --> 01:16:32.840
And that was coming from Jim Gray, from System
R, from the database community.

01:16:32.840 --> 01:16:35.760
Right. And then Lampson and Sturgis with the
stable…

01:16:35.760 --> 01:16:44.550
The stable storage , but that was really much
more a 6.033 topic than it was an Argus topic.

01:16:44.550 --> 01:16:50.849
So what we did in Argus was we brought transactions
into the programming language. We were interested

01:16:50.849 --> 01:16:59.199
in the point that when you make one of these
remote procedure calls, you can’t be sure

01:16:59.199 --> 01:17:02.719
you’re going to get an answer because you’re
talking to a different machine and there could

01:17:02.719 --> 01:17:08.619
be a reason why communication isn’t working,
and you will never know what that reason is

01:17:08.619 --> 01:17:13.909
because you might just not have been waiting
long enough for the answer to come back or

01:17:13.909 --> 01:17:19.630
it might really be down. Right? This is the
beauty and the horribleness of distributed

01:17:19.630 --> 01:17:24.289
computing. I think it’s kind of neat myself,
that you just have to get in this mindset

01:17:24.289 --> 01:17:29.730
where the lack of an answer tells you nothing,
right?

01:17:29.730 --> 01:17:36.880
The problem is here I am on the calling side
and I don’t want to wait forever, so what

01:17:36.880 --> 01:17:41.019
do I do? Well, what we thought you did was
you’re running a little subaction and you

01:17:41.019 --> 01:17:47.030
abort it, and that means even if it happened
over there, it hasn’t really happened and

01:17:47.030 --> 01:17:50.119
so you don’t have to worry about it. You
could try an alternative technique and so

01:17:50.119 --> 01:17:51.119
forth.

01:17:51.119 --> 01:17:56.210
That was a big piece of originality in Argus.
We ran the whole thing as transactions. So

01:17:56.210 --> 01:18:02.249
we had objects that were instances of data
types. They ran on individual machines. And

01:18:02.249 --> 01:18:06.449
then we ran computations as transactions,
and every time we made a remote call, we ran

01:18:06.449 --> 01:18:13.960
it as a subaction. That was sort of the position
of Argus. I don’t think it was necessarily

01:18:13.960 --> 01:18:20.780
a good idea because it was complicated and
expensive. I’m not sure I would do things

01:18:20.780 --> 01:18:26.679
the same way were I to do it today. I would
probably use a much simpler model of computation.

01:18:26.679 --> 01:18:30.400
One thing that’s interesting, a piece of
history about Argus though, is that X-Windows

01:18:30.400 --> 01:18:36.489
came out of Argus. Bob Scheifler was working
for me. He was one of two staff members who

01:18:36.489 --> 01:18:42.530
were big implementers for us. He’s a marvelous
implementer. We needed a way of debugging

01:18:42.530 --> 01:18:48.900
distributed programs you’re running, and
he came up with X-Windows because what was

01:18:48.900 --> 01:18:52.739
nice was you could have a window over here
watching that… we called them “guardians,”

01:18:52.739 --> 01:18:56.709
these objects, and another one over here watching
this guardian. So it gave you a very nice

01:18:56.709 --> 01:18:58.889
debugging environment.

01:18:58.889 --> 01:19:10.969
Then Jerry Saltzer had been in charge of Project
Athena and Kerberos had come out of that.

01:19:10.969 --> 01:19:16.590
That was a big hit because it was public domain,
and so Mike Dertouzos thought, “Well, let’s

01:19:16.590 --> 01:19:21.619
try to make X into the public domain,” so
we formed the X Consortium. This was kind

01:19:21.619 --> 01:19:28.469
of the start of windows being the way that
you managed your system in a distributed world.

01:19:28.469 --> 01:19:32.429
It wasn’t the first windows. There was something
called W I think which preceded it. W, X – “X”

01:19:32.429 --> 01:19:39.310
is after “W.” But it was just an interesting
little sidelight on what was going on. It

01:19:39.310 --> 01:19:43.409
wasn’t my invention, it was Bob’s.

01:19:43.409 --> 01:19:48.269
So we implemented Argus. I mean at this point,
we’re trying to make some sense out of “What

01:19:48.269 --> 01:19:53.479
are distributed systems?” and there’s
a lot of work in the operating system community,

01:19:53.479 --> 01:20:00.269
people are thinking about “Maybe I just
have a great big heap, and programs run and

01:20:00.269 --> 01:20:05.630
they share these objects in the heap.” I’m
not sure that this work ever really went anywhere

01:20:05.630 --> 01:20:11.329
in the sense of “People are building programs
using that,” because what happened was the

01:20:11.329 --> 01:20:16.849
big RPC model came in. The idea was you build
your components, they communicate through

01:20:16.849 --> 01:20:23.360
an interface that’s described in the library,
and software connects them together, so you

01:20:23.360 --> 01:20:28.679
get heterogeneity. The performance is not
great, but that was the idea.

01:20:28.679 --> 01:20:37.360
Anyway, I worked on Argus and then students
who were working for me at the time, we were

01:20:37.360 --> 01:20:47.239
thinking about data abstraction and concurrency.
So Bill Weihl wrote a thesis on commutativity

01:20:47.239 --> 01:20:51.780
and how you can use the specification of an
abstract data type to figure out how much

01:20:51.780 --> 01:20:58.679
concurrency’s allowed. In a database at
that time, they used two-phase locking. That’s

01:20:58.679 --> 01:21:03.719
a mechanism that has no understanding of any
meaning. It’s just a technique that you

01:21:03.719 --> 01:21:08.599
can use that will guarantee serializability.
There was also optimistic concurrency control

01:21:08.599 --> 01:21:14.150
– not used so much then, but used a lot
later. But Bill’s idea was “If I understand

01:21:14.150 --> 01:21:18.159
the semantics of the operations, I can get
more concurrency than would be allowed by

01:21:18.159 --> 01:21:22.389
these concurrency control mechanisms that
don’t understand the semantics.” So that

01:21:22.389 --> 01:21:27.329
was an early piece of work that came out of
that group.

01:21:27.329 --> 01:21:32.869
Then another thing that happened in the ’80s
was we invented what’s essentially Paxos.

01:21:32.869 --> 01:21:35.949
We invented something called “viewstamped
replication” – this was another one of

01:21:35.949 --> 01:21:42.699
my students, Brian Oki – because we were
interested in reliability and availability.

01:21:42.699 --> 01:21:49.769
I mean I thought of distributed computing
as being both a blessing and a curse. If your

01:21:49.769 --> 01:21:56.670
machine went down in a non-distributed system,
you can’t do anything until it comes up.

01:21:56.670 --> 01:22:01.789
With a distributed system, you could have
stuff someplace else so maybe you could continue

01:22:01.789 --> 01:22:02.789
working.

01:22:02.789 --> 01:22:06.530
On the other hand, if you have stuff someplace
else and you don’t have a way of controlling

01:22:06.530 --> 01:22:10.919
things, then there’s more than one failure
that can cause you to stop working, so what

01:22:10.919 --> 01:22:18.119
do you do about that? We came up with a replication
technique to ensure that everything worked

01:22:18.119 --> 01:22:26.110
properly, and as long as f out of 2f + 1 nodes
were working… So yeah.

01:22:26.110 --> 01:22:32.899
Okay. So why don’t you tell us about the
Liskov substitution principle?

01:22:32.899 --> 01:22:40.610
That was an interesting thing that happened
in the ’80s. At the same time that I was

01:22:40.610 --> 01:22:50.670
developing CLU and Bill and Mary were working
on Alphard, Alan Kay and Adele Goldberg were

01:22:50.670 --> 01:23:00.360
working on Smalltalk. On the west coast. Although
it may seem a little strange these days, in

01:23:00.360 --> 01:23:04.929
those days it was a long way from the east
coast to the west coast, and of course we

01:23:04.929 --> 01:23:11.219
had no conference calls in those days too.
That whole business about object-oriented

01:23:11.219 --> 01:23:15.210
programming was developing on the west coast
and on the east coast we were mostly working

01:23:15.210 --> 01:23:21.459
on data abstraction, and the two worlds were
kind of separated. So I knew the name, but

01:23:21.459 --> 01:23:28.749
we didn’t run into each other at conferences
and there wasn’t much crosstalk going on.

01:23:28.749 --> 01:23:34.969
In the 1980s, I was asked to give a keynote
at OOPSLA , which I think it was maybe the

01:23:34.969 --> 01:23:41.659
second OOPSLA. It hadn’t been in existence
very long. So I decided that this was a good

01:23:41.659 --> 01:23:46.719
opportunity to learn about what was going
on in object-oriented languages. So I started

01:23:46.719 --> 01:23:53.679
reading all the papers and I discovered that
hierarchy was being used for two different

01:23:53.679 --> 01:23:59.349
purposes. One was simply inheritance. So I
have a class, it implements something, I can

01:23:59.349 --> 01:24:06.429
build a subclass, I can borrow all that implementation,
change it however I want, add a few extra

01:24:06.429 --> 01:24:11.269
methods, change the representation. Whatever
I want to do, I just sort of borrow the code

01:24:11.269 --> 01:24:13.580
and keep working on it.

01:24:13.580 --> 01:24:19.579
The other way it was being used was for type
hierarchy. So the idea was that the superclass

01:24:19.579 --> 01:24:26.749
would define a supertype, and then a subclass
would extend this to become a subtype. I thought

01:24:26.749 --> 01:24:32.420
this idea of type hierarchy was very interesting,
but I also felt that they didn’t understand

01:24:32.420 --> 01:24:37.919
it very well. I remember reading papers in
which it was clear they were very confused

01:24:37.919 --> 01:24:42.249
about it, because one in particular that I
remember said that a stack and a queue were

01:24:42.249 --> 01:24:49.860
both subtypes of one another. This is clearly
not true because if you wrote a program that

01:24:49.860 --> 01:24:53.979
expected a stack and you got a queue instead,
you would be very surprised by its behavior.

01:24:53.979 --> 01:24:58.749
The difference between LIFO and FIFO is a
big deal.

01:24:58.749 --> 01:25:04.900
This led me to start thinking about “What
does it really mean to have a supertype and

01:25:04.900 --> 01:25:11.579
subtype?” And I came up with a rule, an
informal rule which I presented in my keynote

01:25:11.579 --> 01:25:19.469
at OOPSLA which simply said that a subtype
should behave like a supertype as far as you

01:25:19.469 --> 01:25:24.449
can tell by using the supertype methods. So
it wasn’t that it couldn’t behave differently.

01:25:24.449 --> 01:25:29.860
It’s just that as long as you limited your
interaction with its objects to the supertype

01:25:29.860 --> 01:25:35.159
methods, you would get the behavior you expected.

01:25:35.159 --> 01:25:40.309
This was an informal definition just given
based on intuition. It’s intuitively right

01:25:40.309 --> 01:25:44.800
in some sense. You can see how you understand
the supertype, you write some code in terms

01:25:44.800 --> 01:25:49.140
of the supertype, whatever object you get
should behave that way you expect. Otherwise

01:25:49.140 --> 01:25:53.550
how can you do this independent reasoning
about behavior?

01:25:53.550 --> 01:26:00.739
Later on Jeannette Wing, who actually had
been my master’s student I think and then

01:26:00.739 --> 01:26:05.479
John Guttag’s PhD student, approached me
and said, “Why don’t we try to figure

01:26:05.479 --> 01:26:09.610
out precisely what this means?” So we worked
together on this in some papers that got published

01:26:09.610 --> 01:26:11.500
a bit later.

01:26:11.500 --> 01:26:17.959
Meanwhile I was working on distributed computing,
I was particularly interested in viewstamped

01:26:17.959 --> 01:26:22.781
replication and some of the other work that
was going on in my group at the time, and

01:26:22.781 --> 01:26:27.500
I wasn’t really thinking about this until
sometime in the ’90s when I got an email

01:26:27.500 --> 01:26:32.330
from someone who said, “Can you tell me
if this is the correct meaning of the Liskov

01:26:32.330 --> 01:26:38.619
substitution principle?” So that was the
first time I had any idea [laughs] that there

01:26:38.619 --> 01:26:44.289
was such a thing, that this name had developed.
Technically it’s called “behavioral subtyping.”

01:26:44.289 --> 01:26:49.689
You know, it says subtypes behave like supertypes.
So I just thought that was very amusing. I

01:26:49.689 --> 01:26:54.519
discovered there were lots and lots of people
on the Internet having arguments about what

01:26:54.519 --> 01:26:59.380
the Liskov substitution principle meant. So
it was nice to have something that had an

01:26:59.380 --> 01:27:04.280
impact like that. I would say you put data
abstraction together with type hierarchy and

01:27:04.280 --> 01:27:09.269
now you have sort of modern object-oriented
programming.

01:27:09.269 --> 01:27:17.530
But that was a little deviation from the work
I was doing, which was all distributed computing.

01:27:17.530 --> 01:27:25.849
I worked on distributed computing through
the ’80s and ’90s. And it’s kind of

01:27:25.849 --> 01:27:31.840
hard to remember all the different projects
that were going on. Sometime in the fairly

01:27:31.840 --> 01:27:39.139
early ’90s I started working on the Thor
project, which in some sense was the opposite

01:27:39.139 --> 01:27:48.110
of Argus. So Argus was a project in which
the objects were the components of the distributed

01:27:48.110 --> 01:27:57.139
system. Thor was a project in which you had
a client-server model, the objects were stored

01:27:57.139 --> 01:28:02.130
in the servers, and the clients interacted
with one another only through their use of

01:28:02.130 --> 01:28:03.130
the objects.

01:28:03.130 --> 01:28:08.209
So it was much more of a database view of
the world than Argus was. And we were still

01:28:08.209 --> 01:28:12.590
running transactions, but now these were transactions…
they weren’t distributed transactions as

01:28:12.590 --> 01:28:20.090
in Argus. They were one-machine transactions
where a client would run against the objects

01:28:20.090 --> 01:28:23.829
at the servers and at the end either commit
or abort, and that would cause the global

01:28:23.829 --> 01:28:31.219
state to change. And I think that might be
more productive way of building applications.

01:28:31.219 --> 01:28:37.630
That was truly an object-oriented system as
opposed to a database system. We used a very

01:28:37.630 --> 01:28:42.630
interesting form of optimistic concurrency
control and we did a lot of work on cache

01:28:42.630 --> 01:28:51.530
management and other techniques that made
the system perform well.

01:28:51.530 --> 01:29:01.840
As you know, performance is greatly overrated
in the minds of computer scientists. On the

01:29:01.840 --> 01:29:05.800
other hand, performance matters a lot when
you’re building a platform that you would

01:29:05.800 --> 01:29:09.849
like to people to build applications on top
of. So it matters a lot in an operating system.

01:29:09.849 --> 01:29:14.840
It would matter a lot in a system like Thor
or Argus because you would expect to build

01:29:14.840 --> 01:29:19.949
on top, and any problem with the performance
that exists at the level of the implementation

01:29:19.949 --> 01:29:29.309
of the platform will be multiplied when you
get to the top level.

01:29:29.309 --> 01:29:37.249
In the ’90s, in addition to the work on
Thor, my group did two other things that I

01:29:37.249 --> 01:29:43.960
thought were notable. The first was Byzantine
fault tolerance and the other one was decentralized

01:29:43.960 --> 01:29:50.599
information flow control. The first one…
I’m not sure exactly the order these happened.

01:29:50.599 --> 01:29:56.349
They’re probably simultaneous. The first
one happened with my student Miguel Castro.

01:29:56.349 --> 01:30:06.989
What happened was I saw a request for proposal
from DARPA talking about malicious intruders

01:30:06.989 --> 01:30:12.959
on the Internet and what can we do to counteract
their impact. And I gave this to Miguel. I

01:30:12.959 --> 01:30:16.030
said, “Think about this. See if you can
think of something interesting we might propose

01:30:16.030 --> 01:30:22.139
to do.” And he thought, “Well, maybe we
should look at this question of replication

01:30:22.139 --> 01:30:28.570
in the presence of Byzantine attacks,” and
this ultimately turned into that work on Byzantine

01:30:28.570 --> 01:30:29.769
fault tolerance.

01:30:29.769 --> 01:30:34.039
It wasn’t that people hadn’t worked on
it before, but they had been mostly theoreticians,

01:30:34.039 --> 01:30:39.979
and so they weren’t thinking about a practical
technique, one that would have a low cost

01:30:39.979 --> 01:30:44.159
or as low cost as you could manage, and it
would really be able to be used in practice.

01:30:44.159 --> 01:30:46.699
So we should say what “Byzantine” means.

01:30:46.699 --> 01:30:52.610
Oh. “Byzantine” means arbitrary failures.
The work I did in the ’80s on viewstamped

01:30:52.610 --> 01:30:58.499
replication, otherwise known as Paxos, assumed
benign failures where a computer was either

01:30:58.499 --> 01:31:05.899
running or it wasn’t. You know, a message
either arrived or it didn’t. It wasn’t

01:31:05.899 --> 01:31:12.479
garbled in some way. The computer either failed
by crashing or it was running correctly. You

01:31:12.479 --> 01:31:18.360
know, the message arrived intact or it didn’t
come at all. Or maybe it arrived and it wasn’t

01:31:18.360 --> 01:31:21.709
intact, but you recognized it right away and
you could throw it away.

01:31:21.709 --> 01:31:26.949
With Byzantine failures, the computer keeps
running. It’s not running properly anymore,

01:31:26.949 --> 01:31:31.820
but it’s running nevertheless. Of course
mostly this will happen and you’ll be able

01:31:31.820 --> 01:31:35.679
to know that it’s not running properly,
because it will be doing weird things, but

01:31:35.679 --> 01:31:40.719
a real Byzantine failure is one where it continues
to run and it looks like it’s okay. And

01:31:40.719 --> 01:31:45.179
there were examples of this happening. For
example, you’re probably aware of the stuff

01:31:45.179 --> 01:31:50.929
that was going on in the networking community
where a little flip of a bit in a message

01:31:50.929 --> 01:31:56.689
caused all sorts of problems to develop in
routing and so forth of the message.

01:31:56.689 --> 01:32:03.059
In the case of Byzantine failures in running
a computer, these were mostly the result of

01:32:03.059 --> 01:32:09.440
attacks. And it’s interesting, when I first
started working in the Internet in the ’80s,

01:32:09.440 --> 01:32:16.289
we were just a group of pals. Everybody was
a friend. It started off as a group of universities

01:32:16.289 --> 01:32:23.369
connected by the ARPANET, and we didn’t
really worry about attacks because nobody

01:32:23.369 --> 01:32:27.780
was interested in doing attacks. We were just
interested in “How do you make things work?”

01:32:27.780 --> 01:32:34.550
As we moved into the ’90s, this was increasingly
not a valid assumption. Once the World Wide

01:32:34.550 --> 01:32:35.610
Web came along…

01:32:35.610 --> 01:32:41.869
And I should say right now that, like everybody
else I know in the sort of mainstream computer

01:32:41.869 --> 01:32:47.340
science community, I didn’t see it coming.
I had no idea that we were going to move from

01:32:47.340 --> 01:32:52.949
these computers that my pals were using to
something where the whole world started to

01:32:52.949 --> 01:32:55.919
use it. That was an amazing transformation.

01:32:55.919 --> 01:33:01.159
Anyway, as it became this thing that the whole
wide world was using, then the problem of

01:33:01.159 --> 01:33:07.669
bad actors who would try to launch attacks
on people’s computers for purposes we know

01:33:07.669 --> 01:33:12.959
today of really bad stuff, like encrypting
your files and then demanding blackmail money

01:33:12.959 --> 01:33:15.630
to give you the key and stuff like that.

01:33:15.630 --> 01:33:19.729
So in the ’90s, we were in a transitional
period where we began to think that maybe

01:33:19.729 --> 01:33:27.360
these attacks actually mattered. So the question
of how to do a replication technique that

01:33:27.360 --> 01:33:34.809
would handle Byzantine attacks where one of
the replicas was in fact behaving maliciously

01:33:34.809 --> 01:33:40.070
and would appear to be behaving properly but
was actually not behaving properly. For example

01:33:40.070 --> 01:33:45.070
you’d say, “Run this operation for me,”
and it would come back and say, “Okay, and

01:33:45.070 --> 01:33:49.499
here’s your answer,” but in reality it
had done something entirely different. That

01:33:49.499 --> 01:33:52.300
was an example of a Byzantine attack [really
“failure”].

01:33:52.300 --> 01:34:02.420
So Miguel and I worked on this problem, how
to do a practical protocol. For a benign failure

01:34:02.420 --> 01:34:11.369
you need 2f + 1 replicas. So to handle one
bad replica, you need 3. For Byzantine you

01:34:11.369 --> 01:34:18.480
need 3f + 1. So you would need four. And you
also need a more complicated protocol. And

01:34:18.480 --> 01:34:22.159
I’m convinced that one of the reasons we
were able to figure out how to do this was

01:34:22.159 --> 01:34:28.000
because we had done viewstamped replication
in my group earlier, and looking back at what

01:34:28.000 --> 01:34:33.939
happened, I see Byzantine fault tolerance
as being viewstamped replication extended

01:34:33.939 --> 01:34:42.189
a little bit. It has an extra phase in the
protocol, it has an extra replica, but it’s

01:34:42.189 --> 01:34:46.209
quite closely related. So I think it helped
Miguel and me when we were trying to figure

01:34:46.209 --> 01:34:51.159
out how to make this work that we had that
background to depend on.

01:34:51.159 --> 01:34:55.989
The other major deviation was decentralized
information flow control. This was work I

01:34:55.989 --> 01:35:04.719
did with my student Andrew Myers. For security
in systems, there had always been two different

01:35:04.719 --> 01:35:12.179
approaches. Access control, which controlled
what a program could access or what a user

01:35:12.179 --> 01:35:15.989
was allowed to access, but once something
could be accessed, you could do anything you

01:35:15.989 --> 01:35:20.849
wanted to with it. Information flow control
didn’t control access. It controlled what

01:35:20.849 --> 01:35:26.219
could happen with the information after the
fact. So if you were entitled to read secret

01:35:26.219 --> 01:35:30.739
files – and this came out of this kind of
work in the military – then you would not

01:35:30.739 --> 01:35:35.780
be allowed to expose that information except
to something where secret information could

01:35:35.780 --> 01:35:40.639
go. So it wasn’t the control of what you
looked at that mattered, it was the control

01:35:40.639 --> 01:35:42.539
of what you did with it.

01:35:42.539 --> 01:35:48.239
These systems had always been based on a centralized
notion of who was in control of things. There

01:35:48.239 --> 01:35:52.790
was Top Secret, there was Secret, there was
Confidential. Somebody was classifying everything

01:35:52.790 --> 01:35:58.829
and then the system just followed the rules
based on those sort of centralized notions.

01:35:58.829 --> 01:36:04.709
What I did with Andrew was to decentralize
this so that individual users could put labels

01:36:04.709 --> 01:36:09.879
on their data based on their own desires for
the control and then make the whole thing

01:36:09.879 --> 01:36:14.280
work in the same way, controlling the access.
And that’s led to quite a bit of work in

01:36:14.280 --> 01:36:20.150
programming languages and operating systems
after the fact. We worked on Thor and we worked

01:36:20.150 --> 01:36:25.979
on these two interesting directions, and we
did some programming language work too, especially

01:36:25.979 --> 01:36:30.780
with Andrew who was a programming language
person working in my group.

01:36:30.780 --> 01:36:36.419
That took us through the end of the ’90s.
Then I took a couple years off and worked

01:36:36.419 --> 01:36:42.090
for a startup just to see what it was like.
This was a startup called SightPath that was

01:36:42.090 --> 01:36:47.780
fairly soon after I joined bought by Cisco,
and I ended up working there for two years.

01:36:47.780 --> 01:36:56.539
I would say working in a company was not my
cup of tea, so I returned to MIT and I became

01:36:56.539 --> 01:37:06.699
head of the computer science part of our department.
I continued working on distributed computing,

01:37:06.699 --> 01:37:11.469
developed a system called Aeolus, which was
a decentralized information flow control system

01:37:11.469 --> 01:37:17.880
with a programming language component. Then
I started working in the administration at

01:37:17.880 --> 01:37:25.010
MIT. I was Associate Provost for Faculty Equity.
So that was what was happening in the 2000s.

01:37:25.010 --> 01:37:31.749
Then I decided to retire, and I retired a
couple years ago. But in 2012 I sort of stopped

01:37:31.749 --> 01:37:35.090
working in distributed computing and since
then I’ve been working in programming languages

01:37:35.090 --> 01:37:41.789
and multicore machines just to sort of continue
the… I like to move around and I decided

01:37:41.789 --> 01:37:46.090
it was time to move around for a while, so
I’ve been doing that.

01:37:46.090 --> 01:37:49.039
So that’s sort of what I’ve done.

01:37:49.039 --> 01:37:56.260
Let’s see. A couple things. When you were
doing the Provost thing, what was that and

01:37:56.260 --> 01:37:57.989
how did it work out?

01:37:57.989 --> 01:38:05.869
Well, when I was Associate Head for Computer
Science, I was in that position for three

01:38:05.869 --> 01:38:12.880
years and I hired five women in three years
after a long period in which we had somehow

01:38:12.880 --> 01:38:20.789
or other never been able to find women that
could be hired. And these women have all done

01:38:20.789 --> 01:38:25.139
extremely well, so it wasn’t like I was
making compromises to hire them. I just managed

01:38:25.139 --> 01:38:27.270
to find them where other people couldn’t
see them.

01:38:27.270 --> 01:38:35.349
So the person who… It’s a long, complicated
story. But anyway, it was this kind of thing

01:38:35.349 --> 01:38:43.099
– sort of trying to make sure that departments
all across the Institute were doing the right

01:38:43.099 --> 01:38:48.280
thing as far as women and underrepresented
minorities were concerned. Mostly it had to

01:38:48.280 --> 01:38:54.110
do with first of all you want the data. So
you want to know what’s happening. Then

01:38:54.110 --> 01:38:58.559
you… There’s a lot of… You want to make
sure the search is carried out properly and

01:38:58.559 --> 01:39:03.329
you want to make sure that department heads
understand certain basic things. Like for

01:39:03.329 --> 01:39:08.179
example it’s their responsibility to make
sure that their junior faculty are not being

01:39:08.179 --> 01:39:15.899
asked to do the wrong jobs. For example a
lot of people don’t understand that women

01:39:15.899 --> 01:39:20.400
are much more willing to say yes to things
than men are. So if you say, “Would you

01:39:20.400 --> 01:39:26.059
teach this lab course? And oh, by the way,
it’s really a hard job,” a young woman

01:39:26.059 --> 01:39:29.500
assistant professor is much more likely to
say yes than a man is, so you have to sort

01:39:29.500 --> 01:39:33.019
of take this kind of stuff into account. So
it was just that kind of stuff. Trying to

01:39:33.019 --> 01:39:38.679
make the Institute better by making sure that
we were doing a good job of this.

01:39:38.679 --> 01:39:41.719
And you think it’s made a difference?

01:39:41.719 --> 01:39:45.469
I think that it helped when I was in the position.
I think this is the kind of stuff that you

01:39:45.469 --> 01:39:50.249
have to pay attention to, it has to come from
top, and if you stop paying attention to it,

01:39:50.249 --> 01:39:58.059
I think things will slide. So I haven’t…
I did my bit and now I’ve passed it on to

01:39:58.059 --> 01:39:59.729
others.

01:39:59.729 --> 01:40:01.829
So in general, how do you feel about MIT?

01:40:01.829 --> 01:40:08.399
Oh, I absolutely love MIT. I think it’s
been a great place to work. I mean I would

01:40:08.399 --> 01:40:13.979
say the lab is also a great place. MIT has
this peculiar sort of matrix organization

01:40:13.979 --> 01:40:20.079
where there are departments and then we do
our research in a lab. So I’ve been in…

01:40:20.079 --> 01:40:25.139
it was Project MAC, then it was Lab for Computer
Science, then we merged with the AI lab. Now

01:40:25.139 --> 01:40:29.699
it’s CSAIL – Computer Science and AI Lab.

01:40:29.699 --> 01:40:38.209
But MIT has been wonderful – the quality
of the students, the quality of the faculty,

01:40:38.209 --> 01:40:45.169
the interest in doing research and really
understanding things from first principles.

01:40:45.169 --> 01:40:50.749
I mean I find this is true even in our undergraduates.
They want to really understand things and

01:40:50.749 --> 01:40:58.659
so it just makes a wonderful environment.
I also have found my colleagues very collaborative.

01:40:58.659 --> 01:41:03.380
I love to come to work every day. It’s just
been great.

01:41:03.380 --> 01:41:11.169
Let’s see. A couple of other things that
I wanted to make sure we covered. Tell us

01:41:11.169 --> 01:41:17.560
a little bit about the Turing itself. When
did you hear you were getting the award? What’s

01:41:17.560 --> 01:41:20.469
it been like?

01:41:20.469 --> 01:41:26.159
I received the award… It’s the 2008 Turing
Award. I received it in 2009. This has been

01:41:26.159 --> 01:41:33.489
a mystery to me why they have this offset
in years. It’s something historical.

01:41:33.489 --> 01:41:38.610
I learned about it because I got a phone call
from Brian Randell. He was the head of the

01:41:38.610 --> 01:41:43.629
Turing committee that year and I knew him
from the old times. He was another one of

01:41:43.629 --> 01:41:49.800
the people doing work in programming methodology
in the days when I was in that field. That

01:41:49.800 --> 01:41:54.530
was a huge surprise. He says to me, I picked
up the phone, “This is Brian Randell.”

01:41:54.530 --> 01:42:01.039
I hadn’t seen him in years. He said, “You
better sit down.” [laughs] So that was great.

01:42:01.039 --> 01:42:05.670
It’s wonderful to receive the Turing Award
because it’s such a validation of what you

01:42:05.670 --> 01:42:16.010
did. And what was interesting for me was that,
because of the way I have moved around, I

01:42:16.010 --> 01:42:21.200
had stopped working in data abstraction, programming
languages, methodology. I’d been just working

01:42:21.200 --> 01:42:28.169
in distributed computing and I wasn’t even
thinking about that stuff. So I got the award

01:42:28.169 --> 01:42:33.929
and it caused me to go back and think about
what things were like in the old days.

01:42:33.929 --> 01:42:37.300
The first surprise was that I discovered my
students didn’t really know there was a

01:42:37.300 --> 01:42:43.729
life before data abstraction. And they actually
didn’t even know some of these old papers.

01:42:43.729 --> 01:42:49.849
I was pretty surprised by that. So I went
back and I reread all those old papers. It

01:42:49.849 --> 01:42:56.159
was very interesting to look back. And these
are extremely good papers too. It’s really

01:42:56.159 --> 01:43:01.409
a part of our history that should not be forgotten.

01:43:01.409 --> 01:43:07.010
As I like to tell people, when I got the award,
there’s a lot of buzz on the Internet, and

01:43:07.010 --> 01:43:12.949
my husband was online every day looking at
what the stuff was. And of course not everything

01:43:12.949 --> 01:43:18.149
you see out there is nice. In fact, [laughs]
many things are not so nice. So there’s

01:43:18.149 --> 01:43:21.969
nice things, there’s not so nice things.
But anyway, one thing he found out there one

01:43:21.969 --> 01:43:28.159
day was a quote that was roughly “What did
she get the award for? Everybody knows this

01:43:28.159 --> 01:43:35.689
anyway.” And I just thought that was the
most amazing compliment, though I don’t

01:43:35.689 --> 01:43:42.900
think it was intended that way. But to realize
that these early ideas, not just mine but

01:43:42.900 --> 01:43:47.930
of course all the work that had gone on in
those early years to understand data abstraction

01:43:47.930 --> 01:43:51.079
and specifications and programming language
and so forth, to understand that they had

01:43:51.079 --> 01:43:57.690
moved so into the mainstream that everybody
knew them and they were the basis of how you

01:43:57.690 --> 01:44:01.349
wrote programs, I mean that was just a remarkable
thing to understand.

01:44:01.349 --> 01:44:08.289
Do you want to say a little about Java, which
certainly shows a lot of toolmarks from your…

01:44:08.289 --> 01:44:16.249
Well, so Java, I was very glad to see Java
come along because it was the first mainstream

01:44:16.249 --> 01:44:22.920
programming language that really had these
ideas in it. It really did have data abstraction

01:44:22.920 --> 01:44:29.820
and object-oriented programming. There really
was a notion that superclasses ought to be

01:44:29.820 --> 01:44:35.129
supertypes, the notion of interfaces define
a kind of behavior. They enforce the Liskov

01:44:35.129 --> 01:44:42.419
substitution principle in the sense that a
subtype, a subclass has to provide the methods

01:44:42.419 --> 01:44:47.389
with the right signatures the superclass has.

01:44:47.389 --> 01:44:53.519
I would have done it differently had it been
me, and Andrew and I, Andrew Myers and I did

01:44:53.519 --> 01:44:59.070
try to convince them to put polymorphism into
the language. When it first came out, it wasn’t

01:44:59.070 --> 01:45:03.249
there. Of course when you design a language
like this, you have to decide what’s important

01:45:03.249 --> 01:45:08.550
to concentrate on, what you’re going to
leave for later. So it’s not that this is

01:45:08.550 --> 01:45:16.369
necessarily the wrong thing. It’s just not
what I would have done. I think that it sort

01:45:16.369 --> 01:45:20.400
of opened the doors for this to become…
In a way, the reason it is mainstream is because

01:45:20.400 --> 01:45:26.510
it’s there now in the languages that people
use on a day-to-day basis.

01:45:26.510 --> 01:45:34.599
And it’s moved into C++ in C++’s kind
of form. I wish people would enforce encapsulation

01:45:34.599 --> 01:45:43.389
better. I think they do a better job in C#.
Sometimes you have to violate encapsulation,

01:45:43.389 --> 01:45:47.261
like when you’re building a platform, like
a debugging platform. But it’s better if

01:45:47.261 --> 01:45:52.300
you could limit that to people who are entitled
to do it rather than having it be something

01:45:52.300 --> 01:45:54.399
any old programmer can do.

01:45:54.399 --> 01:46:00.579
You know, there was a lot of stuff, sort of
wisdom in the old days that people maybe lost.

01:46:00.579 --> 01:46:07.039
So one thing we learned was that reading code
mattered much more than writing code, because

01:46:07.039 --> 01:46:14.249
code is written once but read many times,
first by the author, then by others. There

01:46:14.249 --> 01:46:19.489
was another one I was going to tell you about.
Well, it will come to me. Anyway, I feel like

01:46:19.489 --> 01:46:26.269
some of these lessons from the past have been
forgotten, and maybe it’s just as well because

01:46:26.269 --> 01:46:28.869
it means we’ve made progress.

01:46:28.869 --> 01:46:39.239
Well, another thing that we should talk about
to get on tape is the people that you’ve

01:46:39.239 --> 01:46:45.649
learned from and that have influenced you.

01:46:45.649 --> 01:46:59.169
Well, I worked with John McCarthy. I would
not say that John was a very hands-on advisor,

01:46:59.169 --> 01:47:08.090
but I also felt that John was a fair-minded
person and I certainly never felt any sort

01:47:08.090 --> 01:47:14.419
of negative “You’re a woman, you can’t
do it” or stuff like that. So he was good

01:47:14.419 --> 01:47:20.950
and he handed me my thesis topic when I couldn’t
make progress on machine learning, this “Program

01:47:20.950 --> 01:47:25.519
to Play Chess Endgames,” which he thought
I would be good to work on because I didn’t

01:47:25.519 --> 01:47:31.110
play chess. And he wanted me to approach it
from the point of view of “I’m just somebody

01:47:31.110 --> 01:47:35.070
learning and I see what the books are saying
and I think about that from a heuristic point

01:47:35.070 --> 01:47:40.710
of view,” which turned out to be quite effective.

01:47:40.710 --> 01:47:47.840
I think that Niklaus Wirth was also important.
I knew him as a student. He tried to convince

01:47:47.840 --> 01:47:54.199
me to switch into programming languages and
compilers, and he was right that it was really

01:47:54.199 --> 01:47:59.211
much more my field. I didn’t do it because
I felt I would get finished with the PhD faster

01:47:59.211 --> 01:48:05.539
by sticking with AI, which I think was also
correct.

01:48:05.539 --> 01:48:09.729
Of course I’ve learned a lot from lots of
people whose papers I’ve read and whom I’ve

01:48:09.729 --> 01:48:19.110
talked to, technically. I mean Jerry Saltzer,
all those years I was teaching 6.033 which

01:48:19.110 --> 01:48:26.239
was his course, our systems course, and his
way of thinking about systems. Corby, another

01:48:26.239 --> 01:48:31.790
one. Bob Fano, another one. Bob Fano is a
wonderful person. He’s the one who hired

01:48:31.790 --> 01:48:39.610
me. He told me that I was an engineer. I hadn’t
actually realized that, and he was so right.

01:48:39.610 --> 01:48:45.190
[laughs] I think I didn’t know what an engineer
was. And then Jack Dennis was a big help.

01:48:45.190 --> 01:48:50.219
Jack was the one who got me off of the AI
floor down onto the systems floor and in general

01:48:50.219 --> 01:48:55.979
was just encouraging and helpful, especially
in those early years when I was finding my

01:48:55.979 --> 01:49:05.379
way. So I would say those are the people that
I think back on and I feel were helpful.

01:49:05.379 --> 01:49:19.669
And let’s see. Oh yeah. So how has this
experience been for your family?

01:49:19.669 --> 01:49:28.459
Well, I do have a family, so I did get married.
So you can have a career and a family. That

01:49:28.459 --> 01:49:38.489
is a message I always try to convey to young
women. I have a son. I have a granddaughter.

01:49:38.489 --> 01:49:45.760
I had my son before I was tenured. I felt
that “I’ll figure out a way to make this

01:49:45.760 --> 01:49:50.269
work.” I think that in fact is a very good
way to run your life. Rather than to think

01:49:50.269 --> 01:49:54.130
through all the things that might go wrong
and worry about it in advance, you just figure

01:49:54.130 --> 01:50:01.669
you’ll make it work somehow. I don’t know.
My son’s a computer scientist. [laughs]

01:50:01.669 --> 01:50:06.030
Though he’s more on the theoretical side
than I am.

01:50:06.030 --> 01:50:07.579
He’s a professor, right?

01:50:07.579 --> 01:50:11.860
No, he’s not. He was at William and Mary
for a while but now he works for Mitre and

01:50:11.860 --> 01:50:14.399
he does security research.

01:50:14.399 --> 01:50:15.399
Cool.

01:50:15.399 --> 01:50:24.649
Yeah, great. And my husband has been very
supportive and helpful. I don’t think I

01:50:24.649 --> 01:50:31.610
could do it without… You need a helpful
spouse. So I think it’s… I don’t know

01:50:31.610 --> 01:50:39.420
how it’s been for my family, but I do have
a family and it’s all worked out okay.

01:50:39.420 --> 01:50:46.800
Well, let’s see. You’ve won a lot of other
awards.

01:50:46.800 --> 01:50:52.449
Yeah. Well, I won the von Neumann Medal from
the IEEE actually a few years before I got

01:50:52.449 --> 01:50:58.090
the Turing, and I’ve also got some honorary…
You know, I’ve got… Yeah. I think there’s

01:50:58.090 --> 01:51:01.499
sort of a tendency once you get one award,
sort of more come along.

01:51:01.499 --> 01:51:04.590
You’ve got a honorary degree from ETH.

01:51:04.590 --> 01:51:12.349
I do. Yes. That was the first honorary degree
I got. So ETH as you know is one of the top

01:51:12.349 --> 01:51:21.949
schools in Europe and a good science and technology
school, so yeah.

01:51:21.949 --> 01:51:26.619
And the other thing about the Turing Award
is you get called on to do a lot of travel.

01:51:26.619 --> 01:51:31.820
So in the couple, two or three years afterwards,
I traveled and traveled and traveled all over

01:51:31.820 --> 01:51:38.099
the world. And it still happens, though not
as much as it did. So that’s been a lot

01:51:38.099 --> 01:51:42.820
of fun. And my husband has come along with
me, so we’ve been able to experience that

01:51:42.820 --> 01:51:43.820
together.

01:51:43.820 --> 01:51:49.530
So where are notable places that you went?

01:51:49.530 --> 01:51:58.219
China. India. I was thinking… So we’ve
been to the Far East several times. Of course

01:51:58.219 --> 01:52:02.590
we’ve been to Europe in many places. The
only place I haven’t been that I would really

01:52:02.590 --> 01:52:10.539
like to go is Africa. But yeah, it just seemed
like there was a time there when there was

01:52:10.539 --> 01:52:15.639
so much travel. I think that is partly, when
you get the Turing Award, you expect that

01:52:15.639 --> 01:52:21.300
this is going to happen and really you need
to do that travel. It’s sort of part of

01:52:21.300 --> 01:52:25.119
what’s involved. Yeah.

01:52:25.119 --> 01:52:31.239
Well, are there other things that we didn’t
cover that we should have?

01:52:31.239 --> 01:52:36.289
[laughs] It seems to me we’ve done a pretty
good job of covering things.

01:52:36.289 --> 01:52:39.989
Well, then let’s… Thank you. Thank you
so much for your time.

01:52:39.989 --> 01:52:43.089
And thank you for your time. It’s been fun.
Thanks.