Reference no: EM132544053

CTEC5722 Critical Systems - De Montfort University

Learning outcome 1: Critically evaluate the current taxonomies of CSs including international standards

Learning outcome 2: Learn how to specify expandability properties of systems

Learning outcome 3: Know and evaluate methods for developing dependable systems

Learning outcome 4: Critically evaluate the use of formal methods in the life cycle of CSs

Exercise 1.

The Boeing 737 Max 8 aircraft were grounded after two fatal crashes in October 2018 and March 2019 leaving respectively 189 and 157 people dead. In both cases pilots struggled to control the aircraft after it began nosediving. An automated safety system - known as the Manoeuvring Characteristics Augmentation System (MCAS) - was implicated in both crashes.
Reports and information on the MCAS system:

• Indonesian final crash report

• Ethiopian preliminary crash report

• Boeing 737 Max 8 MCAS system
Provide an assessment of the possible reasons for the crash in the light of what we discussed in the module. If possible use the material on the Boeing 737 Max 8 MCAS safety system. You are free to use other material you are able to find, also things which may be published till the end of the submission period.

Exercise 2.

The following is an informal description of the entry and exit system of a bio laboratory (AREA-42). AREA-42 consists of two rooms, the green room where staff put on their bio-hazard suites, and the red room where all the experiments will take place. Staff can enter and exit the green and red rooms via the two orange corridors.

The AREA-42 entry/exit system (see figure) consists of four doors D0, D1, D2 and D3 and two infrared sensors IR0 and IR1.
Initially door D0 is open, door D1 is closed, door D2 is open and door D3 is closed.

The procedure for exiting the green room and entering the red room is as follows:
• Enter the left orange corridor via door D0.
• If infrared sensor IR0 detects somebody then door D0 will close.
• If D0 is closed then door D1 will open.
• If infrared sensor IR0 does not detect somebody then door D1 will close.
• If door D1 is closed then the left corridor is decontaminated. This procedure takes 30 seconds.

• If the decontamination procedure has completed then the door D0 will open.
The procedure for exiting the red room and entering the green room is as follows:
• Enter the right orange corridor via door D2.
• If infrared sensor IR1 detects somebody then door D2 will close.
• If D2 is closed then the right corridor is decontaminated. This procedure takes 1 minute.
• If the decontamination procedure has completed then the door D3 will open.
• If infrared sensor IR1 does not detect somebody then door D3 will close.
• If door D3 is closed then door D2 will open. Be aware of the following
• The two decontamination procedures are different in that the left one is lethal to humans. The right one is human friendly.
• As experiments in the red room are potential dangerous doors D2 and
D3 should not be open at the same time. Similarly doors D0 and D1.
• The software that controls the opening and closing of the doors and start and end of the decontamination procedure currently runs on a single processor.

a) Produce a safety case for AREA-42 when no failures occurs. The following components should be discussed:
• System design and scope
• Safety requirement
• Human factors
• Safety analysis and validation
• Safety argument (textual or in form of GSN)

b) Produce a safety case for AREA-42 when failures occurs. The following components should be discussed:
• System design and scope
• Safety requirement
• Fault tolerant techniques employed
• Hazard/risk identification and analysis
• Human factors
• Root cause analysis
• Hazard control/risk reduction measures

Note: first identify potential hazards/failures for AREA-42 and use fault tolerance techniques to design AREA-42 that meets the safety requirements in the presence of these identified failures.

Exercise 3.

The insulin pump system is a portable, automated insulin pump which is used by diabetics to administer insulin as and when they require it at regular, periodic intervals meaning the user doesn't experience any extreme variations in their blood sugar level (as is often the case with the traditional method of injecting insulin). Maintaining the blood sugar level within a safe range is important as sustained exposure to high levels of blood sugar can have long-term complications such as kidney damage and eye damage. Also, in the short term, very low levels of blood sugar are potentially very dangerous.

When the insulin pump is in automatic mode, the software periodically determines (using the blood sugar level readings) the dose of insulin that should be administered to the user. This is the functionality provided by the insulin pump software which is considered to be a safety critical system. Therefore it is crucial to examine the algorithm (see Annex A, also available from blackboard) that performs this task and produce a safety argument, in order to determine that it is adequately safe.

You are required to deliver
• Produce a safety proof analysis, i.e., check whether the algorithm can reach unsafe state(s).
• If you discovered that unsafe state(s) could be reached, describe an appropriate modification to the algorithm.

Attachment:- Critical Systems.rar