Reference no: EM132958164

CTEC5722 Critical Systems - De Montfort University

Learning outcome 1: Critically evaluate the current taxonomies of CSs including international standards

Learning outcome 2: Learn how to specify expandability properties of systems

Learning outcome 3: Know and evaluate methods for developing dependable systems

Learning outcome 4: Critically evaluate the use of formal methods in the life cycle of CSs

Exercise 1.

The Boeing 737 Max 8 aircraft were grounded after two fatal crashes in October 2018 and March 2019 leaving respectively 189 and 157 people dead. In both cases pilots struggled to control the aircraft after it began nosediving. An automated safety system - known as the Manoeuvring Characteristics Augmentation System (MCAS) - was implicated in both crashes.

Reports and information on the MCAS system:
• Ethiopian preliminary crash report
• Boeing 737 Max 8 MCAS system

Provide an assessment of the possible reasons for the crash in the light of what we discussed in the module. If possible use the material on the Boeing 737 Max 8 MCAS safety system. You are free to use other material you are able to find, also things which may be published till the end of the submission period.

Exercise 2.

The Safety Museum has two entries and three exits. The museum needs to conform to social distance and safety regulations and one of them is that the maximum number of visitors at any time is 50. The museum wants to use the following technology to achieve this capacity requirement:
• one-way entry turnstile E1 which can be closed and opened by the control system and signal S0 is set when a visitor enters
• infrared sensor I that detects when a visitor approaches the entry E1
• two one-way exit turnstile X1 and X2, signal S1 is set when a visitor exits via X1 and signal S2 is set when a visitor exits via exit X2
Furthermore for groups of visitors or visitors who require assistance there is entry E2 and exit X3. Both E2 and X3 have an assistant.
• Upon arrival of a group of visitors the assistant will use numeric keypad K1 to request entry of G (a number) visitors, the control system will open entry E2 as soon as current count of visitors in the museum plus G is 50 or below.
• Upon exit of a group of G visitors the assistant will use numeric keypad K2 to inform the control system that G visitors are leaving. Note exit X3 is always open during visiting hours of the museum.
The control system opens or closes entries E1 and E2 depending on the number of visitors. A counter N is used to count the number of visitors plus the information of
• signals S0, S1 and S2
• numeric keypads K1 and K2
• infrared sensor I

a) Produce a safety case for the museum when no failures occurs. Note: above description is incomplete. You need to discuss the additional measures/technology that may be required in order for the museum to satisfy the capacity requirement when no failures occur.
The following components should be discussed:
• System design and scope
• Safety requirement
• Human factors
• Safety analysis and validation
• Safety argument (textual or in form of GSN)

b) Produce a safety case for the museum when failures occurs. Note: first identify potential hazards/failures for the museum and the use fault tolerance techniques to design a museum that meets the capacity requirement in the presence of these identified failures.
The following components should be discussed:
• System design and scope
• Safety requirement
• Fault tolerant techniques employed
• Hazard/risk identification and analysis
• Human factors
• Root cause analysis
• Hazard control/risk reduction measures

Exercise 3.

The insulin pump system is a portable, automated insulin pump which is used by diabetics to administer insulin as and when they require it at regular, periodic intervals meaning the user doesn't experience any extreme variations in their blood sugar level (as is often the case with the traditional method of injecting insulin). Maintaining the blood sugar level within a safe range is important as sustained exposure to high levels of blood sugar can have long-term complications such as kidney damage and eye damage. Also, in the short term, very low levels of blood sugar are potentially very dangerous.

When the insulin pump is in automatic mode, the software periodically determines (using the blood sugar level readings) the dose of insulin that should be administered to the user. This is the functionality provided by the insulin pump software which is considered to be a safety critical system. Therefore it is crucial to examine the algorithm (see Annex A, also available from blackboard) that performs this task and produce a safety argument, in order to determine that it is adequately safe.

You are required to deliver
• Produce a safety proof analysis, i.e., check whether the algorithm can reach unsafe state(s).
• If you discovered that unsafe state(s) could be reached, describe an appropriate modification to the algorithm.

Attachment:- Critical Systems.rar