Software intensive systems safety analysis

Two important elements in the avionics suite of modern aircraft are: the flight control system (FCS) and the flight management system (FMS). The FCS provides the capability to stabilize and control the aircraft, while the FMS is responsible for flight planning and navigation. A clear trend in the aerospace industry is to place greater reliance on software systems, and many FCS and FMS subsystems are implemented primarily in software. For example, within the FCS is the flight guidance system (FGS) that generates roll and pitch guidance commands. Similarly, within the FMS is the vertical navigation (VNAV) function that acts like a third crew member in the cockpit, ordering mode change requests and resetting target altitude values to enable the aircraft to track the vertical flight plan. We have developed formal, executable models of the requirements for the mode logic of a FGS and for portions of the VNAV functionality. We have also conducted a comprehensive software safety analysis on the FGS mode logic model, and are completing the analysis of the VNAV model. This analysis uses as its starting point several "traditional" safety analysis techniques such as a functional hazard assessment (FHA), a fault tree analysis (FTA), and a failure mode effects analysis (FMEA). However, we are also using formal methods techniques known as model checking and theorem proving to verify the presence of safety properties in the model. This paper summarizes the (now completed) safety analysis that was performed on the FGS model, and highlights the similarities and differences with the (still on-going) safety analysis of the FMS model. In particular, we summarize progress made to date in the use of formal methods to verify the presence of the required safety properties in the models themselves.     

Tissue responses to low protracted doses of high LET radiations or photons: early and late damage relevant to radio-protective countermeasures.

Early and late murine tissue responses to single or fractionated low doses of heavy charged particles, fission-spectrum neutrons or gamma rays are considered. Damage to the hematopoietic system is emphasized, but results on acute lethality, host response to challenge with transplanted leukemia cells and life-shortening are presented. Low dose rates per fraction were used in some neutron experiments. Split-dose lethality studies (LD 50/30) with fission neutrons indicated greater accumulation of injury during a 9 fraction course (over 17 days) than was the case for gamma-radiation. When total doses of 96 or 247 cGy of neutrons or gamma rays were given as a single dose or in 9 fractions, a significant sparing effect on femur CFU-S depression was observed for both radiation qualities during the first 11 days, but there was not an earlier return to normal with dose fractionation. During the 9 fraction sequence, a significant sparing effect of low dose rate on CFU-S depression was observed in both neutron and gamma-irradiated mice. CFU-S content at the end of the fractionation sequence did not correlate with measured LD 50/30. Sustained depression of femur and spleen CFU-S and a significant thrombocytopenia were observed when a total neutron dose of 240 cGy was given in 72 fractions over 24 weeks at low dose rates. The temporal aspects of CFU-S repopulation were different after a single versus fractionated neutron doses. The sustained reduction in the size of the CFU-S population was accompanied by an increase in the fraction in DNA synthesis. The proliferation characteristics and effects of age were different for radial CFU-S population closely associated with bone, compared with the axial population that can be readily aspirated from the femur. In aged irradiated animals, the CFU-S proliferation/redistribution response to typhoid vaccine showed both an age and radiation effect. After high single doses of neutrons or gamma rays, a significant age- and radiation-related deficiency in host defense mechanisms was detected by a shorter mean survival time following challenge with transplantable leukemia cells. Comparison of dose-response curves for life shortening after irradiation with fission-spectrum neutrons or high energy silicon particles indicated high initial slopes for both radiation qualities at low doses, but for higher doses of silicon, the effect per Gy decreased to a value similar to that for gamma rays. The two component life-shortening curve for silicon particles has implications for the potential efficacy of radioprotectants. Recent studies on protection against early and late effects by aminothiols, prostaglandins, and other compounds are discussed.     

Biological UV dosimeters in simulated space conditions.

Polycrystalline uracil thin layers participate in the phage and uracil response (PUR) experiment, assigned to the biological dosimetry of the extraterrestrial solar radiation on the International Space Station (ISS). In ground based experiments (experiment verification tests), the following space parameters were simulated and studied: temperature, vacuum and short wavelength UV (UV-C, down to 200 nm) radiation. The closed uracil samples proved to be vacuum-tight for 7 days. In the tested temperature range (from -20 to +40 degrees C) the uracil samples are stable. The kinetic of dimer formation (dimerization) and reversion (monomerization) of uracil dimers due to short wavelength UV radiation was detected, the monomerization efficiency of the polychromatic deuterium lamp is higher than that of the germicidal lamp. A mathematical model describing the kinetic of monomerization-dimerization was constructed. Under the influence of UV radiation the dimerization-monomerization reactions occur simultaneously, thus the additivity law of the effect of the various wavelengths is not applicable.     

An improved Green's function for ion beam transport.

Ion beam transport theory allows testing of material transmission properties in the laboratory environment generated by particle accelerators. This is a necessary step in materials development and evaluation for space use. The approximations used in solving the Boltzmann transport equation for the space setting are often not sufficient for laboratory work and those issues are the main emphasis of the present work. In consequence, an analytic solution of the linear Boltzmann equation is pursued in the form of a Green's function allowing flexibility in application to a broad range of boundary value problems. It has been established that simple solutions can be found for high charge and energy (HZE) ions by ignoring nuclear energy downshifts and dispersion. Such solutions were found to be supported by experimental evidence with HZE ion beams when multiple scattering was added. Lacking from the prior solutions were range and energy straggling and energy downshift with dispersion associated with nuclear events. Recently, we have found global solutions including these effects providing a broader class of HZE ion solutions.     

The MELISSA pilot plant facility as as integration test-bed for advanced life support systems.

The different advances in the Micro Ecological Life Support System Alternative project (MELISSA), fostered and coordinated by the European Space Agency, as well as in other associated technologies, are integrated and demonstrated in the MELISSA Pilot Plant laboratory. During the first period of operation, the definition of the different compartments at an individual basis has been achieved, and the complete facility is being re-designed to face a new period of integration of all these compartments. The final objective is to demonstrate the potentiality of biological systems such as MELISSA as life support systems. The facility will also serve as a test bed to study the robustness and stability of the continuous operation of a complex biological system. This includes testing of the associated instrumentation and control for a safe operation, characterization of the chemical and microbial safety of the system, as well as tracking the genetic stability of the microbial strains used. The new period is envisaged as a contribution to the further development of more complete biological life support systems for long-term manned missions, that should be better defined from the knowledge to be gained from this integration phase. This contribution summarizes the current status of the Pilot Plant and the planned steps for the new period.     

Human Factors R&D Requirements for Future Aerospace Cockpit Systems

Cockpits are rapidly changing from dedicated instruments to multifunction displays, integrated controls, and computer controlled subsystems. Solid-state displays, voice recognition, and artificial intelligence are just a few of the emerging technologies that will help the pilot perform his mission in the future. Early investigations involving mission analysis, sensor data, software development, and evaluations will be required to insure total integration. These new technologies will require extensive human factors research in the areas of anthropometry, displays, controls, human/computer interface, automation, and workload assessment to support the integration process. This research will help provide weapons systems that have increased survivability and reduced pilot workload. This paper addresses some of the human factors research that will be needed to help develop future cockpit systems. It also reviews the basic evolution of the crew station and some of the emerging technologies that will drive human factors research in the 1990s. In the past, crew systems were designed to provide each aircraft function with a corresponding instrument display, such as airspeed indicator, altimeter, attitude direction indicator, vertical velocity indicator, etc. The bulk of the information had to be integrated by the pilot. Present systems are in a state of transition. We are rapidly moving from individual instruments to multifunction displays. The C-17, HH-60, F-15E, B-1B, F-111D, and F-16C/D aircraft use multifunction, cathode-ray tube displays, some of which are color. Another trend is the continued increase in the use of integrated controls.     

Chemical protection against ionizing radiation.

Some of the problems related to chemical protection against ionizing radiation are discussed with emphasis on: definition, classification, degree of protection, mechanisms of action and toxicity. Results on the biological response modifyers (BRMs) and on the combination of nontoxic (i.e. low) doses of sulphydryl radioprotectors and BRMs are presented.     

Instrumentation for investigation of the depth-dose distribution by the Liulin-5 instrument of a human phantom on the Russian segment of ISS for estimation of the radiation risk during long term space flights.

Described is the Liulin-5 experiment and instrumentation, developed for investigation of the space radiation doses depth distribution in a human phantom on the Russian Segment of the International Space Station (ISS). Liulin-5 experiment is a part of the international project MATROSHKA-R on ISS. The experiment MATROSHKA-R is aimed to study the depth dose distribution at the sites of critical organs of the human body, using models of human body-anthropomorphic and spherical tissue-equivalent phantoms. The aim of Liulin-5 experiment is long term (4-5 years) investigation of the radiation environment dynamics inside the spherical tissue-equivalent phantom, mounted in different places of the Russian Segment of ISS. Energy deposition spectra, linear energy transfer spectra, flux and dose rates for protons and the biologically-relevant heavy ion components of the galactic cosmic radiation will be measured simultaneously with near real time resolution at different depths of the phantom by a telescope of silicon detectors. Data obtained together with data from other active and passive dosimeters will be used to estimate the radiation risk to the crewmembers, verify the models of radiation environment in low Earth orbit, validate body transport model and correlate organ level dose to skin dose. Presented are the test results of the prototype unit. The spherical phantom will be flown on the ISS in 2004 year and Liulin-5 experiment is planned for 2005 year.     

Utilization of white potatoes in CELSS.

Potatoes (Solanum tuberosum) have a strong potential as a useful crop species in a functioning CELSS. The cultivar Denali has produced 37.5 g m-2 d-1 when grown for 132 days with the first 40 days under a 12-h photoperiod and a light:dark temperature cycle of 20 degrees C:16 degrees C, and then 92 days under continuous irradiance and a temperature of 16 degrees C. Irradiance was at 725 micromoles m-2 s-1 PPF and carbon dioxide at 1000 micromoles mol-1. The dried tubers had 82% carbohydrates, 9% protein and 0.6% fat. Other studies have shown that carbon dioxide supplementation (1000 micromoles mol-1) is of significant benefit under 12-h irradiance but less benefit under 24 h irradiance. Irradiance cycles of 60 minutes light and 30 minutes dark caused a reduction of more than 50% in tuber weight compared to cycles of 16 h light and 8 h dark. A diurnal temperature change of 22 degrees C for the 12-h light period to 14 degrees C during the 12-h dark period gave increased yields of 30% and 10% for two separate cultivars, compared with plants grown under a constant 18 degrees C temperature. Cultivar screening under continuous irradiance and elevated temperatures (28 degrees C) for 8 weeks of growth indicated that the cvs Haig, Denali, Atlantic, Desiree and Rutt had the best potential for tolerance to these conditions. Harvesting of tubers from plants at weekly intervals, beginning at 8 weeks after planting, did not increase yield over a single final harvest. Spacing of plants on 0.055 centers produced greater yield per m2 than spacing at 0.11 or 0.22 m2. Plants maintained 0.33 meters apart (0.111 m2 per plant) in beds produced the same yields when separated by dividers in the root matrix as when no separation was made.