Critical Systems in Electrical Engineering

This document discusses critical systems in electrical engineering, including the assessment of possible reasons for the crash of the Boeing 737 Max 8 MCAS safety system, safety case for the museum when no failures occur, and analysis of algorithm and safety argument. It provides insights into the functioning of these systems and suggests improvements for enhanced safety.

Electrical Engg.
Critical Systems
Student Name –
Student ID -

Contents
Assessment of Possible reasons for the crash............................................................................3
Safety Case for the museum when no failures occurs................................................................6
Safety Case for the museum when failures occurs.....................................................................7
Analysis of algorithm and safety argument...............................................................................8
Modification in algorithm ( if an unsafe state(s) is reached)..................................................10
References................................................................................................................................11

Exercise 1
Assessment of Possible reasons for the crash
Boeing 737 Max 8 MCAS safety system
The Boeing 737 Max 8 aircraft were grounded after two serious crashes in 2018 and 2019
which left 189 and 157 people dead, respectively. In both cases, the pilots tried to control the
aircraft but it began nose diving. An automated safety system - known as the Manoeuvring
Characteristics Augmentation System (MCAS) - was implicated in both the crashes. Some
reports related to the MCAS system are - Indonesian crash report, Ethiopian crash report and
Boeing 737 Max 8 MCAS system.
MCAS is a law for controlling flight ( implemented on 737MAX). It is a system which is
added to enhance the characteristics for handling an aircraft MCAS ( Maneuvering
Characteristics Augmentation System).
MCAS can push the jet’s nose down and reduces the risk of stalling. The system gets
automatically activated if the angle of attack ( AOA ) is large, the autopilot is off, the flaps
are up and there is steep turn. The system gets deactivated if the angle of attack is decreased
or the pilot overrides with a manual trim. MCAS is capable of moving the horizontal
stabilizer trim upwards at 0.27 degree per second ( upto 2.5 degree ) and 9.26 s at a time. The
normal electric trim control is thumb – control of the stabilizer trim. The stabilizer trim cut
out disables automated trim control. The manual trim control has a hand cranked wheel to set
the trim. The normal electric trim control can stop the MCAS-driven movement of the
stabilizer. But within next 5 s, the MCAS is activated again after the software is released is

the sensed AOA is very high. The pilot can deactivate the MCAS and stabilizer trim’s
automated control and can use hand crank the trim wheels.
The main problem is that the system was not mentioned in the FCOM ( Flight Crew
Operations Manual ) which is the master document related to the aircraft for a pilot. The
explanation provided for this is to prevent overload of technical data for a pilot and that the
aircraft has high g load and near stall ( so pilot must not notice operation of MCAS ). Some
extra layers have been added to enhance protection. The system compares the inputs of the 2
AOA sensors. If the difference is more than 5.5 degree, the MCAS is not activated. It
prevents the activation of MCAS due to data with error.
The system is used for anti – stalling and does not allow the plane to enter into a stall or lose
lift. The plane crashed soon after the take off after steep climbs and descents and varying air
speeds ( in the Ethiopian crash ). Both the accidents ( also the Lion Air Accident, Indonesia )
may have the same cause.
In MCAS, the engines are heavy and have better fuel efficiency. It can lead to the pitch up of
the plane’s nose ( in certain conditions in a manual flight). It can point the nose down in case
of a danger of stalling. So, MCAS does not come into play for normal operation but comes in
operation in extreme cases. The problem in both the accidents was that the pilots had to
struggle for controlling the airplane ( as the MCAS got activated and pushed down the
plane’s nose after the take off ).

An error in ‘ angle of attack ‘ can activate MCAS. The pilots must be properly trained for
overriding in case of any such unwanted activation and the software must be updated. The
electric or the manual trim can be used for overriding.
A clear understanding of what exactly happened is important to make changes for safety in
future. The MCAS system was turned off ( disabled manually ) systematically, but it got
reactivated ( almost 4 times).
The problem started when the stick shaker on side of the captain started vibrating. It provides
a warning to the pilots for the impending stall. This was ignored by the pilot and after 30
seconds, a sensor malfunctioning was observed.
In future, the problem could be solved by proper training of the pilots about the new system
installed in the aircraft. They must be made to practice regarding the management of any
unwanted activation of the system. In such a case, the pilot must be able to handle the
situation in an effective manner. The system must be deactivated as soon as possible and
again deactivated in case it activates once more.
Another thing which can be done is the improvement of the system itself. The system must
not accidently activate. This can be done by using good quality sensors. This can avoid any
unnecessary activation of the system. This can help the pilot control the flight and save many
lives.

Johnston and Harris1 has given some lessons which the software organisations can learn
from the Boeing 737 Max incidents. Hatton and Rutkowski 2 has also mentioned some lessons
which can be learnt. Yapp3 and Ozkaya4 have studied the concept of virtual reality in the field
of electronic tourism. Taylor and Cottere5have stressed on the role of pilots in the aviation
infrastructure. Epperson6has studied the history of the transport safety. Yeoh7 has made a
detailed study about various regulatory agencies and their role.
1 Johnston, P. and Harris, R., 2019. The Boeing 737 MAX Saga: Lessons for Software Organizations.
2 Hatton, L. and Rutkowski, A., 2019. " Lessons Must Be Learned"-But Are They?
3 Ozkaya, I., 2019. Are DevOps and Automation Our Next Silver Bullet?
4 Yapp, A., Kim, L.C., Kuan, G.K. and Zainudin, H., 2019. The application of immersive technoogy, virtual reality in electronic
tourism.
5 Taylor, A.K. and Cotter, T.S., 2019, July. Pilots’ Role in the Critical Infrastructure of Aviation.
6 Epperson, B., 2019. ".... 6 Seconds loud, undifferentiated noise”.
7 Yeoh, P., 2019. Capture of Regulatory Agencies: A Time for Reflection Again.
8 Eapen and 9 Grewal have studied various attributes of auto dynamics.
9 Nwadiugwu has studied various network channel model systems.
10 Mellema has presented the commercial aviation maintenance incidents.

Exercise 2
In this case, there is a Safety Museum which is having 2 entry gates and 3 exit gates. There is
a limit on the maximum number of visitors at a given time and it is equal to 50. A set up is
used to ensure that this criterion is met. The set up consists of the following elements : an
entry turnstile ‘ E1 ’ ( one way ) that can be closed and opened using a control system and the
signal ‘ S0 ’ is set if a visitor enters, an infrared sensor ( I ) which is capable of detecting a
visitor approaching the entry gate ‘ E1 ’, two exit turnstiles ‘ X1 ’ and ‘ X2 ’ ( one - way )
and the signal ‘ S1 ’ is set if a visitor exits from exit gate ‘ X1 ’ and the signal ‘ S2 ’ is set if a
visitor exits from exit gate ‘ X2 ’. The entry gate ‘ E2 ’ and exit gate ‘ X3 ’ are for visitors
who need assistance. An assistant is present at both the gates, ‘ E2 ’ and ‘ X3 ’. The assistant
uses a numeric keypads ( ‘ K1 ’ for ‘ E2 ’ and ‘ K2 ’ for ‘ X3 ’ ) when group of visitors
come. The number of visitors ( G ) is entered using ‘ K1 ’ and gate ‘ E2 ’ will open if the sum
of the number of visitors in museum and ‘ G ’ is less than or equal to 50. The number of
visitors ( G ) leaving is entered using ‘ K2 ’ at ‘ X3 ’. The exit gate ‘ X3 ’ is always open for
the visiting hours of the museum. The entry gates ‘ E1 ’ and ‘ E2 ’ are opened or closed
depending on the number of visitors in the museum ( counted by ‘ N ’ ).
a) Safety Case for the museum when no failures occurs
A failure will occur if more than 50 visitors enter the museum. If no failure occurs, it means
that the number of visitors in the museum is less than or equal to 50.
As ‘ N ’ stores the number of visitors in the museum, let the initial number of visitors in the
museum be ‘ N ’. If a visitor comes towards ‘ E1 ’, he is detected by the infra red sensor.
Then, the count ‘ N ’ is checked. If ‘ N ’ is less than 50, the entry gate ‘ E1 ’ is opened, the
visitor enters the museum and ‘ S0 ’ is set. When ‘ S0 ’ is set, the value of ‘ N ’ gets

incremented by ‘ 1 ’. Again, the value of ‘S0’ is made ‘ 0 ’. In case, 3 visitors come towards
entry gate ‘ E2 ’, the assistant enters the value of G = 3 in ‘ K1 ’ and the value of ‘ N ’ and ‘
K1 ’ are added which gives the value ( N + 3 ). If the value N + 3 is less than or equal to 50,
then the entry is allowed and the count is updated to N + 3. If a person exits from the exit gate
‘ X1 ’, then the bit ‘ S1 ’ is set and this decrements the value of ‘ N ’ by 1. If a person exits
from the exit gate ‘ X2 ’, then the bit ‘ S2 ’ is set and this decrements the value of N by 1. If a
group of persons ( like 4 persons ) leave from exit gate ‘ X3 ’, then the value of G = 4 is
subtracted from the value of N and it gives a value ( N – 4 ).
In this manner, the value of ‘ N ’ is updated at each entry as well as exit gate. Also, the entry
is allowed only when the capacity less than or equal to 50 is assured.
b) Safety Case for the museum when failures occurs
The failure can occur due to various reasons. Some of the reasons and their remedies have
been described here. The problem may occur at the entry gate points. If the 2 entry gate
points check the value of ‘ N ’ simultaneously, then suppose that ‘ N ’ is 48. The entry gate ‘
E1 ’ and ‘ E2 ’ both read the value of ‘ N ’ as 48. A single person needs to enter from ‘ E1 ’
entry gate and suppose G = 2 persons want to enter through the entry gate ‘ E2 ’. So, in this
case, both the gates show valid entry case and suppose both the gates open simultaneously. In
this case, 3 people enter the museum and this makes the final count N = 48 + 1 + 2 = 51. This
exceeds the permitted limit and causes a system failure.
This type of problem can be avoided by prioritising concept. A priority can be provided to 1
of the 2 entry gates available and this will ensure that both the entry gates do not function
simultaneously. This ensures that the system does not fail.

Another problem can occur if the control system does not function as expected. So, the
control system needs to be designed with care. The system needs to be efficient. Another way
of improving the system is by the addition of displays at the entry and exit gates to display
the number of persons present in the museum. This helps the visitors to a great effect.
Exercise 3
a) Analysis of algorithm and safety argument
The insulin pump system consists automated insulin pump used by diabetics for
administering the insulin whenever they want at regular intervals of time. It is a portable
system. The maintenance of blood sugar levels in a safe range is significant for the overall
health of a person. In the automatic mode, the software can periodically determine ( using the
blood sugar level readings ) the dose of insulin which must be administered to the patient.
This function is carried out by the insulin pump software ( a safety critical system ). The
algorithm is analysed and a safety argument is produced.
The system is used here to measure the blood sugar level which helps to monitor the level to
check whether it is in the safe range or not. If it is not in the safe range then some dose of
insulin has to be given to the patient. The amount of dose is decided by the difference in the
value of the blood sugar level and the normal levels. Also, 3 readings are taken at different
times. These 3 readings help to decide whether the blood sugar level is constantly increasing
or decreasing. The dose provided depends on this factor also. In some cases no dose is
needed. In some cases, a minimum dose is required and in other cases, the amount of the dose
depends on the difference of the blood sugar level obtained in the readings.

Here, the algorithm mentioned is discussed step by step. The algorithm considers 3 readings –
reading 0, reading 1, reading 2. The 3 readings are taken at different times. These readings
show the reading values of the sensor which measures the blood sugar level. Based on this
reading of blood sugar level, the dose of insulin to be provided to the patient is decided.
Initially, no steps are given in the algorithm for the measurement of reading 0 and reading 1.
The algorithm takes the value of reading 2 only. So, steps can be added for the measurement
of readings 0 and 1.
The reading 2 is read from the sensor if certain conditions are met. The conditions are : the
manDeliveryButPressed must be False, the status must be error free, the remaining insulin
must be more than the maximum single dose ( to ensure that if maximum single dose is to be
injected, it is available ) and the cumulative dose must be less than the maximum daily dose
( to ensure that the limit of maximum dose is not crossed, which can cause other problems ).
Once the reading 2 value is available, based on its value, 3 different cases arise.
The case 1 is when the reading 2 value is less than the safe minimum value. So, a warning
status is shown to the user, as his blood sugar levels are very low. In this case, the alarm on
signal becomes true and the comp dose is given a value of 0 as no dose is needed. A message
is displayed as Sugar Low.
The case 2 is when reading 2 has a value greater than or equal to the safe minimum and less
than safe maximum. In this case, the various other readings are also taken into consideration.
If the reading 2 is less than or equal to reading 1, then the comp dose is set to 0 ( blood sugar
level decreased). If ( reading 2 – reading 1 ) is less than ( reading 1 – reading 0 ), then also
the value of comp dose is set to 0, as the rate of increase of the blood sugar level is falling.

But in case ( reading 2 – reading 1 ) is greater than or equal to ( reading 1 – reading 0 ), then
the rate of increase of the blood sugar level is rising. In this case, some dose needs to be
provided. If the dose gets rounded to 0, then minimum dose must be provided. So, if ( reading
2 – reading 1 ) / 4 gives a value equal to 0, then the comp dose value is set to minimum dose.
But if ( reading 2 – reading 1 ) / 4 gives a value more than 0, then the dose amount to deliver
is set to ( reading 2 – reading 1 ) / 4.
The case 3 is when reading 2 has a value greater than safe maximum. It means that the blood
sugar level is more than the safe limit. In this case, 3 sub cases arise – the blood sugar level is
increasing, the blood sugar level is stable and the blood sugar level is decreasing. If the
reading 2 is greater than reading 1, then the sugar level is increasing. In this case some dose
needs to be provided. If the dose gets rounded to 0, then minimum dose must be provided.
So, if ( reading 2 – reading 1 ) / 4 gives a value equal to 0, then the comp dose value is set to
minimum dose. But if ( reading 2 – reading 1 ) / 4 gives a value more than 0, then the dose
amount to deliver is set to ( reading 2 – reading 1 ) / 4. If the reading 2 is equal to the reading
1, then the sugar level is stable. In this case, the comp dose is set to minimum dose. If the
reading 2 is less than reading 1, then the sugar level is decreasing. If the rate of decrease is
increasing then ( reading 2 – reading 1 ) is less than or equal to ( reading 1 – reading 0 ), then
comp dose = 0 and no dose is required. But if the rate of decrease is decreasing, then comp
dose is set to minimum dose as this would be sufficient for the person.
b) Modification in algorithm ( if an unsafe state(s) is reached)
The algorithm does not take into consideration the case when reading 2 is equal to safe
maximum. This is not a safe state as relevant dose may be required at this stage.

The change can be made in line 41 by replacing the ‘ > ’ sign by ‘ > = ’ sign.
Another thing to be kept in mind is that the reading 0 and reading 1 need to be taken in
starting itself using the following commands.
Reading0 = Sensor.getreading ( ) ;
Reading1 = Sensor.getreading ( ) ;
These commands help to get the values of reading 0 and reading 1. These readings need to be
taken at equal intervals of time. For example – If reading 0 is taken at 0 s, then reading 1
must be taken at 2 s and reading 2 must be taken at 4 s. This maintains a time gap of 2 s
between any 2 successive readings. This is essential to study the rate of increase or decrease
for any given case. Once the algorithm is modified, the code becomes more efficient and
flawless.
Bibliography
Johnston, P. and Harris, R.,. ‘The Boeing 737 MAX Saga: Lessons for Software
Organizations’. ( 2019 ) Software Quality Professional, 21(3), pp.4-12.
Hatton, L. and Rutkowski, A., ‘ Lessons Must Be Learned"-But Are They?’. (2019)IEEE
Software, 36(4), pp.91-95.
Ozkaya, I., ‘Are DevOps and Automation Our Next Silver Bullet?.’ (2019) IEEE
Software, 36(4), pp.3-95.
Yapp, A., Kim, L.C., Kuan, G.K. and Zainudin, H., ‘THE APPLICATION OF IMMERSIVE
TECHNOLOGY, VIRTUAL REALITY IN ELECTRONIC TOURISM’. (2019)
International Journal of Advanced Research in Technology and Innovation, 1(1), pp.8-13.

Taylor, A.K. and Cotter, T.S., Pilots’ Role in the Critical Infrastructure of Aviation.’ (2019)
In International Conference on Applied Human Factors and Ergonomics (pp. 349-360).
Springer, Cham.
Epperson, B.. ‘.... 6 Seconds loud, undifferentiated noise [recording ends]’: A History of
Cockpit Recording in Transport Safety. (2019) ARSC Journal., 50(1), pp.79-97.
Yeoh, P.. ‘Capture of Regulatory Agencies: A Time for Reflection Again’. (2019)Business
Law Review, 40(4), pp.134-145.
Eapen, T. and Grewal, R., ‘ Attribute Auto-dynamics.’ (2019) Available at SSRN 3412284.
Nwadiugwu, W.P. and Kim, D.S.. ‘Ultrawideband Network Channel Models for Next
Generation Wireless Avionic System’. (2019)IEEE Transactions on Aerospace and
Electronic Systems.
Mellema, G.M.. ‘Application of Dupont’s Dirty Dozen Framework to Commercial Aviation
Maintenance Incidents’ (2018).
G. N Shirazi, P.Y. Kong, and C.-K. Tham, , ‘A cooperative retransmission scheme for ir-uwb
networks,’ (2008) in IEEE International Conference on UWB, doi:
10.1109/ICUWB.2008.4653387, vol. 2, pp. 207-210.
R. M. Harman, , ‘Wireless solution for aircraft condition based maintenance systems,’ in
Proceedings, (2002) IEEE Aerospace Conference, Big Sky, MT, USA, doi:
10.1109/AERO.2002.1036127, pp. 6-6.
Report ITU-R M.2283-0, ‘Technical characteristics and spectrum requirements of Wireless
Avionics Intra-Communications systems to support their safe operation,’ ( 2013) M Series,
Mobile, radiodetermination, amateur and related satellite services, ITU, Geneva, Switzerland.
J. Chuang, N. Xin, H. Huang, S. Chiu and D. G. Michelson, ‘UWB Radiowave Propagation
within the Passenger Cabin of a Boeing 737- 200 Aircraft,’(2007),in IEEE 65th Vehicular
Technology Conference – Spring, Dublin, doi: 10.1109/VETECS.2007.113, pp. 496-500.
A. Sahebalam and S. Beheshti, ‘Competitive clustering of wireless sensor networks with
ultra-wideband multiple-access relay channel,’ (2015), IEEE 28th Canadian Conference on

Electrical and Computer Engineering (CCECE), Halifax, NS, doi:
10.1109/CCECE.2015.7129393, pp. 893-897.
G. N. Shirazi, P. Kong and T. C. Khong, , ‘Optimal Cooperative Relaying Schemes in IR-
UWB Networks,’ (2010) IEEE Transactions on Mobile computing, doi:
10.1109/TMC.2010.43, vol. 9, no. 7, pp. 969-981.
Y. Yang, D. Wang, Man Li and Y. Song, ‘A relay selection scheme for IR-UWB networks
based on distance information,’ (2010), IEEE International Conference on Information
Theory and Information Security, Beijing, doi: 10.1109/ICITIS.2010.5689728, pp. 1046-
1049.
E. I. S. Saadon, J. Abdullah and N. Ismail, , ‘Evaluating the IEEE 802.15.4a UWB physical
layer for WSN applications,’ (2013) IEEE Symposium on Wireless Technology &
Applications (ISWTA), doi: 10.1109/ISWTA.6688819, pp. 68-73.
B. Elbhiri, R. Saadane, S. E. Fkihi, D. Aboutajdine and M. Wahbi, ‘UWB based maximizing
network lifetime with route selection strategies for wireless sensor networks,’ (2011)
International Conference on Multimedia Computing and Systems (ICMCS), doi:
10.1109/ICMCS.2011.5945636, pp. 1-7.
K. Kang, M. Nam and L. Sha, , ‘Worst Case Analysis of Packet Delay in Avionics Systems
for Environmental Monitoring,’ (2015) IEEE Systems Journal, doi:
10.1109/JSYST.2014.2336872, vol. 9, no. 4, pp. 1354-1362.
B. K. Stanford and P. D. Dunning, , ‘Optimal Topology of Aircraft Rib and Spar Structures
Under Aeroelastic Loads,’ 2015 in Journal of Aircraft, doi.org/10.2514/1.C032913, vol. 52,
No. 4, pp. 1298-1311.
WAIC - Wireless Avionics Intra-Communications, , ‘Wireless for Safety- Related Avionics’.
(2018)
Report ITU-R M.2319, ‘Compatibility analysis between wireless avionics intra-
communication systems and systems in the existing services in the frequency band 4200-

4400 MHz,’ (2014), M Series, Mobile, radio determination, amateur and related satellite
services, ITU, Geneva, Switzerland.
E. Karapistoli, F. Pavlidou, I. Gragopoulos and I. Tsetsinas, , ‘An overview of the IEEE
802.15.4a Standard,’ (2010) ,IEEE Communications magazine, doi:
10.1109/MCOM.2010.5394030,, vol. 48, no. 1, pp. 47- 53.