CSC 379:Week 5, Group 5: Difference between revisions
| Line 34: | Line 34: | ||
===The Space Shuttle Challenger=== | ===The Space Shuttle Challenger=== | ||
The O-rings did not adequately control propellant gas release and there were inadequate controls in the launch-decision process. The failures occurred due to a complex socio-technical interaction. | The O-rings did not adequately control propellant gas release and there were inadequate controls in the launch-decision process. The failures occurred due to a complex socio-technical interaction. | ||
[http://history.nasa.gov/rogersrep/genindex.htm The Rogers Commission Report] | [http://history.nasa.gov/rogersrep/genindex.htm The Rogers Commission Report] | ||
Revision as of 21:58, 4 August 2007
Software Safety: Accident Models - Systems Theory vs. Chain of Events
Skim through the following paper (focus on sections 1, 2.3, and 3, skip figures and tables) entitled "A Systems-Theoretic Approach to Safety in Software-Intensive Systems" by Nancy G. Leveson, a Professor of Aeronautics and Astronautics at MIT, then answer the following questions:
The majority of the content you need to form an informed response to the above questions is included in the paper. Bring in outside resources and topics discussed in class lectures as appropriate to support your response.
What are some shortcomings of traditional methods of accident reporting when applied to complex systems like software systems?
- Event-chain models tend to stop once something to blame is found. "reports stopped after assigning blame—usually to the operators who interacted with the software—and never got to the root of why the accident occurred"
- Event chain models were not designed to handle complex systems such as software. "in dealing with software in safety-critical systems is the result of inappropriately attempting to extend the techniques that were successful in simpler, electromechanical systems and were based on models of accident causation that no longer apply"
- Software can be very complex
How does the STAMP model improve accident prevention efforts? Explain some general concepts of the model.
"Systems theory allows more complex relationships between events to be considered"
"Accident models based on systems theory consider accidents as arising from the interactions among system components and usually do not specify single causal variables or factors"
The STAMP model provides more information in terms of how to prevent future accidents rather then trying to place blame.
Hazard analysis using STAMP rather then traditional methods can prevent accidents from happening in software based systems
What are some appropriate applications of the STAMP model (both current and past)? Explain.
The STAMP model is especially useful in analyzing complex socio-technical and software-based systems where accidents can occur due to complex human decision making, component interaction rather than single component failure, and accidents that occur because slow shifts toward an accident prone environment.
The Mars Polar Lander Loss
"The software did not adequately control the descent speed of the aircraft - it misinterpreted noise from a Hall effect sensor as an indication the spacecraft had reached the surface of the planet"
The components did not fail in terms of not satisfying their specified requirements, the failure occurred due to an unplanned effect of the system's interacting components.
CNN Article on the Mars Polar Lander Loss
The Space Shuttle Challenger
The O-rings did not adequately control propellant gas release and there were inadequate controls in the launch-decision process. The failures occurred due to a complex socio-technical interaction.
What are some ethical concerns of assigning blame for accidents?
Outside Links
Applying STAMP in Accident Analysis