RISKS-LIST: RISKS-FORUM Digest Wednesday, 28 October 1987 Volume 5 : Issue 51 FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator Contents: Re: Reported Japanese Autopilot Problems (Will Martin) (Non-)Japanese Autopilot Problems (Joe Morris) Possible nuclear launch prevented by parked vehicle (Scot Wilcoxon) SDI information system announced (Scot Wilcoxon) 'Computers In Battle' (Rodney Hoffman) Re: Amusing bug: Business Week Computer (F)ails (John Pershing) Civil Disobedience (Fred Baube) The RISKS Forum is moderated. Contributions should be relevant, sound, in good taste, objective, coherent, concise, nonrepetitious. Diversity is welcome. Contributions to RISKS@CSL.SRI.COM, Requests to RISKS-Request@CSL.SRI.COM. For Vol i issue j, FTP SRI.COM, CD STRIPE:, GET RISKS-i.j. Volume summaries for each i in max j: (i,j) = (1,46),(2,57),(3,92),(4,97). ---------------------------------------------------------------------- Date: Wed, 28 Oct 87 10:56:58 CST From: Will Martin -- AMXAL-RI To: Nancy Leveson Cc: risks@csl.sri.com Subject: Re: Reported Japanese Autopilot Problems Yes, I heard that report, and watched most of it (I was in the kitchen at the time and it was on the tiny-screen set on top of the fridge, and I was doing other things at the same time, but I caught the gist). The particular plane is a corporate turboprop, and there have been repeated instances of crashes at high speed into the ground. Recordings of pilot-to-tower conversations indicate that the autopilot has had a history of seizing control away from the human pilot, and that turning it off again is sometimes difficult or impossible. (There weren't many details; I am guessing that to disable it the pilot has to hit circuit breakers or otherwise power down the autopilot, and it may be hard to do when he is also wrestling with the controls to try to keep the plane from crashing.) Could it be that, this being a corporate plane, there is normally only a single pilot, not a pair (pilot & copilot), so there are no free hands to fiddle about with such switches or seldom-used controls? (That's just an unsupported speculation on my part...) In any case, it was a for-real broadcast. You might be able to get a transcript from CBS or from one of the video-news-recording/clipping services. (Side note to the list: Does anyone have a comprehensive list of such video-clipping services? I've heard of them several times, and it seems that people often need to get such info, like in this case, after hearing about a televised report or event that they missed. I don't know any specific firm or organization names or locations, nor have I any idea of what such services cost.) Regards, Will Martin ------------------------------ Organization: The MITRE Corp., Washington, D.C. To: risks@csl.sri.com Subject: (Non-)Japanese Autopilot Problems Date: Wed, 28 Oct 87 12:43:39 EST From: Joe Morris (jcmorris@mitre.arpa) In RISKS 5:50, Nancy Leveson writes: > Supposedly, the [Japanese MU-2's] computerized autopilot will, under > certain conditions, not let the pilot have control back. I think you'll find that most autopilots -- indeed, most avionics of any type -- in American-registered aircraft will be American-manufactured. At least at the low and middle end (I can't speak for the high-priced spread types) there isn't much penetration by foreign manufacturers. While I've never flown the MU-2, my memory says that those I've seen had either King, Bendix, or Sperry avionics packages, probably with a matching IFCS (Integrated Flight Control System). I recall seeing some MU-2 accident reports a while back that referred to the autopilot as being involved, including one in which the pilot told the FAA controller that he had autopilot problems just before the (fatal) crash. I'm inclined to doubt that "the autopilot would not let the pilot have control back", since the control servo drives the (mechanical) control wire through a slip clutch whose breakaway limit must be no greater than can be overcome by the pilot. It would require a runaway autopilot *and* a siezed clutch to deny the pilot control. The MU-2 has a reputation of requiring an unusually high degree of attention by the pilot, so any autopilot problems could be more serious in a MU-2 than the same problem would be in, say, a Cessna 421. What may be more likely is that the autopilot sets up divergent oscillation which ultimately overstresses the airframe. If for some reason the pilot fails to disconnect the autopilot promptly, the result can be spacial disorientation which in turn can cause the pilot to lose control of the aircraft even if the autopilot-induced load was within limits. What does this mean to RISKS-readers? One problem which is found in many aviation accident reports is that the aircrew (student pilot through 747 captain) has become complacent due to the assistance given by the "black boxes" on the aircraft. When one of those boxes fails, the sudden transition to basic flying and navigation (probably not practiced for a l-o-n-g time) isn't successful and the airplane does things it's not supposed to. Even worse, the boxes can give false or conflicting data and the aircrew doesn't resolve the problem in time to prevent an accident, like a 727 did a few years ago in New York when its stall warning (in effect, underspeed...no flames, please) and Mach warning (overspeed) alarms both activated. The result was a "superstall" and crash with no survivers...straight down from 30,000 feet. ------------------------------ Subject: Possible nuclear launch prevented by parked vehicle Date: 28 Oct 87 12:23:56 CST (Wed) From: umn-cs!sewilco@datapg.MN.ORG (Scot Wilcoxon) To: risks@csl.sri.com Nearly three years ago a malfunctioning guidance system caused indication of a launch sequence on a Minuteman 3 missile with three nuclear warheads. An armored vehicle was then parked on the silo to block any accidental launch. AP reported that a Wednesday story in the Casper Star Tribune says the guidance system malfunctioned on January 10, 1984. Capt. Bill Kalton of Warren Air Force base says that lights which monitor the status of the missile followed the pattern of a launch. When the guidance system failed it showed false indications on the monitoring equipment. A response team rushed to the missile site, parked an armored vehicle on top of the silo and left the scene. If the concrete cover of the silo had opened the vehicle would have fallen on the missile, damaging it and blocking its path. A maintenance team determined the missile was not in a launch sequence and that the warheads were not armed. Scot E. Wilcoxon sewilco@DataPg.MN.ORG {ems,meccts}!datapg!sewilco Data Progress Minneapolis, MN, USA +1 612-825-2607 ------------------------------ Subject: SDI information system announced Date: 28 Oct 87 12:23:33 CST (Wed) From: umn-cs!sewilco@datapg.MN.ORG (Scot Wilcoxon) To: risks@csl.sri.com AP reports that the Pentagon has created a computer-based system to encourage communication of SDI technology. Col. Jim Ball, director of technology applications for the SDI Organization, made the announcement. Using TAIS, "a civilian researcher working on a field also being explored for Star Wars can obtain an unclassified summary of the Star Wars work and a referral to the individual researcher for consultation." The TAIS computer will not have classified information and will be available at only the cost of a phone call. U.S. citizens, after agreeing not to disclose sensitive information, can apply to the Defense Logistics agency for an access code. No security clearance is needed, although the Pentagon considers some information as being sensitive enough to keep track of those who have access. Scot E. Wilcoxon sewilco@DataPg.MN.ORG {ems,meccts}!datapg!sewilco Data Progress Minneapolis, MN, USA +1 612-825-2607 ------------------------------ Date: 28 Oct 87 07:25:03 PST (Wednesday) Subject: 'Computers In Battle' To: RISKS@csl.sri.com From: Rodney Hoffman A brand new book of interest: 'Computers In Battle' edited by David Bellin and Gary Chapman. Harcourt Brace Jovanovich, 1987, $14.95. xiv + 362 pages, including Bibliography, Resources, Index. ISBN 0-15-121232-5 Table of Contents Computers in Battle: A Human Overview Severo Ornstein A History of Computers and Weapons Systems Paul N. Edwards The New Generation of High-Technology Weapons Gary Chapman Computer System Reliability and Nuclear War Alan Borning Computer and the Strategic Defense Initiative Eric Roberts and Steve Berlin The Strategic Computing Program Jonathan Jacky Computers in Weapons: The Limits of Confidence David Lorge Parnas Artificial Intelligence as Military Technology Tom Athanasiou High Technology and the Emerging Dual Economy Lenny Siegel and John Markoff The Role of Military Funding in Academic Computer Science Clark Thomborson Computers and War: Philosophical Reflections on Ends and Means John Ladd ------------------------------ Date: 28 October 1987, 09:44:47 EST From: John Pershing To: risks@csl.sri.com Subject: Amusing bug: Business Week Computer (F)ails Just an educated guess, but the failure was probably due to the index generation software not recognizing ligatures (e.g., 'fl' and 'ffl'), which were stored as single, "non-alphabetic" characters. John A. Pershing Jr., Yorktown Heights [Ligature software carefully before using it. PGN] ------------------------------ To: risks@csl.sri.com Subject: Civil Disobedience Date: Wed, 28 Oct 87 10:38:58 -0500 From: Fred Baube An important element of civil disobedience is that you take your lumps as they are determined by the system whose legi- timacy you are challenging. Thus the blacks who sat in the front of the buses and accepted arrest were practicing civil disobedience, in the hope that the visibility would create the public sentiment for change. In a republic such as ours, CD provides an important avenue of political expression, when the "approved" methods (writing legislators, organizing, bumperstickers) don't cut the mustard. [OK... I think we have saturated on this one for now. TNX... PGN.] ------------------------------ End of RISKS-FORUM Digest ************************