I am currently reading through a book on Software Engineering principles, with a lot of the content having to do with proper approaches to software development methodologies and project management approaches. After reading through the chapter on risk assessment and management, one of the review questions caught my eye.
The question asks me to to examine the GPS navigation system of a commercial aircraft as well as the elevator in a high-rise building, and to identify 3 hazards that could become linked to software failures. For the elevator one I foresee several hazards such as the Elevator Doors not opening, the system stopping the elevator between floors, the system failing to the point of "dropping" the elevator from the 217th floor, and so forth.
The commercial airline GPS system though is leaving me stumped. With a car you run the risk of out-dated maps attempting to take you through/over/across hazards or nonexistent routes. While trying to research, I found that apparently radar only works about 100-150 miles past the coast, from there pilots will radio in at checkpoints with location, altitude etc. Aside from the GPS outright failing (picture over the ocean, no landmarks at all or falling off course if the GPS is tied into the AutoPilot), I'm not seeing many other hazards that could arise from software failure in a commercial airline GPS.
Would anyone care to offer their thoughts on this? I feel as if I am either over looking something or way over thinking this.
Also, how can issues such as in an aircraft GPS be prevented? With an elevator you have the Governor and "drop-locks", but how do you avoid GPS failures/errors in an aircraft?
After thinking it over some more I put the following together:
Commercial Aircraft GPS Navigation:
Hazard 1: If the GPS outright fails, the plane can become lost due to unfamiliar terrain or lack of landmarks (picture over the ocean). Even with an old fashioned compass or use of the sun for direction, there are concerns of fuel quantities.
Preventative Measure 1: While certainly not fool-proof, the best preventative measure I can think of is to ensure a backup GPS is available on all aircraft should the first one completely fail.
Hazard 2: Should the GPS navigation in the aircraft fail (but appear to be functioning correctly) there is the chance of 2 planes encountering a mid-air collision as they enter into the same flight path and altitude.
Preventative Measure 2: Having either a second GPS system available to check against or by conducting check points after the flight path has been established, falling so far off course should be avoided. I am not familiar with aviation standards, but I like to assume that most aircraft have some kind of proximity alarm.
Hazard 3: If the GPS is tied into the Auto-Pilot system (which I believe is the case with most commercial aircraft today), then a GPS failure (but seemingly functioning) event could cause the aircraft to rise and stall or to enter into a catastrophic path such as straight into a mountain side.
Preventative Measure 3: Other than building in a method to force the auto-pilot function to disengage, I am unsure of what measure could be taken on this particular event (though it should not occur on a commercial aircraft with the pilots monitoring systems even if not actually “flying” the aircraft).
Hazard 1: There is the risk of the software failing and thus causing the doors to remain closed, trapping passengers.
Preventative Measure 1: I believe most modern elevators have methods in place to prevent this, but my method would be to build a backup or exception catch which would allow passengers to open the door.
Hazard 2: Similar to the above, a software failure could lead an elevator to become stuck between floors – this is often seen in movies but does actually happen. Depending upon the amount of building material separating building floors, this can also lead to passengers being thoroughly trapped.
Preventative Measure 2: There are different issues which could cause this particular hazard situation – the cable could become snagged, cable locks deploy, etc. If this is due to governor, the best measure I think of is for a governor failure to go ahead and trigger the cable locks, keeping the elevator in place, but stopping it from plunging down (or up). From there, the standard call button can be used to contact emergency services.
Hazard 3: Then there is the most concerning hazard of a high-rise elevator: a software failure which causes the governor to malfunction and the elevator to drop straight down at the mercy of gravity and its own weight. Doing so from say the 82nd floor would almost assuredly result in expiration of the passengers on board.
Preventative Measure 3: In this particular scenario, the best measure I can think of is to build into the system where if the governor fails and the elevator begins to move [X] number of feet per second, engage the cable locks to stop the elevator before serious injury causing speed can be built up.
Is there something further I'm overlooking? I feel as if I'm grasping at straws with my current ideas for preventative measures. Besides back-ups to the main system in most of the hazard situations, I'm not seeing many other measures that can be taken to prevent or handle their occurrence.