[mod.politics.arms-d] Arms-Discussion Digest V7 #55

ARMS-D-Request@XX.LCS.MIT.EDU (Moderator) (11/11/86)

Arms-Discussion Digest                Monday, November 10, 1986 4:30PM
Volume 7, Issue 55

Today's Topics:

        Administrivia: fee for service postings (PLEASE READ)
        Re: killing someone if we had to look them in the eye
                            24 hour delay
                            24 hour delay
               Nuke equivalnce/long endurance aircraft
                           Big R&D programs
                   Re: Military Institutions and AI
                        Re: SDI is impossible
                      portable anti-tank weapons
             Yet more on SDI (Star Wars flawed #6-of-10)

----------------------------------------------------------------------

Date: Mon, 10 Nov 1986  16:18 EST
From: LIN@XX.LCS.MIT.EDU
Subject: Administrivia: fee for service postings...

I recently received for posting a note that involves a fee for service
arrangement.  The service to be performed would be of interest to some
segments of the ARMS-D community: it described itself as a new
research and documentation service designed to provide up-to-date
detailed information about military contracting and companies involved
in military work.  The organization providing the service is
non-profit and tax exempt, but it is charging money for the service.

Here is the dilemma.  The June 1984 issue of the "DDN Directory" gives
on page 12 the following statement concerning use of the network:

	"The DDN is an operational DoD network and is not intended
	to compete with comparable commercial service.  It is intended
	to be used solely for the conduct of or in support of official
	U.S. Government business."

It is the vagueness of the term "official U.S. Government business"
that forces me to make a judgment call on what activities constitute
"support of U.S. Government business."  ARMS-D exists to discuss
issues related to war and peace, national security and the like, and
in doing so provides support for many individuals doing work for the
U.S. government.  But what activities should be excluded?

It is clear that advertising for-profit activities or activities for
personal gain would be against this policy.  But the non-profit nature
of the posting organization places the submitted note into a sort-of
limbo.

After pondering the question, I decided to ask the original poster to
resubmit an abbreviated note that leaves out explicit mention of any
cost involved, which I promised I would publish.  In the future, I
will decline any submissions that involve fee for service
transactions.

As always, I welcome comments on whether or not I did the right thing.

Herb Lin 
Moderator ARMS-D

------------------------------

Date: 10 Nov 86 10:03:19 EST (Monday) From: MJackson.Wbst@Xerox.COM
Subject: Re: killing someone if we had to look them in the eye

From: ihnp4!utzoo!henry@ucbvax.Berkeley.EDU (V7 #51):

"Soldiers do get desensitized to violence, but this doesn't turn them
into rabid killing machines, the apparent views of some liberals
notwithstanding.  Combat-experienced infantrymen, at least from
Western cultures, are generally pacifists; patriotism and the glory of
war cut little ice with them.  They fight because it's suicidal not to
in such an environment, and they stay in that environment because they
don't want to leave their buddies short-handed."

Basically correct, and not unknown to this liberal, at least.  See
/The American Soldier: Combat and Its Aftermath/ (Stouffer, et al.)
for details, but in WWII US soldiers expressed hatred of the (Germans
| Japanese) as follows (from lowest to highest):

	combat veterans (same theatre [Europe | Pacific]
	combat veterans (other theatre)
	trainees (in the US)

Hatred of the Japanese was uniformly higher than hatred of the
Germans, but the pattern was the same.

And on the general question of combat incentives ("Generally, from
your combat experience, what was most important to you in making you
want to keep going and do as well as you could?), "Ending the task,"
at 39%, dominated the rest.  "Solidarity with the group" (14%) was
second, "Vindictiveness" was mentioned by 2%.

Mark

------------------------------

Date: Monday, 10 November 1986 08:21-EST 
From: The Computer is your friend! <"NGSTL1::SHERZER%ti-eg.csnet" at RELAY.CS.NET>
To:   arms-d
Re:   24 hour delay

>> From: "NGSTL1::SHERZER%ti-eg.csnet" at RELAY.CS.NET>
>> You misunderstand what I said. The tankers cannot keep THEMSELVES (not
>> to mention the bombers) in the air for 24 hours. This means that NONE
>> of the bomber force would survive.

>But they could.  There is no intrinsic reason that a tanker cannot
>itself be refueled in the air.

Except that we cannot do it now. Does this mean you are saying we should
spend money buying/developing the extra tankers and bombers needed for
this policy? If so, you should say so now (and write your congresscreature).

>I have spoken to a couple of submarine officers.  They have said that
>they are under orders to wait, and then try to monitor other radio
>traffic.  In a pinch, they have orders to go back to the base to look.
>A submarine has many ways of getting information from the world, even
>without surfacing.  Even if it does, the ocean is a big place, and
>poking an antenna above the water for 10 seconds is not likely to be
>seen. 

Nuclear war counts as a pinch. This means, that all you do is wait for the
subs to go to visual range of the ports and nuc them then. The ocean is a
big place, but the area around the ports is not. Poking an antenna above
the water for 10 seconds can be deadly if the enemy knows about where you
are and has nuclear weapons.

>>  the reason we have the triad is to pervent an advance in some capability
>>  from destroying all our capabilities.

>In the event that the Soviets achieve a significant ASW advance, then
>I will rethink the policy.  In the meantime, we should concern
>ourselves with what is true now.  

Lets hope we find out about this new capability in time for you to
rethink the policy.

>The Navy has categorically stated that the present SSBN force is
>not vulnerable to current Soviet ASW.  While they may elaborate on
>this in classified testimony, they will not flatly contradict it.

The Sgt. York is also the greatest thing since sliced bread (if you ask
the people in the Army with a vested interest in it). The fact is, they
are only going on an estimate of what they believe that also takes into
account their vested interest (if Soviet ASW is better, then they are out
of a job). You are betting WWIII on what you think about Soviet ASW
capability. If you were a Soviet commander, and you were told that the
American ICBM, bombers, and an optimistically large portion of the
subs could be eliminated, a first strike would look pretty good. If your
estimates were correct it would work. This adds to the instability.

------------------------------

Date: Mon, 10 Nov 1986  11:55 EST
From: LIN@XX.LCS.MIT.EDU
Subject: 24 hour delay

    From: <"NGSTL1::SHERZER%ti-eg.csnet" at RELAY.CS.NET>
    Except that we cannot do it now. Does this mean you are saying we should
    spend money buying/developing the extra tankers and bombers needed for
    this policy? If so, you should say so now (and write your 
    congresscreature).

Yes.  I agree.  I have done so.

    >In the event that the Soviets achieve a significant ASW advance, then
    >I will rethink the policy.  In the meantime, we should concern
    >ourselves with what is true now.  

    Lets hope we find out about this new capability in time for you to
    rethink the policy.

The Soviets could have achieved a breakthrough in telepathic ways to
find submarines, and we might not know about it.  There could be a
mind warfare gap!!  I'm not worried.  You have to make a judgment
about what is plausible.

    >The Navy has categorically stated that the present SSBN force is
    >not vulnerable to current Soviet ASW.  While they may elaborate on
    >this in classified testimony, they will not flatly contradict it.

    The Sgt. York is also the greatest thing since sliced bread (if you ask
    the people in the Army with a vested interest in it). The fact is, they
    are only going on an estimate of what they believe that also takes into
    account their vested interest (if Soviet ASW is better, then they are out
    of a job).

You forget that the Navy also has control over US ASW, and you can be
very sure that if the Soviets had better ASW than we did, the Navy
would be screaming bloddy murder and demanding all kinds of money to
catch up.

    You are betting WWIII on what you think about Soviet ASW capability.

Yes.  You have to make a judgment about what is plausible.  You also
have to take into account the advantages of what one proposes.
Waiting DOES have SOME advantages.  It also has SOME disadvantages.
My view is obviously not in the majority, but I'm trying to get people
to look past their own narrow preconceptions of what is and is not
appropriate.  

    If you were a Soviet commander, and you were told that the
    American ICBM, bombers, and an optimistically large portion of the
    subs could be eliminated, a first strike would look pretty good. If your
    estimates were correct it would work. This adds to the instability.

"Could be eliminated"?  With what probability?  What confidence would
YOU have if any analyst told you that?  Would you want the Soviet
missiles and the Strategic Rocket Forces and plan a first strike on
the U.S.?  What assurances would *you* need?

Or do you believe them to be crazy madmen who are far less cautious
than you are?  That places your view outside the U.S. intelligence
assessments.  Besides, if they are, you can't do anything about it
anyway. 

------------------------------

Date: Mon 10 Nov 86 14:51:07-AST
From:  Don Chiasson <CHIASSON@DREA-XX.ARPA>
Subject: Nuke equivalnce/long endurance aircraft

1.   > From: Steve Walton <ametek!walton@csvax.caltech.edu>
     > Subject: Meteorite as A-explosion
     > .....  (I can't find the conversion from ergs to megatons in the CRC, 
     > even though it tells me that there are 160 square perches in an
     > acre.)
     'The Effects of Nuclear Weapons' (1977), p. 13 states that a one 
     kiloton blast is equivalent to 4.18e12 joules.

2.   Several contributors have been discussing how long airplanes could
     stay continuously airborne after a nuclear strike.  Figures of 24
     to 72 hours have been mentioned.  Fuel may not be the problem: a
     large number of nuclear explosions would raise massive dust
     clouds.  The dust particles would likely cause jet engines to
     stall.  Remember the case of a 747 near the volcano in Washington
     and all its engines quit?

          Don

------------------------------

Date: 10 Nov 1986 14:07:55-EST
From: Hank.Walker@gauss.ECE.CMU.EDU
Subject: Big R&D programs

I am tired of people out in Hawaii not paying attention.  Many, and probably
most critics of the current SDI program are not against ballistic missile
defense research.  What they are against is the program as currently
constituted.  They feel that it is foolish to pump gigabucks that we don't
have into a program that is at best grossly premature and ill-advised.  Most
of the money will be wasted on big demonstrations of obsolete technology
that tell us very little, and are intended primarily to give the illusion of
progress.  Even some SDI researchers have said this.  A good analogy would
be to start a $30B, 5-year program to explore the feasibility of sending a
manned space mission to Tau Ceti.  We have so many years of the basics ahead
of us that it is silly to even think about attacking the problem of
interstellar travel directly.

------------------------------

Subject: Re: Military Institutions and AI
Date: Mon, 10 Nov 86 14:37:49 EST
From: Bob Munck <munck@mitre-bedford.ARPA>

toma@Sun.COM (Tom Athanasiou) writes:

>	Does anyone know of institutional forces within the
>	military that predispose positive receptions for
>	technologies that don't really work.  There's been a lot
>	of talk about SDI, but I'm interested in AI per se.  The
>	level of hype in the commerical AI world has dropped a
>	lot faster than in the military AI world.  Why?

It's my belief that a great deal of the belief in AI is due to sheer
frustration with conventional ways of acquiring software.  No one that I
know of considers software an easy thing to come by, but the military,
for various institutional reasons, has immensely more difficulty than
the "non-military."

Now they have been offered a MESSIAH by purveyors of AI hype: software
that works perfectly without cost and schedule overruns, slippery
accounting, forked-tongued marketeers, and bearded, blue-jeaned
programmers who aren't at their desk at 0745 hours.  (A neat twist: much
of the hacker culture of jeans, beards, Chinese food, etc. originated in
the AI Lab in Tech Square.) Military types are trained to look for
alternate ways to win a battle that's going badly; of course they're
going to seize on this deus-ex-machina as a way of avoiding the troubles
of software.

Another factor: as time goes on and production AI systems continue to
fail to appear, the commercial world has less and less money available
for them. On the military side, the Reagan/SDI feeding frenzy is still
in full swing.  So naturally that's where those selling AI concentrate
their efforts.

                  -- Bob Munck
  
disclaimer: none of my opinions are ever even
            vaguely related to MITRE policy.

------------------------------

Date: Sat, 8 Nov 86 12:41:00 EST
From: strig@firenze.bellcore.com (lorenzo strigini)
Subject: Re: SDI is impossible


In Arms-D, V7, #47, Jim Hunt states: SDI IS IMPOSSIBLE. His technical
statements seem correct (though I am no weapons expert), and have
interesting political consequences.

His argument (as I understand it) is: SDI cannot work against weapons
engineered for survival; and weapons built for low-precision counter-
population strikes can easily be made survivable.

A consequence seems to be that one could try and develop an SDI without
destabilizing effects. That is, the specifications would be reduced to
"Make life difficult for high-precision weapons". The U.S. would tell
the USSR: "If you launch a first strike, it will kill a lot of people,
but our Strategic Defense will preserve our ability to retaliate. If
your ICBMs are meant for retaliation only, SDI will not change their
effectiveness, and you need not worry about SDI allowing us to launch a
first strike". This might improve stability by allowing the US to have
less ICBMs, longer decision times before retaliation, etc.

It would not work if: 1) the weapons that are best for defense against
precision strikes are also very good against counter-population
retaliation; or 2) even such a reduced SDI is too costly or unfeasible.

I have heard statements that "real SDI" (not the "impotent and obsolete"
version) would only protect the U.S. retaliatory force, but no statement
to the effect that it might be inherently non-offensive for
technological reasons. I would like comments from knowledgeable people.


Lorenzo Strigini
(strig@lafite.bellcore.com)


[PS to the moderator. I will not be able to read ARMS-D for
some time. Persons that wish to discuss with me and want a prompt
response should write to me personally].

------------------------------

Date: Mon, 10 Nov 86 14:39:25 est
From: drogers%farg.umich.csnet@umix.cc.umich.edu (David Rogers)
Subject: portable anti-tank weapons

On the slightly dull topic of portable anti-tank weapons, does anyone
know about the (I believe) Swedish anti-tank weapon scheduled to
replace the LAW, the standard American light anti-tank weapon? If
cheap and even partially effective (alas, the LAW was rumored to give
the occupants of newer Soviet tanks a thrill, but no real damage), it
would certainly be of use in tank-heavy Europe.

On the issue of anti-tank weapons, I am amazed by the seductiveness of
nuclear solutions (the neutron bomb) to the problem of Soviet tanks;
does anyone know the cost of the program the develop that weapon? If,
as Herb Lin claims, a billion could have developed a nice anti-tank
weapon, why was the money not spent on that instead? And indeed, once
the neutron bomb was found to be undeployable, wouldn't it have been
the obvious choice to shift the research funding to the less-glamorous
technology of portable anti-tank weapons?

David Rogers
drogers@farg.UMICH.CSNET

------------------------------

Date: Monday, 3 November 1986  08:05-EST
From: Jane Hesketh <jane%aiva.edinburgh.ac.uk at Cs.Ucl.AC.UK>
To:   ARMS-D
Re:   Star Wars flawed #6-of-10

             Limitations of Simulation, Self-Test, and Sensor Technologies,
                and their effects on the Strategic Defence Initiative

                                      Phil Odor

             Context and Problem Summary

             For an electronic computer-based weapon system  to  function
             correctly when needed, it must be

             o+    completely and correctly specified;

             o+    correctly built (or written) to that specification, and
                  the product verified against it;

             o+    given  access  to  all  data  needed  to   perform   as
                  specified.  This data represents

             o+         the world-state (via sensors/communication)

             o+         the local and global system  state  (via  on-board
                       test equipment and communications).

             This paper focuses on three sets of issues,  beginning  with
             those   arising  out  of  the  use  of  simulation  to  give
             confidence in the system design. Since formal design methods
             don't  address the problem of correct initial specification,
             the design process will include  testing  under  simulation,
             implying that the simulation itself

             o+    is completely and correctly specified

             o+    is correctly built

             o+    has all necessary data.

             We argue that simulation  techniques  cannot  supplement  or
             expose  a  design  based  on false premises, and that in the
             case of SDI cannot be made comprehensive even for the design
             as envisaged.

                 The second issue concerns information about  the  world-
             state,  and  in  particular  that  derived  from space-borne
             sensors. We argue that current or projected technologies for
             sensors   aren't   reliable   enough  to  avoid  potentially
             catastrophic false alarms;  that  they  impose  economically
             unattainable  computational  and  communication  loads; that
             they  are  (and  will  remain)  vulnerable  to  increasingly
             sophisticated  decoys;   and  that  the  programme calls for
             time-tabled breakthroughs in sensor technology which  cannot
             be guaranteed.

                 Finally,  there  are  issues  surrounding  the  system's
             self-knowledge.  Knowledge  of  local  state  is  vital  for
             unattended space-borne components, which should

             o+    function with 100% reliability for many years, or

             o+    repair themselves, possibly with remote advice, or

             o+    fail passively, with correct self diagnosis.

             Global system  status  on  the  other  hand  is  needed  for
             decision-making  during  presumed  attack,  since the threat
             hypothesis  cannot  be  sustained   when   the   system   is
             unserviceable beyond a certain limit.

                 We argue that Built-in-Test-Equipment (BITE) systems can
             in principle never be complete.  Moreover, for both good and
             bad engineering and economic reasons the  BITE  design  will
             not  near  its  theoretical  potential  fault  coverage. The
             result will be both a decrease in the effectiveness  of  the
             system  during  a real attack as dormant faults are exposed,
             and an increased likelihood of the system  being  unable  to
             suppress  one  or  more of its components initiating a false
             counter-attack.

             Simulation

             In SDI there can be no  equivalent  to  a  complete  weapons
             system  trial:   hence  the  reliance  on  simulation during
             design.

                 You can only simulate what you can imagine  can  happen:
             if   a   situation   wasn't   envisaged  during  the  system
             specification, only serendipity or error will produce it  in
             the simulation.

                 You  can  only  simulate  what   you   can   afford   to
             reconstruct.   The   costs   involved   in  a  comprehensive
             simulation of SDI will be prohibitive.

                 Simulation systems are themselves subject  to  error  in
             design or build.

             Why rely on testing through simulation?

             Flight tests of any aircraft prototype and test  firings  of
             nuclear  weapons both show tacit recognition that simulators
             can merely represent those design parameters well understood
             by  designers  in  the previous generation of equipment, and
             only  an  active  test  in  a  real  environment  gives  new
             information  about  a  next-generation system.  The problems
             are especially acute where new technologies are employed, or
             where  large  systems  with  autonomous components are being

             implemented.  In the  case  of  SDI  however  this  form  of
             testing is impossible.

             Why is simulation not sufficient?

             Other  presentations  will  cover   the   impossibility   of
             verifying  the  completeness  and  correctness of the system
             specification. The principles underpinning those discussions
             extend  to  the  effectiveness  of  any simulation test rigs
             which are  devised,  since  any  limitation  in  vision  and
             inventiveness    in    formulating   the   original   system
             specification  will  also  constrain  the  coverage  of  the
             simulation.  Moreover,  any  errors  in  specification  will
             propagate  into  the  specification  for   the   simulators.
             Therefore  only  limited  further  confidence  in the system
             specification itself can be gleaned from simulations  alone.
             This situation is not novel: it is one reason for the flight
             tests and nuclear trials.

                 Further questions arise from  the  completeness  of  any
             simulation  systems  which  are  built.  Systems  which  are
             devised to test a design by simulating its  environment  are
             themselves  costly.   The  costs  and  complexity of a total
             system  test  rig  will  undoubtably  militate  against  its
             creation.   For  economic and engineering complexity reasons
             as much as for failures in foresight, the total system  will
             therefore be delivered untested.

                 The  specification  of  the  system   will   include   a
             failure/functionality  mode  analysis, which will presumably
             be ratified using simulation of  foreseeable  failures,  and
             which  will  rely in part on the effectiveness of the system
             built-in-test  for  information.  We  will  return  to   the
             correctness   of   information   available  to  the  system;
             however, we note here that the construction of  an  adequate
             specification  of the reversionary modes of a system of such
             size is an  engineering  task  of  enormous  magnitude,  far
             greater  than  anything undertaken before.  The scale of the
             exercise again makes it very unlikely that reversionary mode
             simulation and testing could be afforded.

             Sensor Technology

             New sensor technology will reduce, but not  eliminate,  data
             degradation due to overload, interference and noise.

                 The performance limitations will be exacerbated  in  SDI
             sensor  systems  by  operating  near  technology  limits; in
             difficult,  uncontrollable,  "dirty"   environments;   under
             stress; and with decoy systems of increasing sophistication.
             Conventional techniques to reduce failures (such  as  sensor
             duplication)  would  be  prohibitively  expensive  in an SDI
             setting of some thousands of sensors. Some  well  understood

             approaches (such as averaging methods) may not be usable due
             to time constraints.  Functional  failures  of  the  sensors
             themselves  are  therefore  inevitable,  leading  to loss of
             target, generation of false targets, or misrepresentation of
             the   speed   or   position  of  a  target.  There  are  two
             ramifications:

             o+    the size of SDI grows multiplicatively with numbers  of
                  targets, without achieving 100% effectiveness;

             o+    the unreliable data inputs will degrade performance  in
                  conflict and decrease the system's safety in peace.

             Doppler sensing, discrete  difference  detection  and  smear
             detection  all  produce  results  which  are computationally
             marginal and difficult to interpret even for humans.

                 Artificial  vision  theory  and  engineering   are   not
             advanced enough to guarantee object identification.

                 The SDI programme calls for time-tabled breakthroughs in
             sensor   and   data  handling  technology  which  cannot  be
             guaranteed.

                 The computational demands created by  the  system  as  a
             whole are on a scale which has not been demonstrated before,
             even in a benign environment.   No  engineering  models  are
             available   for   a  multiple-autonomous-processor  computer
             system with even one thousandth of the processors needed.

                 The costs of the  sensor  system  alone  make  its  full
             implementation   unlikely,   even  given  military  budgets.
             Lesser implementations will be correspondingly less safe and
             less effective.

                 Hence, SDI will be neither technically satisfactory, nor
             cost-effective  as a complete shield against massive nuclear
             attack:  it will also  be  an  unsafe  implementation  of  a
             partial defence of military targets.

                 These issues are dealt with more  fully  in  "Why  SDI's
             Perceptual System will be unsuitable", attached.

             Built-in-test systems

             Information from BITE in sensor/communications-based systems
             can in principle never be complete.

                 During the system  design  stage,  BITE  (and  therefore
             system  state  information) will be traded off in the design
             specification for good engineering reasons  against  weight,
             complexity  (and  therefore  inherent reliability and system
             integrity).

                 During development, cost control practices  will  reduce
             BITE  functionality:  BITE  necessarily appears later in the
             detailed design than other aspects, and  suffers  most  from
             time and cost over-run.

                 Multiple subcontractors compound the problem:  subsystem
             BITE  specifications  have  historically been met by testing
             what is easy (crude  main  processor  functions,  RAM,  ROM,
             multiple system comparators, time-out monitors) and ignoring
             what  is   hard   (intersubsystem   communications,   sensor
             functioning, actuation system functions).

                 BITE  is  relied  on  not  only  for  subsystem   fault-
             tolerance,   but   also   total   system   integrity.   Poor
             implementations will  increase  the  risk  of  total  system
             malfunction,  or  premature weapons deployment. It is likely
             that BITE will be poor.

             Why will BITE be incorporated?

             SDI system components will fail, as all  engineered  systems
             fail.   They  will  do  so  because  of  design failures, or
             because the enemy has altered the operating environment,  or
             because  of  wear-out,  or  overstress, or damage (battle or
             accidental).  In other environments such failures are  dealt
             with  by  preventative  or on-condition maintenance, and the
             system reliability includes calculation of the effectiveness
             of   these  procedures.   One  side  effect  of  such  human
             intervention is increased information about the system state
             as  a  whole, thus reducing the potential for any particular
             component failure to propagate its effects through the  rest
             of the system.

                 However, the most critical  SDI  systems  will  be  non-
             maintainable,   space   based   components.    The  system's
             knowledge of its own serviceability will depend upon  direct
             information  from  BITE  on  failed components, and inferred
             information from co-operating components. What to  do  under
             the conditions of single or multiple failure will be a major
             design problem, depending for information on BITE  and  good
             communications.

             Will BITE provide good information?

             There are good reasons to believe that BITE systems will  be
             unsatisfactory  providers  of  system  information,  for the
             following reasons.

             BITE information is in principle incomplete.

             o+    Full weapon  functionality  cannot  be  tested  without
                  firing  the  system.  (Note  that  this is not the same
                  issue as that of testing during development.)

             o+    The system can only infer sensor  effectiveness  (using
                  non-target  information).  It  will  be  a  major enemy
                  activity to introduce misinformation  during  the  long
                  life of the system which will add to the "lie count".

             o+    Only  in  rare  cases  does  BITE  not  introduce  more
                  equipment than in a basic system. This equipment itself
                  needs testing, and in the case  of  SDI,  away  from  a
                  maintenance line.

             The  potential  for  incorporating  BITE  will  be  severely
             reduced  in the SDI environment.  High-confidence techniques
             such as "stem to stern" signal  injection/actuator  response
             tests will be discouraged since they reduce the integrity of
             the  system  by  both  reducing  system  up-time,  and  more
             importantly, introduce the possibility of catastrophic error
             during or after the test itself.

                 BITE  introduces  more  components,  and  thus   reduces
             reliability.  Again,  this  situation  works  against making
             available vital information on system state.

                 Finally, the system will be produced by manufacturers in
             collaboration  with  each  other  through  the  normal  sub-
             contractor systems.  The cost  constraints  acting  in  this
             period  will  again  reduce the effectiveness of BITE, since
             manufacturers are concerned to achieve their  own  specified
             targets  for  BITE  coverage in the simplest fashion.  Since
             the  achievable  targets  cannot  be   specified   as   100%
             functionality,  and  since traditionally loss of information
             has taken a low priority against integrity and  reliability,
             there  is  no reason to suppose that the subcontractors will
             focus too hard  on  the  difficult  areas  of  sensor  test,
             actuator test and inter-subsystem (i.e.  inter-manufacturer)
             testing.  These economic and practical issues are not  about
             to  be  overtaken  by  new  technological breakthroughs:  in
             1984, a representative from one major avionic system  design
             firm gave this view of BITE:

                 "false alarm probability is higher than was  expect-
                 ed; BIT capabilities are less than specified; BIT is
                 not totally independent of operators  interpretation
                 .."

             What is expected of BITE, and what are the  results  of  its
             limitations?

             A failed component will rely on its BITE to do three things:

             o+    to inform the system as a whole;

             o+    to adopt an appropriate reversionary mode if possible;

             o+    to fail passively if no reversions are available.

             SDI sources now claim that it will be sufficient to create a
             system  with  less than complete effectiveness for SDI to be
             counted as an overall success.   However,  the  implications
             for  world  security of designing systems in which there are
             potential active failure modes is clear.  Relying on current
             levels  of  BITE  technology to inform on failure modes will
             increase the chances of such a failure.

                 As  far  as  the  system  as  a  whole   is   concerned,
             information  from  a  component  can be present (and true or
             false) or absent (e.g.  if  outgoing  communications  fail).
             Even  if BITE is used, therefore, the system's resolution of
             its own state is not a trivial task: it certainly involves a
             ternary  logic  system  which  includes  "liars".   The less
             effective BITE and the communication channels are, the  more
             potential  liars  in  the  system,  and  the  more chance of
             misinterpretation.   It  is  not  clear  that   a   reliable
             algorithm for handling such a system is feasible.

             Information about the author

             J. P. Odor BSc(Hons) Computing, Senior  Research  Fellow  in
             Computing and Education, Education Department, University of
             Edinburgh.

             Director of Communication Aids  for  Language  and  Learning
             Project.

             Research Interests:

             Computer  Modelling  of  student  learning,  automated  item
             banking  techniques  for skill and academic assessment, uses
             of  microelectronic  systems   for   handicapped   learners,
             especially  the production of intelligent communication aids
             and smart wheelchairs.

             Service Career:

             RAF 1962-1973, Navigational Instruments. Member  of  Central
             Servicing  Development  Establishment 1969-1973, permanently
             detached to BAC Warton during Tornado development.

------------------------------

End of Arms-Discussion Digest
*****************************