Text File

26-Jul-87 19:51:11-PDT,13427;000000000000 Return-Path: <NEUMANN@f4.csl.sri.com> Received: from csl.csl.sri.com (CSL.SRI.COM) by F4.CSL.SRI.COM with TCP; Sun 26 Jul 87 19:49:21-PDT Received: from F4.CSL.SRI.COM by csl.csl.sri.com (3.2/4.16) id AA18414 for RISKS-LIST@f4.csl.sri.com; Sun, 26 Jul 87 19:51:50 PDT Message-Id: <8707270251.AA18414@csl.csl.sri.com> Date: Sun 26 Jul 87 19:48:29-PDT From: RISKS FORUM (Peter G. Neumann -- Coordinator) <RISKS@csl.sri.com> Subject: RISKS DIGEST 5.17 Sender: NEUMANN@csl.sri.com To: RISKS-LIST@csl.sri.com

RISKS-LIST: RISKS-FORUM Digest Sunday, 26 July 1987 Volume 5 : Issue 17

FORUM ON RISKS TO THE PUBLIC IN COMPUTER SYSTEMS ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

Contents: Re: Separation of Duties and Computer Security (Ted Lee) Re: Robocop (Zalman Stern) Re: B of A's computer problems (Bob Larson) Nuclear power plant monitoring and engineering (Leff)

The RISKS Forum is moderated. Contributions should be relevant, sound, in good taste, objective, coherent, concise, nonrepetitious. Diversity is welcome. Contributions to RISKS@CSL.SRI.COM, Requests to RISKS-Request@CSL.SRI.COM. FTP back issues Vol i Issue j from F4.CSL.SRI.COM:<RISKS>RISKS-i.j. Volume summaries for each i in max j: (i,j) = (1,46),(2,57),(3,92),(4,97).

----------------------------------------------------------------------

Date: Sun, 26 Jul 87 12:42 EDT From: Ted Lee <TMPLee@DOCKMASTER.ARPA> Subject: Re: Separation of Duties and Computer Security To: risks@csl.sri.com Cc: willis@RAND-UNIX.ARPA

It is not true that development of computer security principles in the "defense establishment" has ignored the principle of separation of duties. At class B2 of the Orange Book a system is required to support separate operator and [security] administrator roles. At B3 and above it is quite explicit that a) to assume the security administrator role a distinct auditable action must be taken, and b) that when performing in that role a person is limited to ONLY doing those things "essential to performing the security role effectively." Furthermore, there was quite a long discussion at one of the recent national conferences (I forget whether it was the last Oakland conference or the NBS/DoD before it) about the topic of separation of duties as found in the financial community and how it did or did not relate to the kinds of security policies "traditionally" found in trusted systems. One could in fact argue that the fundamental principle of "need-to-know" versus "clearance" is a kind of two-man rule: the person who decides to let me see a particular classified document, based on his judgement that I need to see it, is not the same person who grants me the clearance that I must have in the first place.

------------------------------

Date: Sat, 25 Jul 87 22:23:22 edt From: zs01+@andrew.cmu.edu (Zalman Stern) To: risks@csl.sri.com Subject: Re: Robocop (RISKS DIGEST 5.12)

On the one hand, I am loathe to assign any sort of serious meaning to Robocop. It was basically lots of very well done violence with a streak of humor thrown in. The most thought provoking question I had after seeing it was "Who in their right mind would trust anything that carried a big gun and ran MS-DOS?" On the other hand, Ebert's quote clearly ignored the major plot line of the movie. The guy who was championing ED-209 (The robot that gunned down a board member during a demonstration) really didn't care if it killed people. One of his quotes was something to the effect of "I had it all lined up. Millitary contracts, spare parts for the next 25 years. The profits would have been great. Who cares if it worked!" Of course the competition for the ED-209 was a cyborg (half human) which had human judgement and therefore was much safer... The other great social comment in the movie was the not-so-overdone "trivialize death and suffering" newscasts.

As for computer risks, there was one lesson to be learned from Robocop. If you are going to program back doors into an armed robot to protect yourself, make sure you word your logic strongly enough so you don't get blown away in the end :-)

Zalman Stern, Information Technology Center, Carnegie Mellon University Pittsburgh, PA 15213-3890 Internet: zs01+@andrew.cmu.edu Usenet: ...seismo!andrew.cmu.edu!zs01+

------------------------------

To: comp-risks@ucbvax.Berkeley.EDU From: blarson%castor.usc.edu@oberon.usc.edu (Bob Larson) Subject: Re: B of A's computer problems Date: 26 Jul 87 04:17:56 GMT

In article <8707252233.AA15919@csl.csl.sri.com>: >The system is designed around four Prime Computer models known as Leopards, >costing about $750,000 each. "Prime has had at least five people here full >time trying to staighten things out," a bank official said. "This is going >to be a really slick system, when it works," he added.

A couple of corrections: The "leopard" was Prime's development name for the 6350. B of A did not have any in March, since the 6350 had not been announced and B of A was not a hardware beta test site. (USC was one of three beta sites for the 6350, ours was installed in April if I remember correctly.)

(Chances are that B of A got 9955-II's and planned to upgrade.) Bob Larson Arpa: Blarson@Ecla.Usc.Edu Uucp: {sdcrdcf,seismo!cit-vax}!oberon!castor!blarson

------------------------------

Date: Sat, 25 Jul 1987 19:56 CST From: Leff (Southern Methodist University) <E1AR0002%SMUVM1.BITNET@wiscvm.wisc.edu> Subject: Nuclear power plant monitoring and engineering To: RISKS%CSL.SRI.COM@RELAY.CS.NET

Attached, please find some references to applications of computers to nuclear power plant monitoring and engineering. A frequent theme is to try and reduce cognitive overload in the event of a critical situation, i.e., present something other than 500 alarms ringing at once.

Works in the control engineering field address this issue in a more general context: power plants, nuclear plants, chemical plants etc. A couple of AI based tools for fault tree analysis which is used in estimating risk probabilities in the nuclear field among others have also been announced at various conferences.

For those desiring to track this field, you should watch the American Control Conference every year and the section for nuclear engineering and control engineering in the IEEE Computer and Control Abstracts. This is very complete: our librarians complain that people keep requesting references from there that are not in any library in the United States which makes Interlibrary Loan a tad bit difficult. It ranges from six months to a year behind the date of publication unfortunately for the printed edition.

As far as the RISK of an accident, the average number of days of life loss for nuclear accidents in the United States is on the order of two days per person. This uses probabilities estimated by antinuclear power plant groups. The number of days lost is a tenth to a hundredth of such risks as automobile accidents, lighting and the like which we accept on a regular basis.

Hans Mark pointed out that the loss of life from Chernobyl due to delayed cancers would be lost in the "noise." That is no statistical test done on deaths in the Soviet Union could discern that something happened. If nuclear power plants were removed and replaced with coal burning plants, more people would die from the radiation released into the atmosphere by the burning coal. This ignores the death toll from coal mine accidents and air pollution. In short nuclear power plants are about as risk free as one can get in this society and our energies are much better off being devoted to automobile accidents, cigarrette smoking and alcohol addiction.

[Following is left as is for UNIX users. Apologies to others. PGN]

Sachs, P. A., Paterson, A. M. and Turner, M. H. M., Escort - An Expert System for Complex Operations in Real Time, \fIExpert Systems\fR, Vol. 3, No. 1, pages 22-28, January 1986. .P2 Describes a system to assist operators in controlling such systems as off shore oil rigs and nuclear power plants. It works by reducing the number of alarms and hence the operator's cognitive overload.

Faught, W. S., Applications of AI in Engineering, \fIComputer\fR, Vol. 19, No. 7, pages 18-27, July 1986. .P2 Discusses applications of KEE to diagnosis of the Space Station Life Support System and satellites, simulation of factory cells in sheet-metal manufacturing, and determining the best fuel shuffling for a nuclear power plant so as to keep the shutdown costs as low as possible.

Underwood, W. E., A CSA Model-based Nuclear Power Plant Consultant In \fIProceedings 2nd NCAI\fR, pages 302-305, Pittsburgh, August 1982. .P2 The Common Sense Algorithm representation is used to model the physical system. Diagnostic rules are also represented in this formalism.

Nelson, W. R., REACTOR: An Expert System for Diagnosis and Treatment of Nuclear Reactor Accidents In \fIProceedings 2nd NCAI\fR, Pittsburgh, pages 296-301, August 1982. .P2 REACTOR is being developed at EG & G, Idaho, for assisting operators in the diagnosis and treatment of nuclear reactor accidents.

Ancelin, J. and Legaud, P., An Expert System for Nuclear Reactor Alarm Processing In \fISixth International Workshop on Expert Systems and Their Applications\fR, Avignon, France, April 28-30, 1986.

Piette, D., Roche, C. and Ianeselli, J. C., ALPA: Diagnosis Expert System for Supervision of Nuclear Reactors In \fIECAI '86. Seventh European Conference on Artificial Intelligence (Brighton, England)\fR, Vol. 2, pages 109-113, July 1986. .P2 The use of an expert system to monitor and diagnose nuclear reactor breakdowns. Various knowledge representation schemes were tried.

Hoernes, P. E., Salame-Alfie, A. and Yeater, M. L., Enhanced Inspection of NPP's Using Expert Systems as a New Approach, \fITransactions of the American Nuclear Society\fR, Vol. 53, pages 275-277, 1986 . .P2 The development of a small expert system in evaluation of nuclear power plant performance as part of the process of inspecting it.

Corsberg, D., Extending an Object-Oriented Alarm-Filtering System In \fIExpert Systems in Government Symposium\fR, McLean, Virginia, pages 80-87, Oct. 22-24, 1986. .P2 This system uses functional relationships as opposed to fault/consequence trees to provide necessary alarm filtering in a nuclear power plant.

.P1 Brodsky, S. and Tyle, N., Knowledge-based Expert Systems for Power Engineering In \fIProceedings of the 15th Pittsburgh Modeling and Simulation Conference\fR, Pittsburgh, April 1984. .P2 Paper presents a brief review of the development and application of expert systems in areas related to electric power engineering. The specific examples discussed include nuclear power plant monitoring, power system restoration and hydro-electric plant design. In addition, several problems are examined as candidates for future expert systems.

%A Mark A. Fischeti %A Glenn Zorpette %T Power and Energy %J IEEE Spectrum %V 23 %N 1 %D JAN 1986 %K AA04 AI01 Westinghouse Electric Corporation nuclear power Babcock and Wilson EG&G Idaho reactor %X "Westinghouse Electric Corporation of Pittsburgh, PA offers the Genaid diagnostic software package to monitor changing conditions in power plant generators, analyze them, and warn plant operators of potential trouble." EG&G Idaho of Idaho Falls has a Reactor Safety Assessment system which "processes large amounts of data from a nuclear power plant during an emergency, makes diagnoses, and outliens the consequences of subsequent actions. After final refinements, this expert system program is to go on line this year at he Nuclear Regulatory Commison's Operations Center in Washington Center. The system was developed for use with Babcock and Wilcox Pressurized-water reactors and will be adapted for use with other reactors." [In Spang-Robinson report, they indicated that the Japanese are putting major amounts of money into expert systems for nuclear reactor operations. See my summary for more info. LEFF ]

%A D. Sharma %A B. Chandrasekaran %A D. Miller %T Dynamic Procedure Synthesis, Execution, and Failure Recovery %B Applications of Artificial Intelligence in Engineering Problems %E D. Sriram %E R. Adey %V 2 %I Computational Mechanics Publications %C Woburn, Massachussetts %D 1986 %P 1055-1072 %K AA05 nuclear power plant AI01 AI09 %X Describes a system for planning failure recovery, synthesis, monitoring for nuclear power plants. A comparison of the "event-oriented" and "function oriented" approaches to nuclear power plant management is provided. The nuclear industry is shifting to the latter in reaction to the TMI difficulties. The implications of this for expert system applications and an example from reactor scram concerns are also provided. Various plan templates and blackboards are used in processing. The final expert system consists of system specialists, specialists in various kind of undesirable events and specialists in various kind of goals such as reducing radioactivity.

------------------------------

End of RISKS-FORUM Digest ************************ -------