Thursday, December 5, 2013

three complex Taos: Ecosystem

Of the three most complex systems known - consciousness, earth ecosystem and the universe - the study and modelling of the earth global ecosystem has a key relevance since several years, though widely underestimated and ignored, for prediction of destructive and irreversible environmental changes due to human influence.
The 2013 report on climate changes of the
IPCC  Working Group I describes the current situation and gives some future estimates:
Gary Larson

http://www.ipcc.ch/

arriving somewhere but not in Tao


Never stop the car on a drive in the dark
Never look for the truth in your mother's eyes
Never trust the sound of rain upon a river rushing
Through your ears

Arriving somewhere but not here

Could you imagine the final sound as a gun
Or the smashing windscreen of a car?
Did you ever imagine the last thing you'd hear as you're fading out
Was a song?

Arriving somewhere but not here

[Chorus:]

All my designs, simplified
And all of my plans, compromised
And all of my dreams, sacrificed

Ever had the feeling you've been here before?
Drinking down the poison the way you were taught
Ever thought from here on in your life begins
And all you knew was wrong?

Arriving somewhere but not here

All my designs, simplified
And all of my plans, compromised
And all of my dreams...

Did you see the redness block your part?
Did the scissors cut a way to your heart?
Did you feel the end before the suns of mothers
Tearing you apart?

Tuesday, December 3, 2013

meta-Tao cycles

Krebs cycle: citric acid
The next metapattern discussed by Tyler Volk and Jeff Bloom are cycles, structures repetion in space and time:

Background

Cycles are repetitions in space or time, such as, circulations, waves, repetitive routines, etc. Interactions of cycles and arrows create spirals or helices.

Examples

  • In science: Kreb’s cycle, Earth’s rotation and revolution, lunar phases, animal movement, biological rhythms, breathing, water cycle, carbon cycle, nitrogen cycle, seasons, tides, bird songs, light, sound, cybernetic feedback loops, system operational closure etc.
  • In architecture and design: heating & cooling systems, movement patterns in buildings, etc.
  • In art: perceptual “movement,” musical compositions, choreography, etc.
  • In social sciences: repetitive actions, routines, rituals, helical patterns of themes running through discourse and other psychosocial situations, etc.
  • In other senses: laps in a race, wheel of karma, etc.

Metapatterns

The Pattern Underground

Tao by hands





Tuesday, November 26, 2013

the Tao of Nagarjuna

Golden statue of Nagarjuna at Samye Ling Monastery.
The search for a Self and a Consciousness in the enactionist view considering worlds of consciousness and experience without ground has its root in the teachings of Nāgārjuna (about 150-250 CE), founder of the Madhyamika tradition of the Mahāyāna buddhism, the first to declare the consciousness arising as a co-dependent/co-production/co-emergence between the conscious subject and its world:

WORLDS WITHOUT GROUND

The Middle Way

Nāgārjuna and the Madhyamika Tradition


Hitherto we have spoken of the Buddhist tradition of mindfulness/awareness as though it were all one unified tradition. And in fact, the teachings of no-self-the five aggregates, some form of mental factor analysis, and karma and the wheel of conditioned origination-are common to all of the major Buddhist traditions. At this point, however, we come to a split. The teaching of emptiness (sunyata), which we are about to explore, according to the Buddhist tradition itself as well as to scholarship, did not become apparent until approximately 500 years after the Buddha's death, at which time the Prajñāpāramitā and other texts that expound this doctrine began to appear. During those 500 years, the Abhidharma tradition had become elaborated into eighteen different schools that debated each other about various subtle points and debated the many non-Buddhist schools within Hinduism and Jainism. Those who adopted the newer teachings called themselves the Great Vehicle (Mahāyāna) and designated those who continued to adhere to the earlier teachings the Lesser Vehicle Hīnayāna)-an epithet to this day widely loathed by non-Mahayanists. One of the eighteen original schools, the Theravāda (the speech of the elders) has survived with great vigor in the modem world; it is the undisputed form of Buddhism in the countries of Southeast Asia-Burma, Sri Lanka, Cambodia, Laos, and Thailand. Theravada Buddhism does not teach sunyata. Sunyata is, however, the foundation of Mahayana Buddhism (the form that spread to China, Korea, and Japan) and of the Vajrayana, the Buddhism of Tibet.
In approximately the first half of the second century CE, the Prajñāpāramitā teachings were put into a form of philosophical argument by Nagarjuna (according to some Mahayana schools and many, but not all, Western scholars). Nagarjuna's stature in Mahayana and Varjayana Buddhism is enormous. His method was to work solely by means of refutation of the positions and assertions of others. His followers soon split into those who continued this method, which is very demanding for the listener as well as for the speaker (the Prasangikas) and those who made positive arguments about emptiness (Svatantrikas).
The Madhyamika tradition, although it delighted in debate and logical argument, is not to be taken as abstract philosophy in the modem sense. For one thing, the debate was considered so meaningful in the social context of the courts and universities of early India that the losing side in a debate was expected to convert. More important, the philosophy was never to be divorced from meditation practice or from the daily activities of life. The point was to realize egolessness in one's own experience and manifest it in action to others. Texts discussing the philosophy included meditation manuals for how to contemplate, meditate, and act on the topic.
In exposition of Nagarjuna in the present day, there is a split between Buddhist practitioners (including traditionally trained practitioner scholars) and Western academic scholars. Practitioners say that Western scholars are making up issues, interpretations, and confusions that have nothing to do with the texts or with Buddhism.
Western scholars feel that the opinions (and teachings) of "believers" are not an appropriate source for textual exegesis. Since in this book we wish to bring into contact the living tradition of mindfulness/awareness meditation with the living tradition of phenomenology and of cognitive science, for our exposition of the Madhyamika we will draw from the practitioner as well as from the scholarly side of this interesting sociological detente.
Śūnyatā literally means "emptiness" (sometimes misleadingly translated as "the void" or "voidness"). In the Tibetan tradition, it is said that sunyata may be expounded from three perspectives--sunyata with respect to codependent arising, sunyata with respect to compassion, and sunyata with respect to naturalness. It is the first of these, sunyata with respect to codependent arising, that most naturally fits with the logic we have been exploring in the discovery of groundlessness and its relationship to cognitive science and the concept of enaction.

Nagarjuna's most well known work is the Stanzas of the Middle Way (Mulamadhyamikakarikas). From the perspective that we will now examine, it carries through the logic of codependent arising to its logical conclusion.
In the Abhidharma analysis of consciousness, each moment of experience takes the form of a particular consciousness that has a particular object to which it is tied by particular relations. For example, a moment of seeing consciousness is composed of a seer (the subject) who sees (the relation) a sight (the object); in a moment of anger consciousness, the one who is angry (the subject) experiences (the relation) anger (the object). (This is what we have called protointentionality.) The force of the analysis was to show that there was no truly existing subject (a self) continuing unchangingly through a series of moments. But what of the objects of consciousness? And what of the relations? The Abhidharma schools had assumed that there were material properties that were taken as objects by five of the senses-seeing, hearing, smelling, tasting, and touching-and that there were thoughts that were taken as an object by the mind consciousness. Such an analysis is still partially subjectivist/objectivist because (1) many schools, such as the basic element analysis discussed in chapters 4 and 6, took moments of consciousness as ultimate realities, and (2) the external world had been left in a relatively unproblematic, objectivist, independent state.
The Mahayana tradition talks about not just one but two senses of ego-self: ego of self and ego of phenomena (dharmas). Ego of self is the habitual grasping after a self that we have been discussing. Mahayanists claim that the earlier traditions attacked this sense of self but did not challenge the reliance on an independently existing world or the mind's (momentary) relations to that world. Nagarjuna attacks the independent existence of all three terms-the subject, the relation, and the object. What follows will be a (synthetically constructed)example of the kind of argument that Nagarjuna makes. What is it that we mean when we say that the one who sees exists independently or when we say that that which is seen exists independently? Surely we mean that the one who sees exists even when she is not seeing the sight; she exists prior to and/or after seeing the sight. And likewise we mean that the sight exists prior to and/or after it is seen by the seer. That is, if I am the seer of a sight and I truly exist, it means that I can walk away and not see that sight-I can go hear something or think something instead. And if the sight truly exists, it should be able to stay there even when I am not seeing it-for example, it could have someone else see it at a future moment.
Upon closer examination, however, Nagarjuna points out that this makes little sense. How can we talk about the seer of a sight who is not seeing its sight? Conversely how can we speak of a sight that is not being seen by its seer? Nor does it make any sense to say that there is an independently existing seeing going on somewhere without any seer and without any sight being seen. The very position of a seer, the very idea of a seer, cannot be separated from the sights it sees. And vice versa, how can the sight that is being seen be separated from the seer that sees it?
We might try a negative tack and reply that all this is true and that the seer does not exist prior to the sight and the seeing of it. But then how can a nonexistent seer give rise to an existing seeing and an existing sight? Or if we try to argue the other way round and say that the sight didn't exist until the seer saw it, the reply is, How can a nonexistent sight be seen by a seer?
Let us try the argument that the seer and the sight arise simultaneously. In that case, they are either one and the same thing, or they are different things. If they are one and the same thing, then this cannot be a case of seeing, since seeing requires that there be one who sees, a sight, and the seeing of the sight. We do not say that the eye sees it~elf. Then they must be two separate, independent things. But in that case, if they are truly independent things, each existing in its own right independently of the relations in which it happens to figure, then there could be many relations beside seeing between them. But it makes no sense to say that a seer hears a sight; only a hearer can hear a sound.
We might give in and agree that there is no truly existent independent seer, sight, or seeing but claim that all three put together form a truly existent moment of consciousness that is the ultimate reality. But if you add one nonexistent thing to another nonexistent thing, how can you say that that makes a truly existent thing? Indeed, how can you say that a moment of time is a truly existent thing when to be truly existent, it would have to exist independently- of other moments in the past and future? Furthermore, since one moment is but an aspect of time itself, that moment would have to exist independently of time itself (this is an argument about the codependence of things and their attributes); and time itself would have to exist independently of that one moment.
At this point, we might be seized with the terrible feeling that indeed these things do not exist. But surely it makes even less sense to assert that a nonexistent seer either sees or does not see a nonexistent sight at a nonexistent moment than to make these claims about an existent seer. (That this argument has actual psychological force is illustrated by an Israeli joke: Man 1 says, "Things are getting worse and worse; better never to have existed at all." Man 2 says, "How true. But who should be so lucky?--one in ten thousand!") Nagarjuna's point is not to say that things are nonexistent in an absolute way any more than to say that they are existent. Things are codependently originated; they are completely groundless.
Nagarjuna's arguments for complete codependence (or more properly his arguments against any other conceivable view than codependence) are applied to three main classes of topics: subjects and their objects, things and their attributes, and causes and their effects. By these means, he disposes of the idea of noncodependent existence for virtually everything-subject and object for each of the senses; material objects; the primal elements (earth, water, fire, air, and space); passion, aggression, and ignorance; space, time, and motion; the agent, his doing, and what he does; conditions and outcomes; the self as perceiver, doer, or anything else; suffering; the causes of suffering, cessation of suffering, and the path to cessation (known as the Four Noble Truths); the Buddha; and nirvana. Nagarjuna finally concludes, "Nothing is found that is not dependently arisen. For that reason, nothing is found that is not empty."
It is important to remember the context within which these arguments are employed. Nagarjuna's arguments fasten on psychologically real habits of mind and demonstrate their groundlessness within the context of mindfulness/awareness meditation and Abhidharma psychology. A modem philosopher might believe himself able to find faults with Nagarjuna's logic. Even if this were the case, however, it would not overturn the epistemological and psychological force of Nagarjuna's argumentation within the context of his concerns. In fact, Nagarjuna's arguments can be summarized in a way that makes this point apparent:

1. If subjects and their objects, things and their attributes, and causes and their effects exist independently as we habitually take them to, or exist intrinsically and absolutely as basic element analysis holds, then they must not depend on any kind of condition or relation. This point basically amounts to a philosophical insistence on the meanings of independent, intrinsic, and absolute. By definition, something is independent, intrinsic, or absolute only if it does not depend on anything else; it must have an identity that transcends its relations.
2. Nothing in our experience can be found that satisfies this criterion of independence or ultimacy. The earlier Abhidharma tradition had expressed this insight as dependent coarising: nothing can be found apart from its conditions of arising, formation, and decay. In our modem context this point is rather obvious when considering the causes and conditions of the material world and is expressed in our scientific tradition. Nagarjuna took the understanding of codependence considerably further. Causes and their effects, things and their attributes, and the very mind of the inquiring subject and the objects of mind are each equally codependent on the other. Nagarjuna's logic addresses itself penetratingly to the mind of the inquiring subject (recall our fundamental circularity), to the ways in which what are actually codependent factors are taken by that subject to be the ultimate founding blocks of a supposed objective and a supposed subjective reality.
3. Therefore, nothing can be found that has an ultimate or independent existence. Or to use Buddhist language, everything is "empty" of an independent existence, for it is codependently originated.
We now have a context for understanding emptiness with respect to codependent origination: all things are empty of any independent intrinsic nature. This may sound like an abstract statement, but it has far-ranging implications for experience. We explained in chapter 4 how the categories of the Abhidharma were both descriptions and contemplative directives for the way the mind is actually experienced when one is mindful. It is important to realize that Nagarjuna is not rejecting the Abhidharma, as he is sometimes interpreted as doing in Western scholarship. His entire analysis is based on the categories of the Abhidharma: what sense would arguments such as that of the seer, the sight, and the seeing have except in that context? (If the reader thinks that Nagarjuna's argument is a linguistic one, that is because he has not seen the force of the Abhidharma.) It is a very precise argument, not just a general handwaving that everything is dependent on everything. Nagarjuna is extending the Abhidharma, but that extension makes an incisive difference to experience.
Why should it make any difference at all to experience? One might say, So what if the world and the self change moment to moment whoever thought that they were permanent? And so what if they are mutually dependent on each other-whoever thought they were isolated? The answer (as we have seen throughout the book) is that as one becomes mindful of one's own experience, one realizes the power of the urge to grasp after foundations-to grasp the sense of foundation of a real, separate self, the sense of foundation of a real, separate world, and the sense of foundation of an actual relation between self and world.
It is said that emptiness is a natural discovery that one would make by oneself with sufficient mindfulness/awareness-natural but shocking. Previously we have been talking about examining the mind with meditation. There may not have been a self, but there was still a mind to examine itself, even if a momentary one. But now we discover that we have no mind; after all, a mind must be something that is separate from and knows the world. We also don't have a world. There is neither an objective nor subjective pole. Nor is there any knowing because there is nothing hidden. Knowing sunyata (more accurately knowing the world as sunyata) is surely not an intentional act. Rather (to use traditional imagery), it is like a reflection in a mirror-pure, brilliant, but with no additional reality apart from itself. As mind/world keeps happening in its interdependent continuity, there is nothing extra on the side of mind or on the side of world to know or be known further. Whatever experience happens is open (Buddhist teachers use the word exposed), perfectly revealed just as it is.
We can now see why Madhyamika is called the middle way. It avoids the extreme of either objectivism or subjectivism, of absolutism or nihilism. As is said by the Tibetan commentators, "Through ascertaining the reason - that all phenomena are dependent arisings - the extreme of annihilation (nihilism) is avoided, and realization of dependent-arising of causes and effects is gained. Through ascertaining the thesis-that all phenomena do not inherently exist-the extreme of permanence (absolutism) is avoided, and realization of the emptiness of all phenomena is gained. " But what does all this mean for the everyday world? I still have a name, a job, memories, and plans. The sun still rises in the morning, and scientists still work to explain that. What of all this?

Tao quartet







Zentralfriedhof, Vienna (Wien), Austria

Wednesday, November 6, 2013

Tao Paradoxico-Philosophicus 9-10



    Un dieu donne le feu     
     Pour faire l'enfer;      
      Un diable, le miel     
       Pour faire le ciel.  
   



TRACTATUS PARADOXICO-PHILOSOPHICUS

9 Nervous system: consider one or more closed organizations that intersect with a living organism and its cognitive domain, expanding it.
9.1 A logical observer distinguishes the nervous system only within the living organism and interprets sensory surfaces and effector surfaces as “inputs” to and “outputs” from the nervous system that match “outputs” from and “inputs” to a world “out there”.
9.2 A paradoxical observer interacts with and tentatively distinguishes the activity of the nervous system as “nerve” impulses that encode only “how much” not “what” the living organism “perceives”.
9.21 Since everything “perceived” translates into nerve impulses, the nervous system does not discriminate (distinguish) between impulses coming from an “outside” world and those originated “within” the nervous system (“inside” or “outside” blend into “inside and outside”).
9.22 For this same observer, the encounter with other observers triggers the invention of a tentative world “in and out there”.
9.23 While some of these observers adjust, share, and thus “confirm”, tentatively the invention, others do not.



10 Environment: logical observers distinguish the intersection of their cognitive domains as a common dwelling and call it their environment.
10.1 The distinction of an environment appears to these observers as an invitation to extract or deduce further distinctions.
10.12 These further distinctions appear to these observers as processes (events in time) that produce components (objects in space) forming open networks of processes and components that exclude these and other observers.
10.2 Language and communication emerge in this way from the activity (of processes) in the nervous system and thus, the logical observer invents a world “out there” independent of the observers.
10.3 Since processes, components, open networks of processes and components, and an environment neither define nor maintain themselves, logical observers may only distinguish (extricate or deduce) them from organizationally closed unities (paradoxical context), which will appear open and no longer organizationally closed (nor paradoxical) for these observers.
10.4 Paradoxical observers interact with and tentatively distinguish an environment as a world “in and out there”, through which they may, with some difficulty, relate to logical observers.

Tractatus Paradoxico-Philosophicus

A Philosophical Approach to Education
Un Acercamiento Filosófico a la Educación
Une Approche Philosophique à l'Education
Eine Philosophische Annäherung an Bildung

Ricardo B. Uribe

Copyright © by a collaborating group of people including the author, editing consultants, translators, and printers. All rights reserved.





Tao Paradoxico-Philosophicus 7-8

Friday, October 25, 2013

solar Tao



Sonne (Sun)

Lyrics ©2001 Rammstein.

Eins, zwei, drei, vier, fünf, sechs, sieben, acht, neun, aus
Alle warten auf das Licht
fürchtet euch fürchtet euch nicht
die Sonne scheint mir aus den Augen
sie wird heut Nacht nicht untergehen
und die Welt zählt laut bis zehn
Eins
Hier kommt die Sonne
Zwei
Hier kommt die Sonne
Drei
Sie ist der hellste Stern von allen
Vier
Hier kommt die Sonne
Die Sonne scheint mir aus den Händen
kann verbrennen, kann euch blenden
wenn sie aus den Fäusten bricht
legt sich heiß auf das Gesicht
sie wird heut Nacht nicht untergehen
und die Welt zählt laut bis zehn
Eins
Hier kommt die Sonne
Zwei
Hier kommt die Sonne
Drei
Sie ist der hellste Stern von allen
Vier
Hier kommt die Sonne
Fünf
Hier kommt die Sonne
Sechs
Hier kommt die Sonne
Sieben
Sie ist der hellste Stern von allen
Acht, neun
Hier kommt die Sonne
Die Sonne scheint mir aus den Händen
kann verbrennen, kann dich blenden
wenn sie aus den Fäusten bricht
legt sich heiß auf dein Gesicht
legt sich schmerzend auf die Brust
das Gleichgewicht wird zum Verlust
lässt dich hart zu Boden gehen
und die Welt zählt laut bis zehn
Eins
Hier kommt die Sonne
Zwei
Hier kommt die Sonne
Drei
Sie ist der hellste Stern von allen
Vier
Und wird nie vom Himmel fallen
Fünf
Hier kommt die Sonne
Sechs
Hier kommt die Sonne
Sieben
Sie ist der hellste Stern von allen
Acht , neun
Hier kommt die Sonne
Unofficial Translation ©2003 Jeremy Williams.

One, two, three, four, five, six, seven, eight, nine, out
Everyone is waiting for the light
be afraid, don't be afraid
the sun is shining out of my eyes
it will not set tonight
and the world counts loudly to ten
One
Here comes the sun
Two
Here comes the sun
Three
It is the brightest star of them all
Four
Here comes the sun
The sun is shining out of my hands
it can burn, it can blind you all
when it breaks out of the fists
it lays down hotly on the face
it will not set tonight
and the world counts loudly to ten
One
Here comes the sun
Two
Here comes the sun
Three
It is the brightest star of them all
Four
Here comes the sun
Five
Here comes the sun
Six
Here comes the sun
Seven
It is the brightest star of them all
Eight, nine
Here comes the sun
The sun is shining out of my hands
it can burn, it can blind you
when it breaks out of the fists
it lays down hotly on your face
it lays down painfully on your chest
balance is lost
it lets you go hard to the floor
and the world counts loudly to ten
One
Here comes the sun
Two
Here comes the sun
Three
It is the brightest star of them all
Four
And it will never fall from the sky
Five
Here comes the sun
Six
Here comes the sun
Seven
It is the brightest star of them all
Eight, nine
Here comes the sun

Tuesday, October 22, 2013

meta-Tao breaks

Vladimir Kush, Sunrise by the ocean
The next metapattern discussed by Tyler Volk and Jeff Bloom are breaks:

Background

Transformations; change; leaps; shifts; sequences of stages; dilemmas and decisions.

Examples

  • In science: chemical reactions, metamorphosis, evolutionary change (punctuated equilibrium), energy transformations, phenotypic plasticity, point of change from action to reaction, waterfalls, branching, etc.
  • In architecture and design: divisions of space and activity, vehicle brakes, etc.
  • In art: perceptual shifts, design changes, etc.
  • In social sciences: insights, stages in development, events that change psychosocial states, etc.
  • In other senses: divorce, death, birth, marriage, crashing waves, breakthroughs, etc.

Metapatterns

The Pattern Underground

VROOM VROOM Tao



Wednesday, October 16, 2013

Tao subsystems - IX



Subsystems

Motor Output

The Motor Output subsystem consists of those structures which we physically affect the external world and our own bodies. In terms of conscious awareness, these structures are primarily the skeletal, voluntary musculature. If I take a minute out from writing to pet my cat, I am using my Motor Output subsystem with full awareness. The Motor Output subsystem elements that primarily affect our own bodies are glandular secretions and other internal, biological processes. These latter, involuntary effectors are controllable not directly, but through intermediates. I cannot directly increase the amount of adrenaline in my bloodstream, for example, but if I make myself angry and wave my fists and shout and holler, I will almost certainly increase the amount of adrenaline secreted.
Two kinds of inputs control Motor Output: input from the Evaluation and Decision-Making subsystem, conscious decisions to do or not to do something, and input from a series of controlling signals that bypasses the Evaluation and Decision-Making subsystem. The latter includes reflexes (jumping at a sudden sound, for example), emotional reactions, and direct control of Motor Output from the Subconscious subsystem. Subconscious control in the ordinary d-SoC includes qualities added to otherwise conscious gestures that reflect nonconscious mental processes: you may state, for example, that a certain person does not make you angry, but an observer notices that your fists clench whenever this person is mentioned.
Motor Output operates with almost constant feedback control. By monitoring the environment with the Exteroception subsystem and the body with the Interoception subsystem, you constantly check on the effect of your physical actions and on whether these are desirable and make adjustments accordingly.
Many voluntary movements are quite unconscious in terms of their details. You decide to lift your arm, yet you have little awareness of the individual muscle actions that allow you to do so. In d-ASCs, greatly increased awareness of particular aspects of the Motor Output subsystem are sometimes reported. Greatly decreased awareness has also been reported: actions that are ordinarily subject to conscious awareness, via feedback from the interoceptors, are done with no awareness at all. During my first experience with a psychedelic drug, mescaline, I told my body to walk down to the end of the hall. Then my awareness became completely absorbed in various internal events. After what seemed a very long time, I was surprised to notice that my body had walked down the hall and obligingly stopped at the end, with no conscious participation or awareness on my part. To some extent this occurs in an ordinary d-SoC, especially with well-learned actions, but the effect can be much more striking in a d-ASC. We should distinguish lack of sensory awareness of body actions from awareness of them but without the sense of ego added. The latter also creates a different relationship with motor actions.
Deautomatization of motor actions is another sort of altered awareness of motor output that can occur in a d-ASC. Either you become unusually aware of components of automatized actions normally inaccessible to consciousness or you have deliberately to will each of these component actions to take place because the whole automated action will not occur by itself.
D-ASC related changes in the way the body is experienced via the Exteroception subsystem and in awareness of functioning of the Motor Output subsystem can alter the operating characteristics of voluntary action. You may have to perform a different kind of action internally in order to produce the same kind of voluntary action. Carlos Castaneda gives a striking example of this in a drug-induced d-ASC. His body was completely paralyzed from the "little smoke" in terms of his ordinary way of controlling it. Doing all the things he ordinarily did to move produced zero response. But if he simply willed movement in a certain way, his body responded.
Changes in the awareness of the functioning of the Motor Output subsystem may include feelings of greatly increased strength or skill, or of greatly decreased strength or skill. Often these feelings do not correspond with performance: you may feel exceptionally weak or unsure of your skill, and yet perform in a basically ordinary fashion. Or you may feel exceptionally strong, but show no actual increase in performance. The potential for a true increment in strength in d-ASCs is real, however, because in the ordinary d-SoC you seldom use your musculature to its full strength. Safety mechanisms prevent you from fully exerting yourself and possibly damaging yourself. For example, some muscles are strong enough to break your own bones if they were maximally exerted. In various d-ASCs, especially when strong emotions are involved, these safety mechanisms may be temporarily bypassed, allowing greater strength, at the risk of damage.
In a d-ASC the Subconscious subsystem may control the Motor Output subsystem or parts of it. For example, if a hypnotist suggests to a subject that his arm is moving up and down by itself, the arm will do so and the subject will experience the arm moving by itself, without his conscious volition. If a hypnotist suggests automatic writing, the subject's hand will write complex material, with as much skill as in ordinary writing, without any conscious awareness by the subject of what he is going to write and without any feeling of volitional control over the action. This kind of disassociated motor action can also sometimes occur in the ordinary d-SoC, where it may represent the action of a disassociated d-ASC.
This ends our survey of the main subsystems of states of consciousness. It is only a survey, pointing out the major variations. Much literature already exists from which more specific information about various subsystems can be gleaned, and much research remains to be done to clarify our concepts of particular subsystems. Particularly we need to know exactly how each subsystem changes for each specific d-ASC. So we must know our parts better, although I emphasize again that it is just as important to know how these parts are put into the functioning whole that constitutes a system, a d-SoC.

Tao subsystems - VIII

Tao beyond passion




I often watched you the way you whore yourself/You're so beautiful/You flirt, tease, enviously I wish you'd flirt with me.

Perhaps I'm enticed by what you are/I imagined us jumpin' the broom, foolish I know/'Cause that's not the life you live.

You live alone in a crowded bed never remembering faces

Conversations just a body for the lonely

Spend one night with me satisfy me for free and I'll love you endlessly

I overheard you say you'd give them what they wanted

So give me what I want

Tell me I'm the only one

I want to marry you

Tell me I'm the only one

In a harlot's dress you wear the smile of a child with the faith of

Mary Magdalene

Yet you wash the feet of unworthy men

Come and I'll set you free into an endless valley of fruits both sweet and sour

And whatever displeases your palate my kisses will wash away

Stay. If you must dance, dance for me

Blessed are the pure at heart for they shall see god so close your eyes and dream

For the world will blind you and I'll judge not so that I may not be judged

Please give me what I want

Tell me I'm the only one

I want to marry you

Tell me I'm the only one

Friday, September 27, 2013

Tao Paradoxico-Philosophicus 7-8



    Un dieu donne le feu     
     Pour faire l'enfer;      
      Un diable, le miel     
       Pour faire le ciel.  
   



TRACTATUS PARADOXICO-PHILOSOPHICUS

7 An observer observing itself: this leads to the following dilemma:
7.01 From a logical perspective, an observer may observe itself, either at the same location but at different instants (emergence of time), or at the same instant but at different locations (emergence of space).
7.1 An observer observing itself at the same instant and location (a paradoxical, unpredictable observer) reveals a paradox with no logical solution.
7.2 This observer offers a paradoxical context from where the same or other observers, adopting a logical perspective, may extract or deduce distinctions, and then more distinctions from those distinctions treated as new paradoxical contexts so that the world “out there” for these observers slowly emerges.
7.3 The logical observer: consider an observer that adopts only a logical perspective and hence only extracts or deduces distinctions from a paradoxical context and allowed by the logic chosen, such as considering other observers as paradoxical or logical.
7.4 The paradoxical observer: consider an observer that adopts a paradoxical and logical perspective and makes tentative distinctions in a paradoxical context considering all possibilities, such as considering other observers as paradoxical and logical.



8 Living organism: consider an organization that produces and maintains itself as an organizationally closed unity that defines its cognitive domain and that:
8.01 as a paradoxical observer interacts with, and makes tentative distinctions in its own paradoxical context (the living organism and its cognitive domain).
8.02 as a logical observer distinguishes itself from its own cognitive domain as a processor whose space and time emerge together with this same distinction and from which it extracts or deduces further distinctions.
8.1 A living organism, as a paradoxical observer, interacts with and tentatively distinguishes the self-producing organization of a living organism maintaining its organizational closure through a closed network of processes (tentative events in time) that produce components (tentative objects in space) and that continuously regenerate the network of processes.
8.2 A living organism, as a logical observer, may extract distinctions from a paradoxical context, but may not act as a paradoxical observer.
8.3 A living organism, as a paradoxical observer, may act as a paradoxical observer and as a logical observer.
8.4 A living organism, even without a nervous system, defines and supports its own cognitive domain and cognition.

Tractatus Paradoxico-Philosophicus

A Philosophical Approach to Education
Un Acercamiento Filosófico a la Educación
Une Approche Philosophique à l'Education
Eine Philosophische Annäherung an Bildung

Ricardo B. Uribe

Copyright © by a collaborating group of people including the author, editing consultants, translators, and printers. All rights reserved.





Tao Paradoxico-Philosophicus 5-6

Wednesday, August 28, 2013

Tao lost challenge

video
Space Shuttle mission 51-L: Crew boarding; source: NASA

video
Space Shuttle mission 51-L: Liftoff; source: NASA

video
Space Shuttle mission 51-L: Explosion; source: NASA


DPS: Data Processing Systems Engineer - Flight: Flight Director Jay Greene - Scobee: Dick Scobee (Commander) - Smith: Michael J. Smith (Pilot) - Booster: Booster Systems Engineer - CAPCOM: Capsule communicator - FIDO: Flight Dynamics Officer - GC: Ground Controller - RSO: Range Safety Officer - PAO: Public Affairs Officer (public announcer) - intercom: internal crew communication

T=0 Liftoff
T+5.000 seconds DPS: "Liftoff confirmed". Flight: "Liftoff..."
T+19.859 seconds: Booster: "Throttle down to 94". Flight: "Ninety four..."
T+40.000 seconds: Smith, intercom: "There's Mach 1". Scobee: "Going through 19,000".
T+48.900 seconds: Booster: "Three at 65". Flight: "Sixty-five, FIDO..." FIDO: "T-del confirms throttles". Flight: "Thank-you".
T+57.000 seconds: Scobee, intercom: Throttling up.
T+62.000 seconds: Smith, intercom: "Thirty-five thousand, going through one point five."
T+68.000 seconds: CAPCOM: "Challenger, go at throttle up". Scobee: "Roger, go at throttle up".

T+73.000 seconds: Smith, intercom: "Uh oh..."

T+89.000 seconds: Flight: "FIDO, trajectories" FIDO: "Go ahead." Flight: "Trajectory, FIDO" FIDO: "Flight, FIDO, filters (radar) got discreting sources. We're go." FIDO: "Flight, FIDO, till we get stuff back he's on his cue card for abort modes" Flight: "Procedures, any help?" Unknown: "Negative, flight, no data." GC: "Flight, GC, we've had negative contact, loss of downlink (of radio voice or data from Challenger)." Flight: "OK, all operators, watch your data carefully."
T+1 min. 56 seconds PAO: "Flight controllers here are looking very carefully at the situation. Obviously a major malfunction."
T+2 min. 1 second GC: "Flight, GC, negative downlink." Flight: "Copy."
T+2 min. 8 seconds PAO: "We have no downlink."
T+2 min. 25 seconds FIDO: "Flight, FIDO." Flight: "Go ahead." FIDO: "RSO reports vehicle exploded." Flight: (after a long pause): "Copy. FIDO, can we get any reports from recovery forces?" FIDO: "Stand by."
T+2 min. 45 seconds Flight: "GC, all operators, contingency procedures in effect."


Following mission STS-51-L disaster of January 28, 1986 of Space Shuttle Challenger, after 73 seconds of flight, the presidential commission reported a final document where are included some observations and analysis by one of the most relevant physicists of history, Richard P. Feynman, concerning Shuttle reliability.
His report became a classic about the relation between technique and management of highly complex projects.


Appendix F - Personal observations on the reliability of the Shuttle

by R. P. Feynman

Introduction

It appears that there are enormous differences of opinion as to the probability of a failure with loss of vehicle and of human life. The estimates range from roughly 1 in 100 to 1 in 100,000. The higher figures come from the working engineers, and the very low figures from management. What are the causes and consequences of this lack of agreement? Since 1 part in 100,000 would imply that one could put a Shuttle up each day for 300 years expecting to lose only one, we could properly ask "What is the cause of management's fantastic faith in the machinery?"

We have also found that certification criteria used in Flight Readiness Reviews often develop a gradually decreasing strictness. The argument that the same risk was flown before without failure is often accepted as an argument for the safety of accepting it again. Because of this, obvious weaknesses are accepted again and again, sometimes without a sufficiently serious attempt to remedy them, or to delay a flight because of their continued presence.

There are several sources of information. There are published criteria for certification, including a history of modifications in the form of waivers and deviations. In addition, the records of the Flight Readiness Reviews for each flight document the arguments used to accept the risks of the flight. Information was obtained from the direct testimony and the reports of the range safety officer, Louis J. Ullian, with respect to the history of success of solid fuel rockets. There was a further study by him (as chairman of the launch abort safety panel (LASP)) in an attempt to determine the risks involved in possible accidents leading to radioactive contamination from attempting to fly a plutonium power supply (RTG) for future planetary missions. The NASA study of the same question is also available. For the History of the Space Shuttle Main Engines, interviews with management and engineers at Marshall, and informal interviews with engineers at Rocketdyne, were made. An independent (Cal Tech) mechanical engineer who consulted for NASA about engines was also interviewed informally. A visit to Johnson was made to gather information on the reliability of the avionics (computers, sensors, and effectors). Finally there is a report "A Review of Certification Practices, Potentially Applicable to Man-rated Reusable Rocket Engines," prepared at the Jet Propulsion Laboratory by N. Moore, et al., in February, 1986, for NASA Headquarters, Office of Space Flight. It deals with the methods used by the FAA and the military to certify their gas turbine and rocket engines. These authors were also interviewed informally.

Solid Rockets (SRB)

An estimate of the reliability of solid rockets was made by the range safety officer, by studying the experience of all previous rocket flights. Out of a total of nearly 2,900 flights, 121 failed (1 in 25). This includes, however, what may be called, early errors, rockets flown for the first few times in which design errors are discovered and fixed. A more reasonable figure for the mature rockets might be 1 in 50. With special care in the selection of parts and in inspection, a figure of below 1 in 100 might be achieved but 1 in 1,000 is probably not attainable with today's technology. (Since there are two rockets on the Shuttle, these rocket failure rates must be doubled to get Shuttle failure rates from Solid Rocket Booster failure.)

NASA officials argue that the figure is much lower. They point out that these figures are for unmanned rockets but since the Shuttle is a manned vehicle "the probability of mission success is necessarily very close to 1.0." It is not very clear what this phrase means. Does it mean it is close to 1 or that it ought to be close to 1? They go on to explain "Historically this extremely high degree of mission success has given rise to a difference in philosophy between manned space flight programs and unmanned programs; i.e., numerical probability usage versus engineering judgment." (These quotations are from "Space Shuttle Data for Planetary Mission RTG Safety Analysis," Pages 3-1, 3-1, February 15, 1985, NASA, JSC.) It is true that if the probability of failure was as low as 1 in 100,000 it would take an inordinate number of tests to determine it ( you would get nothing but a string of perfect flights from which no precise figure, other than that the probability is likely less than the number of such flights in the string so far). But, if the real probability is not so small, flights would show troubles, near failures, and possible actual failures with a reasonable number of trials. and standard statistical methods could give a reasonable estimate. In fact, previous NASA experience had shown, on occasion, just such difficulties, near accidents, and accidents, all giving warning that the probability of flight failure was not so very small. The inconsistency of the argument not to determine reliability through historical experience, as the range safety officer did, is that NASA also appeals to history, beginning "Historically this high degree of mission success..."

Finally, if we are to replace standard numerical probability usage with engineering judgment, why do we find such an enormous disparity between the management estimate and the judgment of the engineers? It would appear that, for whatever purpose, be it for internal or external consumption, the management of NASA exaggerates the reliability of its product, to the point of fantasy.

The history of the certification and Flight Readiness Reviews will not be repeated here. (See other part of Commission reports.) The phenomenon of accepting for flight, seals that had shown erosion and blow-by in previous flights, is very clear. The Challenger flight is an excellent example. There are several references to flights that had gone before. The acceptance and success of these flights is taken as evidence of safety. But erosion and blow-by are not what the design expected. They are warnings that something is wrong. The equipment is not operating as expected, and therefore there is a danger that it can operate with even wider deviations in this unexpected and not thoroughly understood way. The fact that this danger did not lead to a catastrophe before is no guarantee that it will not the next time, unless it is completely understood. When playing Russian roulette the fact that the first shot got off safely is little comfort for the next. The origin and consequences of the erosion and blow-by were not understood. They did not occur equally on all flights and all joints; sometimes more, and sometimes less. Why not sometime, when whatever conditions determined it were right, still more leading to catastrophe?

In spite of these variations from case to case, officials behaved as if they understood it, giving apparently logical arguments to each other often depending on the "success" of previous flights. For example. in determining if flight 51-L was safe to fly in the face of ring erosion in flight 51-C, it was noted that the erosion depth was only one-third of the radius. It had been noted in an experiment cutting the ring that cutting it as deep as one radius was necessary before the ring failed. Instead of being very concerned that variations of poorly understood conditions might reasonably create a deeper erosion this time, it was asserted, there was "a safety factor of three." This is a strange use of the engineer's term, "safety factor." If a bridge is built to withstand a certain load without the beams permanently deforming, cracking, or breaking, it may be designed for the materials used to actually stand up under three times the load. This "safety factor" is to allow for uncertain excesses of load, or unknown extra loads, or weaknesses in the material that might have unexpected flaws, etc. If now the expected load comes on to the new bridge and a crack appears in a beam, this is a failure of the design. There was no safety factor at all; even though the bridge did not actually collapse because the crack went only one-third of the way through the beam. The O-rings of the Solid Rocket Boosters were not designed to erode. Erosion was a clue that something was wrong. Erosion was not something from which safety can be inferred.

There was no way, without full understanding, that one could have confidence that conditions the next time might not produce erosion three times more severe than the time before. Nevertheless, officials fooled themselves into thinking they had such understanding and confidence, in spite of the peculiar variations from case to case. A  mathematical model was made to calculate erosion. This was a model based not on physical understanding but on empirical curve fitting. To be more detailed, it was supposed a stream of hot gas impinged on the O-ring material, and the heat was determined at the point of stagnation (so far, with reasonable physical, thermodynamic laws). But to determine how much rubber eroded it was assumed this depended only on this heat by a formula suggested by data on a similar material. A logarithmic plot suggested a straight line, so it was supposed that the erosion varied as the .58 power of the heat, the .58 being determined by a nearest fit. At any rate, adjusting some other numbers, it was determined that the model agreed with the erosion (to depth of one-third the radius of the ring). There is nothing much so wrong with this as believing the answer! Uncertainties appear everywhere. How strong the gas stream might be was unpredictable, it depended on holes formed in the putty. Blow-by showed that the ring might fail even though not, or only partially eroded through. The empirical formula was known to be uncertain, for it did not go directly through the very data points by which it was determined. There were a cloud of points some twice above, and some twice below the fitted curve, so erosions twice predicted were reasonable from that cause alone. Similar uncertainties surrounded the other constants in the formula, etc., etc. When using a mathematical model careful attention must be given to uncertainties in the model.

Liquid Fuel Engine (SSME)

During the flight of 51-L the three Space Shuttle Main Engines all worked perfectly, even, at the last moment, beginning to shut down the engines as the fuel supply began to fail. The question arises, however, as to whether, had it failed, and we were to investigate it in as much detail as we did the Solid Rocket Booster, we would find a similar lack of attention to faults and a deteriorating reliability. In other words, were the organization weaknesses that contributed to the accident confined to the Solid Rocket Booster sector or were they a more general characteristic of NASA? To that end the Space Shuttle Main Engines and the avionics were both investigated. No similar study of the Orbiter, or the External Tank were made.

The engine is a much more complicated structure than the Solid Rocket Booster, and a great deal more detailed engineering goes into it. Generally, the engineering seems to be of high quality and apparently considerable attention is paid to deficiencies and faults found in operation.

The usual way that such engines are designed (for military or civilian aircraft) may be called the component system, or bottom-up design. First it is necessary to thoroughly understand the properties and limitations of the materials to be used (for turbine blades, for example), and tests are begun in experimental rigs to determine those. With this knowledge larger component parts (such as bearings) are designed and tested individually. As deficiencies and design errors are noted they are corrected and verified with further testing. Since one tests only parts at a time these tests and modifications are not overly expensive. Finally one works up to the final design of the entire engine, to the necessary specifications. There is a good chance, by this time that the engine will generally succeed, or that any failures are easily isolated and analyzed because the failure modes, limitations of materials, etc., are so well understood. There is a very good chance that the modifications to the engine to get around the final difficulties are not very hard to make, for most of the serious problems have already been discovered and dealt with in the earlier, less expensive, stages of the process.

The Space Shuttle Main Engine was handled in a different manner, top down, we might say. The engine was designed and put together all at once with relatively little detailed preliminary study of the material and components. Then when troubles are found in the bearings, turbine blades, coolant pipes, etc., it is more expensive and difficult to discover the causes and make changes. For example, cracks have been found in the turbine blades of the high pressure oxygen turbopump. Are they caused by flaws in the material, the effect of the oxygen atmosphere on the properties of the material, the thermal stresses of startup or shutdown, the vibration and stresses of steady running, or mainly at some resonance at certain speeds, etc.? How long can we run from crack initiation to crack failure, and how does this depend on power level? Using the completed engine as a test bed to resolve such questions is extremely expensive. One does not wish to lose an entire engine in order to find out where and how failure occurs. Yet, an accurate knowledge of this information is essential to acquire a confidence in the engine reliability in use. Without detailed understanding, confidence can not be attained.

A further disadvantage of the top-down method is that, if an understanding of a fault is obtained, a simple fix, such as a new shape for the turbine housing, may be impossible to implement without a redesign of the entire engine.

The Space Shuttle Main Engine is a very remarkable machine. It has a greater ratio of thrust to weight than any previous engine. It is built at the edge of, or outside of, previous engineering experience. Therefore, as expected, many different kinds of flaws and difficulties have turned up. Because, unfortunately, it was built in the top-down manner, they are difficult to find and fix. The design aim of a lifetime of 55 missions equivalent firings (27,000 seconds of operation, either in a mission of 500 seconds, or on a test stand) has not been obtained. The engine now requires very frequent maintenance and replacement of important parts, such as turbopumps, bearings, sheet metal housings, etc. The high-pressure fuel turbopump had to be replaced every three or four mission equivalents (although that may have been fixed, now) and the high pressure oxygen turbopump every five or six. This is at most ten percent of the original specification. But our main concern here is the determination of reliability.

In a total of about 250,000 seconds of operation, the engines have failed seriously perhaps 16 times. Engineering pays close attention to these failings and tries to remedy them as quickly as possible. This it does by test studies on special rigs experimentally designed for the flaws in question, by careful inspection of the engine for suggestive clues (like cracks), and by considerable study and analysis. In this way, in spite of the difficulties of top-down design, through hard work, many of the problems have apparently been solved.

A list of some of the problems follows. Those followed by an asterisk (*) are probably solved:

1.Turbine blade cracks in high pressure fuel turbopumps (HPFTP). (May have been solved.)

2.Turbine blade cracks in high pressure oxygen turbopumps (HPOTP).

3.Augmented Spark Igniter (ASI) line rupture.*

4.Purge check valve failure.*

5.ASI chamber erosion.*

6.HPFTP turbine sheet metal cracking.

7.HPFTP coolant liner failure.*

8.Main combustion chamber outlet elbow failure.*

9.Main combustion chamber inlet elbow weld offset.*

10.HPOTP subsynchronous whirl.*

11.Flight acceleration safety cutoff system (partial failure in a redundant system).*

12.Bearing spalling (partially solved).

13.A vibration at 4,000 Hertz making some engines inoperable, etc.

Many of these solved problems are the early difficulties of a new design, for 13 of them occurred in the first 125,000 seconds and only three in the second 125,000 seconds. Naturally, one can never be sure that all the bugs are out, and, for some, the fix may not have addressed the true cause. Thus, it is not unreasonable to guess there may be at least one surprise in the next 250,000 seconds, a probability of 1/500 per engine per mission. On a mission there are three engines, but some accidents would possibly be contained, and only affect one engine. The system can abort with only two engines. Therefore let us say that the unknown suprises do not, even of themselves, permit us to guess that the probability of mission failure do to the Space Shuttle Main Engine is less than 1/500. To this we must add the chance of failure from known, but as yet unsolved, problems (those without the asterisk in the list above). These we discuss below. (Engineers at Rocketdyne, the manufacturer, estimate the total probability as 1/10,000. Engineers at marshal estimate it as 1/300, while NASA management, to whom these engineers report, claims it is 1/100,000. An independent engineer consulting for NASA thought 1 or 2 per 100 a reasonable estimate.)

The history of the certification principles for these engines is confusing and difficult to explain. Initially the rule seems to have been that two sample engines must each have had twice the time operating without failure as the operating time of the engine to be certified (rule of 2x). At least that is the FAA practice, and NASA seems to have adopted it, originally expecting the certified time to be 10 missions (hence 20 missions for each sample). Obviously the best engines to use for comparison would be those of greatest total (flight plus test) operating time -- the so-called "fleet leaders." But what if a third sample and several others fail in a short time? Surely we will not be safe because two were unusual in lasting longer. The short time might be more representative of the real possibilities, and in the spirit of the safety factor of 2, we should only operate at half the time of the short-lived samples.

The slow shift toward decreasing safety factor can be seen in many examples. We take that of the HPFTP turbine blades. First of all the idea of testing an entire engine was abandoned. Each engine number has had many important parts (like the turbopumps themselves) replaced at frequent intervals, so that the rule must be shifted from engines to components. We accept an HPFTP for a certification time if two samples have each run successfully for twice that time (and of course, as a practical matter, no longer insisting that this time be as large as 10 missions). But what is "successfully?" The FAA calls a turbine blade crack a failure, in order, in practice, to really provide a safety factor greater than 2. There is some time that an engine can run between the time a crack originally starts until the time it has grown large enough to fracture. (The FAA is contemplating new rules that take this extra safety time into account, but only if it is very carefully analyzed through known models within a known range of experience and with materials thoroughly tested. None of these conditions apply to the Space Shuttle Main Engine.

Cracks were found in many second stage HPFTP turbine blades. In one case three were found after 1,900 seconds, while in another they were not found after 4,200 seconds, although usually these longer runs showed cracks. To follow this story further we shall have to realize that the stress depends a great deal on the power level. The Challenger flight was to be at, and previous flights had been at, a power level called 104% of rated power level during most of the time the engines were operating. Judging from some material data it is supposed that at the level 104% of rated power level, the time to crack is about twice that at 109% or full power level (FPL). Future flights were to be at this level because of heavier payloads, and many tests were made at this level. Therefore dividing time at 104% by 2, we obtain units called equivalent full power level (EFPL). (Obviously, some uncertainty is introduced by that, but it has not been studied.) The earliest cracks mentioned above occurred at 1,375 EFPL.

Now the certification rule becomes "limit all second stage blades to a maximum of 1,375 seconds EFPL." If one objects that the safety factor of 2 is lost it is pointed out that the one turbine ran for 3,800 seconds EFPL without cracks, and half of this is 1,900 so we are being more conservative. We have fooled ourselves in three ways. First we have only one sample, and it is not the fleet leader, for the other two samples of 3,800 or more seconds had 17 cracked blades between them. (There are 59 blades in the engine.) Next we have abandoned the 2x rule and substituted equal time. And finally, 1,375 is where we did see a crack. We can say that no crack had been found below 1,375, but the last time we looked and saw no cracks was 1,100 seconds EFPL. We do not know when the crack formed between these times, for example cracks may have formed at 1,150 seconds EFPL. (Approximately 2/3 of the blade sets tested in excess of 1,375 seconds EFPL had cracks. Some recent experiments have, indeed, shown cracks as early as 1,150 seconds.) It was important to keep the number high, for the Challenger was to fly an engine very close to the limit by the time the flight was over.

Finally it is claimed that the criteria are not abandoned, and the system is safe, by giving up the FAA convention that there should be no cracks, and considering only a completely fractured blade a failure. With this definition no engine has yet failed. The idea is that since there is sufficient time for a crack to grow to a fracture we can insure that all is safe by inspecting all blades for cracks. If they are found, replace them, and if none are found we have enough time for a safe mission. This makes the crack problem not a flight safety problem, but merely a maintenance problem.

This may in fact be true. But how well do we know that cracks always grow slowly enough that no fracture can occur in a mission? Three engines have run for long times with a few cracked blades (about 3,000 seconds EFPL) with no blades broken off.

But a fix for this cracking may have been found. By changing the blade shape, shot-peening the surface, and covering with insulation to exclude thermal shock, the blades have not cracked so far.

A very similar story appears in the history of certification of the HPOTP, but we shall not give the details here.

It is evident, in summary, that the Flight Readiness Reviews and certification rules show a deterioration for some of the problems of the Space Shuttle Main Engine that is closely analogous to the deterioration seen in the rules for the Solid Rocket Booster.

Avionics

By "avionics" is meant the computer system on the Orbiter as well as its input sensors and output actuators. At first we will restrict ourselves to the computers proper and not be concerned with the reliability of the input information from the sensors of temperature, pressure, etc., nor with whether the computer output is faithfully followed by the actuators of rocket firings, mechanical controls, displays to astronauts, etc.

The computer system is very elaborate, having over 250,000 lines of  code. It is responsible, among many other things, for the automatic control of the entire ascent to orbit, and for the descent until well into the atmosphere (below Mach 1) once one button is pushed deciding the landing site desired. It would be possible to make the entire landing automatically (except that the landing gear lowering signal is expressly left out of computer control, and must be provided by the pilot, ostensibly for safety reasons) but such an entirely automatic landing is probably not as safe as a pilot controlled landing. During orbital flight it is used in the control of payloads, in displaying information to the astronauts, and the exchange of information to the ground. It is evident that the safety of flight requires guaranteed accuracy of this elaborate system of computer hardware and software.

In brief, the hardware reliability is ensured by having four essentially independent identical computer systems. Where possible each sensor also has multiple copies, usually four, and each copy feeds all four of the computer lines. If the inputs from the sensors disagree, depending on circumstances, certain averages, or a majority selection is used as the effective input. The algorithm used by each of the four computers is exactly the same, so their inputs (since each sees all copies of the sensors) are the same. Therefore at each step the results in each computer should be identical. From time to time they are compared, but because they might operate at slightly different speeds a system of stopping and waiting at specific times is instituted before each comparison is made. If one of the computers disagrees, or is too late in having its answer ready, the three which do agree are assumed to be correct and the errant computer is taken completely out of the system. If, now, another computer fails, as judged by the agreement of the other two, it is taken out of the system, and the rest of the flight canceled, and descent to the landing site is instituted, controlled by the two remaining computers. It is seen that this is a redundant system since the failure of only one computer does not affect the mission. Finally, as an extra feature of safety, there is a fifth independent computer, whose memory is loaded with only the programs of ascent and descent, and which is capable of controlling the descent if there is a failure of more than two of the computers of the main line four.

There is not enough room in the memory of the main line computers for all the programs of ascent, descent, and payload programs in flight, so the memory is loaded about four time from tapes, by the astronauts.

Because of the enormous effort required to replace the software for such an elaborate system, and for checking a new system out, no change has been made to the hardware since the system began about fifteen years ago. The actual hardware is obsolete; for example, the memories are of the old ferrite core type. It is becoming more difficult to find manufacturers to supply such old-fashioned computers reliably and of high quality. Modern computers are very much more reliable, can run much faster, simplifying circuits, and allowing more to be done, and would not require so much loading of memory, for the memories are much larger.

The software is checked very carefully in a bottom-up fashion. First, each new line of code is checked, then sections of code or modules with special functions are verified. The scope is increased step by step until the new changes are incorporated into a complete system and checked. This complete output is considered the final product, newly released. But completely independently there is an independent verification group, that takes an adversary attitude to the software development group, and tests and verifies the software as if it were a customer of the delivered product. There is additional verification in using the new programs in simulators, etc. A discovery of an error during verification testing is considered very serious, and its origin studied very carefully to avoid such mistakes in the future. Such unexpected errors have been found only about six times in all the programming and program changing (for new or altered payloads) that has been done. The principle that is followed is that all the verification is not an aspect of program safety, it is merely a test of that safety, in a non-catastrophic verification. Flight safety is to be judged solely on how well the programs do in the verification tests. A failure here generates considerable concern.

To summarize then, the computer software checking system and attitude is of the highest quality. There appears to be no process of gradually fooling oneself while degrading standards so characteristic of the Solid Rocket Booster or Space Shuttle Main Engine safety systems. To be sure, there have been recent suggestions by management to curtail such elaborate and expensive tests as being unnecessary at this late date in Shuttle history. This must be resisted for it does not appreciate the mutual subtle influences, and sources of error generated by even small changes of one part of a program on another. There are perpetual requests for changes as new payloads and new demands and modifications are suggested by the users. Changes are expensive because they require extensive testing. The proper way to save money is to curtail the number of requested changes, not the quality of testing for each.

One might add that the elaborate system could be very much improved by more modern hardware and programming techniques. Any outside competition would have all the advantages of starting over, and whether that is a good idea for NASA now should be carefully considered.

Finally, returning to the sensors and actuators of the avionics system, we find that the attitude to system failure and reliability is not nearly as good as for the computer system. For example, a difficulty was found with certain temperature sensors sometimes failing. Yet 18 months later the same sensors were still being used, still sometimes failing, until a launch had to be scrubbed because two of them failed at the same time. Even on a succeeding flight this unreliable sensor was used again. Again reaction control systems, the rocket jets used for reorienting and control in flight still are somewhat unreliable. There is considerable redundancy, but a long history of failures, none of which has yet been extensive enough to seriously affect flight. The action of the jets is checked by sensors, and, if they fail to fire the computers choose another jet to fire. But they are not designed to fail, and the problem should be solved.

Conclusions

If a reasonable launch schedule is to be maintained, engineering often cannot be done fast enough to keep up with the expectations of originally conservative certification criteria designed to guarantee a very safe vehicle. In these situations, subtly, and often with apparently logical arguments, the criteria are altered so that flights may still be certified in time. They therefore fly in a relatively unsafe condition, with a chance of failure of the order of a percent (it is difficult to be more accurate).

Official management, on the other hand, claims to believe the probability of failure is a thousand times less. One reason for this may be an attempt to assure the government of NASA perfection and success in order to ensure the supply of funds. The other may be that they sincerely believed it to be true, demonstrating an almost incredible lack of communication between themselves and their working engineers.

In any event this has had very unfortunate consequences, the most serious of which is to encourage ordinary citizens to fly in such a dangerous machine, as if it had attained the safety of an ordinary airliner. The astronauts, like test pilots, should know their risks, and we honor them for their courage. Who can doubt that McAuliffe was equally a person of great courage, who was closer to an awareness of the true risk than NASA management would have us believe?

Let us make recommendations to ensure that NASA officials deal in a world of reality in understanding technological weaknesses and imperfections well enough to be actively trying to eliminate them. They must live in reality in comparing the costs and utility of the Shuttle to other methods of entering space. And they must be realistic in making contracts, in estimating costs, and the difficulty of the projects. Only realistic flight schedules should be proposed, schedules that have a reasonable chance of being met. If in this way the government would not support them, then so be it. NASA owes it to the citizens from whom it asks support to be frank, honest, and informative, so that these citizens can make the wisest decisions for the use of their limited resources.

For a successful technology, reality must take precedence over public relations, for nature cannot be fooled.


Space Shuttle Challenger Memorial, Arlington National Cemetery

Report of the Presidential Commission on the Space Shuttle Challenger Accident


51-L (25)