Formal Verification of a Gravity-Induced Loss-of-Consciousness Monitoring System for Aircraft

Military-related industries have developed many high-gravity aircraft, such as high-performance fighters and aerobatic aircrafts, which can maneuver beyond the acceleration tolerance limit of human beings. Gravity-induced loss of consciousness (GLOC) due to blood draining away from the brain is one of the main reasons for many high-gravity maneuvering aircraft accidents with many pilots losing their lives. Therefore, many automatic GLOC-monitoring systems have been proposed to prevent these accidents. However, it's not a trivial task to ensure system safety by ordinary simulation or testing methods. This article presents a case study to verify a GLOC monitoring system by using a model-checking technique. As a result of this verification, the authors report a case where the GLOC monitoring system misses, in which a pilot loses consciousness after some intentional movements.