Certified Machine Learning-Based Avionics

February 1, 2024

Over the past few decades, aircraft automation has progressively increased. Advances in digital computing during the 1980s eliminated the need for onboard flight engineers. Avionics systems, exemplified by FADEC for engine control and Fly-By-Wire, handle lower-level functions, reducing human error. This shift allows pilots to focus on higher-level tasks like navigation and decision-making, enhancing overall safety.

Full automation and autonomous flight operations are a logical continuation of this trend. Thanks to aerospace pioneers, most functions for full autonomy are achievable with legacy technologies. Machine learning (ML), especially neural networks (NNs), will enable what Daedalean terms Situational Intelligence: the ability to understand and make sense of the current environment and situation but also anticipate and react to a future situation, including a future problem. By automating tasks traditionally limited to human pilots – like detecting airborne traffic and identifying safe landing locations – ML can raise safety levels, lower costs, and increase fleet capacity.

Despite progress, integrating machine learning into civilian aircraft cockpits faces certification challenges, raising significant barriers to commercial operations. However, there has been rapid progress in this relation over the last two years. We are currently on the verge of witnessing the first real-world ML applications approved by aviation regulators making their way to the market– and Daedalean and Xwing are among the first to deliver them.

Certified Embedded Aerospace Computing: Overcoming the Challenges

NNs are extremely computationally demanding – Daedalean’s visual traffic system, for instance, needs about one Tera Operation per Second (TOPS), approximately double the power of the CPU’s integrated GPU or a fully dedicated CPU core. A serious barrier to designing such high-performance systems for safety-critical applications for civil aerospace is that they need to be certified. A common design assurance challenge is establishing deterministic behavior and guaranteeing mitigation of all potential failure conditions. Doing so can be challenging with compute-intensive ML algorithms and the highly complex devices necessary to process them.

In 2023, Daedalean and Intel Corp. jointly published the whitepaper “The Future of Avionics: High Performance, Machine-Learned, and Certified.” The document proposes a collaboratively developed reference architecture for certifiable embedded electronics. Key components include the Daedalean Tensor Accelerator (DTA) – a certifiable Convolutional Neural Network (CNN) accelerator designed with a DO-254-aligned process – and the Intel^® Agilex^™ FPGA. Agilex, based on advanced CMOS technology, offers increased computational power on a single FPGA and lower power consumption compared to any other certifiable options available.

The proposed solution significantly reduces time-to-market for companies looking at incorporating Daedalean’s ML applications for situational awareness. The reference architecture, though, is valuable for any firm developing certifiable embedded electronics for aerospace and defense. Avionics systems designers implementing ML into safety-critical aerospace equipment should view NNs as a new element. Some FPGA vendors provide tools automating NN mapping on FPGAs, with reduced performance compared to a bespoke solution. Developing systems subject to safety assurance requires a handcrafted solution, and the proposed reference design helps to achieve improved performance while opening the way to certifying the final product.

Certifying NNs: A Paradigm Shift in Software Assurance

When developing an ML-based application, ‘classical’ code for tracking, monitoring, and inference coexists with the neural networks. The DO-178C standard applies to this classical code. However, the primary ML-driven function can’t undergo traditional verification and validation. ML model parameters, learned from data, aren’t hand-coded or physics-derived, hindering direct tracing of requirements to code lines. This challenge disrupts the current aerospace certification paradigm.

In 2021, the European Union Aviation Safety Agency (EASA) proposed AI/ML guidelines, partly informed by two research studies conducted in collaboration with Daedalean. The 2020 and 2021 joint reports explored adapting software design assurance for ML, introducing Concepts of Design Assurance for Neural Networks (CoDANN). A crucial insight was the W-shaped development process, modifying the classical V-shaped cycle and demonstrated using the example of Daedalean’s Visual Traffic Detection application. In 2021, the FAA, in collaboration with Daedalean, assessed CoDANN’s applicability to a real application (Daedalean’s Visual Landing Guidance system), leading to a 2022 joint FAA-Daedalean report.

This process ensures that ML-based software adheres to required safety standards and maintains an acceptable error rate in the field. By functionally decomposing system-level requirements into ones related to the dataset and the learning algorithm, Statistical Learning Theory methods can provide assurance on the system’s behavior in its operational domain.

This approach aligns with the modified V-diagram independently proposed by Xwing in 2021. The verification is decomposed here into similar stages: data set, model, and inference.

In October 2023, Xwing published “Formal and Practical Elements for the Certification of Machine Learning Systems,” with a more complete process and an example certification argument for a runway detection model.

In December 2023, the two companies announced a strategic collaboration to share data, knowledge, and processes. Both companies believe that forming a consensus on their assurance approaches is the best way to advance the development of and harmonize certification standards and help all stakeholders, including the industry players, regulators, and the public, to speed up the path to certifying AI systems.

PilotEye: The Unprecedented ML Application Set For Historic Certification

The first real-world use case that Daedalean is bringing to the market in partnership with Avidyne is a visual traffic detection application marketed as PilotEye™. The system will serve as an additional visual source of information on air hazards, supplementing the ADS-B and FLARM data. The product is capable of detecting non-cooperative traffic, such as birds, drones, gliders, and balloons. Daedalean’s ML-enabled technology integrates with Avidyne’s Skytrax™ Traffic Advisory System into the IFD5XX flight display series. A tablet screen shows detailed information on any detected intruders in the real-time video feed from three aircraft-mounted cameras.

Collecting and presenting information from cameras, radars, and other types of sensors is not enough for the task described above: it requires interpreting the data, i.e., recognition and categorizing, performed by a machine-learned model – a CNN.

The role of the CNN here is in answering the question for each of the frames obtained from each of the cameras: is there an intruder (such as an aircraft or bird) on this image or not, and if yes, then categorizing it and evaluating its size and the distance between the ownship and an intruder.

It is important to emphasize that no in-flight learning process occurs. Despite the common misconception, the process of training the CNN (tuning the weights of a statistical model processing the images of a training dataset presented to it) happens exclusively “in the lab.” After the satisfactory performance (in terms of the percentage of errors in the answers compared to the known truth) is achieved, the model is frozen, at which point it goes into production. So, the algorithm performed in the flying product may be considered deterministic, meaning that given the same input, it will always produce the same output.

PilotEye is poised to become EASA’s – and possibly the world’s – first certified civil aviation cockpit application with a machine-learned component. The application will be certified to the DAL-C level by the FAA and to the “advanced pilot assistance” level according to EASA’s classification of the levels of autonomy.

In December 2021, Avidyne submitted an STC application for the product to the FAA with concurrent validation by EASA. In 2023, EASA’s delegation made a several-day visit to Daedalean as a part of the stages-of-involvement (SOI) audit – a key component of the DO-178C certification process, which ensures that software development is conducted in compliance with the standard.

So, the process of exploring how to certify ML-learning-based software systems by the regulators, using this first case, is going at full speed. The DO-178C compliance audit has always been object-oriented and flexible, and a rigid list of checkpoints to pass to obtain the TC or STC doesn’t exist – so, no estimations of when the certification may be granted can be stated, but the effort of the regulators and their commitment to put the full attention on the case is apparent. We will see this product launched to the market not before the regulators are fully assured of its safety and fitness for purpose, and we expect it to happen only as swiftly as the process allows.

Xwing Superpilot: Leading the Charge on Uncrewed Aircraft Certification

Xwing has been developing Superpilot, an aircraft agnostic autonomy system enabling fully uncrewed operations since 2016. In March 2023, Xwing submitted the world’s first certification plan for a normal category type certified airplane UA modification (STC). The system is currently getting FAA-certified on a Cessna Grand Caravan aircraft.

While a variety of other companies are developing safety-enhancing features that require the pilot to remain onboard to monitor the system, Xwing is the only player in this space currently certifying an autonomy system enabling the removal of the pilot from the cockpit. The Xwing system not only handles nominal cases, but is also capable of covering all contingencies that a human pilot would be required to. On top of that, the human now sits in a ground station and oversees the flight, thereby adding yet another safety layer. Xwing decided to pursue this full autonomy direction to maximize safety and offer an enticing product to the commercial, non-transport aviation industry, especially cargo operations.

The Xwing system is designed to be aircraft agnostic, can autonomously fly the full mission of the plane, and can deal with contingencies to get the aircraft to the ground, even in rare cases where the remote pilot is unable to communicate with the aircraft.

ML-based Systems Will Revolutionize Aviation Safety

The gradual increase in aircraft autonomy, marked by advances in avionic systems, has laid the groundwork for the logical progression toward automation and fully autonomous flight operations. Close collaboration of the industry with regulators is critical to lead this transformative journey that promises to revolutionize safety, efficiency, and autonomy in aviation. As certified ML applications become integral to aviation, the industry stands on the threshold of a new era where technology and safety converge to redefine the possibilities and potential of autonomous flight. Daedalean and Xwing are proud to be among those helping the industry stride across that threshold and deliver on the promise of a revolutionary future.

This article was written by Luuk van Dijk, Ph.D., CEO, Daedalean; Yemaya Bordain, Ph.D., President of the Americas, Daedalean; Jean-Guillaume Durand, Ph.D., Head of Perception, Xwing; and Arthur Dubois, VP of Engineering and Programs, Xwing. For more information, visit www.daedalean.ai  and www.xwing.com  .

---