Runtime monitoring of operational design domain to safeguard machine learning components

Abstract

To increase the autonomy of future air taxis, machine learning is necessary for a lot of areas such as vision-based tasks. However, the safety aspect of any machine learning application is of significant concern for users, experts, and certification authorities. To mitigate the risk to passengers or people on the ground, any machine learning-enabled component requires demonstration of rigorous compliance to safety and development assurance standards. Standardization organizations and authorities are currently developing and establishing new guidelines for the safe use of machine learning applications in the aviation domain. This work showcases the concept of runtime monitoring for enabling the safe integration of an example machine learning application in the urban air mobility context: the detection of humans during a landing approach of an air taxi via an onboard camera. Such an application may be useful in the context of autonomous landing to ensure that no person on the ground is endangered. In particular, the concept of operational design domain monitoring is discussed in the context of the recent European Union Aviation Safety Agency guidance and demonstrated in flight testing. The operational design domain monitor is composed of several sub-monitors that supervise different parameters in the operational domain and detect out-of-distribution inputs. Through the development of this component, this work further extends our work on safe operation monitor and runtime assurance for machine learning applications. The flight test results indicate that monitoring the operational design domain can support performance as well as the safety of the operation.