Dual-Assurance Flight Command Validation for Autonomous Aircraft
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current aviation technologies face challenges in certifying autonomous aircraft control systems due to the complexity of certifying advanced processing systems and unstructured sensor inputs, which can lead to increased cognitive load on pilots and limitations in remote operation capabilities.
Innovation Solution
A dual-assurance system architecture is introduced, comprising a lower assurance system for autonomous processing and a higher assurance system for validation, where the lower assurance system generates flight commands using uncertified components and the higher assurance system validates and executes these commands through a certified flight management and control system, ensuring deterministic and fault-tolerant operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If autonomous processing systems with uncertified components are used, then aircraft control automation is improved, but system certification difficulty increases
Solution Approach 1:
The system is divided into two distinct segments: a lower assurance system (LAS) that handles autonomous processing with uncertified components, and a higher assurance system (HAS) that performs validation with certified components. This segmentation allows each subsystem to be optimized independently - the LAS for automation capability and the HAS for certification compliance - thereby resolving the contradiction between automation extent and certification difficulty.
Solution Approach 2:
The higher assurance system acts as an intermediary between the autonomous processing system and the certified flight control system. It validates commands generated by the LAS before execution, serving as a bridge that enables autonomous functionality while maintaining certification requirements. This intermediary layer allows uncertified components to be used in the LAS while still achieving overall system certification through the HAS.
2Extent of automation
If advanced processing systems are used, then autonomous control capability is improved, but cognitive load on pilots increases
Solution Approach 1:
The higher assurance system serves as an intermediary that handles the complex validation tasks, shielding pilots from the cognitive burden of verifying autonomous system decisions. The system automatically validates commands against safety constraints and certification requirements, reducing pilot workload while maintaining autonomous control capability.
Solution Approach 2:
The autonomous processing system performs self-validation through the higher assurance system, automatically checking its own commands against safety constraints and certification rules. This self-service capability reduces the need for pilot intervention and cognitive engagement with complex system validations.
3Adaptability or versatility
If uncertified components are used in autonomous processing, then system flexibility is improved, but safety assurance decreases
Solution Approach 1:
The system separates flexible autonomous processing (LAS with uncertified components) from safety-critical validation (HAS with certified components). This segmentation allows the LAS to use flexible, adaptive technologies like machine learning and natural language processing while the HAS ensures safety assurance through certified validation methods.
Solution Approach 2:
The higher assurance system acts as an intermediary safety layer that validates commands from the flexible but uncertified lower assurance system. This intermediary ensures that even though uncertified components are used, safety assurance is maintained through rigorous validation against certified safety constraints and operational envelopes.
Data Source
AI summary
The method can include: determining sensor information with an aircraft sensor suite: based on the sensor information, determining a flight command using a set of models: validating the flight command S130; and facilitating execution of a validated flight command. The method can optionally include generating a trained model. However, the method S100 can additionally or alternatively include any other suitable elements. The method can function to facilitate aircraft control based on autonomously generated flight commands. The method can additionally or alternatively function to achieve human-in-the-loop autonomous aircraft control, and/or can function to generate a trained neural network based on validation of autonomously generated aircraft flight commands.