ASTM F3269 - An Industry Standard on Run Time Assurance for Aircraft Systems

Abstract

This paper discusses the philosophy and editorial considerations behind the ongoing second revision of the ASTM F38 Committee standard on run time assurance for aircraft systems -ASTM F3269, titled "Standard Practice for Methods to Safely Bound Flight Behavior of Unmanned Aircraft Systems Containing Complex Functions". It describes the key aspects of the Run Time Assurance (RTA) architecture as depicted in the current revision of the standard and provides some insights on the design best practices suggested in the standard. RTA is a certification strategy for unmanned aircraft systems that contain complex functions, which may not be certifiable using traditional design assurance practices. This challenge may arise in part due to the inherent algorithmic complexity of these functions. It may also be due to the inability to produce design assurance artifacts according to industry standards such as RTCA DO-178C (software) or DO-254 (hardware) for commercial off-the-shelf components used on-board the aircraft. RTA adds value not only to unmanned applications, but also to manned aviationparticularly in General Aviation (GA) and Advanced Air Mobility (AAM). It has the potential to enable technologies for autonomous aircraft systems and simplified vehicle operations. The strategy will also play a role in the design assurance and certification of adaptive controllers and functions using artificial intelligence and machine learning algorithms.

Review of Sensor Technology to Support Automated Air-to-Air Refueling of a Probe Configured Uncrewed Aircraft

“…Luckily, different government organizations, such as the European Union Aviation Safety Agency (EASA), have begun publishing concepts for assuring neural networks, which could be used to provide perception to a UA [ 91 ]. Additionally, civilian standard organizations that include the American Society for Testing and Materials (ASTM) [ 52 ] and Society of Automotive Engineers (SAE) International [ 108 ] have begun to address many of the same concerns the DoD has identified as well.…”

“…Depending on the level of autonomy onboard the UA, a data link may or may not be required to the AVO. The airworthiness officials certifying the UA at the platform level may not require a human either in (interacting with operations) or on the loop (monitoring operations) to conduct A3R if additional assurance is provided by a certified Run Time Assurance (RTA) [ 52 ]. A RTA serves as a monitor to the autonomy under test (AUT), and in the event the AUT encounters a problem or suffers from a degradation, the RTA will revert control back to an automated recovery controller, similar to an Auto Ground Collision Avoidance System (Auto GCAS), to ensure safe operations [ 53 ].…”

Toward Runtime Assurance of Complex Systems with AI Components

“…In contrast to most related work, which aims at supporting property checking for V&V and safety purposes, we use R2U2 to switch between the AI component and different fall-back components in order to dynamically select a safe and suitable one. Our architecture is somewhat inspired by the ASTM3269 Runtime Assurance (RTA) architecture (ASTM, Nov 2021; Nagarajan et al, 2021), where a safety-monitor can switch from a complex, unassured component (e.g., a DNN) to some assured fall-back function, but aims to fulfill a different purpose.…”

A Hierarchy of Monitoring Properties for Autonomous Systems

“…Interestingly, however, the performance of the automation functions is no longer the main concern, since well-performing vision-based autonomous flying systems already exist; instead the challenge lies in ensuring the safety of these functions during operation [1]. To safely bound the behavior of such a complex automation function, ASTM International proposes a run-time assurance architecture [2], simplified in Figure 1. At its core lies a safety monitor that switches to an assured recovery control function when it detects a violation of a safety property.…”