Bastian Luettig, Yassine Akhiat, and Zamira Daw published a comprehensive analysis in Frontiers in Aerospace Engineering examining why machine learning has failed to penetrate commercial aviation, and what it would take to change that. Their systematic literature review, which filtered 246 initial articles down to 70 for detailed analysis, identified four dominant categories of AI application in aerospace: flight management and operations accounting for 39 percent of published work, predictive maintenance at 34 percent, security and surveillance at 23 percent, and air traffic management at 4 percent. These applications span everything from convolutional neural networks detecting runways during autonomous landing, to long short-term memory networks predicting the remaining useful life of aircraft engines, to gradient boosting methods forecasting flight delays.

The criticality spectrum in aviation is unlike anywhere else AI operates. Aviation certification follows what safety engineers call the Swiss cheese model — acknowledging that any single system contains flaws, but layering multiple independent defenses so that a failure must penetrate every barrier simultaneously to cause an accident. Within this framework, components receive Design Assurance Levels ranging from DAL A to DAL E, where DAL A components are those whose catastrophic failure could cause loss of the aircraft and require the most exhaustive verification evidence. The standards governing this process — ARP4754B for system development, ARP4761A for safety assessment, DO-178C for software, and DO-254 for complex hardware — were written for systems whose behavior is entirely specified by human engineers writing explicit requirements.

Machine learning breaks this fundamental assumption. In a conventional software system, a requirement might state that the flight control computer shall command a specific surface deflection when a specific input pattern is detected, and engineers can trace that requirement through every line of code to verify compliance. In a machine learning system, the behavior is not written by anyone — it emerges from statistical patterns in training data. The researchers note that current aerospace standards fail to apply directly to AI because of three interlocking problems: the manner in which behavior is specified by data rather than explicit requirements, the inherent uncertainty of learned models, and the fundamental limitations of white-box verification when applied to neural networks whose internal states cannot be meaningfully mapped to behavioral guarantees.

The gap analysis conducted by the Stuttgart team identified specific open research questions that must be resolved before AI can fly. These include validating that the intended behavior encoded in training data actually matches what the system is supposed to do, establishing whether verification methods are sufficient to demonstrate safety, quantifying uncertainty in model predictions, ensuring models generalize to conditions not seen during training, and mitigating unintended behaviors that emerge from the learning process. Each of these challenges represents a domain where the machine learning research community has not yet produced methods rigorous enough for aviation’s safety demands.

To test whether current certification efforts could actually work in practice, the researchers applied two emerging frameworks to a real system called ADIMA — an automated peripheral detection system running on integrated modular avionics hardware. ADIMA uses an autoencoder and a classification network to identify what type of peripheral device is connected to an avionics input-output port by analyzing its electrical current-voltage characteristics. The system serves two very different criticality levels: cabin lighting verification at DAL D, where failure has no safety consequence, and emergency lighting at DAL A, where failure could be hazardous under Federal Aviation Regulation CS25.812. The researchers demonstrated compliance with the European Union Aviation Safety Agency’s W-shaped development process — an extension of the traditional V-model that adds a second verification path specifically for learning assurance — and achieved key certification objectives.

Yet the exercise revealed profound limitations. Many of the EASA concept paper’s objectives proved inapplicable to ADIMA because the guidelines focus heavily on human-machine interaction, explainability to pilots, and human factors considerations — all designed for systems that assist flight crews rather than operate autonomously. The researchers classified ADIMA as Level 3B under EASA’s framework precisely because it operates hidden from all potential crew members. When they applied the Federal Aviation Administration’s Overarching Properties framework, which decomposes safety arguments into three properties — Intent, Correctness, and Innocuity — the structured argument uncovered several defeaters: gaps in the argument that could not be closed with existing machine learning technology. These included the challenge of validating that the Operational Design Domain is complete, the absence of quantitative metrics for testing data sufficiency, and uncertainty about whether all potential sources of unintended behavior had been identified.

The verification challenge is perhaps the most technically intractable problem. In conventional software, structural coverage metrics like modified condition/decision coverage provide a measurable proxy for testing sufficiency — if every branch and condition has been exercised, engineers have reasonable confidence the code has been thoroughly tested. For neural networks, the researchers found that using neurons as an analogy for lines of code does not provide equivalent coverage of behavior. The Stuttgart team’s own testing revealed this vividly: their classification network achieved perfect scores on training and validation data, yet failed 100 percent of the time when presented with electric motors or empty input-output ports — and worse, it expressed near-total confidence in these wrong classifications. The autoencoder caught these anomalies, but only because the researchers had deliberately acquired out-of-distribution testing data including aged LEDs, broken components, and disconnected ports.

The researchers also examined how AI-accelerating hardware might be integrated into avionics. Three architectural options emerged: running the model within an existing ARINC653 partition on certified avionics hardware, which limits computational power to dated single-core PowerPC processors; adding dedicated machine learning hardware inside the integrated modular avionics module, which requires re-certification against the highest design assurance level; or placing the AI hardware outside the safety-critical module entirely, connected via a bus, so the certified avionics system acts as a gatekeeper. Each option involves distinct trade-offs between computational capability and certification burden, and none has yet been proven in commercial service.

The path forward, according to the researchers, requires simultaneous progress on multiple fronts. Certification standards must evolve to address AI’s probabilistic behavior, identify new failure causes unique to learned systems, and accommodate the continuous evolution that machine learning demands — a stark contrast to aviation’s traditional point-in-time certification model where software updates trigger costly re-certification. The machine learning community must develop training methods that prioritize safety and robustness over raw performance, create inherently more transparent architectures, and establish reliable uncertainty quantification techniques such as Monte Carlo dropout and deep ensembles. Until these pieces converge, the safest transportation mode in human history will continue flying without a single line of learned code aboard — protected by the very certification rigor that AI has not yet learned to satisfy.

Subject of Research: ML meets aerospace: challenges of certifying airborne AI

Article Title: ML meets aerospace: challenges of certifying airborne AI

Article References: ML meets aerospace: challenges of certifying airborne AI. (n.d.). https://doi.org/10.3389/fpace.2024.1475139

Image Credits: AI Generated

DOI: 10.3389/fpace.2024.1475139

Keywords: meets, aerospace, challenges, certifying, airborne, scientific research