Assessing Python’s suitability for airborne safety-critical systems under DO-178C guidelines

RTCA SC-205/EUROCAE WG-71 was established in late 2005 to provide the third major update to DO178/ED12, SOFTWARE CONSIDERATIONS IN AIRBORNE SYSTEMS AND EQUIPMENT CERTIFICATION, from DO-178B/ED- 12B to DO-178C/ED-12C. According to its Terms of Reference (TOR) [1], one of its key objectives is to address emerging software trends and technologies. Over the course of the last several years of work, it has become increasingly apparent to some of us in SC-205/WG-71 that ensuring consistency among an already diverse and still expanding set of emerging trends and technologies would not be as simple as merely providing separate, specialized guidance and objectives for them. In some cases, the conceptual underpinnings and core vocabulary used in DO-178B/ED-12B were going to need modernization to allow the extension of its fundamental principles into the world of twenty-first century software systems engineering. In particular, the software engineering field's evolving understanding of the nature of the inter-relationships among requirements and design information for the more complex software systems now being developed was going to require a generalization and re-conceptualization of the key DO-178B/ED-12B concepts of high-level, low-level, and derived requirements. Accordingly, a team, SG2.1, from within Sub Group 2, the Issues and Rationale group, has been working on Information Paper 217 (IP217) to propose and justify some changes to DO-178B/ED-12B in this area. Although IP217 is still very much a work in progress and has not been submitted yet for final approval by the SC-205/WG-71 plenary, it is clear that some of the issues involved overlap with similar issues at the systems engineering level that precedes the software engineering process that remains the scope of DO-178C/ED-12C. There has always been a fair amount of overlap and commonality between the two disciplines and the future of software-intensive systems in the airborne domain is more likely to see the lines more blurred rather than less. This paper is a work-in-progress report whose purpose is to provide the larger community with an advance look and opportunity to contribute comments and suggestions to the ongoing work of SG2.1 on IP217 and the issues and approaches to their resolution being described here. (6 pages)

With the extensive application of information technology in civil aircraft airborne systems, airborne systems are facing the threat of security vulnerabilities. For this reason, this paper adopts model-based system engineering method to analyze the application scenario of vulnerability management alarm for airborne equipment and designs the overall architecture of the vulnerability management and alarm system for civil aircraft airborne equipment, as well as the key subsystems such as vulnerability automatic collection and asset management, vulnerability tracking and alarm, vulnerability management database, which are implemented in Java language, developed based on Spring Boot and VUE frameworks, deployed in microservice mode, with features such as rich functions and easy operation. It's verified by actual use that the system can meet the functional requirements of vulnerability management and alarm of civil aircraft airborne system.

Airborne systems are considered to compose a highly complex network of interconnected Cyber-Physical Systems (CPS). Following the ARP-4754A development guidelines, a series of multidisciplinary engineers have to decompose system, hardware and software requirements in order to validate their correctness. System intrinsic complexity though, imposed by CPS(s), constitutes the certification of airborne systems a difficult, time-consuming and often expensive task. In the same line, requirements traceability, validation and verification is considered to be a crucial part of certification processes for both hardware (DO-254) and software (DO-178C) components. In this paper we review challenges and solutions for software certification under the DO-178C standard using formal verification in line with new CPS analysis evolution. We describe current model-based design methodologies followed today in the aerospace domain and comment on new approaches and techniques that could accelerate the software certification processes with respect to CPS(s) requirements.

This paper addresses topics concerning the development of future Unmanned Aerial Vehicles (UAV) so that they can operate safely within the community of the Federal Aviation Administration (FAA) and the International Civil Aviation Organization (ICAO). Studies by the Defense Science Board; the Office of Science and Technology; Government Accountability Office; and the Congressional Research Service: Library of Congress; have all emphasized that soon there will be a significant number of UAVs operating sideby- side with manned civil aircraft in the FAA’s National Airspace System (NAS). It is anticipated that future UAVs will start to perform many of the dull, dirty, and dangerous civilian missions. In 2006, about 600 UAVs are expected to be manufactured in the US alone. Therefore, there is an urgent need for developers of UAVs to understand safety certification for operations in the NAS, and that safety certification starts with the safety requirements; safety design; safe development process; safety verification; and safe operating procedures in the planned operational environment. This paper presents and discusses the experiences and lessons gained by the authors on the development of end-toend aviation safety; from the safety requirements to their final safety certification in the planned operational environment. The authors’ previous and ongoing works include the Global Navigation Satellite Systems (GNSS) systems such as the GPS; WAAS; LAAS; MSAS; GPS III; and different operational environments at different airports such as Incheon International Airport. The FAA started with the two traditional safety certifications processes: airborne system certification and ground system certification; governed mostly by Federal Aviation Regulations (FAR) and FAA’s Acquisition Management System (AMS), respectively. However, when FAA started to implement GNSS, the lines between airborne and ground systems became blurred, and as a result many current Communications, Navigation, Surveillance, and Air Traffic Management (CNS/ATM) systems have to follow both processes. We will also discuss the current Safety Management Systems being developed by both FAA and ICAO as an integrated, systematic, and harmonized approach and process to sort out the differing safety requirements from FAA, SAE-ARP, MIL-STD, RTCA, ASTM, ICAO, etc. to provide the eventual safe operations within the NAS. The discussion will then focus on the real world of institutional, operational, and technical issues for safety certification worldwide. Despite the numerous standards and guidance documents, many past safety analyses and studies were guided by best practices that had been used successfully in the past to streamline the process of providing all the required documentations and verifications. One such area is in the use of the “Integrity Panel of Experts” that had been used successful in the implementation of safety for the FAA’s Wide Area Augmentation System (WAAS) and Local Area Augmentation System (LAAS) programs. In many areas of the world, safety certification from a technical point of view is only the first step to achieving safety certification to fly in their national and sovereign airspace. Finally, we will show the first steps that UAV manufactures need to consider if they want their UAVs to be approved to fly safely in different national civilian airspace.

Aircraft maintenance has, since its conception, relied primarily on two methods of fault detection and isolation: 1) in-flight observation and reporting by flight personnel 2) ground operation or testing of airborne systems and equipment. Both methods, even when combined to the optimum, are not always sufficient to pinpoint the exact cause of trouble or locate a defective component. A third method, which analyzes airborne system's performance through various techniques of multiparameter sampling, has recently come into the picture and is showing significant promise for advancing the present state-of-the-art in aircraft maintenance. Systems utilizing this technique are discussed and examples of their benefits cited. These benefits not only encompass detection and isolation of defective units or components, but also include predicting impending malfunctions.

Driving simulators are essential tools to guide automotive research and development. Their motion system requires a motion cueing algorithm (MCA) to keep the simulator motion platform within its physical boundaries, while simultaneously aiming to recreate the sensation of real vehicle motion. While traditional, filter-based approaches are still predominant, optimization-based MCAs have been at the center of MCA research for over a decade due to their ability to systematically improve motion cueing quality through explicit cost function design and constraints handling. However, despite their demonstrated advantages, these optimization-based methods have not yet achieved widespread adoption in driving simulation. This paper therefore provides a comprehensive review of optimization-based MCAs for driving simulation, categorizing and comparing algorithms, describing their key developments and core characteristics. The current limited real-time capability, lack of accurate evaluation methods, challenges in cost function design and its tuning, and the current lack of accurate future reference predictions are identified as key barriers to the practical deployment and widespread use of optimization-based MCAs. These theoretical and practical challenges are further reviewed, providing guidelines to advance the theory and application of optimization-based MCAs. Central in these advancements are a better understanding of which motions constitute a realistic motion experience, a framework allowing to compare the achieved motion fidelity of MCAs across papers, the design of the cost function focusing on human motion perception, and techniques for easing up the tuning process to swiftly reach high quality tunings for different simulators, scenarios, and use cases. We identify the need for improving the real-time capability, and providing high quality motion reference predictions using learning-based approaches on diverse datasets, along with techniques to handle existing uncertainties. Following these guidelines, new foundations for optimization-based algorithms in driving simulation can be achieved, which will significantly impact the research and development of automotive systems.

Memory safety is instrumental to the safety and security of software systems. The Rust language stands out with a type system and underlying memory model targeting memory safety without the need for dynamic garbage collection, making Rust a viable option for embedded applications. In this paper we present an integrated tool for call-stack analysis of Rust applications. We cover both theoretical and practical challenges, their solutions and open questions. The cargo-call-stack tool is useful for analyzing Rust applications in general, and embedded Rust in particular. To the latter, we show that using the call-stack analysis we can give guarantees of total memory safety, free of assumptions on operating systems and underlying memory protection mechanisms in hardware. The feasibility of the approach is demonstrated by applying the `call-stack' tool on production code targeting a light-weight ARM Cortex-M platform.

Ensuring the safety of AI-enabled systems, particularly in high-stakes domains such as autonomous driving and healthcare, has become increasingly critical. Traditional formal verification tools fall short when faced with systems that embed both opaque, black-box AI components and complex stochastic dynamics. To address these challenges, we introduce LUCID (Learning-enabled Uncertainty-aware Certification of stochastIc Dynamical systems), a verification engine for certifying safety of black-box stochastic dynamical systems from a finite dataset of random state transitions. As such, LUCID is the first known tool capable of establishing quantified safety guarantees for such systems. Thanks to its modular architecture and extensive documentation, LUCID is designed for easy extensibility. LUCID employs a data-driven methodology rooted in control barrier certificates, which are learned directly from system transition data, to ensure formal safety guarantees. We use conditional mean embeddings to embed data into a Reproducing Kernel Hilbert Space (RKHS), where an RKHS ambiguity set is constructed that can be inflated to robustify the result to out-of-distribution behavior. A key innovation within LUCID is its use of a finite Fourier kernel expansion to reformulate a semi-infinite non-convex optimization problem into a tractable linear program. The resulting spectral barrier allows us to leverage the fast Fourier transform to generate the relaxed problem efficiently, offering a scalable yet distributionally robust framework for verifying safety. LUCID thus offers a robust and efficient verification framework, able to handle the complexities of modern black-box systems while providing formal guarantees of safety. These unique capabilities are demonstrated on challenging benchmarks.

Laser safety testing is performed under the umbrella of the 1ECEE (IEC System for Conformity testing and Certification of Electrical Equipment), a branch of IEC, also Mown as the CB Scheme. Its members include 137 National Certification Bodies (NCBs) from 39 countries. The significant growth of the organization is reflected in the release of over 40 thousand CB certificates and test reports in the year 2005. The Committee of Testing Laboratories (CTL) is the technical branch of the IECEE. The focus of its activity is test specifications, test methods and reproducibility of test results. At its December 2004 meeting, CTL decided to set up an Expert Task Force 11 (ETF 11) for lasers, with the mission to produce a laser test equipment list, laser testing guidelines, and develop a laser proficiency testing program for the participating test laboratories. ETF11 also has the responsibility to develop Decision Sheets concerning the interpretation of IEC60825-1 and IEC60825-2 and to provide support to other ETFs with respect to the laser safety issues. The paper reviews the past work of the CTL concerning the application of laser safety standards as well as the past and proposed agenda of ETF 11. The authors put forward suggestions for improving communication between the CTL and technical committees developing laser standards, IEC TC 76 in particular.

By virtue of its ease of operation compared with its conventional manual counterpart, automatic transmissions are commonly used as automotive power transmission control system in today’s passenger cars. In accordance with this trend, research efforts on closed-loop automatic transmission controls have been extensively carried out to improve ride quality and fuel economy. State-of-the-art power transmission control algorithms may have limitations in performance because they rely on the steady-state characteristics of the hydraulic actuator rather than fully exploit its dynamic characteristics. Since the ultimate viability of closed-loop power transmission control is dominated by precise pressure control at the level of hydraulic actuator, closed-loop control can potentially attain superior efficacy in case the hydraulic actuator can be easily incorporated into model-based observer/controller design. In this paper, we propose to use a recurrent neural network (RNN) to establish a nonlinear empirical model of a cascade hydraulic actuator in a passenger car automatic transmission, which has potential to be easily incorporated in designing observers and controllers. Experimental analysis is performed to grasp key system characteristics, based on which a nonlinear system identification procedure is carried out. Extensive experimental validation of the established model suggests that it has superb one-step-ahead prediction capability over appropriate frequency range, making it an attractive approach for model-based observer/controller design applications in automotive systems.

In recent years, with the development of battery energy storage technology and the support of policy, the construction scale of user-side battery energy storage system is increasing rapidly, and its operation performance has become more and more valued. In-depth quantitative analysis and evaluation is of great significance to provide reliable guarantee for high efficiency, safety and reliability operation of energy storage system. Based on the principles of scientificity, comprehensiveness and operability, the operation evaluation indexes are proposed including charge-discharge performance, energy efficiency, safety, reliability and economic performance. The operation performance of an example battery energy storage system for peak-load shifting is quantitatively analyzed and evaluated, based on the operation data and field test data. And the optimization suggestions are given for the problems existing in the operation of the system. The results show that the proposed operation evaluation indexes and methods can realize the quantitative evaluation of user-side battery energy storage systems on the charge-discharge performance, energy efficiency, safety, reliability and economic performance, which are helpful for the operation and maintenance of user-side battery energy storage systems.

In future large-scale multi-core microprocessors, hard errors and process variations will create dynamic heterogeneity, causing performance and power characteristics to differ among the cores in an unanticipated manner. Under this scenario, naive assignments of applications to cores degraded by various faults and variations may result in large performance losses and power inefficiencies. We propose scheduling algorithms based on the Hungarian Algorithm and artificial intelligence (AI) search techniques that account for this future uncertainty in core characteristics. These thread assignment policies effectively match the capabilities of each degraded core with the requirements of the applications, achieving an ED <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> only 3.2% and 3.7% higher, respectively, than a baseline eight core chip multiprocessor with no degradation, compared to over 22% for a round robin policy.

Air transport of infants in incubators should be undertaken in a manner that is safe for both staff and infant and satisfies all directives by appropriate regulatory bodies. In Scotland...

The purpose of this descriptive study was to evaluate use of a previously validated, online, interactive wound assessment and wound care clinical pathway in a group of RNs. Specific aims were to (a) evaluate the proportions of correct, partially correct, and incorrect algorithmic decisions and dressing selections, (b) compare response rates between nurses who are and who are not wound care certified, and (c) evaluate its ease of use, educational value, and applicability in clinical practice. Descriptive study. Participants were recruited using convenience and snowball sampling methods. Four hundred eighteen nurses completed all 15 assessments; nearly half held a bachelors' degree in nursing (189, 45%), more than two-thirds worked in an inpatient acute care settings (277, 68%), and 293 (70%) were not certified in wound care. After providing written informed consent and completing the participant demographics form, participants assessed 15 photographs of wounds with accompanying moisture descriptions and completed an algorithm and dressing selection for each. All responses were anonymously collected by the program. Existing, retrospective, program data were also downloaded and data from nurses who completed all assessments were extracted and analyzed. Descriptive statistics were used to analyze all variables. Selection outcomes and survey responses between nurses who were and who were not wound care certified were compared using a 2-sample Student t test assuming unequal variances. Individual responses for the first 6 wounds were compared to the last 6 wounds using a paired t test. The mean (M) proportions of fully or partially correct (operationally defined as safe but not fully correct) algorithm and dressing choice were 81% (SE: 0.88, 95% confidence level: 1.73) and 78.1% (SE: 0.70, 95% confidence level: 1.39), respectively. Wound care-certified nurses had higher mean algorithm scores than those who were not certified (M: 89.2%, SE: 1.27 vs M: 77.8%, SE: 1.10, P < .001). Most incorrect/partially correct choices were attributable to incorrect necrotic tissue assessment (n = 845, 58%). The difference between fully correct first 6 and last 6 algorithm choices was statistically significant (M: 310, SE: 0.02 vs M: 337, SE: 9.32, P = .04). On a Likert scale of 1 (not at all) to 5 (very), average scores for ease of program and algorithm use, educational value, and usefulness for clinicians ranged from M: 4.14, SE: 0.08 to M: 4.22, SE: 0.08. Results suggest that the algorithm is valid and has potential educational value. Initial evaluation also suggests that program refinements are needed. Evaluation of participant responses indicated potential problems with the definitions used for necrotic tissue or assessment knowledge deficits. Results also substantiate the importance of instructional design and testing online education programs. More research is needed to uncover potential gaps in nurses' wound care knowledge that may hamper evidence-based practices adoption and the need to develop effective, evidence-based education-delivery techniques.

Development strategies of conducting polymer-based electrochemical biosensors for virus biomarkers: Potential for rapid COVID-19 detection