Run-Time Verification and Validation for Safety-Critical Flight Control Systems

Mission and safety requirements for next-generation aerospace vehicles have given rise to flight software with an ever-increasing level of complexity and autonomy. “Intelligence” is built into new and emerging designs through the development of novel algorithms that detect, learn, adapt, switch modes, coordinate, plan, etc. As the complexity of flight controllers grows, so does the cost associated with Verification and Validation (V&V). Current-generation controllers are already reaching a level of complexity that pushes the envelopes of existing V&V approaches, with little hope for affordable certification of nextgeneration intelligent systems under current V&V practices. One possible solution is to combine run-time monitors for advanced components with simple backup modules that provide a safe reversionary mode if undesirable behavior is detected. Such an architecture allows the V&V to be partitioned into design-time V&V (for the relatively simple monitor and fail-safe subsystems), and run-time V&V (for the full complex controller). A prototype run-time monitoring approach for flight-critical systems has been developed and demonstrated in batch and real-time simulations for a UAV system. Software faults were seeded into advanced control algorithms to test the runtime monitoring systems. In all experiments, it is shown that without a runtime V&V system, the vehicle either fails to accomplish the mission, or worse, is lost due to ensuing instability. With the runtime V&V system, the vehicle is saved and can either continue the mission or return to base.