🤖 AI Summary
To address the lack of clear mapping between safety objectives and performance metrics for machine learning components in aviation—such as object detection models in emergency braking systems—this paper proposes a system safety–driven method for deriving verifiable performance requirements. First, safety-critical scenarios are identified via Functional Hazard Analysis (FHA) and Fault Tree Analysis (FTA). Second, a behavioral abstraction model of the ML component is constructed to quantitatively decompose top-level safety requirements (e.g., maximum allowable failure probability) into concrete neural network performance constraints (e.g., minimum detection accuracy, robustness thresholds against adversarial perturbations). Finally, applicable assumptions are explicitly defined, and the impact of verification deviations is quantified. The method establishes a traceable, rigorously verifiable linkage from safety goals to model-level metrics, providing both theoretical foundations and a practical framework for airworthiness certification of ML components in safety-critical domains.
📝 Abstract
The prediction quality of machine learnt models and the functionality they ultimately enable (e.g., object detection), is typically evaluated using a variety of quantitative metrics that are specified in the associated model performance requirements. When integrating such models into aeronautical applications, a top-down safety assessment process must influence both the model performance metrics selected, and their acceptable range of values. Often, however, the relationship of system safety objectives to model performance requirements and the associated metrics is unclear. Using an example of an aircraft emergency braking system containing a machine learnt component (MLC) responsible for object detection and alerting, this paper first describes a simple abstraction of the required MLC behavior. Then, based on that abstraction, an initial method is given to derive the minimum safety-related performance requirements, the associated metrics, and their targets for the both MLC and its underlying deep neural network, such that they meet the quantitative safety objectives obtained from the safety assessment process. We give rationale as to why the proposed method should be considered valid, also clarifying the assumptions made, the constraints on applicability, and the implications for verification.