Towards Certification of a Reduced Footprint ACAS-Xu System: A Hybrid ML-Based Solution

Damour, Mathieu; Grancey, Florence De; Gabreau, Christophe; Gauffriau, Adrien; Ginestet, Jean-Brice; Hervieu, Alexandre; Huraux, Thomas; Pagetti, Claire; Ponsolle, Ludovic; Clavière, Arthur

doi:10.1007/978-3-030-83903-1_3

Cited by 8 publications

(4 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Finally, we may transform the resulting triple (Belief, Disbelief, Uncertainty) concerning the conclusion, to a pair (Decision, Confidence) using formulas (4) and approximate them by qualitative values. In this section, we use a portion of GSN proposed in [3] to test and validate our uncertainty propagation approach. That study proposed a hybrid architecture of a collision avoidance system for drones, Urban Air Mobility and Air Taxis with horizontal automatic resolution.…”

Section: Uncertainty Assessment Proceduresmentioning

confidence: 99%

“…7. Assurance Case -ML subsystem robustness [3] Table 1 groups the degrees of belief on the rules involved in this case. Following the assessment procedure above, these values are the result of a questionnaire 4 answered by a safety expert about this system.…”

Section: (S2)mentioning

confidence: 99%

“…A special thanks to the authors of [3], especially to Christophe GABREAU for answering the questionnaire concerning the assessment of the GSN presented in our case study.…”

Section: Acknowledgementmentioning

confidence: 99%

See 2 more Smart Citations

Uncertainty Elicitation and Propagation in GSN Models of Assurance Cases

Idmessaoud

Dubois

Guiochet

2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Goal structuring notation (GSN) is commonly proposed as a structuring tool for arguing about the high-level properties (e.g. safety) of a system. However, this approach does not include the representation of uncertainties that may affect arguments. Several works extend this framework using uncertainty propagation methods. The ones based on Dempster-Shafer Theory (DST) are of interest as DST can model incomplete information. However, few works relate this approach with a logical representation of relations between elements of GSN, which is actually required to justify the chosen uncertainty propagation schemes. In this paper, we improve previous proposals including a logical formalism added to GSN, and an elicitation procedure for obtaining uncertainty information from expert judgements. We briefly present an application to a case study to validate our uncertainty propagation model in GSN that takes into account both incomplete and conflicting information.

show abstract

Section: Uncertainty Assessment Proceduresmentioning

confidence: 99%

Section: (S2)mentioning

confidence: 99%

See 1 more Smart Citation

Uncertainty Elicitation and Propagation in GSN Models of Assurance Cases

Idmessaoud

Dubois

Guiochet

2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…The solution we propose is a partitioning scheme that splits the operational domain into areas where the monotony property is respected and areas where it is (partially) violated; in the latter, the neural network's behavior could be mitigated. This possibility has been considered on a collision detection use case in [4] and studied at a higher level for the certification of a system before an ML component [17].…”

Section: Related Workmentioning

confidence: 99%

Formal Monotony Analysis of Neural Networks with Mixed Inputs: An Asset for Certification

Vidot

Ducoffe

Gabreau

et al. 2022

Formal Methods for Industrial Critical Systems

Self Cite

View full text Add to dashboard Cite

The use of ML technology to design safety-critical systems requires a complete understanding of the neural network's properties. Among the relevant properties in an industrial context, the verification of partial monotony may become mandatory. This paper proposes a method to evaluate the monotony property using a Mixed Integer Linear Programming (MILP) solver. Contrary to the existing literature, this monotony analysis provides a lower and upper bound of the space volume where the property does not hold, that we denote "Non-Monotonic Space Coverage". This work has several advantages: (i) our formulation of the monotony property works on discrete inputs, (ii) the iterative nature of our algorithm allows for refining the analysis as needed, and (iii) from an industrial point of view, the results of this evaluation are valuable to the aeronautical domain where it can support the certification demonstration. We applied this method to an avionic case study (braking distance estimation using a neural network) where the verification of the monotony property is of paramount interest from a safety perspective.

show abstract