Auf dem Weg zur unbemannten Luftfracht durch sichere ... · Auf dem Weg zur unbemannten Luftfracht...

$: Auf dem Weg zur unbemannten Luftfracht durch sichere ... · Auf dem Weg zur unbemannten Luftfracht durch sichere Software und Laufzeitabsicherung. Christoph Torens, Florian Adolf,$
Auf dem Weg zur unbemannten Luftfracht durch sichere Software und Laufzeitabsicherung Christoph Torens, Florian Adolf, Sebastian Schirmer DLR Institut für Flugsystemtechnik, Abteilung Unbemannte Luftfahrtzeuge DGLR Workshop “Software Safety”, 5. Oktober 2016 Fachausschüsse L6.3 Flugregelung und Q3.4 Software Engineering

www.DLR.de • Chart 2 > DGLR 2016 > Christoph Torens • DGLR Workshop 2016 – Software Safety

Unbemannte Luftfracht Stand der Technik

Kaman Unmanned K-Max Militärische Anwendung

Ca. 750 h automatischer Flug

DHL Paketkopter Erprobungsphase 45 min Flugzeit 1.2 kg Nutzlast

© Lockheed Martin

© DHL

© Google

Google Project Wing Erprobungsphase Bisher Luftraum G 1.5 kg Nutzlast

© Amazon

Amazon Prime Air Erprobungsphase Höhenseparation nach Fluggeschw.

Langsam: AGL < 200ft Schnell: 200 ft < AGL <500 ft

NASA UTM Air traffic management for low altitude drones

© NASA

© Lockheed Martin

DARPA ARES Aerial Reconfigurable

Embedded System Phase III: Prototypherstellung

EASA: Concept of Operations for Drones

Direct visual line of sight < 150 m altitude Outside reserved areas

No certification

Risks like manned aviation Size, complexity, kinetic energy

Full certification

Open Category Certified Category Specific Category

?

Beyond line of sight > 150 m altitude No MTOW limit Increased Risk

Operation-based safety risk assessment

Specific Operation Risk Assessment (SORA)

𝑃𝑃𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 < 10−7

𝑃𝑃𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐𝑐 < 10−3

𝑃𝑃𝑣𝑣𝑣𝑣𝑣𝑣𝑣𝑣𝑐𝑐𝑣𝑣𝑣𝑣 < 10−4

?

open certified specific

Specific Operation Risk Assessment

Direct visual line of sight

< 150 m altitude

Outside reserved areas

No certification

Risks like manned aviation

Size, complexity, kinetic energy

Full certification

Beyond line of sight > 150 m altitude Increased Risk


Introduction ARTIS Fleet Autonomous Research Testbed for Intelligent Systems

miniARTIS (1.5kg) midiARTIS (14kg)

superARTIS (90-150 kg)

Prometheus (25kg)


Research Focus & Challenges

DO-178C

Online Mapping Algorithms Trajectory-based Control

Online Guidance and Navigation Algorithms Assurance

MiPlEx Software Framework


ALFURS Capabilities [Kendoul2012]


ALFURS-based Generic Model


DO-178C Process View

• Testautomatisierung • Agile Ansätze • Metriken • Formale Methoden • DO-178C


ARTIS Test Strategy [DGLR WS L6.3/Q3.4, 2013]

Formal Methods

Static Tests

Unit Tests Software-

in-the-Loop

Hardware-in-the-Loop

Flight Test

CppCheck

Static Asserts

Sensor Emulation

Closed Loop Planning &Control Use Cases / Boundary Cases

MBT, Coverage


ARTIS Test & Assurance Strategy

CppCheck

Static Asserts

Formal Methods

Static Tests

Unit Tests

Software-in-the-Loop

Hardware-in-the-Loop

Flight Test

Runtime Monitoring

Monitor


Formal Methods and Requirements in DO-Stds

Requirements

Formalization

Modelling

Model-checking Certification

DO-178C

DO-331

DO-333 DO-333 DO-330

DO-178C

DO-330

DO-331

DO-333

…

DO-333

[Torens2016]

[Torens2016]

[Torens2016]

[Torens2015]


Requirements

Formalization

Modelling

Model-checking

Certification DO-178C Verification Processes:


Requirements Related Objectives DO-178C/333

Requirements

Formalization

Modelling

Model-checking

Certification


Requirements Elicitation with Templates

• Semi-formalization of requirements • Template for engineers not familiar with requirements management • Helps to include relevant aspects • Allow full textual requirements as alternative

Requirements

Formalization

Modelling

Model-checking

Certification

Condition System / Subsystem

Obligation Action Object Additional Details


Tabular Representation MiPlEx: Mission Management

Requirements

Formalization

Modelling

Model-checking

Certification


Obliga-tion

Action Object / Additional Details


Requirements Formalization MiPlEx: Mission Management

Certification

Requirements

Formalization

Modelling

Model-checking

Certification

* *) no actual certification was done, BUT we see that certification is reasonable using the proposed methodology


Obliga-tion

Action Object / Additional Details


Graphical Concept Model MiPlEx: Mission Management

Requirements

Formalization

Modelling

Model-checking

Certification


NuSMV Modelling (LTL) MiPlEx: Mission Management

Requirements

Formalization

Modelling

Model-checking

Certification


Model-Checking with NuSMV MiPlEx: Mission Management

Certification

Requirements

Formalization

Modelling

Model-checking

Certification

* *) no actual certification was done, BUT we see that certification is reasonable using the proposed methodology


Checked and confirmed properties of the model

Model Implementation

Requirements

Formalization

Model CheckingSpecification / Properties

Specification / Properties

valid


Checked and confirmed properties of the system?


valid


Requirements

Formalization

Model Checking

?=

?

?Specification /

Propertiesvalid



Checked and confirmed properties of the system!


Requirements

Formalization

Model Checking

!=



valid

Runtime Monitoring


valid


Runtime Monitor

• A Monitor observes System behavior • Is the system observed behavior consistent to the specification?

• Issued a warning to the user • Initiate an action to ensure a safe system state

• The system under observation can be a program, Hardware, network or any kind of system combination

Monitor


Hardware

Software

System

User / Environment


Motivation

• Are the same properties valid for the system as for the model

• Ensuring a safe operation by monitoring of

• Operation specific risk

• Violation of safety requirements

• Functional consistency

• Increase of Situational Awareness

• Control of functional states not available via pilot instruments


Extendable and Scalable Approach

• “Inverse”, safety view on the system functionality • Debugging • Certification Credit • Formal test case • Instant Reaction / Notification • Contingency / Safe Termination • Reduce Software Safety Level • Fail-Safe / Robust Systems

Offline Online Mitigation Runtime Certification

Fail-Safeness


Specific Operation Category Safety Concept

Functional requirements

Safety Assessment

Safety critical system design

Runtime Monitoring

System

Safe Flight Termination

Flight control architecture suitable for runtime monitoring

Monitoring Specification

• Not an “Aircraft Level Authorization”, instead Aircraft + Operation • Analysis of relevant safety requirements • Flight control system architecture with runtime monitoring

specifically to support specific category safety case


Safety-Critical System Architecture


Runtime Monitoring using Temporal Logic (LTL) and Formal Methods

• Research Tool University Saarbrücken: Lola

• Specification language for offline and online monitoring

• Based on mathematical foundation of linear temporal logic

• Lola is based on typed streams, which are used both for the inputs to the monitor as well as for output

• Goal: generate independent standalone executable monitoring module in software or in hardware

Example Lola specification to supervise the allowed flight altitude


Summary

1. Approach based on Formal Methods

• Demonstration based on DLR‘s flight tested unmanned aircraft

guidance software (MiPlEx)

• Qualification for Certification

• Assurance Considerations w.r.t. Autonomy

2. Approach enhancement for new DLR unmanned air freight project

• V&V effort reduction: Explotation of new EASA concept (esp. SORA)

• Technical concept based on Formal Methods

and Runtime Monitoring


Q&A: V&V => [email protected] MiPlEx => [email protected]

Requirements

Formalization

Modelling

Model-checking

Certification

Vielen Dank für die

Aufmerksamkeit!

Functional requirements

Safety Assessment

Safety critical system design

Runtime Monitoring

System

Safe Flight Termination

mailto:[email protected]

mailto:[email protected]

Auf dem Weg zur unbemannten Luftfracht durch sichere ... · Auf dem Weg zur unbemannten Luftfracht...

Documents

Transcript of Auf dem Weg zur unbemannten Luftfracht durch sichere ... · Auf dem Weg zur unbemannten Luftfracht...