HOW S18 PROCESSES HELP MAKE SYSTEMS TRUSTWORTHY SAE

HOW S-18 PROCESSES HELP MAKE SYSTEMS TRUSTWORTHY SAE 2018 Aerospace Standards Summit, October 2, 2018 Presenter: Robert Voros Regulatory Compliance Lead – Development Assurance & System Safety Civil Certification & ODA, Textron Aviation Flight Controls ODA-UM SAE S-18 Committee Chair S-18: Aircraft & Systems Development and Safety Assessment Committee

SAE S-18 Committee Scope/Charter The S-18 Committee brings together qualified specialists for the advancement of aerospace safety and to support effective safety management. It provides a resource for other committees and organizations with common interests in safety and development processes. The committee develops Aerospace vehicle and system: • Safety assessment processes • Development assurance processes • Practices for accomplishing in-service safety assessments S-18’s Core Objective: Assure an inverse relationship between the severity of an aircraft’s failure conditions’ effects and the probability of their occurrences. SAE INTERNATIONAL S-18 2

Guidelines and methods of performing the safety assessment for the aircraft. S-18 Documents S-18 Guidelines for the development, validation, and verification of aircraft systems requirements. Guidelines, methods, and tools to perform the ongoing safety assessment process in service. AIR 6110–Contiguous Aircraft/System Development Process Example AIR 6218–Constructing Development Assurance Plan for Integrated Systems AIR 6219–Incorporation of Atmospheric Neutron Single Event Effects Analysis into Safety Assessment AIR 6276–Use Of Modeling And Tools For Aircraft Systems Development (in work) AIR 6913 –Using STPA During Development and Safety Assessment of Civil Aircraft (in work) SAE INTERNATIONAL S-18 3

S-18 Processes Accommodate a Wide Range of Vehicles ARP 4754 A Process • • • S-18 Processes are structured around aircraft and system functions Function: Intended behavior of a product based on a defined set of requirements regardless of implementation. Therefore, the process can adapt, based on the set of a vehicle’s intended behaviors. Based on AIR 6110, Figure 2 SAE INTERNATIONAL S-18 4

Systematic Assessments of Functions Determines Safety Criticality ARP 4761 Process Once the conditions of the aircraft operation are defined, each function is systematically assessed to understand that function’s: • Failure conditions, • the effects of those conditions, and • the severity of those effects Functional Hazard Assessment Loss of the Function Effects of Loss on the Aircraft, Crew and Passengers Malfunction Effects of Malfunction on the Aircraft, Crew and Passengers FUNCTION ARP 4754 A Process SAE INTERNATIONAL S-18 ARP 4761 Process Catastrophic Hazardous Major Minor 5

The Architecture Informs the Safety Requirements ARP 4754 A Process Function Procedures System Behaviors Mechanism Definition The balance of these attributes depends on the aircraft. Procedures System Behaviors Procedures SAE INTERNATIONAL Procedures Mechanism Definition System Behaviors S-18 System Behaviors Mechanism Definition 6

Safety Requirements are Used to Reduce the Occurrence of Failure Conditions Based on their Severity ARP 4761 Process Procedures Flight System Behaviors Maintenance Development Assurance Levels Mechanism Definition Independence Probability of Failure Preliminary System Safety Assessment ARP 4761 Process Severity Development Assurance Levels Activity per Severity Independence per Severity Probability of Failure Catastrophic A Assure Correctness and Completeness, Implementation Verification Validation Activity Independence, Verification Activity Independence, No single failures 1 E-9 Hazardous B Assure Correctness and Completeness, Implementation Verification Validation Activity Independence, Verification Activity Independence 1 E-7 Major C Assure Correctness and Completeness, Implementation Verification 1 E-5 Minor D As negotiated 1 E-3 SAE INTERNATIONAL S-18 7

How S-18 Processes Help make Systems Trustworthy • • S-18 processes provide a flexible framework within which a variety of configurations can be developed, assessed, and demonstrated to be safe. These processes provide assurance that: • all functions, no matter their complexity, provided by an aircraft are systematically and comprehensively assessed; • the most safety critical aspects of the aircraft’s systems are identified; • that criticality drives both the aircraft’s systems’ architecture and its development process; and • the final design can be shown to address these critical safety aspects SAE INTERNATIONAL S-18 8

How does Artificial Intelligence and Big Data Fit in to S-18 Processes? Procedures • • • System Behaviors Mechanism Definition The S-18 Processes work on the idea that the aircraft functions are defined and knowable, and unintended behaviors are identifiable. Depending on implementation, this premise can be challenged by Artificial Intelligence. How can we address this? • Define objectives, requirements, and constraints of Artificial Intelligence, • Assure the AI is bound by constraints (what it shouldn’t be doing), and • Show that the constraints cannot be overridden by the AI. SAE INTERNATIONAL S-18 9

Contact Information Bob Voros Regulatory Compliance Leader - Development Assurance & System Safety Civil Certification & ODA Textron Aviation 316. 517. 3856 OFFICE 316. 644. 9593 MOBILE revoros@txtav. com Committee Website: http: //www. sae. org/servlets/works/committee. Home. do? comt. ID=TEAS 18 SAE INTERNATIONAL S-18 10