Ensuring Safety of Machine Learning Components Using Operational Design Domain

Aug 2, 2026

Urban Air Mobility relies increasingly on machine learning for autonomy functions, yet ensuring safety for aviation systems using ML components remains difficult. This work investigates verification and safety aspects of an exemplary camera-based object detector for detecting humans on the ground. It presents an Operational Design Domain (ODD) concept adapted in the context of machine learning assurance and applies runtime monitoring to check conformance during flight. Flight test results show that ODD monitoring can improve operational safety while also enhancing performance by reducing misdetections.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages14

Reading Time35 min

AccessFree to download

Introduction

Related work

ML Safety Assurance

Operational Design Domain

Architecture and runtime assurance

Flight test setup

Software setup

Flight test results

Ensuring Safety of Machine Learning Components Using Operational Design Domain Christoph Torens∗ , Franz Jünger†, Sebastian Schirmer‡, Simon Schopferer § , Dmytro Zhukov¶ , Johann C. Dauer ‖, German Aerospace Center (DLR), Institute of Flight Systems, Braunschweig, Germany The introduction of machine learning in the aviation domain is an ongoing process. This is also true for safety-critical domains, especially for the area of Urban Air Mobility. A signiﬁcant growth in number of air taxis and an increasing level of autonomy is to be expected allowing for operating a large number of air taxis in complex urban environments. Due to the complexity of the tasks and the environment, key autonomy functions will be realized using machine learning, for example the camera-based detection of objects. However, the safety assurance for avionics systems using machine learning components is challenging. This work investigates safety and veriﬁcation aspects of machine learning components. A camera-based detection of humans on the ground, [e.g. to](e.g. to) assess a potential landing area, serves as an example for an machine learning-based autonomy functio and was integrated into an Unmanned Aircraft. In the context of this exemplary machine learning component, the concept of Operational Design Domain as recently adapted European Aviation Safety Agency in the context of machine learning assurance is described along with other key concepts of machine learning assurance. Furthermore, runtime assurance is used to monitor conformance to the Operational Design Domain during ﬂight. The presented ﬂight test results indicate that monitoring the Operational Design Domain can support performance as well as the safety of the operation. I. Introduction With recent advances in artiﬁcial intelligence (AI) and machine learning (ML) there is an increasing demand for the use of ML, even for safety-critical applications in the aviation domain. Current research is targeted towards the use of ML to reach high degrees of autonomy in the context of Urban Air Mobility (UAM), i.e. transportation services via air taxis in urban environments. However, a key research question is how ML-enabled autonomy can be safely applied in the context of UAM [1] . It is diﬃcult to comply to rigorous safety requirements and the corresponding standards, as established in aviation for safety-critical systems and software. Furthermore, safety standards for ML applications are currently under development and give only ﬁrst guidelines [2] . In this paper we use key concepts such as Operational Design Domain (ODD) introduced by these guidelines to derive an architecture that ensures proper operational conditions for an exemplary ML algorithm during ﬂight by the use of runtime monitoring. This algorithm is a state-of-the-art object detector for detecting persons on images captured by a Unmanned Aircraft (UA)’s onboard camera. The components of the derived architecture ﬁlter inputs to the ML algorithm that are outside of its ODD based on navigation information and image metadata. Results indicate that using such an architecture to detect images outside of the ODD cannot safeguard the ML component. It improves the overall performance, i.e. reduces the number of misdetections, and may therefore contribute to the overall operational safety. The remainder of this paper is structured as follows: First, Section III derives components of the architecture based on existing safety and trustworthiness guidelines. Then, Section IV presents the setup for the ﬂight test, followed by the presentation of the software setup for the ﬂight test in Section V. Finally, in Section VI results of the ﬂight test are shown. II. Related work ∗Research Associate, Department Unmanned Aircraft, AIAA Senior Member.†Research Associate, Department Unmanned Aircraft ‡Research Associate, Department Unmanned Aircraft § Team Lead Safe Autonomy, Department Unmanned Aircraft ¶ Research Associate, Department U

FAQs

What is the document’s main focus regarding machine learning in aviation?

It focuses on safety assurance and verification of machine learning components used in aviation, especially for urban air mobility scenarios.

How is Operational Design Domain (ODD) used in the proposed approach?

ODD defines the operational conditions for the ML component, and the system uses runtime monitoring to ensure the component operates within those conditions during flight.

What role do the flight test results play in the conclusions?

They indicate that monitoring conformance to the ODD during flight supports both performance and safety, for example by reducing misdetections.

Aug 2, 2026

Upload by Lucas Martin