Monitoring Unmanned Aircraft: Specification, Integration, and Lessons-learned

Jan Baumeister,Bernd Finkbeiner,Florian Kohn,Florian Löhr,Guido Manfredi,Sebastian Schirmer,Christoph Torens
2024-04-18
Abstract:This paper reports on the integration of runtime monitoring into fully-electric aircraft designed by Volocopter, a German aircraft manufacturer of electric multi-rotor helicopters. The runtime monitor recognizes hazardous situations and system faults. Since the correct operation of the monitor is critical for the safety of the aircraft, the development of the monitor must follow strict aeronautical standards. This includes the integration of the monitor into different development environments, such as log-file analysis, hardware/software-in-the-loop testing, and test flights. We have used the stream-based monitoring framework RTLola to generate monitors for a range of requirements. In this paper, we present representative monitoring specifications and our lessons learned from integrating the generated monitors. Our main finding is that the specification and the integration need to be decoupled, because the specification remains stable throughout the development process, whereas the different development stages require a separate integration of the monitor into each environment. We achieve this decoupling with a novel abstraction layer in the monitoring framework that adapts the monitor to each environment without affecting the core component generated from the specification. The decoupling of the integration has also allowed us to react quickly to the frequent changes in the hardware and software environment of the monitor due to the fast-paced development of the aircraft in a startup company.
Software Engineering,Logic in Computer Science
What problem does this paper attempt to address?
The main problem that this paper attempts to solve is to integrate runtime monitoring into fully electric aircraft to ensure the safety and reliability of these aircraft. Specifically, the paper explores how to effectively integrate real - time monitoring systems in different development and testing environments (such as log file analysis, hardware/software - in - the - loop testing, and flight tests) to identify dangerous situations and system failures, and ensure that the correct operation of the monitoring system complies with strict aviation standards. ### Core Problems of the Paper 1. **Ensuring Safety**: Since the operating environment of electric multi - rotor helicopters (such as eVTOL aircraft designed by Volocopter) involves high - population - density areas and high - air - traffic - density, it is necessary to ensure that their safety performance meets the same standards as traditional aircraft, that is, only one failure is allowed per billion flight hours. 2. **Integration Challenges**: In different development stages (such as offline log analysis, hardware/software - in - the - loop testing, actual flight testing, etc.), the monitoring system needs to adapt to different environments and technical requirements while maintaining the stability of its core functions. 3. **Rapidly Responding to Changes**: Due to the rapid changes in the hardware and software environments in the start - up company environment, the integration of the monitoring system needs to be able to adapt to these changes quickly without affecting its core functions. ### Solutions To solve the above problems, the author proposes a new abstraction layer for decoupling the specification and integration of the monitoring system: - **Abstraction Layer**: By introducing an abstraction layer, the input - output interface of the monitoring system can be adaptively adjusted according to different development environments without affecting the core monitoring components. - **Event Transformation and Judgment Transformation**: These two components are respectively responsible for transforming the system output into monitoring input and transforming the monitoring results into judgment information understandable by users. This enables the monitoring system to be seamlessly integrated into different development environments. - **Streaming Monitoring Framework RTLola**: Use the RTLola framework to generate monitors. This framework supports a stream - based real - time property specification language and can operate efficiently in different environments and provide formal safety guarantees. ### Conclusions The main finding of the paper is that specification and integration need to be decoupled because the specification remains stable throughout the development process, while in different development stages, the monitoring system needs to be integrated into each environment separately. By introducing the abstraction layer, the author has achieved this decoupling, thereby being able to respond quickly to changes in the hardware and software environments, ensuring the efficient integration and safety verification of the monitoring system. This solution not only improves the flexibility and adaptability of the monitoring system but also provides a basis for the development of future automatic emergency response mechanisms.