REVIEW 3 major objections 5 minor 31 references
Approach Towards Semi-Automated Certification for Low Criticality ML-Enabled Airborne Applications
T0 review · 3 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash
Pith's one-line read A weighted Assurance Profile can certify low-criticality ML systems for DO-178C Level D.
desk verdict Useful framework, but the compliance claim doesn't survive the paper's own rubric. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central object is the Assurance Profile: a structured scorecard, described by the authors as similar to a nutrition label, that consolidates all certification evidence into one number. Activity scores $S_{\mathrm{act}}$ are aggregated into process scores by weighted sums, and the four process scores are aggregated into the final certification score $S$. The weights are chosen as a function of the system classification $C = \langle c_{\mathrm{crit}}, c_{\mathrm{aut}}, c_{\mathrm{model}} \rangle$ and contextual factors. The classification also selects the depth of validation: Air Sight's complex model (a YOLOv8 neural network) receives the most extensive validation level $V_3$, while Level D criticality and 2A autonomy keep human oversight in the loop.
What would settle it
Recompute the final Assurance Profile with a different but plausible Quality Assurance process weight, say 0.35 instead of 0.20; the total falls below 70, flipping the verdict from Moderate to Limited Assurance and contradicting the paper's claim that Air Sight meets DO-178C Level D compliance.
Extended reading notes
Core claim
The paper's core claim is that certification readiness for a low-criticality ML component can be expressed as a single weighted score derived from four processes: Development, Verification & Validation, Quality Assurance, and Configuration Management. Each process is scored through activities that mix automated checks, semi-automated tests, and manual reviews, and the scores are combined using weights that depend on the system's classification $C = \langle c_{\mathrm{crit}}, c_{\mathrm{aut}}, c_{\mathrm{model}} \rangle$. For Air Sight, classified $\langle D, 2A, 3 \rangle$, the resulting score is $S = 74.7$, corresponding to Moderate Assurance. The paper states that this result demonstrates that Air Sight meets the compliance criteria for DO-178C Level D and that, for its classification, full recertification is unnecessary within a typical operational lifecycle; targeted drift checks suffice.
Load-bearing premise
The certification verdict rests entirely on Assurance Profile weights and activity scores that are assigned by hand without a documented derivation, so choosing different numbers would produce a different compliance outcome.
Editorial extensions
If this is right
- Certification of a Level D ML component can reduce to producing a documented Assurance Profile, with automated checks doing most of the verification work and manual reviews reserved for integration, usability, and uncertainty handling.
- Once certified, the system can remain compliant through targeted drift checks rather than full re-audits, as long as drift stays below the stated thresholds such as the 30% dataset-shift trigger.
- Weak scores in Quality Assurance and Configuration Management do not block certification but identify where post-deployment monitoring and version-control discipline must improve.
- The same classification and scorecard structure can be applied to other low-criticality ML-enabled airborne functions with comparable autonomy and model complexity.
Reading between the lines
- The weakest link in the chain is the provenance of the Assurance Profile weights: until a derivation or calibration procedure is published, the framework can produce a different certification verdict for the same system under a different but equally plausible set of hand-assigned numbers.
- A natural next test is to apply the same scorecard to several Level D ML systems and check whether the resulting score separates systems that later experience operational failures from those that do not.
- The 30% drift threshold used as a recertification trigger is presented as acceptable for Level D; tying it to a formal risk model would make recertification decisions auditable across applications.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes a semi-automated certification approach for low-criticality (DO-178C Level D) ML-enabled airborne systems. The approach consists of a multi-axial system classification C=(ccrit, caut, cmodel), three certification layers, and an Assurance Profile that aggregates manual and automated activity scores into a weighted process score and a final certification score S. The final score is mapped to a confidence level sigma(S). The approach is exercised on a case study, Air Sight, a YOLOv8-based vehicle detector for surveillance aircraft. The paper reports a final score of 74.7, labels it 'Moderate Assurance', and concludes in Section V-A that 'Air Sight meets the compliance criteria for DO-178C Level D criticality'. The paper also defines recertification triggers and reports a robustness evaluation with Gaussian noise and drift checks.
Significance. The paper is clearly relevant to an active problem: current airworthiness standards do not address ML-specific assurance artifacts such as data validation, drift monitoring, and model robustness. Its strengths are that it is explicitly scoped to Level D and to offline-trained, static models; it makes its assumptions explicit; it reports a real case study with YOLOv8 and Deepchecks; and it provides a public code repository link for the prototype. If the proposed framework could demonstrate a defensible link to DO-178C objectives, it would be a useful contribution to the ongoing discussion on ML certification. However, as written, the central claim is not supported: the Assurance Profile is a compensatory score computed from hand-assigned inputs, whereas DO-178C compliance is an objective-based, conjunctive determination. The paper therefore currently functions more as an illustrative position piece than as a validation of a certification method.
major comments (3)
- [Section IV-C and Table I, Section V-A] The certification score is computed as a weighted sum S = sum_j w_process_j * S_process_j, which is a compensatory model: high Development and V&V scores offset low QA and CM scores. In Table I, the QA score is 52.5 and the CM score is 61.5, which fall below the paper's own 'Insufficient Assurance' (<60) and 'Limited Assurance' (60-70) thresholds, respectively. Despite this, Section V-A states that 'Air Sight meets the compliance criteria for DO-178C Level D criticality'. DO-178C is an objective-based standard: each applicable objective must be satisfied, and there is no provision for a high verification score to compensate for an unsatisfied quality-assurance or configuration-management objective. The paper supplies no mapping from the Assurance Profile activities to the DO-178C Level D objectives, so the compliance statement is internally inconsistent with the paper's own rubric and unsupported by the cited standard.
- [Section IV-C, score equations and Table I] The weights w_act and w_process are introduced as 'a factor of the system's classification C and contextual factors', but no elicitation procedure, data source, sensitivity analysis, or independent criterion is given for their values. The activity scores in Table I are reported without confidence intervals, inter-rater agreement, or an audit trail showing how manual reviews and automated check pass rates were converted into the 0-100 scores. Since the final score 74.7 is an arithmetic consequence of these hand-assigned inputs, the resulting 'Moderate Assurance' verdict is not an independent measurement or prediction. Before the score can support a compliance determination, the paper should provide a documented scoring protocol, a sensitivity analysis, and ideally a comparison with a certification authority or with a system of known conformance status.
- [Section V-C versus Section V-B] The evaluation concludes that 'prediction drift was observed during testing, it remained within the acceptable threshold for Level D criticality systems (<30%)', but the only 30% threshold defined in Section V-B is a recertification trigger for 'a significant change (over 30%) in dataset distribution or model architecture'. The paper does not define an acceptable prediction-drift threshold for Level D, nor does it justify transferring the 30% value from dataset change to prediction drift. The conclusion that recertification is not needed is therefore based on an arbitrary threshold and should either be removed or supported by a rationale tied to operational requirements or an applicable standard.
minor comments (5)
- [Abstract] The phrase 'confidence measure the ML component' is missing a preposition and should read 'confidence measure for the ML component'.
- [Section I] The text contains a duplicated phrase: 'low-criticality corresponds to DO-178C Level D, corresponds to DO-178C Level D'. The repetition should be removed.
- [Section IV-C] The summation notation 'Sprocess = nX i=1 wacti ·Sacti' uses an undefined upper limit n; please define the number of activities per process or use explicit enumeration.
- [Table I] The Configuration Management process is labeled 'Total SCM Score' in the table but is consistently called CM elsewhere in the paper; the label should be made consistent.
- [Section IV-C] There are several typographical errors, including 'uncertainity' in the introduction and 'appropraite' in Section IV-C5; the manuscript should be proofread for such issues.
Circularity Check
The Level D compliance verdict is a restatement of the paper's own score-bin definition: S=74.7 falls in 'Moderate Assurance', which is defined as 'meets criteria', so the central claim does not rest on independent DO-178C evidence.
-
self definitional
[Section IV-C (certification confidence level definition), Table I, Section V-A (Certification Details)]
"The certification confidence level σ(S) categorizes the MLS score S ∈ [0,100] into five confidence levels: ... Moderate Assurance : 70≤ S <80 ... Where: ... Moderate Assurance meets criteria, with periodic review advised. ... This initial certification assessment demonstrates that Air Sight meets the compliance criteria for DO-178C Level D criticality."
The central claim is already contained in the definition of the score bin. Section IV-C defines S as a weighted sum of hand-assigned activity scores and weights, then defines σ(S) so that 70≤S<80 is 'Moderate Assurance' with the gloss 'Moderate Assurance meets criteria.' Table I computes S=74.7, and Section V-A converts this into 'meets the compliance criteria for DO-178C Level D criticality.' No DO-178C objective-level check or external pass/fail criterion is applied; the conclusion is just the label attached to the 70-80 bin. The paper even notes QA (52.5) and CM (61.5) sit below its own Insufficient and Limited bounds, so the aggregate pass is an artifact of the weighted-average construction, not a conjunctive objective-by-objective pass.
full rationale
The paper's load-bearing conclusion is that Air Sight 'meets the compliance criteria for DO-178C Level D criticality.' That conclusion is derived by applying the paper's own scoring rubric: the final score S is defined as a weighted sum of process scores, σ(S) is defined so that 70≤S<80 is 'Moderate Assurance,' and the rubric text defines 'Moderate Assurance meets criteria.' The case study then computes S=74.7 and reads the compliance statement directly off the bin label. This is a definitional reduction: the output ('meets criteria') is the meaning assigned to the input score range, not a result obtained from an independent DO-178C assessment. The activity scores and weights in Table I are introduced without a stated procedure or external source, but that arbitrariness is a validity concern rather than circularity by itself; the circularity is in the step that equates a score-bin label with DO-178C Level D compliance. There is no load-bearing self-citation, no imported uniqueness theorem, and no ansatz smuggled in via citation. The empirical robustness measurements (precision, recall, mAP under noise) and drift checks are genuine external checks and are not circular. However, because the central certification claim reduces by construction to the rubric's own definition of 'Moderate Assurance,' the paper merits a score of 6: partial circularity in the central claim, with some independent content elsewhere.
Assumptions & free parameters
free parameters (8)
- Process weights (w_process) =
Development 0.30, V&V 0.35, QA 0.20, CM 0.15
- Development activity weights =
Dataset Quality 0.40, Model Documentation 0.35, Integration Documentation 0.25
- V&V activity weights =
0.25, 0.25, 0.20, 0.15, 0.15
- QA activity weights =
0.35, 0.35, 0.30
- CM activity weights =
0.40, 0.35, 0.25
- Activity scores in Table I =
e.g., Dataset Quality 80, Model Performance 95, Post-Certification Monitoring 55, Version Control 65
- Confidence level thresholds =
90, 80, 70, 60
- Recertification drift threshold =
30%
assumptions (5)
- domain assumption Non-ML components are certifiable under DO-178C without modification.
- domain assumption ML models are static after deployment; adaptive learning is out of scope.
- ad hoc to paper A weighted sum of rubric scores can represent certification compliance.
- domain assumption The public Roboflow military vehicle dataset plus injected Gaussian noise is representative of reconnaissance and surveillance aircraft operation.
- ad hoc to paper Automated and manual checks in the four processes cover the DO-178C Level D objectives for ML components.
invented entities (2)
-
Assurance Profile
-
Confidence Level sigma(S)
Cite this review
Pith. "Pith review of Approach Towards Semi-Automated Certification for Low Criticality ML-Enabled Airborne Applications." pith.science (2026). https://pith.science/paper/BJOGRTZK
@misc{pith2026250117028,
author = {Pith},
title = {Pith review of: Approach Towards Semi-Automated Certification for Low Criticality ML-Enabled Airborne Applications},
year = {2026},
howpublished = {\url{https://pith.science/paper/BJOGRTZK}},
note = {Machine review of arXiv:2501.17028}
}
read the original abstract
As Machine Learning (ML) makes its way into aviation, ML enabled systems including low criticality systems require a reliable certification process to ensure safety and performance. Traditional standards, like DO 178C, which are used for critical software in aviation, do not fully cover the unique aspects of ML. This paper proposes a semi automated certification approach, specifically for low criticality ML systems, focusing on data and model validation, resilience assessment, and usability assurance while integrating manual and automated processes. Key aspects include structured classification to guide certification rigor on system attributes, an Assurance Profile that consolidates evaluation outcomes into a confidence measure the ML component, and methodologies for integrating human oversight into certification activities. Through a case study with a YOLOv8 based object detection system designed to classify military and civilian vehicles in real time for reconnaissance and surveillance aircraft, we show how this approach supports the certification of ML systems in low criticality airborne applications.
Figures
Reference graph
Works this paper leans on
-
[1]
DO-178C: Software Considerations in Airborne Systems and Equipment Certification,
Radio Technical Commission for Aeronautics (RTCA), “DO-178C: Software Considerations in Airborne Systems and Equipment Certification,”
-
[2]
How to certify machine learning based safety-critical systems? a systematic literature review,
F. Tambon, G. Laberge, L. An, A. Nikanjam, P. S. N. Mindom, Y . Pequignot, F. Khomh, G. Antoniol, E. Merlo, and F. Laviolette, “How to certify machine learning based safety-critical systems? a systematic literature review,” Automated Software Engineering , vol. 29, no. 2, p. 38, 2022
work page 2022
-
[3]
Identifying challenges to the certification of machine learning for safety critical systems,
E. Jenn, A. Albore, F. Mamalet, G. Flandin, C. Gabreau, H. Delseny, A. Gauffriau, H. Bonnin, L. Alecu, J. Pirard, et al., “Identifying challenges to the certification of machine learning for safety critical systems,” in European congress on embedded real time systems (ERTS 2020) , 2020
work page 2020
-
[4]
Continuous validation for data analytics systems,
M. Staples, L. Zhu, and J. Grundy, “Continuous validation for data analytics systems,” in Proceedings of the 38th International Conference on Software Engineering Companion , ICSE ’16, (New York, NY , USA), p. 769–772, Association for Computing Machinery, 2016
work page 2016
-
[5]
Data integrity challenges and solutions in machine learning- driven clinical trials,
Z. Chain and D. Alexander, “Data integrity challenges and solutions in machine learning- driven clinical trials,” 08 2023
work page 2023
-
[6]
Tensorflow data validation: Data analysis and validation in continuous ml pipelines,
E. Caveness, P. S. GC, Z. Peng, N. Polyzotis, S. Roy, and M. Zinkevich, “Tensorflow data validation: Data analysis and validation in continuous ml pipelines,” in Proceedings of the 2020 ACM SIGMOD International Conference on Management of Data , pp. 2793–2796, 2020
work page 2020
-
[7]
Engineering ai systems: A research agenda,
J. Bosch, H. H. Olsson, and I. Crnkovic, “Engineering ai systems: A research agenda,” Artificial intelligence paradigms for smart cyber-physical systems, pp. 1–19, 2021
work page 2021
-
[8]
Aleatoric and epistemic uncertainty in machine learning: An introduction to concepts and methods,
E. H ¨ullermeier and W. Waegeman, “Aleatoric and epistemic uncertainty in machine learning: An introduction to concepts and methods,” Machine learning, vol. 110, no. 3, pp. 457–506, 2021
work page 2021
Show all 31 references
-
[9]
Easa artificial intelligence (ai) concept paper issue 2: Guidance for level 1&2 machine learning applications,
EASA, “Easa artificial intelligence (ai) concept paper issue 2: Guidance for level 1&2 machine learning applications,” March 2024
2024
-
[10]
Toward certification of machine-learning systems for low criticality airborne applications,
K. Dmitriev, J. Schumann, and F. Holzapfel, “Toward certification of machine-learning systems for low criticality airborne applications,” in 2021 IEEE/AIAA 40th Digital Avionics Systems Conference (DASC) , pp. 1–7, IEEE, 2021
2021
-
[11]
Jocher et al., “Yolov8.” https://github.com/ultralytics/ultralytics, 2023
G. Jocher et al., “Yolov8.” https://github.com/ultralytics/ultralytics, 2023
2023
-
[12]
Hidden technical debt in machine learning systems,
D. Sculley, G. Holt, D. Golovin, E. Davydov, T. Phillips, D. Ebner, V . Chaudhary, M. Young, J.-F. Crespo, and D. Dennison, “Hidden technical debt in machine learning systems,” in Proceedings of the 28th International Conference on Neural Information Processing Systems - Volum...
2015
-
[13]
Artificial intelligence for safety-critical systems in industrial and transportation domains: A survey,
J. Perez-Cerrolaza, J. Abella, M. Borg, C. Donzella, J. Cerquides, F. J. Cazorla, C. Englund, M. Tauber, G. Nikolakopoulos, and J. L. Flores, “Artificial intelligence for safety-critical systems in industrial and transportation domains: A survey,” ACM Computing Surveys , vol. ...
2024
-
[14]
Correctness verification of neural networks,
Y . Yang and M. Rinard, “Correctness verification of neural networks,” 2022
2022
-
[15]
Deepxplore: Automated whitebox testing of deep learning systems,
K. Pei, Y . Cao, J. Yang, and S. Jana, “Deepxplore: Automated whitebox testing of deep learning systems,” in Proceedings of the 26th Symposium on Operating Systems Principles , SOSP ’17, p. 1–18, ACM, Oct. 2017
2017
-
[16]
Deeptest: Automated testing of deep-neural-network-driven autonomous cars,
Y . Tian, K. Pei, S. Jana, and B. Ray, “Deeptest: Automated testing of deep-neural-network-driven autonomous cars,” 2018
2018
-
[17]
The ml test score: A rubric for ml production readiness and technical debt reduction,
E. Breck, S. Cai, E. Nielsen, M. Salib, and D. Sculley, “The ml test score: A rubric for ml production readiness and technical debt reduction,” in 2017 IEEE International Conference on Big Data (Big Data) , pp. 1123–1132, 2017
2017
-
[18]
Ai/ml for safety-critical software: the case of the space domain,
A. Petrucci, F. Basciani, and P. Pelliccione, “Ai/ml for safety-critical software: the case of the space domain,” IEEE Software, pp. 1–8, 2024
2024
-
[19]
Tool qualification aspects in ml-based airborne systems development,
K. Dmitriev, F. Kaakai, M. Ibrahim, U. Durak, B. Potter, and F. Holzapfel, “Tool qualification aspects in ml-based airborne systems development,” in Software Engineering 2023 Workshops , pp. 208–221, Bonn: Gesellschaft f¨ur Informatik e.V ., 2023
2023
-
[20]
DO-330: Software Tool Qualification Considerations,
Radio Technical Commission for Aeronautics (RTCA), “DO-330: Software Tool Qualification Considerations,” 2011. RTCA DO-330
2011
-
[21]
DO-200B: Standards for Processing Aeronautical Data,
Radio Technical Commission for Aeronautics (RTCA), “DO-200B: Standards for Processing Aeronautical Data,” 2015. RTCA DO-200B
2015
-
[22]
White paper ma- chine learning in certified systems,
H. Delseny, C. Gabreau, A. Gauffriau, B. Beaudouin, L. Ponsolle, L. Alecu, H. Bonnin, B. Beltran, D. Duchel, J.-B. Ginestet, et al., “White paper ma- chine learning in certified systems,” arXiv preprint arXiv:2103.10529, 2021
2021 arXiv
-
[23]
Towards certifiable ai in aviation: landscape, challenges, and opportunities,
H. Bello, D. Geißler, L. Ray, S. M¨uller-Div´eky, P. M¨uller, S. Kittrell, M. Liu, B. Zhou, and P. Lukowicz, “Towards certifiable ai in aviation: landscape, challenges, and opportunities,” arXiv preprint arXiv:2409.08666 , 2024
2024 arXiv
-
[24]
Framework for certification of ai-based systems,
M. Gariel, B. Shimanuki, R. Timpe, and E. Wilson, “Framework for certification of ai-based systems,” arXiv preprint arXiv:2302.11049 , 2023
2023 arXiv
-
[25]
Rierson, Developing safety-critical software: a practical guide for aviation software and DO-178C compliance
L. Rierson, Developing safety-critical software: a practical guide for aviation software and DO-178C compliance . CRC Press, 2017
2017
-
[26]
I came, i saw, i certified: some perspectives on the safety assurance of cyber-physical systems,
M. Sivakumar, A. B. Belle, K. K. Shahandashti, O. Odu, H. Hemmati, S. Kpodjedo, S. Wang, and O. O. Adesina, “I came, i saw, i certified: some perspectives on the safety assurance of cyber-physical systems,” arXiv preprint arXiv:2401.16633 , 2024
2024 arXiv
-
[27]
Test & evaluation best practices for machine learning-enabled systems,
J. Chandrasekaran, T. Cody, N. McCarthy, E. Lanus, and L. Freeman, “Test & evaluation best practices for machine learning-enabled systems,” arXiv preprint arXiv:2310.06800 , 2023
2023 arXiv
-
[28]
Rethinking certification for trustworthy machine learning-based applications,
M. Anisetti, C. A. Ardagna, N. Bena, and E. Damiani, “Rethinking certification for trustworthy machine learning-based applications,” IEEE Internet Computing, 2023
2023
-
[29]
Application and certification challenges for ai/ml techniques in safety critical avionics systems,
R. Sabatini, E. Blasch, I. Majid, A. Gardi, and A. Roy, “Application and certification challenges for ai/ml techniques in safety critical avionics systems,” 09 2022
2022
-
[30]
Military vehicles object detection dataset
M. V . O. Detection, “Military vehicles object detection dataset.” https://universe.roboflow.com/military-vehicle-object-detection/ military-vehicles-object-detection, may 2023. visited on 2024-11-06
2023
-
[31]
Deepchecks: A library for testing and validating machine learning models and data,
S. Chorev, P. Tannor, D. B. Israel, N. Bressler, I. Gabbay, N. Hutnik, J. Liberman, M. Perlmutter, Y . Romanyshyn, and L. Rokach, “Deepchecks: A library for testing and validating machine learning models and data,” Journal of Machine Learning Research , vol. 23, no. 285, pp. 1–6, 2022
2022
Reviewed August 10, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.