Coverage-Driven Verification for Safety-by-Design in AI-Based Collision Avoidance Systems

Technical Summary: Coverage-Driven Verification for Safety-by-Design in AI-Based Collision Avoidance Systems

Problem Statement
The integration of Artificial Intelligence (AI) and Machine Learning (ML) into safety-critical aviation systems, such as collision avoidance, faces significant regulatory hurdles. The European Union Aviation Safety Agency (EASA) mandates that developers demonstrate the "completeness and representativeness" of the Operational Design Domain (ODD) and the data distributions used for verification. While previous research has addressed the completeness of ODD coverage (ensuring all parameter combinations are tested), there is a lack of structured engineering processes to assess representativeness (ensuring the data follows the prescribed operational distributions). Existing methods often rely on geometric coverage metrics or statistical tests that suffer from scalability issues in high-dimensional spaces or fail to distinguish between mere data presence and distributional fidelity. Specifically, standard goodness-of-fit tests like the Chi-squared test are prone to "large-sample inflation," where they reject null hypotheses for negligible deviations simply due to massive dataset sizes, rendering them unsuitable for modern simulation-based verification.

Methodology
The authors propose a structured, two-step coverage assessment loop aligned with EASA's learning assurance framework (specifically MOC DM-07-2 and DM-08). The process operates sequentially:

1. Target Distribution Definition: Engineers must first define a target distribution for each ODD parameter. This is derived from real-world data, representative simulation data, physically motivated statistical assumptions (e.g., uniform or normal distributions), or expert knowledge. The source and rationale for each distribution are documented to ensure traceability.
2. Representativeness Assessment: The available verification dataset is compared against these target distributions using a two-stage gate:
   • Stage 1: Bin-Coverage Gate: Ensures that every bin in the parameter's partition contains at least one sample (100% bin coverage). If this fails, distributional analysis is halted as the partition is not fully populated.
   • Stage 2: Divergence Evaluation: If the bin coverage is sufficient, the dataset's distribution is compared to the target using two complementary metrics:
     • Kullback–Leibler (KL) Divergence: An information-theoretic measure quantifying the information loss when approximating the target distribution with the observed data. It is sensitive to shape and tail mismatches.
     • Cramér's V: An effect-size measure derived from the Chi-squared statistic but normalized by sample size and degrees of freedom. This addresses the large-sample inflation problem, providing a bounded measure of deviation magnitude independent of dataset size.

The authors explicitly reject the raw Chi-squared test as a decision criterion for large datasets because its p-values become insignificant for even trivial deviations as sample size ($n$) increases. Instead, they utilize Cramér's V to assess the magnitude of the deviation.

Case Study and Results
The method was applied to experimental data from two AI-based collision avoidance systems: the Horizontal Collision Avoidance System (HCAS) and the Vertical Collision Avoidance System (VCAS), utilizing 1.97 million simulated scenario rows.

• Metric Validation: A sensitivity analysis on the time-to-closest-point-of-approach ($\tau$) parameter confirmed that the Chi-squared test yielded $p$-values near zero regardless of bin count, failing to distinguish between good and bad fits. In contrast, Cramér's V remained stable and below the "negligible" threshold, correctly identifying the excellent fit.
• Coverage Findings:
  • Excellent Fit: Parameters such as $\tau$ (VCAS) and range ($\rho$), intruder speed ($v_{int}$), and $\tau$ (HCAS) showed low KL divergence and low Cramér's V values, indicating strong representativeness.
  • Mixed/Failed Fit: The relative altitude ($h$) and vertical rate ($\dot{h}_{own}$) for VCAS, and the bearing angle ($\theta$) and relative heading ($\psi$) for HCAS, exhibited significant distributional mismatches.
  • Key Insight: The study highlighted that high range utilization (e.g., 92.96% for $h$) and high bin coverage (89.65%) do not guarantee representativeness. For instance, the $h$ parameter covered nearly the entire ODD range but was heavily concentrated near zero, deviating sharply from the assumed normal target distribution. This resulted in a "Fail" rating for KL divergence (1.0382) despite high coverage metrics, demonstrating that coverage and representativeness are distinct properties.
  • Discrepancy in Metrics: For parameters with sparse bins (e.g., $\psi$), the KL divergence was inflated by empty-bin contributions, rating them "Fail," while Cramér's V rated them "Fail" as well, confirming a substantial mismatch. For others (e.g., $h$), KL divergence rated "Fail" due to sensitivity to empty bins, while Cramér's V rated "Good" or "Moderate," illustrating the complementary nature of the two metrics.

Key Contributions and Significance
The paper claims to provide a generic, reusable method for assessing ODD representativeness that aligns with EASA's emerging safety guidance. Its primary contributions include:

1. Process Flow: A defined engineering workflow (Figure 2) for deriving target distributions from various sources (data, simulation, assumptions, expertise) to support traceability.
2. Metric Selection: The identification of the Chi-squared test's unsuitability for large-scale AI verification and the proposal of a dual-metric approach (KL divergence and Cramér's V) to robustly assess distributional representativeness.
3. Two-Stage Criterion: The establishment of a sequential assessment loop where bin coverage must be established before distributional divergence is evaluated, ensuring statistical reliability.
4. Safety-by-Design Alignment: The method operationalizes EASA's "Safety-by-Design" principles by providing a quantitative mechanism to verify that verification data adequately reflects the intended operational environment, moving beyond simple combinatorial coverage.

Limitations and Future Work
The authors maintain a modest stance, noting that the current method addresses only the representativeness pillar, while combinatorial completeness is treated separately. They acknowledge that the current bin-coverage gate requires only minimal occupancy, which may not ensure statistical reliability of frequency estimates. Furthermore, the acceptance thresholds for KL and Cramér's V are currently heuristic and qualitative; future work must anchor these to specific safety-relevance tiers for formal certification. Finally, the reliance on assumed target distributions (e.g., normal or uniform) is a limitation; the authors suggest that future iterations should utilize empirical distributions derived from actual operational surveillance data to strengthen the representativeness claim.