AI Flight Control Software DO-178C — PatSnap Eureka
Certifying AI-Based Flight Control Software Under DO-178C
DO-178C was built for deterministic code. Neural networks are not. Explore the patent-backed engineering strategies Boeing, Airbus, and Korea Aerospace are using to bridge that gap — and accelerate your own certification programme.
Why DO-178C and Machine Learning Are in Fundamental Tension
Patent landscape analysis of approximately 60 records across US, EPO, JP, KR, BR, and CN jurisdictions reveals a consistent engineering problem: DO-178C, the primary international standard governing airborne software certification, was designed around deterministic, traceable software artifacts — requirements, design models, source code, and test cases. Machine learning and neural network-based control systems are inherently non-deterministic, data-driven, and resist classical line-by-line coverage analysis.
The standard demands Modified Condition/Decision Coverage (MC/DC) at Level A — a structural coverage criterion that requires demonstrating every condition in every decision independently affects the decision outcome. For a neural network with millions of weights, this is computationally intractable using classical DO-178C tooling. This is not a gap in implementation; it is a gap in the standard's conceptual framework.
Patent filings from leading aerospace innovators including Airbus, Boeing, and Korea Aerospace reveal three dominant engineering responses: runtime integrity monitoring of ML models, model-based design and formal verification pipelines that generate certifiable artifacts, and hybrid architectures that confine AI to non-safety-critical advisory roles while retaining deterministic control law software for Level A functions.
The European Union Aviation Safety Agency (EASA) has published an AI roadmap acknowledging operational data coverage as a surrogate for structural coverage in principle — but this approach is not yet formally accepted under DO-178C Annex A, leaving engineers to navigate the gap using the strategies mapped in this analysis.
Key Players and Filing Patterns in AI Flight Control Certification
Analysis of ~60 patent records spanning 2010–2025 reveals Boeing as the most prolific assignee, with Airbus, Korean defense institutions, and eVTOL players forming a growing secondary cluster.
Patent Assignee Filing Volume — AI Flight Control
Boeing leads with 7+ verified active records; Korean defense institutions and Airbus entities form a significant secondary cluster.
AI Application Layer vs. DO-178C DAL Requirement
Advisory ML roles (structural monitoring) attract DAL C–D; direct flight control path roles demand Level A with full MC/DC coverage.
Four Patent-Backed Strategies for DO-178C AI Certification
Each strategy maps to a specific DO-178C compliance pathway. The dominant industry approach is to confine AI to advisory roles — but formal methods and model-based pipelines offer routes to Level A certification.
Runtime ML Integrity Monitoring via Test Module
Airbus disclosed an aircraft control architecture comprising two distinct modules: an aircraft control module hosting a machine learning model that generates live flight control outputs, and a test module that stores predefined test input/output pairs. While the control module is not actively performing flight control, the test module writes known test inputs to the ML model and reads back its outputs, comparing them to expected values. This implements a periodic, model-level equivalence check — mapping conceptually to DO-178C's structural coverage analysis but at the model inference layer rather than the source code layer. The system explicitly targets prevention of neural network corruption, addressing both bit-flip hardware faults and potential data poisoning at runtime.
Maps to DO-178C Table A-7 verification of outputsFormal Barrier Function Analysis for Invariant Set Certification
Boeing's patent defines a vehicle dynamics model, constructs barrier functions based on that model, and identifies candidate invariant sets — bounded regions of the state space within which all valid flight control commands must remain. The patent discloses analysis of multiple flight control candidates against these invariants and explicit identification of commands that violate the invariant boundary. This approach generates a formal proof artifact about the flight control envelope, which is directly usable as verification evidence under DO-178C's supplement for formal methods (DO-333). Invariant-based certification is one of the few rigorous paths to certifying ML controllers because it does not require examining individual neural network weights, but rather proves properties about the controller's input-output behavior over a defined state space.
Accepted under DO-333 formal methods supplementModel-Based Design with Bidirectional Traceability
South Korea's Agency for Defense Research disclosed a pipeline that generates a standard model from control equipment standards, generates a design model specifying particular functions, generates source code from the design model, and then performs two-level openness verification — first comparing the standard model to the design model (requirements-to-design traceability), and second comparing the standard model directly to the source code (requirements-to-implementation traceability). This dual-layer comparison is structurally isomorphic to the DO-178C requirement for bidirectional traceability between software requirements, software architecture, source code, and test cases. This approach is the most straightforward to present to a Designated Engineering Representative (DER) or EASA Authorized Representative.
Aligns with DO-178C Sections 5.1–5.5 development processHybrid Architecture: AI Advisory, Deterministic Control Execution
Placing ML outputs in monitoring or maintenance-triggering functions rather than direct control surfaces is the dominant industry strategy for assigning lower DALs to ML components and avoiding Level A certification requirements. Boeing's structural load assessment patents use an ML approximator together with a structural dynamics model to compute response loads from measured flight event parameters — the ML component functions as an approximator in a monitoring system that affects maintenance scheduling, not real-time flight control surface commands. This classification allows ML components to be assigned a lower DAL (e.g., DAL C or D) under DO-178C, bypassing Level A requirements for full MC/DC. Aurora Flight Sciences extends this to crew automation: AI for state detection, deterministic autopilot for control execution.
Dominant industry approach — DAL C or D for ML advisory componentsMonitoring-Based vs. Formal Verification: Airbus vs. Boeing
Two principal architectural paradigms emerge from the patent data. Each has distinct strengths, weaknesses, and DO-178C compliance implications.
| Dimension | Airbus — Runtime Monitoring | Boeing — Formal Barrier Functions |
|---|---|---|
| Core mechanism | Test module periodically injects predefined inputs; checks ML model still produces expected outputs — runtime regression testing | Constructs barrier functions and invariant sets from vehicle dynamics model; exhaustively characterizes which control commands fall inside vs. outside safe invariant set |
| DO-178C mapping | Architecturally similar to software verification independence; maps to DO-178C Table A-7 verification of outputs | Generates formal mathematical proof artifacts accepted under DO-178C's formal methods supplement DO-333 DO-333 |
| Coverage claim | Verifies model has not been corrupted relative to a known-good state | Proves properties about controller's input-output behavior over a defined state space — does not require examining individual neural network weights |
| Key weakness | Cannot provide DO-178C-style coverage evidence about the model's behavior across all possible inputs — insufficient alone for Level A Section 6.4.4.2 MC/DC | Computational tractability: for high-dimensional state spaces typical of commercial aircraft, computing tight barrier functions over the full flight envelope is computationally expensive and may require simplifying assumptions |
| Best fit DAL | DAL B–C supplementary integrity check alongside other evidence | DAL A — generates proof artifacts suitable for Level A evidence package DAL A capable |
| Patent reference | System for preventing corruption of neural network in safety-critical systems on aircraft — Airbus Opérations SAS, EP 2025 (active) | Evaluation of air vehicle flight controls — The Boeing Company, KR 2022 (pending) |
Compare the full patent claims side-by-side in PatSnap Eureka
Access claim maps, family trees, and prosecution history for both filings
Where AI Enters the Flight Control Stack
AI and ML functionality appears at distinct layers of the flight control stack, each with different implications for DO-178C Design Assurance Level assignment.
Structural Load Monitoring — Most Mature ML Application
Boeing's patents disclose an approximator that applies a machine learning algorithm together with a structural dynamics model to compute response loads from measured flight event parameters. These loads are compared to design limits by an analysis engine, which then triggers maintenance actions. The ML component functions as an approximator in a monitoring system that affects maintenance scheduling, not real-time flight control surface commands — allowing DAL C or D assignment.
Autonomous Flight — Highest DO-178C Challenge
Boeing's autonomous flight patents disclose a pre-flight training phase in which recorded surveillance data from multiple flight operations is used to infer aircraft intent, compute trajectories, and train a mapping function via a machine learning algorithm. The trained mapping function then generates autonomous control commands during flight. Boeing's approach — pre-flight training on recorded real-world data from FAA's SWIM infrastructure — suggests reliance on operational data coverage as a surrogate for structural coverage.
Innovation Trends Across the DO-178C AI Patent Landscape
The Boeing Company is the most prolific assignee in this dataset, with verified active patents in Japan and Brazil covering machine learning for structural load assessment, autonomous flight, route suitability monitoring, aircraft tracking, and flight control evaluation via barrier functions. Boeing's strategy is notable for its use of pre-flight training on recorded operational data as a foundation for autonomous control, and for its adoption of formal mathematical tools (barrier functions, invariant sets) to generate certification evidence. The life sciences and aerospace certification parallels are instructive: both domains face the challenge of validating data-driven models against deterministic regulatory frameworks.
Airbus appears through two entities. Airbus Opérations SAS filed the most directly DO-178C-relevant ML certification patent in the dataset — the test module architecture for preventing neural network corruption. Airbus Defence and Space GmbH filed a patent covering emergency route and collision path selection logic in autonomous control systems. Together, these filings show Airbus pursuing both runtime monitoring and autonomous decision-making architectures.
Korea Aerospace Industries Ltd. holds two active Korean patents on fly-by-wire flight control systems with integrated OFP functions that use aircraft type identification signals to activate the correct Operational Flight Program — directly relevant to the DO-178C concept of software partitioning across aircraft configurations. Hanwha Systems is active across multiple patents covering machine learning-based UAV control, urban air mobility operations, predictive maintenance reliability evaluation, and airspace collision avoidance.
Volocopter GmbH describes an eVTOL operation planning method that decouples flight planning into independently verifiable and checkable zones — a zonal decomposition approach that aligns with DO-178C's concept of software component partitioning and separate DAL assignment for different functional areas. Explore the full patent analytics platform to map these filing strategies across your own technology domain. RTCA DO-178C and its supplements remain the governing framework across all these filings.
DO-178C Compliance Pathways for AI/ML Components
Each pathway maps to a specific section or supplement of DO-178C. The choice of pathway determines the type of verification evidence required and the computational cost of producing it.
Model-Based Design Traceability Pipeline (DO-178C Sections 5.1–5.5)
Dual-layer comparison from standard model → design model → source code satisfies DO-178C bidirectional traceability requirements at each level.
Barrier Function Invariant Set — Boeing Formal Verification Approach
Barrier functions bound the safe flight control state space; commands outside the invariant set are identified as violations — generating DO-333-compatible proof artifacts.
What the Patent Landscape Tells Certification Engineers
Seven distinct certification strategies emerge from the ~60-record dataset. Each maps to a specific DO-178C compliance pathway and a specific type of verification evidence.
Runtime ML Integrity Verification via Test Modules
Runtime ML integrity verification via test modules — as disclosed by Airbus Opérations SAS — provides a certifiable mechanism for detecting model corruption, but does not substitute for structural coverage analysis required under DO-178C Level A.
Supplementary integrity check — not Level A substituteFormal Barrier Functions Generate DO-333 Proof Artifacts
Formal barrier function analysis — as disclosed by The Boeing Company — generates proof artifacts about flight control envelope invariance that can be submitted as verification evidence under DO-178C's formal methods supplement (DO-333).
DO-333 compliant — Level A capableAdvisory ML Roles Enable DAL C or D Assignment
Partitioning AI into advisory roles — placing ML outputs in monitoring or maintenance-triggering functions rather than direct control surfaces, as demonstrated in Boeing's structural load assessment patents — is the dominant industry strategy for assigning lower DALs to ML components and avoiding Level A certification requirements.
Dominant industry strategy — DAL C or DModel-Based Design Provides DER-Presentable Traceability
Model-based design with bidirectional traceability — as disclosed by South Korea's Agency for Defense Research — provides a DO-178C-aligned development pipeline that generates standard model, design model, and source code artifacts with verifiable traceability at each level. This is the approach most directly aligned with DO-178C Sections 5.1 through 5.5 and most straightforward to present to a DER or EASA Authorized Representative.
Most DER-friendly approach — aligns with §§5.1–5.5DO-178C AI Flight Control Certification — key questions answered
DO-178C was designed around deterministic, traceable software artifacts — requirements, design models, source code, and test cases. Machine learning and neural network-based control systems are inherently non-deterministic, data-driven, and resist classical line-by-line coverage analysis, creating a fundamental tension with the standard's structural coverage requirements.
Partitioning AI into advisory roles — placing ML outputs in monitoring or maintenance-triggering functions rather than direct control surfaces, as demonstrated in On-board structural load assessment of aircraft during flight events by The Boeing Company — is the dominant industry strategy for assigning lower DALs to ML components and avoiding Level A certification requirements.
Airbus Opérations SAS disclosed an aircraft control architecture comprising two distinct modules: an aircraft control module hosting a machine learning model that generates live flight control outputs, and a test module that stores predefined test input/output pairs. While the control module is not actively performing flight control, the test module writes known test inputs to the ML model and reads back its outputs, comparing them to expected values — a periodic, model-level equivalence check.
DO-333 is the formal methods supplement to DO-178C. Boeing's barrier function approach constructs barrier functions and invariant sets from the vehicle dynamics model and then exhaustively characterizes which control commands fall inside versus outside the safe invariant set, generating formal mathematical proof artifacts about the controller's behavior — the kind of evidence accepted under DO-333.
The model-based design pipeline disclosed by South Korea's Agency for Defense Research generates a standard model from control equipment standards, generates a design model specifying particular functions, generates source code from the design model, and then performs two-level openness verification — first comparing the standard model to the design model (requirements-to-design traceability), and second comparing the standard model directly to the source code (requirements-to-implementation traceability). This dual-layer comparison is structurally isomorphic to the DO-178C requirement for bidirectional traceability.
The dominant assignees by frequency are The Boeing Company (appearing in at least seven records across JP, BR, and KR jurisdictions), Korea Aerospace Industries Ltd., Airbus Defence and Space GmbH, Airbus Opérations SAS, Hanwha Systems, and Subaru Corporation. A smaller but significant cluster of filings originates from defense research institutions, including South Korea's Agency for Defense Development and the Defense Acquisition Program Administration.
Still have questions? Let PatSnap Eureka search the patent literature for you.
Ask PatSnap Eureka Your QuestionAccelerate Your DO-178C AI Certification Programme
Join 18,000+ innovators already using PatSnap Eureka to navigate complex certification landscapes, identify prior art, and map competitive patent strategies in flight control software.
References
- System for preventing corruption of neural network in safety-critical systems on aircraft — Airbus Opérations SAS, EP 2025 (active)
- Evaluation of air vehicle flight controls — The Boeing Company, KR 2022 (pending)
- On-board structural load assessment of aircraft during flight events — The Boeing Company, JP 2017 (active)
- Apparatus and method for evaluating structural load on board an aircraft during flight events — The Boeing Company, BR 2023 (active)
- Method and system for autonomously operating aircraft — The Boeing Company, JP 2019 (active)
- Method and system for autonomously piloting an aircraft — The Boeing Company, JP 2022 (active)
- Apparatus for testing a software of flight control law and method thereof — Agency for Defense Development, KR 2010
- Openness verification device and verification method for unmanned aerial vehicle control — Defense Research Institute, KR 2025 (pending)
- Fly-by-wire flight control system having an integrated OFP function — Korea Aerospace Industries Ltd., KR 2014
- Method for the autonomous control of an aerial vehicle and corresponding system — Airbus Defence and Space GmbH, ES 2022 (active)
- Aircraft crew automation system and method — Aurora Flight Sciences Corporation, JP 2021 (active)
- Automatic control of aircraft when flight crew is incapacitated — The Boeing Company, JP 2017 (active)
- A method and system for controlling flight movements of air vehicles — SkyRoads AG, EP 2025 (active)
- Machine learning based control apparatus and method for unmanned aerial vehicle — Hanwha Systems, KR 2024 (active)
- Method for planning aircraft operations, aircraft and control unit thereof — Volocopter GmbH, CN 2022 (active)
- Platform for training and/or assistance with air control through an electronic air traffic control system — Thales, CA 2019 (pending)
- Apparatus and method for verifying flight control software for unmanned aerial vehicle — Electronics and Telecommunications Research Institute, KR 2013
- On-board structural load assessment of aircraft during flight events — The Boeing Company, JP 2021 (active)
- Federal Aviation Administration (FAA) — Aviation Safety Standards and SWIM Infrastructure
- European Union Aviation Safety Agency (EASA) — AI Roadmap for Aviation
- RTCA — DO-178C Software Considerations in Airborne Systems and Equipment Certification
All data and statistics on this page are sourced from the references above and from PatSnap's proprietary innovation intelligence platform. Patent analysis conducted via PatSnap Eureka.
PatSnap Eureka searches patents and research to answer instantly.