The Importance of Assuring Algorithm-based Verification Agents

DNV GL, Group Technology & Research, Trondheim, Norway

^* Corresponding author: +4791715040, odd.ivar.haugen@dnvgl.com

Abstract

Safety verification is about creating trust and building confidence that a system is safe and conforms to the specified requirements. The term confidence means the assurance level which is built by generating objective evidence through activities such as testing. In the maritime industry, classification societies (a.k.a. class) are instrumental in the assurance process of maritime safety-critical systems. These systems become more and more software-intensive, enabling a high degree of complexity and even autonomy. Automatization in the verification effort emerges as system complexity increases and cost-pressure rises. An automatic condition-based survey scheme, utilizing data from sensors and algorithms is seen as more efficient and effective than the traditional calendar-based survey scheme performed by trained class surveyors (people) today. In the assurance of self-learning adaptive systems such as autonomous navigation systems, possibly based upon Machine Learning (ML), online safety monitors may become instrumental in creating relevant safety evidence. These monitors may also be based on ML and may be adaptive, resulting in one adaptive ML-algorithm verifying another adaptive ML-based target system. Class surveyors are test engineers who are verification agents and generate evidence about the system safety level. The verification algorithms, such as a Condition Monitoring system should also be categorized as a verification agent; an Algorithm-based Verification Agent (AVA). Moreover, class surveyors represent an independent Verification Organization. Independence in the verification effort increases the assurance level because the level of evidence objectiveness increases. If the AVA is developed by the target system developer, it decreases the evidence objectiveness and affects the agency of humans in the verification. This paper argues that AVAs must be assured at a level reflecting their agency within the verification effort, and the target system criticality. The same cognitive and societal biases infecting the target system may also affect the AVA if it is developed by the same organization as the developer, possibly masking critical defects, and making the generated evidence less trustworthy.